# changelog

author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-568.el6]
changelog:
  - [base] reduce boot delay on large memory systems (Seth Jennings) [1221389]
  - [md] dm: run queue on re-queue (Mike Snitzer) [1225158]
  - [fs] take i_mutex during prepare_binprm for set<u,g>id executables (Mateusz Guzik) [1216269] {CVE-2015-3339}
  - [netdrv] i40e: Make sure to be in VEB mode if SRIOV is enabled at probe (Stefan Assmann) [1206000]
  - [netdrv] i40e: start up in VEPA mode by default (Stefan Assmann) [1206000]
  - [netdrv] e1000e: Bump the version to 3.2.5 (John Greene) [1211531]
  - [netdrv] e1000e: fix unit hang during loopback test (John Greene) [1211531]
  - [netdrv] e1000e: fix systim issues (John Greene) [1211531]
  - [netdrv] e1000e: fix legacy interrupt handling in i219 (John Greene) [1211531]
  - [netdrv] e1000e: fix flush_desc_ring implementation (John Greene) [1211531]
  - [netdrv] e1000e: fix logical error in flush_desc_rings (John Greene) [1211531]
  - [netdrv] e1000e: remove call to do_div and sign mismatch warning (John Greene) [1211531]
  - [netdrv] e1000e: i219 execute unit hang fix on every reset or power state transition (John Greene) [1211531]
  - [netdrv] e1000e: i219 fix unit hang on reset and runtime D3 (John Greene) [1211531]
  - [netdrv] e1000e: fix call to do_div to use u64 arg (John Greene) [1211531]
  - [netdrv] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size (John Greene) [1211531]
  - [netdrv] e1000e: Correctly include VLAN_HLEN when changing interface MTU (John Greene) [1211531]
  - [netdrv] e1000e: call netif_carrier_off early on down (John Greene) [1211531]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-569.el6]
changelog:
  - [gpu] drm/radeon: fix freeze for laptop with Turks/Thames GPU (Jerome Glisse) [1213297]
  - [md] dm: fix casting bug in dm_merge_bvec (Mike Snitzer) [1226453]
  - [fs] nfs: Send the size attribute on open(O_TRUNC) (Benjamin Coddington) [1208065]
  - [net] inet: fix processing of ICMP frag_needed messages (Sabrina Dubroca) [1210321]
  - [net] tcp: double default TSQ output bytes limit (Hannes Frederic Sowa) [1140590]
  - [hv] hv_balloon: correctly handle num_pages>INT_MAX case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: correctly handle val.freeram<num_pages case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: survive ballooning request with num_pages=0 (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: eliminate jumps in piecewiese linear floor function (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: do not online pages in offline blocks (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: don't lose memory when onlining order is not natural (Vitaly Kuznetsov) [1006234]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-570.el6]
changelog:
  - [block] fix ext_dev_lock lockdep report (Jeff Moyer) [1230927]
  - [md] Revert "md dm: run queue on re-queue" (Mike Snitzer) [1232007]
  - [firmware] another cxgb4 firmware load fixup (Sai Vemuri) [1189255]
  - [char] tty: Don't protect atomic operation with mutex (Aristeu Rozanski) [1184182]
  - [edac] i5100 add 6 ranks per channel (Aristeu Rozanski) [1171333]
  - [edac] i5100 clean controller to channel terms (Aristeu Rozanski) [1171333]
  - [crypto] rng - Remove krng (Herbert Xu) [1226418]
  - [crypto] drbg - Add stdrng alias and increase priority (Herbert Xu) [1226418]
  - [crypto] seqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] eseqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] chainiv - Move IV seeding into init function (Herbert Xu) [1226418]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-571.el6]
changelog:
  - [netdrv] bnx2x: Move statistics implementation into semaphores (Michal Schmidt) [1231348]
  - [scsi] storvsc: Set the SRB flags correctly when no data transfer is needed (Vitaly Kuznetsov) [1221404]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-573.el6]
changelog:
  - [security] selinux: don't waste ebitmap space when importing NetLabel categories (Paul Moore) [1130197]
  - [x86] Revert "Add driver auto probing for x86 features v4" (Prarit Bhargava) [1231280]
  - [net] bridge: netfilter: don't call iptables on vlan packets if sysctl is off (Florian Westphal) [1236551]
  - [net] ebtables: Allow filtering of hardware accelerated vlan frames (Florian Westphal) [1236551]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.2.1.el6]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240758 1240759] {CVE-2015-5364 CVE-2015-5366}
  - [fs] vfs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1243400 1241030]
  - [fs] vfs: Prevent syncing frozen file system (Lukas Czerner) [1243404 1241791]
  - [fs] vfs: Prevent freeing unlinked file to be indefinitely delayed (Lukas Czerner) [1243406 1236736]
  - [fs] vmcore: continue vmcore initialization if PT_NOTE is found empty (Baoquan He) [1245195 1236437]
  - [fs] vmcore: prevent PT_NOTE p_memsz overflow during header update (Baoquan He) [1245195 1236437]
  - [kernel] audit/fix non-modular users of module_init in core code (Baoquan He) [1245195 1236437]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.3.1.el6]
changelog:
  - [md] Revert "dm: don't schedule delayed run of the queue if nothing to do" (Mike Snitzer) [1246095 1240767]
  - [md] Revert "dm: only run the queue on completion if congested or no requests pending" (Mike Snitzer) [1246095 1240767]


author: Tomas Smetana <tsmetana@redhat.com> 20070328-2
changelog:
  - fix wrong exit status of spawned process after SIGSTOP
  - fix building of debuginfo package, add %{?dist} to release
  - fix handling of SIGTTOU in non-interactive shell
  - remove useless builtins


author: Tomas Smetana <tsmetana@redhat.com> 20071105-2
changelog:
  - fix #405381 - ksh will not handle $(xxx) when typeset -r IFS
  - fix #386501 - bad group in spec file


author: Michal Hlavinka <mhlavink@redhat.com> 20081104-1
changelog:
  - update to 2008-11-04
  - ast-ksh-locales are not useable remove them
  - /usr/bin/ksh symlink was removed


author: Michal Hlavinka <mhlavink@redhat.com> - 20100202-6
changelog:
  - fix infinite loop when whence builtin is used with -q option (#587127)
  - fix stdin for double command substitution (#584704)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-3
changelog:
  - fix file io race condition when file was created, but still does not exist (#660319)
  - use 'alternatives' for (m)ksh switching (#659658)
  - do not forget to restore file handles after execution of sourced script (#651888)
  - fix bug when here document got sometimes truncated (#644362)
  - do not forget to close autoloaded file with function definition (#643811)
  - fix wrong typeset handling of arrays that could caused a crash (#637052)
  - fix minor issues in man page (#619692)
  - fix crash when ksh get SIGPIPE while already executing signal handler (#616691)
  - fix wrong output redirection in SIGPIPE trap (#616684)
  - add RLIMIT_RTPRIO and RLIMIT_NICE support to ulimit (#582690)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-7
changelog:
  - ksh did not wait for pipeline to complete when pipefail option was used (#702016)
  - completion used after an environment variable reported bad susbstituion error (#702015)
  - ksh child exit code not preserved correctly (#702013)
  - do not change $0 in posix function (#702011)
  - fix man page information about default value for PATH variable (#702008)
  - do not use invalid PID values in ksh kill built-in (#701890)
  - fix crashe when IFS is unset inside a function (#683734)
  - do not count empty array elements (#702014)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-14
changelog:
  - fix data corruption in a here-document section of a script at byte 8192 (#786787)
  - restore tty settings after timed out read (#577223)
  - do not create extra process when it's not needed (#781976)
  - fix file descriptor leak (#781498)
  - do not segfault on incorrect oop code (#743840)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-19
changelog:
  - assigning a right justified typedef'd variable to a smaller one
    could corrupt the result (#846678)
  - fix exporting of l/r-justified variable (#846678)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-2
changelog:
  - fix overflow in subshell loop (#858263)
  - set default editing mode to emacs (#761551)
  - ksh -m did not turn monitor mode on (#960034)
  - prevent fork bomb trigered by SIGSTP (#922851)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-14
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1066589)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-16
changelog:
  - do not resend signal on termination (#1075635)
  - fix argv rewrite (#1047506)
  - fix brace expansion on/off (#1078698)
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1070350)
  - fix parser errors related to the end of the here-document marker (#1036931)
  - ksh hangs when command substitution fills out the pipe buffer (#1062296)
  - using typeset -l with a restricted variabled caused segmentation fault (#1083713)
  - ksh stopped on read when monitor mode was enabled (#1023109)
  - monitor mode was documented incorrectly (#1019334)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-17
changelog:
  - do not crash when unsetting running function from another one (#1105138)
  - should report an error when trying to cd into directory without execution bit (#1102627)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-18
changelog:
  - job locking mechanism did not survive compiler optimization (#1112306)
  - wrong return code from a pipe in command substitution (#1117316)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-24
changelog:
  - cd to directory without execution permission can't fail silently (#1160923)
  - current directory could differ from PWD (#1168611)
  - declaration of a two dimemsional associatve array could add an extra 0 element (#1173668)
  - exporting fixed with variable corrupted its data (#1188377)
  - fixes memmory leak on unset of associative array (#1189294)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - fix segfault when handling a trap (#1117404)
  - closing a file descriptor in a command substitution caused loss of the output (#1116072)


author: Nalin Dahyabhai <nalin@redhat.com> 0.7
changelog:
  - add openldap-devel as a buildprereq
  - krb5: use a continuous connection
  - krb5: add "realm" config directive
  - ldap: use a continuous connection
  - ldap: add "server", "basedn", "binddn", "user", "authuser" config directives
  - ldap: actually finish the account deletion function
  - ldap: don't send cleartext passwords to the directory
  - fix naming attribute for users (should be uid, not gid)
  - refine the search-by-id,convert-to-name,search-by-name logic
  - fix handling of defaults when the config file is read in but contains no value
  - implement an LDAP information store
  - try to clean up module naming with libtool
  - luseradd: pass plaintext passwords along
  - luseradd: use symbolic attribute names instead of hard-coded
  - lusermod: pass plaintext passwords along
  - lgroupadd: pass plaintext passwords along
  - lgroupmod: pass plaintext passwords along
  - add libuser as a dependency of libuser-devel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - the great adding-of-the-copyright-statements
  - take more care when creating backup files in the files module


author: Nalin Dahyabhai <nalin@redhat.com> 0.8
changelog:
  - add a "quiet" prompter
  - add --interactive flag to sample apps and default to using quiet prompter
  - ldap: attempt a "self" bind if other attempts fail
  - krb5: connect to the password-changing service if the user principal has
    the NULL instance


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add functions for enumerating users and groups, optionally per-module
  - lusermod.c: -s should specify the shell, not the home directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - get bindings for prompts to work correctly
  - clean up some of the add/remove semantics (set source on add)
  - ldap: implement enumeration
  - samples/enum: fix the argument order


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - clean up quota bindings some more
  - finish most of the ldap bindings
  - fix a subtle bug in the files module that would show up when renaming accounts
  - fix mapping methods for entity structures in python


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish implementing is_locked methods in files/shadow module
  - finish cleanup of the python bindings
  - allow conditional builds of modules so that we can build without
    all of the prereqs for all of the modules


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't bail when writing empty fields to colon-delimited files
  - use permissions of the original file when making backup files instead of 0600


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix errors due to uninitialized fields in the python bindings
  - add kwargs support to all python wrappers
  - add a mechanism for passing arguments to python callbacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix group password setting in the files module
  - setpass affects both auth and info, so run both stacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - lib/user.c: catch and ignore errors when running stacks
  - lusermod: fix slightly bogus help messages
  - luseradd: when adding a user and group, use the gid of the group
    instead of the user's uid as the primary group
  - properly set the password field in user accounts created using
    auth-only auth modules (shadow needs "x" instead of "!!")
  - implement home directory removal, start on population


author: Nalin Dahyabhai <nalin@redhat.com> 0.16.1-1
changelog:
  - finish home directory population
  - implement home directory moving
  - change entity get semantics in the python bindings to allow default values for .get()
  - add lu_ent_has(), and a python has_key() method to Entity types
  - don't include tools in the binary package
  - add translated strings


author: Nalin Dahyabhai <nalin@redhat.com> 0.18-1
changelog:
  - actually make the new optional arguments optional
  - fix lu_error_new() to actually report errors right
  - fix part of the python bindings
  - include tools in the binary package again
  - fixup modules so that password-changing works right again
  - add a "key" field to prompt structures for use by apps which like to
    cache these things
  - add an optional "mvhomedir" argument to userModify (python)


author: Nalin Dahyabhai <nalin@redhat.com> 0.20-1
changelog:
  - only call the auth module when setting passwords (oops)
  - use GTrees instead of GHashTables for most internal tables
  - files: complain properly about unset attributes
  - files: group passwords are single-valued, not multiple-valued
  - add lpasswd app, make sure all apps start up popt with the right names


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - luserdel: remove the user's primary group if it has the same name as
    the user and has no members configured (-G disables)
  - fixup some configure stuff to make libuser.conf get generated correctly
    even when execprefix isn't specified


author: Nalin Dahyabhai <nalin@redhat.com> 0.21-1
changelog:
  - finish adding a sasldb module which manipulates a sasldb file
  - add users_enumerate_by_group and groups_enumerate_by_users


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - print uids and gids of users and names in lid app
  - fix tree traversal in users_enumerate_by_group and groups_enumerate_by_users
  - implement enumerate_by_group and enumerate_by_user in ldap module
  - fix id-based lookups in the ldap module
  - implement islocked() method in ldap module
  - implement setpass() method in ldap module
  - add lchfn and lchsh apps
  - add %d substitution to libuser.conf


author: Nalin Dahyabhai <nalin@redhat.com> 0.23-1
changelog:
  - install sv translation
  - make lpasswd prompt for passwords when none are given on the command line
  - make sure all user-visible strings are marked for translation
  - clean up some user-visible strings
  - require PAM authentication in lchsh, lchfn, and lpasswd for non-networked modules


author: Nalin Dahyabhai <nalin@redhat.com> 0.24-3
changelog:
  - stop leaking descriptors in the files module
  - speed up user creation by reordering some checks for IDs being in use
  - update the shadowLastChanged attribute when we set a password
  - adjust usage of getXXXXX_r where needed
  - fix assorted bugs in python binding which break prompting


author: Nalin Dahyabhai <nalin@redhat.com> 0.25-1
changelog:
  - close up some memory leaks
  - add the ability to include resident versions of modules in the library


author: Nalin Dahyabhai <nalin@redhat.com> 0.25.1-1
changelog:
  - rename the quota source files to match the library, which clears up a
    file conflict with older quota packages
  - add ja translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.26-1
changelog:
  - lusermod: change user name in groups the user is a member of during renames
  - lgroupmod: change primary GID for users who are in the group during renumbers
  - ldap.c: handle new attributes more gracefully if possible
  - add ru translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.27-1
changelog:
  - add ko translation files
  - files.c: fix a heap corruption bug in lock/unlock (#51750)
  - files.c: close a memory leak in reading of files


author: Nalin Dahyabhai <nalin@redhat.com> 0.28-1
changelog:
  - apps: print usage on errors
  - lnewusers.c: initialize groups as groups, not users
  - lnewusers.c: set passwords for new accounts
  - luseradd.c: accept group names in addition to IDs for the -g flag
  - luseradd.c: allow the primary GID to be a preexisting group


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - HUP nscd on modifications
  - userutil.c: mmap files we're reading for probable speed gain
  - userutil.c: be conservative with the amount of random data we read
  - docs fixes


author: Nalin Dahyabhai <nalin@redhat.com> 0.30-1
changelog:
  - quotaq: fix argument order when reading quota information
  - user_quota: set quota grace periods correctly
  - luseradd: never create home directories for system accounts


author: Nalin Dahyabhai <nalin@redhat.com> 0.32-1
changelog:
  - link the python module against libpam
  - attempt to import the python modules at build-time to verify dependencies


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - renamed the python module
  - revamped internals to use gobject's gvalues and gvaluearrays instead of
    glists of cached strings
  - add enumeration-with-data functions to the C library


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.91-1
changelog:
  - ldap: finish port to new API
  - sasl: finish port to new API (needs test)
  - libuser: don't commit object changes before passing data to service
    functions which might need differing data sets to figure out what to
    change (for example, ldap)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.93-1
changelog:
  - move shadow initialization for groups to the proper callback
  - rework locking in the files module to not require that files be writable


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.97-1
changelog:
  - files: fix bug in removals
  - ldap: revert attempts at being smart at startup time, because it makes UIs
    very messy (up the three whole dialogs just to start the ldap stuff!)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.98-1
changelog:
  - automatically refresh entities after add, modify, setpass, removepass,
    lock, and unlock operations
  - remove debug spewage when creating and removing mail spools
  - files: fix saving of multi-valued attributes
  - rename MEMBERUID attribute for groups to MEMBERNAME


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.100-1
changelog:
  - be more careful about printing error messages
  - fix refreshing after adding of accounts
  - ldap: try to use a search to convert names to DNs, and only fall back to
    guessing if it turns up nothing
  - files: fix an off-by-one in removal of entries


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.101-1
changelog:
  - fix python bindings of enumerateFull functions
  - adjust prompter wrapping to not error out on successful returns


author: Nalin Dahyabhai <nalin@redhat.com> 0.51-1
changelog:
  - files: ignore blank lines in files
  - libuser: disallow creation of accounts with names containing whitespace,
    control characters, or non-ASCII characters


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.5-1
changelog:
  - expose lu_get_first_unused_id() as a package-private function
  - provide libuser.ADMIN.getFirstUnusedUid and libuser.ADMIN.getFirstUnusedGid
    in python


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.6-1
changelog:
  - use a crypt salt consistent with the defaults/crypt_style setting when
    setting new passwords (#79337)


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.7-1
changelog:
  - ldap: set error codes correctly when we encounter failures initializing
  - don't double-close modules which fail initialization
  - ldap: don't set an error in cases where one is already set


author: Miloslav Trmac <mitr@redhat.com> - 0.51.8-1
changelog:
  - Update to build with latest autotools and gtk-doc
  - Update ALL_LINGUAS and POTFILES.in
  - Rebuild to depend on newer openldap


author: Miloslav Trmac <mitr@redhat.com> - 0.51.10-1
changelog:
  - Don't attempt to lookup using original entity name after entity
    modification (rename in particular) (#78376, #121252)
  - Fix copying of symlinks from /etc/skel (#87572, original patch from gLaNDix)
  - Make --enable-quota work, and fix the quota code to at least compile (#89114)
  - Fix several bugs (#120168, original patch from Steve Grubb)
  - Don't hardcode python version in spec file (#130952, from Robert Scheck)
  - Properly integrate the SELinux patch, it should actually be used now, even
    though it was "enabled" since 0.51.7-6


author: Miloslav Trmac <mitr@redhat.com> - 0.51.11-1
changelog:
  - Allow documented optional arguments in Python
    ADMIN.{addUser,modifyUser,deleteUser} (#119812)
  - Add man pages for lchfn and lchsh
  - LDAP fixes, first round
  - Avoid file conflict on multilib systems
  - Call ldconfig correctly


author: Miloslav Trmac <mitr@redhat.com> - 0.51.12-1
changelog:
  - Don't claim success and exception at the same time (#133479)
  - LDAP fixes, second round
  - Various other bugfixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.2-1
changelog:
  - Allow LDAP connection using ldaps, custom ports or without TLS (original
    patch from Pawel Salek).


author: Miloslav Trmac <mitr@redhat.com> - 0.52.5-1
changelog:
  - Fix home directory renaming in ADMIN.modifyUser (#135280)
  - Further Python reference counting fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.6-1
changelog:
  - Make error reporting more consistent, more verbose and always on stderr
    (partly #133861, original patch by Pawel Salek)
  - Mark strings previously blocked by string freeze for translation


author: Miloslav Trmac <mitr@redhat.com> - 0.53-1
changelog:
  - Support UID and GID values larger than LONG_MAX (#124967)
  - Fix updating of groups after user renaming in lusermod
  - Allow setting a shadow password even if the current shadow password is
    invalid (#131180)
  - Add lu_{user,group}_unlock_nonempty (#86414); module interface ABI has 
    changed
  - Miscellaneous bug and memory leak fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.53.2-1
changelog:
  - Important bug fixes in lchage, lgroupmod, lnewusers and lusermod
  - Minor bug fixes in lpasswd and luseradd
  - Add man pages for the utilities (#61673)


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-1
changelog:
  - Don't silently ignore some I/O errors
  - Don't include a Cyrus SASL v1 header file when libldap links to v2 (#150046)
  - Rebuild with gcc 4


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-2
changelog:
  - Add Requires: glib2-devel to libuser-devel (#152501)
  - Run ldconfig using %post{,un} -p to let RPM play tricks


author: Miloslav Trmac <mitr@redhat.com> - 0.53.5-1
changelog:
  - Ignore nss_compat lines in the "files" module (#154651)
  - Autodetect Python version (#154096)
  - Add BuildRequires: libselinux-devel, s/BuildPrereq/BuildRequires/


author: Miloslav Trmac <mitr@redhat.com> - 0.53.8-1
changelog:
  - Permit "portable" user and group names as defined by SUSv3, plus trailing $
    (#159452)
  - Don't build static libraries


author: Miloslav Trmac <mitr@redhat.com> - 0.54-1
changelog:
  - Make sure attributes with no values can never appear
  - Fix crash in the "files" module when an attribute is missing
  - Use hidden visibility for internal functions, remove them from
    libuser/user_private.h; this changes module interface ABI


author: Miloslav Trmac <mitr@redhat.com> - 0.54.1-1
changelog:
  - Support importing of configuration from shadow-utils (/etc/login.defs and
    /etc/default/useradd)
  - Add libuser.conf(5) man page


author: Miloslav Trmac <mitr@redhat.com> - 0.54.6-1
changelog:
  - Fix bugs in handling of invalid lines in the files and shadow modules
  - Fix pattern matching in lu_*_enumerate_full in the files and shadow modules
  - Add more error reporting, return non-zero exit status on error from utils
  - Use the skeleton directory specified in libuser.conf by Python
    admin.createHome and admin.addUser, add parameter skeleton= to admin.addUser
    (#189984)


author: Miloslav Trmac <mitr@redhat.com> - 0.56-1
changelog:
  - Tighten the API and implementation to avoid corrupting number-like strings;
    the module interface ABI has changed
    Resolves: #226976


author: Miloslav Trmac <mitr@redhat.com> - 0.56.1-1
changelog:
  - When changing passwords, only silently ignore know shadow markers, not all
    invalid hashes
    Resolves: #225495


author: Miloslav Trmač <mitr@redhat.com> - 0.56.4-2
changelog:
  - Split the Python module to a separate subpackage (original patch by Yanko
    Kaneti)
  - Update the License: tag


author: Miloslav Trmač <mitr@redhat.com> - 0.56.5-1
changelog:
  - Work around spurious error messages when run against the Fedora Directory
    server
  - Fix error reporting when creating home directories and creating/removing mail
    spool files
    Resolves: #318121


author: Miloslav Trmač <mitr@redhat.com> - 0.56.6-1
changelog:
  - Set SELinux file contexts when creating home directories, preserve them when
    moving home directories
    Resolves: #351201


author: Miloslav Trmač <mitr@redhat.com> - 0.56.7-1
changelog:
  - Add support for SHA256 and SHA512 in password hashes
    Related: #173583
  - Fix file locking on some architectures
  - Rename sr@Latn.po to sr@latin.po
    Resolves: #426584
  - Address issues from a review by Jason Tibbitts:
    - Remove default.-c, moving the provided functions to libuser proper
    - Remove the WITH_SELINUX build option
    - Move Python library test to %check
    Resolves: #226054


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-7
changelog:
  - Don’t use 512-bit RSA private keys in tests
    Related: #1235518
  - Fix testsuite failures if more than one architecture is building concurrently
    Related: #1235518


author: Jeremy Katz <katzj@redhat.com> 2.00.08-5
changelog:
  - Fix sysfs patch to find sysfs
  - Take patch from dwalsh and tweak a little for setting SELinux contexts on
    device node creation and also do it on the symlink creation.  
    Part of this should probably be pushed down to device-mapper instead


author: Alasdair Kergon <agk@redhat.com> 2.00.10-1
changelog:
  - Update to version 2.00.10, which incorporates the RH-specific patches
    and includes various fixes and enhancements detailed in WHATS_NEW.


author: Alasdair Kergon <agk@redhat.com> 2.00.12-1
changelog:
  - Install default /etc/lvm/lvm.conf.
  - Move non-static binaries to /usr/sbin.
  - Add temporary links in /sbin to lvm.static until rc.sysinit gets updated.


author: Jeremy Katz <katzj@redhat.com> - 2.00.20-2
changelog:
  - add patch for iSeries viodasd support
  - add patch to check file type using stat(2) if d_type == DT_UNKNOWN (#129674)


author: Alasdair Kergon <agk@redhat.com> - 2.00.24-1
changelog:
  - More upstream fixes.  (Always check WHATS_NEW file for details.)
  - Add requested BuildRequires. [bz 124916, 132408]


author: Alasdair Kergon <agk@redhat.com> - 2.01.07-1.0
changelog:
  - Remove build directory from built-in path.
  - Extra /dev scanning required for clustered operation.


author: Alasdair Kergon <agk@redhat.com> - 2.01.08-1.0
changelog:
  - Improve detection of external changes affecting internal cache.
  - Add clustered VG attribute.
  - Suppress rmdir opendir error message.


author: Alasdair Kergon <agk@redhat.com> - 2.01.08-2.0
changelog:
  - No longer abort read operations if archive/backup directories aren't there.
  - Add runtime directories and file to the package.


author: Alasdair Kergon <agk@redhat.com> - 2.02.11-1.0
changelog:
  - New upstream with numerous fixes and small enhancements.
    (See the WHATS_NEW documentation file for complete upstream changelog.)


author: Alasdair Kergon <agk@redhat.com> - 2.02.12-2
changelog:
  - Remove no-longer-used ldconfig from lvm2-cluster and fix lvmconf
    to cope without the shared library.


author: Alasdair Kergon <agk@redhat.com> - 2.02.16-1
changelog:
  - Fix VG clustered read locks to use PR not CR.
  - Adjust some alignments for ia64/sparc.
  - Fix mirror segment removal to use temporary error segment.
  - Always compile debug logging into clvmd.
  - Add startup timeout to clvmd startup script.
  - Add -T (startup timeout) switch to clvmd.
  - Improve lvm_dump.sh robustness.


author: Alasdair Kergon <agk@redhat.com> - 2.02.17-1
changelog:
  - Add missing pvremove error message when device doesn't exist.
  - When lvconvert allocates a mirror log, respect parallel area constraints.
  - Check for failure to allocate just the mirror log.
  - Support mirror log allocation when there is only one PV: area_count now 0.
  - Fix detection of smallest area in _alloc_parallel_area() for cling policy.
  - Add manpage entry for clvmd -T
  - Fix hang in clvmd if a pre-command failed.


author: Alasdair Kergon <agk@redhat.com> - 2.02.18-1
changelog:
  - Use CFLAGS when linking so mixed sparc builds can supply -m64.
  - Prevent permission changes on active mirrors.
  - Print warning instead of error message if lvconvert cannot zero volume.
  - Add snapshot options to lvconvert man page.
  - dumpconfig accepts a list of configuration variables to display.
  - Change dumpconfig to use --file to redirect output to a file.
  - Avoid vgreduce error when mirror code removes the log LV.
  - Fix ambiguous vgsplit error message for split LV.
  - Fix lvextend man page typo.
  - Use no flush suspending for mirrors.
  - Fix create mirror with name longer than 22 chars.


author: Alasdair Kergon <agk@redhat.com> - 2.02.19-1
changelog:
  - Fix a segfault if an empty config file section encountered.
  - Fix partition table processing after sparc changes.
  - Fix cmdline PE range processing segfault.
  - Move basic reporting functions into libdevmapper.


author: Alasdair Kergon <agk@redhat.com> - 2.02.20-1
changelog:
  - Fix exit statuses of reporting tools.
  - Add some missing close() and fclose() return code checks.
  - Add devices/ignore_suspended_devices to ignore suspended dm devices.
  - Fix refresh_toolcontext() always to wipe persistent device filter cache.
  - Long-lived processes write out persistent dev cache in refresh_toolcontext().
  - Streamline dm_report_field_* interface.
  - Update reporting man pages.
  - Add --clustered to man pages.
  - Add field definitions to report help text.


author: Alasdair Kergon <agk@redhat.com> - 2.02.21-1
changelog:
  - Fix vgsplit to handle mirrors.
  - Reorder fields in reporting field definitions.
  - Fix vgs to treat args as VGs even when PV fields are displayed.
  - Fix md signature check to handle both endiannesses.


author: Alasdair Kergon <agk@redhat.com> - 2.02.22-1
changelog:
  - Add ncurses-static BuildRequires after package split.
  - Fix loading of segment_libraries.
  - If a PV reappears after it was removed from its VG, make it an orphan.
  - Don't update metadata automatically if VGIDs don't match.
  - Fix some vgreduce --removemissing command line validation.
  - Trivial man page corrections (-b and -P).
  - Add global/units to example.conf.
  - Remove readline support from lvm.static.


author: Alasdair Kergon <agk@redhat.com> - 2.02.23-1
changelog:
  - Fix vgrename active LV check to ignore differing vgids.
  - Fix two more segfaults if an empty config file section encountered.
  - Fix a leak in a reporting error path.
  - Add devices/cache_dir & devices/cache_file_prefix, deprecating devices/cache.


author: Alasdair Kergon <agk@redhat.com> - 2.02.24-1
changelog:
  - Add BuildRequires readline-static until makefiles get fixed.
  - Fix processing of exit status in init scripts
  - Fix vgremove to require at least one vg argument.
  - Fix reading of striped LVs in LVM1 format.
  - Flag nolocking as clustered so clvmd startup sees clustered LVs.
  - Add a few missing pieces of vgname command line validation.
  - Support the /dev/mapper prefix on most command lines.


author: Alasdair Kergon <agk@redhat.com> - 2.02.27-1
changelog:
  - Add -f to vgcfgrestore to list metadata backup files.
  - Add pvdisplay --maps implementation.
  - Add devices/preferred_names config regex list for displayed device names.
  - Add vg_mda_count and pv_mda_count columns to reports.
  - Change cling alloc policy attribute character from 'C' to l'.
  - Print warnings to stderr instead of stdout.
  - Fix snapshot cow area deactivation if origin is not active.
  - Reinitialise internal lvmdiskscan variables when called repeatedly.
  - Allow keyboard interrupt during user prompts when appropriate.
  - Fix deactivation code to follow dependencies and remove symlinks.
  - Fix a segfault in device_is_usable() if a device has no table.
  - Fix creation and conversion of mirrors with tags.
  - Add command stub for pvck.
  - Handle vgsplit of an entire VG as a vgrename.
  - Fix vgsplit for lvm1 format (set and validate VG name in PVs metadata).
  - Split metadata areas in vgsplit properly.
  - Fix and clarify vgsplit error messages.
  - Update lists of attribute characters in man pages.
  - Remove unsupported LVM1 options from vgcfgrestore man page.
  - Update vgcfgrestore man page to show mandatory VG name.
  - Update vgrename man page to include UUID and be consistent with lvrename.
  - Add some more debug messages to clvmd startup.
  - Fix thread race in clvmd.
  - Make clvmd cope with quorum devices.
  - Add extra internal error checking to clvmd.
  - Fix missing lvm_shell symbol in lvm2cmd library.
  - Move regex functions into libdevmapper.
  - Add kernel and device-mapper targets versions to lvmdump.
  - Add /sys/block listings to lvmdump.
  - Make lvmdump list /dev recursively.
  - Mark /etc/lvm subdirectories as directories in spec file.


author: Alasdair Kergon <agk@redhat.com> - 2.02.28-1
changelog:
  - vgscan and pvscan now trigger clvmd -R, which should now work.
  - Fix clvmd logging so you can get lvm-level debugging out of it.
  - Allow clvmd debug to be turned on in a running daemon using clvmd -d [-C].
  - Add more cluster info to lvmdump.
  - Fix lvdisplay man page to say LV size is reported in sectors, not KB.
  - Fix loading of persistent cache if cache_dir is used.
  - Only permit --force, --verbose and --debug arguments to be repeated.
  - Add support for renaming mirrored LVs.
  - Add --mirrorlog argument to specify log type for mirrors.
  - Don't leak a file descriptor if flock or fcntl fails.
  - Detect stream write failure reliably.
  - Reduce severity of lstat error messages to very_verbose.
  - Update to use autoconf 2.61, while still supporting 2.57.


author: Alasdair Kergon <agk@redhat.com> - 2.02.29-1
changelog:
  - Make clvmd backup vg metadata on remote nodes.
  - Decode cluster locking state in log message.
  - Change file locking state messages from debug to very verbose.
  - Fix --addtag to drop @ prefix from name.
  - Stop clvmd going haywire if a pre_function fails.
  - Avoid nested vg_reads when processing PVs in VGs and fix associated locking.
  - Attempt to remove incomplete LVs with lvcreate zeroing/activation problems.
  - Add full read_ahead support.
  - Add lv_read_ahead and lv_kernel_read_ahead fields to reports and lvdisplay.
  - Prevent lvconvert -s from using same LV as origin and snapshot.
  - Fix human-readable output of odd numbers of sectors.
  - Add pv_mda_free and vg_mda_free fields to reports for raw text format.
  - Add LVM2 version to 'Generated by' comment in metadata.
  - Show 'not usable' space when PV is too large for device in pvdisplay.
  - Ignore and fix up any excessive device size found in metadata.
  - Fix error message when fixing up PV size in lvm2 metadata (2.02.11).
  - Fix orphan-related locking in pvdisplay and pvs.
  - Fix missing VG unlocks in some pvchange error paths.
  - Add some missing validation of VG names.
  - Detect md superblocks version 1.0, 1.1 and 1.2.
  - Add some pv-related error paths.
  - Handle future sysfs subsystem/block/devices directory structure.
  - Fix a bug in lvm_dump.sh checks for lvm/dmsetup binaries.
  - Fix underquotations in lvm_dump.sh.
  - Print --help output to stdout, not stderr.
  - After a cmdline processing error, don't print help text but suggest --help.
  - Add %PVS extents option to lvresize, lvextend, and lvcreate.
  - Remove no-longer-correct restrictions on PV arg count with stripes/mirrors.
  - Fix strdup memory leak in str_list_dup().
  - Link with -lpthread when static SELinux libraries require that.
  - Detect command line PE values that exceed their 32-bit range.
  - Include strerror string in dev_open_flags' stat failure message.
  - Avoid error when --corelog is provided without --mirrorlog. (2.02.28)
  - Correct --mirrorlog argument name in man pages (not --log).
  - Clear MIRROR_NOTSYNCED LV flag when converting from mirror to linear.
  - Modify lvremove to prompt for removal if LV active on other cluster nodes.
  - Add '-f' to vgremove to force removal of VG even if LVs exist.


author: Alasdair Kergon <agk@redhat.com> - 2.02.30-6
changelog:
  - Remove static libraries and binaries and move most binaries out of /usr.
  - Fix a segfault if using pvs with --all argument.
  - Fix vgreduce PV list processing not to process every PV in the VG.
  - Reinstate VG extent size and stripe size defaults (halved).
  - Set default readahead to twice maximium stripe size.
  - Detect non-orphans without MDAs correctly.
  - Prevent pvcreate from overwriting MDA-less PVs belonging to active VGs.
  - Don't use block_on_error with mirror targets version 1.12 and above.
  - Change vgsplit -l (for unimplemented --list) into --maxlogicalvolumes.
  - Update vgsplit to accept vgcreate options when new VG is destination.
  - Update vgsplit to accept existing VG as destination.
  - Major restructuring of pvmove and lvconvert code, adding stacking support.
  - Add new convert_lv field to lvs output.
  - Permit LV segment fields with PV segment reports.
  - Extend lvconvert to use polldaemon and wait for completion of initial sync.
  - Add seg_start_pe and seg_pe_ranges to reports.
  - Add fsadm interface to filesystem resizing tools.
  - Update --uuid argument description in man pages.
  - Print warning when lvm tools are running as non-root.


author: Alasdair Kergon <agk@redhat.com> - 2.02.31-7
changelog:
  - Avoid readahead error message when using default setting of lvcreate -M1.
  - Fix lvcreate --nosync not to wait for non-happening sync.
  - Add very_verbose lvconvert messages.


author: Alasdair Kergon <agk@redhat.com> - 2.02.32-8
changelog:
  - Fix pvs, vgs, lvs error exit status on some error paths.
  - Fix new parameter validation in vgsplit and test mode.
  - Fix internal metadata corruption in lvchange --resync.


author: Alasdair Kergon <agk@redhat.com> - 2.02.33-9
changelog:
  - Improve internal label caching performance while locks are held.
  - Fix mirror log name construction during lvconvert.


author: Alasdair Kergon <agk@redhat.com> - 2.02.38-1
changelog:
  - libdevmapper: Make dm_hash_iter safe against deletion.
  - libdevmapper: Accept a NULL pointer to dm_free silently.
  - libdevmapper: Calculate string size within dm_pool_grow_object.
  - libdevmapper: Send reporting field help text to stderr not stdout.

  - dmsetup: Add tables_loaded, readonly and suspended columns to reports.
  - dmsetup: Add --nameprefixes for new report output format FIELD=VALUE.

  - Add --nameprefixes to reporting tools for field name prefix output format.
  - Fix return values for reporting commands when run with no PVs, LVs, or VGs.
  - Add omitted unlock_vg() call when sigint_caught() during vg processing.
  - Fix free_count when reading pool metadata.
  - Fix segfault when using pvcreate on a device containing pool metadata.
  - In script-processing mode, stop if any command fails.
  - Warn if command exits with non-zero status code without a prior log_error.
  - Correct config file line numbers in messages when parsing comments.
  - Add missing deactivation after activation failure in lvcreate -Zy.
  - When removing LV symlinks, skip any where the VG name is not determined.
  - Fix vgsplit internal counting of snapshot LVs.
  - Update vgsplit to only restrict split with active LVs involved in split.
  - Fix vgsplit to only move hidden 'snapshotN' LVs when necessary.
  - Update vgsplit man page to reflect lvnames on the cmdline.
  - Update vgsplit to take "-n LogicalVolumeName" on the cmdline.
  - Fix vgsplit error paths to release vg_to lock.
  - Avoid spurious duplicate VG messages referring to VGs that are gone.
  - Drop dev_name_confirmed error message to debug level.
  - Fix setpriority error message to signed int.
  - Add assertions to trap deprecated P_ and V_ lock usage.
  - Avoid using DLM locks with LCK_CACHE type P_ lock requests.
  - Don't touch /dev in vgrename if activation is disabled.
  - Exclude VG_GLOBAL from internal concurrent VG lock counter.
  - Fix vgmerge snapshot_count when source VG contains snapshots.
  - Fix internal LV counter when a snapshot is removed.
  - Fix metadata corruption writing lvm1-formatted metadata with snapshots.
  - Fix lvconvert -m0 allocatable space check.
  - Don't attempt remote metadata backups of non-clustered VGs.
  - Improve preferred_names lvm.conf example.
  - Fix vgdisplay 'Cur LV' field to match lvdisplay output.
  - Fix lv_count report field to exclude hidden LVs.
  - Fix some pvmove error status codes.
  - Indicate whether or not VG is clustered in vgcreate log message.
  - Mention default --clustered setting in vgcreate man page.
  - Fix vgreduce to use vg_split_mdas to check sufficient mdas remain.
  - Update lvmcache VG lock state for all locking types now.
  - Fix output if overriding command_names on cmdline.
  - Add check to vg_commit() ensuring VG lock held before writing new VG metadata.
  - Add validation of LV name to pvmove -n.
  - Add some basic internal VG lock validation.
  - Fix vgsplit internal counting of snapshot LVs.
  - Update vgsplit to only restrict split with active LVs involved in split.
  - Fix vgsplit to only move hidden 'snapshotN' LVs when necessary.
  - Update vgsplit man page to reflect lvnames on the cmdline.
  - Update vgsplit to take "-n LogicalVolumeName" on the cmdline.
  - Fix vgsplit error paths to release vg_to lock.
  - Fix vgsplit locking of new VG.
  - Avoid erroneous vgsplit error message for new VG.
  - Suppress duplicate message when lvresize fails because of invalid vgname.
  - Cache VG metadata internally while VG lock is held.
  - Fix redundant lvresize message if vg doesn't exist.
  - Make clvmd-cman use a hash rather than an array for node updown info.
  - Decode numbers in clvmd debugging output.
  - Fix uninitialised mutex in clvmd if all daemons are not running at startup.
  - Add config file overrides to clvmd when it reads the active LVs list.
  - Make clvmd refresh the context correctly when lvm.conf is updated.
  - Fix another allocation bug with clvmd and large node IDs.
  - Fix uninitialised variable in clvmd that could cause odd hangs.
  - Correct command name in lvmdiskscan man page.
  - clvmd no longer crashes if it sees nodeids over 50.
  - Fix potential deadlock in clvmd thread handling.
  - Update usage message for clvmd.
  - Fix clvmd man page not to print <br> and clarified debug options.
  - Escape double quotes and backslashes in external metadata and config data.
  - Correct a function name typo in _line_append error message.
  - Fix resetting of MIRROR_IMAGE and VISIBLE_LV after removal of LV.
  - Fix remove_layer_from_lv to empty the LV before removing it.
  - Add missing no-longer-used segs_using_this_lv test to check_lv_segments.
  - Fix lvconvert detection of mirror conversion in progress.
  - Avoid automatic lvconvert polldaemon invocation when -R specified.
  - Fix 'pvs -a' to detect VGs of PVs without metadata areas.
  - Divide up internal orphan volume group by format type.
  - Fix lvresize to support /dev/mapper prefix in the LV name.
  - Fix lvresize to pass new size to fsadm when extending device.
  - Fix unfilled parameter passed to fsadm from lvresize.
  - Update fsadm to call lvresize if the partition size differs (with option -l).
  - Fix fsadm to support VG/LV names.


author: Alasdair Kergon <agk@redhat.com> - 2.02.38-2
changelog:
  - dmsetup: Add --unquoted and --rows to 'info -c' command.
  - libdevmapper: Fix inverted no_flush debug message.


author: Alasdair Kergon <agk@redhat.com> - 2.02.39-3
changelog:
  - Fix up cache for PVs without mdas after consistent VG metadata is processed.
  - Update validation of safe mirror log type conversions in lvconvert.
  - Fix lvconvert to disallow snapshot and mirror combinations.
  - Fix reporting of LV fields alongside unallocated PV segments.
  - Add --unquoted and --rows to reporting tools.
  - Avoid undefined status code after _memlock commands in lvm shell.
  - Fix and improve readahead 'auto' calculation for stripe_size.
  - Fix lvchange output for -r auto setting if auto is already set.
  - Fix add_mirror_images not to dereference uninitialized log_lv upon failure.
  - Add --force to lvextend and lvresize.
  - Fix vgchange to not activate component mirror volumes directly.


author: Fabio M. Di Nitto <fdinitto@redhat.cm> - 2.02.39-5
changelog:
  - Add BuildRequires on cmanlib-devel. This is required after libcman split
    from cman and cman-devel into cmanlib and cmanlib-devel.
  - Make versioned BuildRequires on cman-devel and cmanlib-devel more strict
    to guarantee to get the right version.


author: Alasdair Kergon <agk@redhat.com> - 2.02.43-1
changelog:
  - Upstream merge of device-mapper and lvm2 source.
  - Correct prototype for --permission on lvchange and lvcreate man pages.
  - Exit with non-zero status from vgdisplay if couldn't show any requested VG.
  - libdevmapper.pc: Use simplified x.y.z version number.
  - Accept locking fallback_to_* options in the global section as documented.
  - Several fixes to lvconvert involving mirrors.
  - Avoid overwriting in-use on-disk text metadata when metadataarea fills up.
  - Generate man pages from templates and include version.
  - Fix misleading error message when there are no allocatable extents in VG.
  - Fix handling of PVs which reappeared with old metadata version.
  - Fix validation of --minor and --major in lvcreate to require -My always.
  - Allow lvremove to remove LVs from VGs with missing PVs.
  - In VG with PVs missing, by default allow activation of LVs that are complete.
  - Require --force with --removemissing in vgreduce to remove partial LVs.
  - No longer write out PARTIAL flag into metadata backups.
  - Treat new default activation/missing_stripe_filler "error" as an error target.
  - Add devices/md_chunk_alignment to lvm.conf.
  - Pass struct physical_volume to pe_align and adjust for md chunk size.
  - Avoid shuffling remaining mirror images when removing one, retaining primary.
  - Prevent resizing an LV while lvconvert is using it.
  - Avoid repeatedly wiping cache while VG_GLOBAL is held in vgscan & pvscan.
  - Fix pvresize to not allow resize if PV has two metadata areas.
  - Fix setting of volume limit count if converting to lvm1 format.
  - Fix vgconvert logical volume id metadata validation.
  - Fix lvmdump metadata gather option (-m) to work correctly.
  - Fix allocation bug in text metadata format write error path.
  - Fix vgcfgbackup to properly check filename if template is used.
  - vgremove tries to remove lv snapshot first.
  - Improve file descriptor leak detection to display likely culprit and filename.
  - Avoid looping forever in _pv_analyze_mda_raw used by pvck.
  - Change lvchange exit status to indicate if any part of the operation failed.
  - Fix pvchange and pvremove to handle PVs without mdas.
  - Fix pvchange -M1 -u to preserve existing extent locations when there's a VG.
  - Cease recognising snapshot-in-use percentages returned by early devt kernels.
  - Add backward-compatible flags field to on-disk format_text metadata.
  - libdevmapper: Only resume devices in dm_tree_preload_children if size changes.
  - libdevmapper: Extend deptree buffers so the largest possible device numbers fit.
  - libdevmapper: Underline longer report help text headings.


author: Alasdair Kergon <agk@redhat.com> - 2.02.44-1
changelog:
  - Add --nameprefixes, --unquoted, --rows to pvs, vgs, lvs man pages.
  - Fix lvresize size conversion for fsadm when block size is not 1K.
  - Fix pvs segfault when run with orphan PV and some VG fields.
  - Display a 'dev_size' of zero for missing devices in reports.
  - Add pv_mda_size to pvs and vg_mda_size to vgs.
  - Fix lvmdump /sys listing to include virtual devices directory.
  - Add "--refresh" functionality to vgchange and vgmknodes.
  - Avoid exceeding LV size when wiping device.
  - Calculate mirror log size instead of using 1 extent.
  - Ensure requested device number is available before activating with it.
  - Fix incorrect exit status from 'help <command>'.
  - Fix vgrename using UUID if there are VGs with identical names.
  - Fix segfault when invalid field given in reporting commands.
  - Use better random seed value in temp file creation.
  - Add read_urandom to read /dev/urandom. Use in uuid calculation.
  - Fix race in vgcreate that would result in second caller overwriting first.
  - Fix uninitialised lv_count in vgdisplay -c.
  - Don't skip updating pvid hash when lvmcache_info struct got swapped.
  - Fix startup race in clvmd.
  - Cope with snapshot dependencies when removing a whole VG with lvremove.
  - Make man pages and tool help text consistent using | for alternative options.
  - Add "all" field to reports expanding to all fields of report type.
  - Enforce device name length and character limitations in libdm.


author: Alasdair Kergon <agk@redhat.com> - 2.02.45-1
changelog:
  - Update clusterlib and corosync dependencies.
  - Attempt proper clean up in child before executing fsadm or modprobe.
  - Do not scan devices if reporting only attributes from PV label.
  - Use pkgconfig to obtain corosync library details during configuration.
  - Fix error returns in clvmd-corosync interface to DLM.
  - Add --refresh to vgchange and vgmknodes man pages.
  - Pass --test from lvresize to fsadm as --dry-run.
  - Prevent fsadm from checking mounted filesystems.
  - No longer treats any other key as 'no' when prompting in fsadm.
  - Add --dataalignment to pvcreate to specify alignment of data area.
  - Fix unblocking of interrupts after several commands.
  - Provide da and mda locations in debug message when writing text format label.
  - Mention the restriction on file descriptors at invocation on the lvm man page.
  - Index cached vgmetadata by vgid not vgname to cope with duplicate vgnames.
  - No longer require kernel and metadata major numbers to match.
  - If kernel supports only one dm major number, use in place of any supplied.
  - Add option to /etc/sysconfig/cluster to select cluster type for clvmd.
  - Allow clvmd to start up if its lockspace already exists.
  - Separate PV label attributes which do not need parse metadata when reporting.
  - Remove external dependency on the 'cut' command from fsadm.
  - Fix pvs segfault when pv mda attributes requested for unavailable PV.
  - Add fsadm support for reszing ext4 filesysystems.
  - Change lvm2-cluster to corosync instead of cman.
  - Fix some old changelog typos in email addresses.


author: Alasdair Kergon <agk@redhat.com> - 2.02.47-1
changelog:
  - Inherit readahead setting from underlying devices during activation.
  - Detect LVs active on remote nodes by querying locks if supported.
  - Enable online resizing of mirrors.
  - Use suspend with flush when device size was changed during table preload.
  - Implement query_resource_fn for cluster_locking.
  - Support query_resource_fn in locking modules.
  - Fix pvmove to revert operation if temporary mirror creation fails.
  - Fix metadata export for VG with missing PVs.
  - Add vgimportclone and install it and the man page by default.
  - Force max_lv restriction only for newly created LV.
  - Do not query nonexistent devices for readahead.
  - Reject missing PVs from allocation in toollib.
  - Fix PV datalignment for values starting prior to MDA area. (2.02.45)
  - Add sparse devices: lvcreate -s --virtualoriginsize (hidden zero origin).
  - Fix minimum width of devices column in reports.
  - Add lvs origin_size field.
  - Implement lvconvert --repair for repairing partially-failed mirrors.
  - Fix vgreduce --removemissing failure exit code.
  - Fix remote metadata backup for clvmd.
  - Fix metadata backup to run after vg_commit always.
  - Fix pvs report for orphan PVs when segment attributes are requested.
  - Fix pvs -a output to not read volume groups from non-PV devices.
  - Introduce memory pools per volume group (to reduce memory for large VGs).
  - Always return exit error status when locking of volume group fails.
  - Fix mirror log convert validation question.
  - Enable use of cached metadata for pvs and pvdisplay commands.
  - Fix memory leak in mirror allocation code.
  - Save and restore the previous logging level when log level is changed.
  - Fix error message when archive initialization fails.
  - Make sure clvmd-corosync releases the lockspace when it exits.
  - Fix segfault for vgcfgrestore on VG with missing PVs.
  - Block SIGTERM & SIGINT in clvmd subthreads.
  - Detect and conditionally wipe swapspace signatures in pvcreate.
  - Fix maximal volume count check for snapshots if max_lv set for volume group.
  - Fix lvcreate to remove unused cow volume if the snapshot creation fails.
  - Fix error messages when PV uuid or pe_start reading fails.
  - Flush memory pool and fix locking in clvmd refresh and backup command.
  - Fix unlocks in clvmd-corosync. (2.02.45)
  - Fix error message when adding metadata directory to internal list fails.
  - Fix size and error message of memory allocation at backup initialization.
  - Remove old metadata backup file after renaming VG.
  - Restore log_suppress state when metadata backup file is up-to-date.
  - Export dm_tree_node_size_changed() from libdevmapper.
  - Fix segfault when getopt processes dmsetup -U, -G and -M options.
  - Add _smp_mflags to compilation and remove DESTDIR.


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 2.02.47-2
changelog:
  - BuildRequire newer version of corosynclib (0.97-1) to link against
    latest libraries version (soname 4.0.0).
  - Add lvm2-2_02_48-cluster-cpg-new-api.patch to port clvmd-corosync
    to new corosync cpg API.


author: Alasdair Kergon <agk@redhat.com> - 2.02.48-1
changelog:
  - Abort if automatic metadata correction fails when reading VG to update it.
  - Don't fallback to default major number in libdm: use dm_task_set_major_minor.
  - Explicitly request fallback to default major number in device mapper.
  - Ignore suspended devices during repair.
  - Suggest using lvchange --resync when adding leg to not-yet-synced mirror.
  - Destroy toolcontext on clvmd exit to avoid memory pool leaks.
  - Fix lvconvert not to poll mirror if no conversion in progress.
  - Fix memory leaks in toolcontext error path.
  - Reinstate partial activation support in clustered mode.
  - Allow metadata correction even when PVs are missing.
  - Use 'lvm lvresize' instead of 'lvresize' in fsadm.
  - Do not use '-n' realine option in fsadm for rescue disk compatiblity.
  - Round up requested readahead to at least one page and print warning.
  - Try to repair vg before actual vgremove when force flag provided.
  - Unify error messages when processing inconsistent volume group.
  - Introduce lvconvert --use_policies (repair policy according to lvm.conf).
  - Fix rename of active snapshot with virtual origin.
  - Fix convert polling to ignore LV with different UUID.
  - Cache underlying device readahead only before activation calls.
  - Fix segfault when calculating readahead on missing device in vgreduce.
  - Remove verbose 'visited' messages.
  - Handle multi-extent mirror log allocation when smallest PV has only 1 extent.
  - Add LSB standard headers and functions (incl. reload) to clvmd initscript.
  - When creating new LV, double-check that name is not already in use.
  - Remove /dev/vgname/lvname symlink automatically if LV is no longer visible.
  - Rename internal vorigin LV to match visible LV.
  - Suppress 'removed' messages displayed when internal LVs are removed.
  - Fix lvchange -a and -p for sparse LVs.
  - Fix lvcreate --virtualsize to activate the new device immediately.
  - Make --snapshot optional with lvcreate --virtualsize.
  - Generalise --virtualoriginsize to --virtualsize.
  - Skip virtual origins in process_each_lv_in_vg() without --all.
  - Fix counting of virtual origin LVs in vg_validate.
  - Attempt to load dm-zero module if zero target needed but not present.
  - Add crypt target handling to libdevmapper tree nodes.
  - Add splitname command to dmsetup.
  - Add subsystem, vg_name, lv_name, lv_layer fields to dmsetup reports.
  - Make mempool optional in dm_split_lvm_name() in libdevmapper.


author: Fabio M. Di Nitto <fdinitto@redhat.com> 2.02.48-2
changelog:
  - BuildRequires and Requires on stable versions of both corosync-lib (1.0.0-1)
    and cluster-lib (3.0.0-20).


author: Alasdair Kergon <agk@redhat.com> - 2.02.49-1
changelog:
  - Exclude VG_GLOBAL from vg_write_lock_held so scans open devs read-only again.
  - Fix dev name mismatch in vgcreate man page example.
  - Check md devices for a partition table during device scan.
  - Add extended device (blkext) and md partition (mdp) types to filters.
  - Make text metadata read errors for segment areas more precise.
  - Fix text segment metadata read errors to mention correct segment name.
  - Include segment and LV names in text segment import error messages.
  - Fix memory leak in vgsplit when re-reading the vg.
  - Permit several segment types to be registered by a single shared object.
  - Update the man pages to document size units uniformly.
  - Allow commandline sizes to be specified in terms of bytes and sectors.
  - Update 'md_chunk_alignment' to use stripe-width to align PV data area.
  - Fix segfault in vg_release when vg->cmd is NULL.
  - Add dm_log_with_errno and dm_log_with_errno_init, deprecating the old fns.
  - Fix whitespace in linear target line to fix identical table line detection.
  - Add device number to more log messages during activation.


author: Alasdair Kergon <agk@redhat.com> - 2.02.50-1
changelog:
  - Add libs and devel subpackages to include shared libraries for applications.
    N.B. The liblvm2app API is not frozen yet and may still be changed
    Send any feedback to the mailing list lvm-devel@redhat.com.
  - Remove obsolete --with-dmdir from configure.
  - Add global/wait_for_locks to lvm.conf so blocking for locks can be disabled.
  - Fix race condition with vgcreate and vgextend on same device since 2.02.49.
  - Add an API version number, LVM_LIBAPI, to the VERSION string.
  - Return EINVALID_CMD_LINE not success when invalid VG name format is used.
  - Remove unnecessary messages after vgcreate/vgsplit code change in 2.02.49.
  - Store any errno and error messages issued while processing each command.


author: Alasdair Kergon <agk@redhat.com> - 2.02.51-2
changelog:
  - Fix clvmd locking broken in 2.02.50-1.
  - Only change LV /dev symlinks on ACTIVATE not PRELOAD (so not done twice).
  - Make lvconvert honour log mirror options combined with downconversion.
  - Add devices/data_alignment_detection to lvm.conf.
  - Add devices/data_alignment_offset_detection to lvm.conf.
  - Add --dataalignmentoffset to pvcreate to shift start of aligned data area.
  - Update synopsis in lvconvert manpage to mention --repair.
  - Document -I option of clvmd in the man page.


author: Milan Broz <mbroz@redhat.com> - 2.02.51-3
changelog:
  - Fix global locking in PV reporting commands (2.02.49).
  - Fix pvcreate on a partition (2.02.51).
  - Build clvmd with both cman and corosync support.


author: Alasdair Kergon <agk@redhat.com> - 2.02.52-1
changelog:
  - Prioritise write locks over read locks by default for file locking.
  - Add local lock files with suffix ':aux' to serialise locking requests.
  - Fix readonly locking to permit writeable global locks (for vgscan). (2.02.49)
  - Make readonly locking available as locking type 4.
  - Fix global locking in PV reporting commands (2.02.49).
  - Make lvchange --refresh only take a read lock on volume group.
  - Fix race where non-blocking file locks could be granted in error.
  - Fix pvcreate string termination in duplicate uuid warning message.
  - Don't loop reading sysfs with pvcreate on a non-blkext partition (2.02.51).
  - Fix vgcfgrestore error paths when locking fails (2.02.49).
  - Make clvmd check corosync to see what cluster interface it should use.
  - Fix vgextend error path - if ORPHAN lock fails, unlock / release vg (2.02.49).
  - Clarify use of PE ranges in lv{convert|create|extend|resize} man pages.
  - Restore umask when device node creation fails.
  - Check kernel vsn to use 'block_on_error' or 'handle_errors' in mirror table.


author: Alasdair Kergon <agk@redhat.com> - 2.02.52-2
changelog:
  - Build dmeventd and place into a separate set of subpackages.
  - Remove no-longer-needed BuildRoot tag and buildroot emptying at install.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.52-3
changelog:
  - Enable udev synchronisation code.
  - Install default udev rules for device-mapper and LVM2.
  - Add BuildRequires: libudev-devel.
  - Add Requires: libudev (to check udev is running).
  - Add Requires: util-linux-ng (blkid used in udev rules).


author: Alasdair Kergon <agk@redhat.com> - 2.02.53-1
changelog:
  - Create any directories in /dev with umask 022. (#507397)
  - Handle paths supplied to dm_task_set_name by getting name from /dev/mapper.
  - Add splitname and --yes to dmsetup man page.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.56-1
changelog:
  - Update to latest upstream release with various fixes and enhancements
    detailed in WHATS_NEW.
    Resolves: #463271 #533275


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.57-1
changelog:
  - Add --splitmirrors to lvconvert to split off part of a mirror.
  - Allow vgremove to remove a VG with PVs missing after a prompt.
  - Add activation/udev_rules config option in lvm.conf.
  - Add --poll flag to vgchange and lvchange to control background daemon launch.
  - Impose limit of 8 mirror images to match the in-kernel kcopyd restriction.
  - Log failure type and recognise type 'F' (flush) in dmeventd mirror plugin.
  - Add --noudevrules option for dmsetup to disable /dev node management by udev.
  - Fix 'dmsetup info -c -o all' to show all fields.
  - Fix coredump and memory leak for 'dmsetup help -c'. 
  - Rename mirror_device_fault_policy to mirror_image_fault policy.
  - Use extended status of new kernel snapshot target 1.8.0 to detect when empty.
  - Allow use of precommitted metadata when a PV is missing.
  - Add global/abort_on_internal_errors to lvm.conf to assist testing.
  - If aborting due to internal error, always send that message to stderr.
  - Keep log type consistent when changing mirror image count.
  - Exit with success in lvconvert --repair --use-policies on failed allocation.
  - Ensure any background daemon exits without duplicating parent's functionality.
  - Change background daemon process names to "(lvm2)".
  - Fix internal lock state after forking.
  - Remove empty PV devices if lvconvert --repair is using defined policies.
  - Use fixed buffer to prevent stack overflow in persistent filter dump.
  - Propagate metadata commit and revert notifications to other cluster nodes.
  - Fix metadata caching and lock state propagation to remote nodes in clvmd.
  - Properly decode all flags in clvmd messages including VG locks.
  - Drop cached metadata after device was auto-repaired and removed from VG.
  - Clear MISSING_PV flag if PV reappeared and is empty.
  - Fix removal of multiple devices from a mirror.
  - Also clean up PVs flagged as missing in vgreduce --removemissing --force.
  - Fix some pvresize and toollib error paths with missing VG releases/unlocks.
  - Explicitly call suspend for temporary mirror layer.
  - Add memlock information to do_lock_lv debug output.
  - Always bypass calls to remote cluster nodes for non-clustered VGs. 
  - Permit implicit cluster lock conversion in pre/post callbacks on local node.
  - Permit implicit cluster lock conversion to the lock mode already held.
  - Fix lock flag masking in clvmd so intended code paths get invoked.
  - Remove newly-created mirror log from metadata if initial deactivation fails.
  - Improve pvmove error message when all source LVs are skipped.
  - Fix memlock imbalance in lv_suspend if already suspended.
  - Fix pvmove test mode not to poll (and fail).
  - Fix vgcreate error message if VG already exists.
  - Fix tools to use log_error when aborted due to user response to prompt.
  - Fix ignored readahead setting in lvcreate --readahead.
  - Fix clvmd memory leak in lv_info_by_lvid by calling release_vg.
  - If LVM_UDEV_DISABLE_CHECKING is set in environment, disable udev warnings.
  - If DM_UDEV_DISABLE_CHECKING is set in environment, disable udev warnings.
  - Always set environment variables for an LVM2 device in 11-dm-lvm.rules.
  - Disable udev rules for change events with DISK_RO set. 
  - Add dm_tree_add_dev_with_udev_flags to provide wider support for udev flags.
  - Correct activated or deactivated text in vgchange summary message.
  - Fix fsadm man page typo (fsdam).
    Resolves: #549870


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.58-1
changelog:
  - Fix clvmd automatic target module loading crash.
  - Fix allocation code not to stop at the first area of a PV that fits.
  - Add support for the "snapshot-merge" kernel target (2.6.33-rc1).
  - Add --merge to lvconvert to merge a snapshot into its origin.
  - Disable openais and corosync support for clvmd.
    Resolves: #249478 #493055


author: Alasdair Kergon <agk@redhat.com> - 2.02.60-1
changelog:
  - Add cmirror subpackage for clustered mirrors.
  - Sleep before first progress check iff pvmove/lvconvert interval has prefix '+'.
  - Fix first syslog message prefix for dmeventd plugins.
  - Make failed locking initialisation messages more descriptive.
  - Add cman requires to cluster subpackage.
  - Set 'preferred_names' in default lvm.conf.
  - Add libdevmapper-event-lvm2.so to serialise dmeventd plugin liblvm2cmd use.
  - Stop dmeventd trying to access already-removed snapshots.
  - Fix clvmd to never scan suspended devices.
  - Fix detection of completed snapshot merge.
  - Improve snapshot merge metadata import validation.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.61-1
changelog:
  - Add %ORIGIN support to lv{create,extend,reduce,resize} --extents.
  - Accept a list of LVs with 'lvconvert --merge @tag' using process_each_lv.
  - Remove false "failed to find tree node" error when activating merging origin.
  - Exit with success when lvconvert --repair --use-policies performs no action.
  - Avoid unnecessary second resync when adding mimage to core-logged mirror.
  - Make clvmd -V return status zero.
  - Fix cmirrord segfault in clog_cpg list processing when converting mirror log. 
  - Deactivate temporary pvmove mirror cluster-wide when activating it fails.
  - Add missing metadata vg_reverts in pvmove error paths.
  - Unlock shared lock in clvmd if activation calls fail.
  - Add lvm_pv_get_size, lvm_pv_get_free and lvm_pv_get_dev_size to lvm2app.
  - Change lvm2app to return all sizes in bytes as documented (not sectors).
  - Exclude internal VG names and uuids from lists returned through lvm2app.
  - Add LVM_SUPPRESS_LOCKING_FAILURE_MESSAGES environment variable.
  - Add DM_UDEV_DISABLE_LIBRARY_FALLBACK udev flag to rely on udev only.
  - Remove hard-coding that skipped _mimage devices from 11-dm-lvm.rules.
  - Export dm_udev_create_cookie function to create new cookies on demand.
  - Add --udevcookie, udevcreatecookie and udevreleasecookie to dmsetup.
  - Set udev state automatically instead of using DM_UDEV_DISABLE_CHECKING.
  - Set udev state automatically instead of using LVM_UDEV_DISABLE_CHECKING.
  - Remove pointless versioned symlinks to dmeventd plugin libraries.
    Resolves: #561422 #561423 #563321


author: Alasdair Kergon <agk@redhat.com> - 2.02.64-1
changelog:
  - Avoid pointless initialisation when the 'version' command is run directly.
  - Fix memory leak for invalid regex pattern input.
  - Display invalid regex pattern for filter configuration in case of error.
  - Fix -M and --type to use strings, not pointers that change on config refresh.
  - Fix lvconvert error message when existing mirrored LV is not found.
  - Set appropriate udev flags for reserved LVs.
  - Disallow the direct removal of a merging snapshot.
  - Don't preload the origin when removing a snapshot whose merge is pending.
  - Disallow the addition of mirror images while a conversion is happening.
  - Disallow primary mirror image removal when mirror is not in-sync.
  - Remove obsolete --name parameter from vgcfgrestore.
  - Add -S command to clvmd to restart the daemon preserving exclusive locks.
  - Increment lvm2app version from 1 to 2 (memory allocation changes).
  - Change lvm2app memory alloc/free for pv/vg/lv properties.
  - Change daemon lock filename from lvm2_monitor to lvm2-monitor for consistency.
  - Add support for new IMPORT{db} udev rule available in udev v152.
  - Add DM_UDEV_PRIMARY_SOURCE_FLAG udev flag to recognize proper DM events.
  - Also include udev libs in libdevmapper.pc.
  - Cache bitset locations to speed up _calc_states.
  - Add a regex optimisation pass for shared prefixes and suffixes.
  - Add dm_bit_and and dm_bitset_equal to libdevmapper.
  - Speed up dm_bit_get_next with ffs().
  - Remove 'lvmconf --lockinglibdir' from cluster post: locking is now built-in.
  - Move libdevmapper-event-lvm2.so to devel package.
  - Explicitly specify libdevmapper-event.so* attributes.
  - Drop support for upgrades from very old versions that used lvm not lvm2.
  - Move libdevmapper-event plug-in libraries into new device-mapper subdirectory.
  - Don't verify lvm.conf contents when using rpm --verify.
  - Move development links to shared objects to /usr.
  - Change libdevmapper deactivation to fail if device is open.
  - Wipe memory buffers for libdevmapper dm-ioctl parameters before releasing.
  - Add support for ioctl's DM_UEVENT_GENERATED_FLAG.
  - Allow incomplete mirror restore in lvconvert --repair upon insufficient space.
  - Do not reset position in metadata ring buffer on vgrename and vgcfgrestore.
  - Allow VGs with active LVs to be renamed.
  - Only pass visible LVs to tools in cmdline VG name/tag expansions without -a.
  - Use C locale and mlockall in clvmd and dmeventd.
  - Mask LCK_HOLD in cluster VG locks for upgrade compatibility with older clvmd.
  - Add activation/polling_interval to lvm.conf as --interval default.
  - Don't ignore error if resuming any LV fails when resuming groups of LVs.
  - Skip closing persistent filter cache file if open failed.
  - Permit mimage LVs to be striped in lvcreate, lvresize and lvconvert.
  - Fix pvmove allocation to take existing parallel stripes into account.
  - Fix incorrect removal of symlinks after LV deactivation fails.
  - Fix is_partitioned_dev not to attempt to reopen device.
  - Fix another thread race in clvmd.
  - Improve vg_validate to detect some loops in lists.
  - Change most remaining log_error WARNING messages to log_warn.
  - Always use blocking lock for VGs and orphan locks.
  - Allocate all memory for segments from private VG mempool.
  - Optimise searching PV segments for seeking the most recently-added.
  - Remove duplicated vg_validate checks when parsing cached metadata.
  - Use hash table of LVs to speed up parsing of text metadata with many LVs.
  - Fix two vg_validate messages, adding whitespace and parentheses.
  - When dmeventd is not forking because of -d flag, don't kill parent process.
  - Fix dso resource leak in error path of dmeventd.
  - Fix --alloc contiguous policy only to allocate one set of parallel areas.
  - Do not allow {vg|lv}change --ignoremonitoring if on clustered VG.
  - Add ability to create mirrored logs for mirror LVs.
  - Fix clvmd cluster propagation of dmeventd monitoring mode.
  - Allow ALLOC_ANYWHERE to split contiguous areas.
  - Add some assertions to allocation code.
  - Introduce pv_area_used into allocation algorithm and add debug messages.
  - Add activation/monitoring to lvm.conf.
  - Add --monitor and --ignoremonitoring to lvcreate.
  - Don't allow resizing of internal logical volumes.
  - Avoid scanning all pvs in the system if operating on a device with mdas.
  - Disable long living process flag in lvm2app library.
  - Fix pvcreate device md filter check.
  - Suppress repeated errors about the same missing PV uuids.
  - Bypass full device scans when using internally-cached VG metadata.
  - Only do one full device scan during each read of text format metadata.
  - Look up missing PVs by uuid not dev_name in pvs to avoid invalid stat.
  - Rewrite clvmd init script.
  - Add default alternative to mlockall using mlock to reduce pinned memory size.
  - Add use_mlockall and mlock_filter to activation section of lvm.conf.
  - Handle misaligned devices that report alignment_offset of -1.
  - Extend core allocation code in preparation for mirrored log areas.
  - No longer fall back to looking up active devices by name if uuid not found.
  - Don't touch /dev in vgmknodes if activation is disabled.
  - Add --showkeys parameter description to dmsetup man page.
  - Add --help option as synonym for help command.
  - Add lvm2app functions lvm_{vg|lv}_{get|add|remove}_tag() functions.
  - Refactor snapshot-merge deptree and device removal to support info-by-uuid.
  - Change spec file to excluding cluster components from the build on s390.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.65-1
changelog:
  - Disallow vgchange --clustered if there are active mirrors or snapshots.
  - Fix truncated total size displayed by pvscan.
  - Skip internal lvm devices in scan if ignore_suspended_devices is set.
  - Do not merge old device cache after we run full scan. (2.02.56)
  - Add new --sysinit compound option to vgchange and lvchange.
  - Fix clvmd init script never to deactivate non-clustered volume groups.
  - Drop duplicate errors for read failures and missing devices to verbose level.
  - Do not print encryption key in message debug output (cryptsetup luksResume).
  - Use -d to control level of messages sent to syslog by dmeventd.
  - Change -d to -f to run dmeventd in foreground.
  - Fix udev flags on remove in create_and_load error path.
  - Add dm_list_splice() function to join two lists together.
  - Use /bin/bash for scripts with bashisms.
  - Switch Libs.private to Requires.private in devmapper.pc and lvm2app.pc.
  - Use pkgconfig Requires.private for devmapper-event.pc.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.66-2
changelog:
  - Simplify and fix Requires package headers.
  - If unable to obtain snapshot percentage leave value blank on reports.
  - Use new install_system_dirs and install_initscripts makefile targets.
  - Add lvm2app functions to lookup a vgname from a pvid and pvname.
  - Change internal processing of PVs in pvchange.
  - Validate internal lock ordering of orphan and VG_GLOBAL locks.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.68-1
changelog:
  - Have device-mapper-libs require device-mapper (circular) for udev rules.
  - Clear exec_prefix.
  - Use early udev synchronisation and update of dev nodes for clustered mirrors.
  - Fix udev rules to handle spurious events properly.
  - Add lv_path to reports to offer full /dev pathname.
  - Avoid abort when generating cmirror status.
  - Fix clvmd initscript status to print only active clustered LVs. 
  - Fix segfault in clvmd -R if no response from daemon received.
  - Honour log argument when down-converting stacked mirror.
  - Sleep to workaround clvmd -S race: socket closed early and server drops cmd. 
  - Exit successfully when using -o help (but not -o +help) with LVM reports.
  - Add man pages for lvmconf, dmeventd and non-existent lvmsadc and lvmsar tools.
  - Add --force, --nofsck and --resizefs to lvresize/extend/reduce man pages.
  - Fix lvm2cmd example in documentation.
  - Fix typo in warning message about missing device with allocated data areas.
  - Add device name and offset to raw_read_mda_header error messages.
  - Allow use of lvm2app and lvm2cmd headers in C++ code.
  - Require partial option in lvchange --refresh for partial LVs.
  - Don't merge unchanged persistent cache file before dumping if tool scanned.
  - Avoid selecting names under /dev/block if there is an alternative.
  - Fix clvmd initscript restart command to start clvmd if not yet running.
  - Handle failed restart of clvmd using -S switch properly.
  - Use built-in absolute paths in clvmd (clvmd restart and PV and LV queries).
  - Consistently return ECMD_FAILED if interrupted processing multiple LVs.
  - Add --type parameter description to the lvcreate man page.
  - Document 'clear' in dmsetup man page.
  - Replace strncmp kernel version number checks with proper ones.
  - Update clustered log kernel module name to log-userspace for 2.6.31 onwards.
  - Support autoloading of dm-mod module for kernels from 2.6.35.
  - Add dm_tree_node_set_presuspend_node() to presuspend child when deactivating.
  - Do not fail lvm_init() if init_logging() or _init_rand() generates an errno.
  - Fix incorrect memory pool deallocation while using vg_read for files.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.69-1
changelog:
  - Add metadata/vgmetadatacopies to lvm.conf.
  - Add --metadataignore to pvcreate and vgextend.
  - Add vg_mda_copies, pv_mda_used_count and vg_mda_used_count to reports.
  - Describe --vgmetadatacopies in lvm.conf and other man pages.
  - Add --[vg]metadatacopies to select number of mdas to use in a VG.
  - Make the metadata ignore bit control read/write metadata areas in a PV.
  - Add pvchange --metadataignore to set or clear a metadata ignore bit. 
  - Refactor metadata code to prepare for --metadataignore / --vgmetadatacopies.
  - Ensure region_size of mirrored log does not exceed its full size.
  - Preload libc locale messages to prevent reading it in memory locked state.
  - Fix handling of simultaneous mirror image and mirrored log image failure.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.69-2
changelog:
  - Always pass unsuspended dm devices through persistent filter to other filters.
  - Move test for suspended dm devices ahead of other filters.
  - Fix another segfault in clvmd -R if no response from daemon received. (2.02.68)
  - Preserve memlock balance in clvmd when activation triggers a resume.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.72-2
changelog:
  - Make vgck warn about missing PVs.
  - Revert failed table load preparation after "create, load and resume".
  - Check if cluster log daemon is running before allowing cmirror create.
  - Add dm_create_lockfile to libdm and use for pidfiles for all daemons.
  - Correct LV list order used by lvconvert when splitting a mirror.
  - Check if LV with specified name already exists when splitting a mirror.
  - Fix suspend/resume logic for LVs resulting from splitting a mirror.
  - Fix possible hang when all mirror images of a mirrored log fail.
  - Adjust auto-metadata repair and caching logic to try to cope with empty mdas.
  - Update pvcreate, {pv|vg}change, and lvm.conf man pages about metadataignore.
  - Prompt if metadataignore with vgextend or pvchange would adjust vg_mda_copies.
  - Adjust vg_mda_copies if metadataignore given with vgextend or pvchange.
  - Speed up the regex matcher.
  - Use "nowatch" udev rule for inappropriate devices.
  - Document LVM fault handling in lvm_fault_handling.txt.
  - Clarify help text for vg_mda_count.
  - Add more verbose messages while checking volume_list and hosttags settings.
  - Add log_error when strdup fails in {vg|lv}_change_tag().
  - Do not log backtrace in valid _lv_resume() code path.
  - Remove log directly if all mirror images of a mirrored log fail.
  - Randomly select which mdas to use or ignore.
  - Add printf format attributes to yes_no_prompt and fix a caller.
  - Remove superfluous suspended device counter from clvmd.
  - Fix lvm shell crash when input is entirely whitespace.
  - Update partial mode warning message.
  - Restore the removemissing behaviour of lvconvert --repair --use-policies.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.72-4
changelog:
  - Fix data corruption bug in cluster mirrors.
  - Require logical volume(s) to be explicitly named for lvconvert --merge.
  - Disallow 'mirrored' log type for cluster mirrors.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.72-5
changelog:
  - Fix clvmd init script to require proper dependencies.
  - Recognise and give preference to md device partitions (blkext major).
  - Split-mirror operations were ignoring user-specified PVs.
  - Never scan internal LVM devices.
  - Fix segfault in regex matcher with characters of ordinal value > 127.
  - Use built-in rule for device aliases: block/ < dm- < disk/ < mapper/ < other.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.72-8
changelog:
  - Fix potential for corruption during cluster mirror device failure.
  - Fix 'lvconvert --splitmirrors' in cluster operation.
  - Ignore snapshots when performing mirror recovery beneath an origin.
  - Add suspend_lv_origin and resume_lv_origin using LCK_ORIGIN_ONLY.
  - Allow internal suspend and resume of origin without its snapshots.
  - Fix dev_manager_transient to access -real device not snapshot-origin.
  - Monitor origin -real device below snapshot instead of overlay device.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.82-1
changelog:
  - Allow exclusive activation of snapshots in a cluster.
  - Add addnodeonresume and addnodeoncreate switch to dmsetup.
  - Add dm_tak_secure_data fn to libdevmapper to wipe all ioctl buffers in kernel.
  - Increase hash table size to 1024 LV names and 64 PV uuids.
  - Fix node and symlink operations in /dev for recent udev_sync optimalisation.
  - Remove unneeded checks for open_count in lv_info().
  - Synchronize with udev before checking open_count in lv_info().
  - Remove fs_unlock() from lv_resume path.
  - Allow CLVMD_CMD_SYNC_NAMES to be propagated around the cluster if requested.
  - Avoid rebuilding of uuid validation table.
  - Improve lvcreate "insufficient extents" errors to "insufficient free space".
  - Update to latest upstream release with various fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.83-1
changelog:
  - Fix CRC32 calculation on big endian CPU (2.02.75).
  - Update to latest upstream release with various fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.83-3
changelog:
  - Mitigate annoying error warning from device is usable check if run as non-root.
  - Fallback to control node creation only if node doesn't exist yet.
  - Avoid possible endless loop in _free_vginfo when 4 or more VGs have same name.
  - Fix to make resuming exclusive cluster mirror use local target type.
  - Lower secure data flag warning to verbose level if unsupported by kernel.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.86-1
changelog:
  - Fix read-only identical table reload supression.
  - Suppress low-level locking errors and warnings while using --sysinit.
  - Remove --force option from lvrename manpage.
  - Change DEFAULT_UDEV_SYNC to 1 so udev_sync is used even without any config.
  - Compare also file size to detect changed config file.
  - Update to latest upstream release with various fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.87-1
changelog:
  - Update to latest upstream release with various fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.87-2
changelog:
  - Terminate pv_attr field correctly (2.02.86).
  - Fix resource leak when strdup fails in _get_device_status() (2.02.85).
  - Fix unsafe table load when splitting off smaller mirror from a larger one.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.87-3
changelog:
  - Fix overly strict extent-count divisibility requirements for striped mirrors.
  - Fix rounding direction in lvresize when reducing volume size.
  - Fix possible overflow of size if %FREE or %VG is used.
  - Fix vgchange activation of snapshot with virtual origin.
  - Activate virtual snapshot origin exclusively (only on local node in cluster).
  - Fix lv_mirror_count to handle mirrored stripes properly.
  - Fix failure to down-convert a mirror to linear due to udev "dev open" conflict.
  - Fix mirrored log creation when PE size is small - force log_size >= region_size.
  - Fix log size calculation when only a log is being added to a mirror.
  - Work around resume_lv causing error LV scanning during splitmirror operation.
  - Begin using 64-bit status field flags.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.87-4
changelog:
  - Fix splitmirror in cluster having different DM/LVM views of storage.
  - Fix improper udev settings during suspend/resume for mirror sub-LVs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.87-6
changelog:
  - Fix lv_info open_count test for disabled verify_udev_operations (2.02.86).
  - Log dev name now returned to kernel for registering during cmirror CTR.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-1
changelog:
  - Update to latest upstream release with initial support for thinly-provisioned
    devices and scalable snapshots, improved support for RAID personalities,
    initial support for LVM metadata caching daemon and various other fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-2
changelog:
  - Fix a regression in handling of lvchange/lvcreate --major/--minor (2.02.95).
  - Fix name conflicts that prevent down-converting RAID1 when specifying a device.
  - Improve thin_check option passing and use configured path.
  - Add --with-thin-check configure option for path to thin_check.
  - Restart dmeventd on device-mapper-event package upgrade.
  - Do not run a new dmeventd instance on restart if there's no existing one.
  - Detect lvm binary path in lvmetad udev rules.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-3
changelog:
  - Restart clvmd daemon on lvm2-cluster package upgrade.
  - Keep exclusive activation in pvmove if LV is already active.
  - Disallow pvmove for exclusive LV if some affected LVs are not exclusively activated.
  - Remove unused and wrongly set cluster VG flag from clvmd lock query command.
  - Fix pvmove for exclusively activated LV pvmove in clustered VG (2.02.86).
  - Detect VG name being part of the LV name in lvconvert --splitmirrors -n.
  - Add 'vgscan --cache' functionality for consistency with 'pvscan --cache'.
  - Use 'pvscan --cache' instead of vgscan in lvmetad init script.
  - Exit immediately if LISTEN_PID env var incorrect during systemd handover.
  - Update and fix monitoring of thin pool devices.
  - Fix initializiation of thin monitoring (2.02.92).
  - Remove watch udev rule from 13-dm-disk.rules.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-4
changelog:
  - Fix lvresize of thin pool for striped devices.
  - Round upwards when specifying number of extents for lvresize.
  - Round downwards strip alignment for lvcreate with %FREE.
  - Fix problems when specifying PVs during RAID down-converts.
  - Fix ability to handle failures in mirrored log (2.02.89).
  - Change message severity to log_very_verbose for missing dev info in udev db.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-5
changelog:
  - Add lvmetad man page.
  - Fix RAID device replacement code so that it works under snapshot.
  - Fix inability to split RAID1 image while specifying a particular PV.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-6
changelog:
  - Allow subset of failed devices to be replaced in RAID LVs.
  - Prevent resume from creating error devices that already exist from suspend.
  - Fix lvconvert error message for non-mergeable volumes.
  - Fix volume group unlocking in vgreduce error path.
  - Update and correct lvs man page with supported column names.
  - Rename (Blk)DevNames/DevNos dmsetup header to (Blk)DevNamesUsed/DevNosUsed.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-7
changelog:
  - Disallow snapshots of mirror segment type.
  - Fix bug in cmirror that caused incorrect status info to print on some nodes.
  - Disallow changing cluster attribute of VG while RAID LVs are active.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-8
changelog:
  - Fix up-convert when mirror activation is controled by volume_list and tags.
  - Add a note for global/mirror_segtype_default setting that RAID1 is not cluster-aware.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.95-9
changelog:
  - Re-enable partial activation of non-thin LVs until it can be fixed (2.02.90).
  - Reinstate snapshots of mirror segment type.
    Warn of deadlock risk when using snapshots of mirror segment type.
  - Set delay_resume_if_new on deptree snapshot origin.
  - Add Conflicts: vdsm < 4.9-113.0 (new 'target' and 'zero' LV attr breaks vdsm).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.97-1
changelog:
  - Use 'ignore' discards for thin metadata created with older versions.
  - Use proper condition to check for unsupported discards settings.
  - Update lvs manpage with discards (2.02.97).
  - Add support for lvcreate --discards.
  - Issue error message when arguments do not match specified RAID type.
  - Update to latest upstream release with various fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-1
changelog:
  - Don't try to issue discards to a missing PV to avoid segfault.
  - Fix vgchange -aay not to activate non-matching LVs that follow a matching LV.
  - Fix lvchange --resync for RAID LVs which had no effect.
  - Add RAID10 support (--type raid10).
  - Introduce blkdeactivate script to deactivate block devs with dependencies.
  - Apply 'dmsetup mangle' for dm UUIDs besides dm names.
  - Use -q as short form of --quiet.
  - Suppress non-essential stdout with -qq.
  - Add log/silent to lvm.conf equivalent to -qq.
  - Add (p)artial attribute to lvs.
  - Implement devices/global_filter to hide devices from lvmetad.
  - Add lvmdump -l, to collect a state dump from lvmetad.
  - Add --discards to lvconvert.
  - Add --poolmetadata to lvconvert and support thin meta/data dev stacking.
  - Support creation of read-only thin volumes (lvcreate -p r).
  - Support changes of permissions for thin snapshot volumes.
  - Make lvremove ask before discarding data areas.
  - Prohibit not yet supported change of thin-pool to read-only.
  - Using autoextend percent 0 for thin pool fails 'lvextend --use-policies'.
  - Make vgscan --cache an alias for pvscan --cache.
  - Clear lvmetad metadata/PV cache before a rescan.
  - Fix a segmentation fault upon receiving a corrupt lvmetad response.
  - Give inconsistent metadata warnings in pvscan --cache.
  - Avoid overlapping locks that could cause a deadlock in lvmetad.
  - Fix memory leaks in libdaemon and lvmetad.
  - Optimize libdaemon logging for a fast no-output path.
  - Only create lvmetad pidfile when running as a daemon (no -f).
  - Warn if lvmetad is running but disabled.
  - Warn about running lvmetad with use_lvmetad = 0 in example.conf.
  - Update lvmetad help output (flags and their meaning).
  - Make pvscan --cache read metadata from LVM1 PVs.
  - Make libdaemon buffer handling asymptotically more efficient.
  - Make --sysinit suppress lvmetad connection failure warnings.
  - Prohibit usage of lvcreate --thinpool with --mirrors.
  - Fix lvm2api origin reporting for thin snapshot volume.
  - Add implementation of lvm2api function lvm_percent_to_float.
  - Allow non power of 2 thin chunk sizes if thin pool driver supports that.
  - Allow limited metadata changes when PVs are missing via [vg|lv]change.
  - Do not start dmeventd for lvchange --resync when monitoring is off.
  - Remove pvscan --cache from lvm2-lvmetad init script.
  - Report invalid percentage for property snap_percent of non-snaphot LVs.
  - Disallow conversion of thin LVs to mirrors.
  - Fix lvm2api data_percent reporting for thin volumes.
  - Do not allow RAID LVs in a clustered volume group.
  - Enhance insert_layer_for_lv() with recursive rename for _tdata LVs.
  - Skip building dm tree for thin pool when called with origin_only flag.
  - Ensure descriptors 0,1,2 are always available, using /dev/null if necessary.
  - Use /proc/self/fd when available for closing opened descriptors efficiently.
  - Fix inability to create, extend or convert to a large (> 1TiB) RAID LV.
  - Update lvmetad communications to cope with clients using different filters.
  - Clear LV_NOSYNCED flag when a RAID1 LV is converted to a linear LV.
  - Disallow RAID1 upconvert if the LV was created with --nosync.
  - Disallow addition of RAID images until the array is in-sync.
  - Fix RAID LV creation with '--test' so valid commands do not fail.
  - Add lvm_lv_rename() to lvm2api.
  - Fix setvbuf code by closing and reopening stream before changing buffer.
  - Disable private buffering when using liblvm.
  - When private stdin/stdout buffering is not used always use silent mode.
  - Fix 32-bit device size arithmetic needing 64-bit casting throughout tree.
  - Fix dereference of NULL in lvmetad error path logging.
  - Fix buffer memory leak in lvmetad logging.
  - Change lvmetad logging syntax from -ddd to -l {all|wire|debug}.
  - Add new libdaemon logging infrastructure.
  - Support unmount of thin volumes from pool above thin pool threshold.
  - Update man page to reflect that dm UUIDs are being mangled as well.
  - Add 'mangled_uuid' and 'unmangled_uuid' fields to dmsetup info -c -o.
  - Mangle device UUID on dm_task_set_uuid/newuuid call if necessary.
  - Add dm_task_get_uuid_mangled/unmangled to libdevmapper.
  - Always reset delay_resume_if_new flag when stacking thin pool over anything.
  - Don't create value for dm_config_node and require dm_config_create_value call.
  - Check for existing new_name for dmsetup rename.
  - Fix memory leak in dmsetup _get_split_name() error path.
  - Add Requires: bash >= 4.0 for blkdeactivate script.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-3
changelog:
  - Init lvmetad lazily to avoid early socket access on config overrides.
  - Hardcode use_lvmetad=0 if cluster locking used and issue a warning msg.
  - Avoid reading mirrors with failed devices in its mirrored log.
  - Avoid reading from mirrors that have failed devices if they block I/O.
  - Change lvs heading Copy% to Cpy%Sync and print RAID4/5/6 sync% there too.
  - Fix dm_task_set_cookie to properly process udev flags if udev_sync disabled.
  - Add Requires: device-mapper-persistent-data for thin provisioning support.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-4
changelog:
  - Add DM_DISABLE_UDEV environment variable to manage dev nodes by libdm only.
  - Recognize DM_DISABLE_UDEV environment variable for a complete fallback.
  - Do not verify udev operations if --noudevsync command option is used.
  - Automatically deactivate failed preloaded dm tree node.
  - Fix lvm2app to return all property sizes in bytes.
  - Add lvm.conf option global/thin_disabled_features.
  - Add lvconvert support to swap thin pool metadata volume.
  - Implement internal function detach_pool_metadata_lv().
  - Fix lvm2app and return lvseg discards property as string.
  - Allow forced vgcfgrestore of lvm2 metadata with thin volumes.
  - Add lvm.conf thin pool defs thin_pool_{chunk_size|discards|zero}.
  - Support discards for non-power-of-2 thin pool chunks.
  - Support allocation of pool metadata with lvconvert command.
  - Move common functionality for thin lvcreate and lvconvert to toollib.
  - Use lv_is_active() instead of lv_info() call.
  - Disallow pvmove on RAID LVs until they are addressed properly
  - Automatically restore MISSING PVs with no MDAs.
  - Do not allow --splitmirrors on RAID10 logical volumes.
  - When no '-i' argument is given for RAID10, default to 2 stripes.
  - Mirrored log is now fixed before its mirror when double-fault occurs.
  - Exit pvscan --cache immediately if cluster locking used or lvmetad not used.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-5
changelog:
  - Avoid a global lock in pvs when lvmetad is in use.
  - Fix crash in pvscan --cache -aay triggered by non-mda PV.
  - Fix memleak in device_is_usable mirror testing function.
  - Do not ignore -f in lvconvert --repair -y -f for mirror and raid volumes.
  - Fix regression that caused inability to create a snapshot of an inactive LV.
  - Remove warning about unsupported discards for non-power-of-2 thin pool chunks.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-6
changelog:
  - Limit RAID device replacement to repair only if LV is not in-sync.
  - Disallow RAID device replacement or repair on inactive LVs.
  - Fix possible race while removing metadata from lvmetad.
  - Fix possible deadlock when querying and updating lvmetad at the same time.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-7
changelog:
  - Synchronize with udev in pvscan --cache and fix dangling udev_sync cookies.
  - Fix autoactivation to not autoactivate VG/LV on each change of the PVs used.
  - Fix lvmetad updates for lvm1 format and fix reported internal errors.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-1
changelog:
  -  o Features/Extensions/Additions:
  - Add DM_ABORT_ON_INTERNAL_ERRORS env var support to abort on internal errors.
  - Verify clvmd message validity before processing and log error if incorrect.
  - Add initial support thin pool lvconvert --repair.
  - Add support for poolmetadataspare LV, that will be used for pool recovery.
  - Improve activation order when creating thin pools in non-clustered VG.
  - Add lvm2-activation-net systemd unit to activate LVs on net-attached storage.
  - Automatically flag thin snapshots to be skipped during activation.
  - Add support for persistent flagging of LVs to be skipped during activation.
  - Make selected thinp settings customizable by a profile.
  - Support storing profile name in metadata for both VGs and LVs.
  - Add support for configuration profiles.
  - Add support for thin volumes in vgsplit.
  - Require 1.9 thin pool target version for online thin pool metadata resize.
  - Add lvresize support for online thin pool metadata volume resize.
  - Add detection for thin pool metadata resize kernel support.
  - Add vg->vg_ondisk / lv_ondisk() holding committed metadata.
  - Add detection of mounted fs also for vgchange deactivation.
  - Avoid a global lock in pvs when lvmetad is in use.
  - Detect maximum usable size for snapshot for lvresize.
  - Improve RAID kernel status retrieval to include sync_action/mismatch_cnt.
  - Add external origin support for lvcreate.
  - Support automatic config validation.
  - Add PV header extension: extension version, flags and bootloader areas.
  - Initial support for lvconvert of thin external origin.
  - Improve activation code for better support of stacked devices.
  - vgimport '--force' now allows import of VGs with missing PVs.
  - Allow removal or replacement of RAID LV components that are error segments.
  - Make 'vgreduce --removemissing' able to handle RAID LVs with missing PVs.
  - Add lvconvert support to swap thin pool metadata volume.
  - Allow vgcfgrestore of lvm2 metadata with thin volumes if --force is used.
  - Give precedence to EMC power2 devices with duplicate PVIDs.
  - Recognise Storage Class Memory (IBM S/390) devices in filter.
  - Recognise STEC skd devices in filter.
  - Recognise Violin Memory vtms devices in filter.
  - Support discards for non-power-of-2 thin pool chunks.
  - Automatically restore MISSING PVs with no MDAs.
  - Support allocation of pool metadata with lvconvert command.
  - Detect mounted fs also via reading /proc/self/mountinfo.
  -  o Command Interface/Options:
  - Support ARG_GROUPABLE with merge_synonym (for --raidwritemostly).
  - Add --ignoreactivationskip to lvcreate/vgchange/lvchange to ignore skip flag.
  - Add --setactivationskip to lvcreate/lvchange to set activation skip flag.
  - Add --type profilable to lvm dumpconfig to show profilable config settings.
  - Add --mergedconfig to lvm dumpconfig for merged --config/--profile/lvm.conf.
  - Support changing VG/LV profiles: vgchange/lvchange --profile/--detachprofile.
  - Add new --profile command line arg to select a configuration profile for use.
  - For creation of snapshot require size for at least 3 chunks.
  - Do not accept size parameters bigger then 16EiB.
  - Accept --yes in all commands so test scripts can be simpler.
  - Add lvcreate/lvchange --[raid]{min|max}recoveryrate for raid LVs.
  - Add lvchange --[raid]writemostly/writebehind support for RAID1
  - Add lvchange --[raid]syncaction for scrubbing of RAID LVs.
  - Add --validate option to lvm dumpconfig to validate current config on demand.
  - Add --ignoreadvanced and --ignoreunsupported switch to lvm dumpconfig.
  - Add --withcomments and --withversions switch to lvm dumpconfig.
  - Add --type {current|default|missing|new} and --atversion to lvm dumpconfig.
  - Add --bootloaderareasize to pvcreate and vgconvert to create bootloader area.
  - Do not take a free lv name argument for lvconvert --thinpool option.
  - Allow lvconvert --stripes/stripesize only with --mirrors/--repair/--thinpool.
  - Do not ignore -f in lvconvert --repair -y -f for mirror and raid volumes.
  - Support use of option --yes for lvchange --persistent.
  - Fix clvmd support for option -d and properly use its argument.
  -  o Reporting:
  - Issue an error msg if lvconvert --type used incorrectly with other options.
  - Use LOG_DEBUG/ERR msg severity instead default for lvm2-activation-generator.
  - Add LV report fields: raid_mismatch_count/raid_sync_action/raid_write_behind.
  - Add LV reporting fields raid_min_recovery_rate, raid_max_recovery_rate.
  - Add sync_percent as alias for copy_percent LV reporting field.
  - Add lv_ prefix to modules reporting field.
  - Use units B or b (never E) with no decimal places when displaying sizes < 1k.
  - List thin-pool and thin modules for thin volumes.
  - Add 's(k)ip activation' bit to lvs -o lv_attr to indicate skip flag attached.
  - Improve error loging when user tries to interrupt commands.
  - Add vgs/lvs -o vg_profile/lv_profile to report profiles attached to VG/LV.
  - Report lvs volume type 'e' with higher priority.
  - Report lvs volume type 'o' also for external origin volumes.
  - Report lvs target type 't' only for thin pools and thin volumes.
  - Add "active" LV reporting field to show activation state.
  - Add "monitor" segment reporting field to show dmevent monitoring status.
  - Add explicit message about unsupported pvmove for thin/thinpool volumes.
  - Add pvs -o pv_ba_start,pv_ba_size to report bootloader area start and size.
  - Fix pvs -o pv_free reporting for PVs with zero PE count.
  - Report blank origin_size field if the LV doesn't have an origin instead of 0.
  - Report partial and in-sync RAID attribute based on kernel status
  - Log output also to syslog when abort_on_internal_error is set.
  - Change lvs heading Copy% to Cpy%Sync and print RAID4/5/6 sync% there too.
  - Report error for nonexisting devices in dmeventd communication.
  - Reduce some log_error messages to log_warn where we don't fail.
  -  o Configuration:
  - Add lvm.conf thin_repair/dump_executable and thin_repair_options.
  - Add activation/auto_set_activation_skip to control activation skip flagging.
  - Add default.profile configuration profile and install it on make install.
  - Add config/profile_dir to set working directory to load profiles from.
  - Use mirror_segtype_default if type not specified for linear->mirror upconvert.
  - Refine lvm.conf and man page documentation for autoactivation feature.
  - Override system's global_filter settings for vgimportclone.
  - Find newest timestamp of merged config files.
  - Add 'config' section to lvm.conf to set the way the LVM configuration is handled.
  - Add global/raid10_segtype_default to lvm.conf.
  - Accept activation/raid_region_size in preference to mirror_region_size config.
  - Add log/debug_classes to lvm.conf to control debug log messages.
  - Allow empty activation/{auto_activation|read_only|}_volume_list config option.
  - Add lvm.conf option global/thin_disabled_features.
  - Add lvm.conf thin pool allocation settings thin_pool_{chunk_size|discards|zero}.
  - Relax ignore_suspended_devices to read from mirrors that don't have a device marked failed.
  -  o Documentation:
  - Add man page entries for profile configuration and related options.
  - Document lvextend --use-policies option in man.
  - Improve lvcreate, lvconvert and lvm man pages.
  -  o API/interfaces:
  - liblvm/python API: Additions: PV create/removal/resize/listing
  - liblvm/python API: Additions: LV attr/origin/Thin pool/Thin LV creation
  - Fix exported symbols regex for non-GNU busybox sed.
  - Add LV snapshot support to liblvm and python-lvm.
  - Fix lvm2app to return all property sizes in bytes (not sectors).
  - Fix lvm2app and return lvseg discards property as string.
  - Remove python liblvm object. systemdir can only be changed using env var now.
  - Add DM_DISABLE_UDEV environment variable to manage dev nodes by libdm only.
  - Add dm_get_status_snapshot() for parsing snapshot status.
  - Append discards and read-only fields to exported struct dm_status_thin_pool.
  - Validate passed params to dm_get_status_raid/thin/thin_pool().
  - Fix dm_task_set_cookie to properly process udev flags if udev_sync disabled.
  - Add dm_mountinfo_read() for parsing /proc/self/mountinfo.
  - Add dm_config_write_{node_out/one_node_out} for enhanced config output.
  - Add dm_config_value_is_bool to check for boolean value in supported formats.
  - Add DM_ARRAY_SIZE public macro.
  - Add DM_TO_STRING public macro.
  - Implement ref-counting for parents in python lib.
  -  o Fixes (general):
  - Create dmeventd timeout threads as "detached" so exit status is freed.
  - Fix inability to remove a VG's cluster flag if it contains a mirror.
  - Suppress arg: prefix in log_sys_error macro when arg is empty string.
  - Fix bug making lvchange unable to change recovery rate for RAID.
  - Prohibit conversion of thin pool to external origin.
  - When creating PV on existing LV don't forbid reserved LV names on LVs below.
  - When converting mirrors, default segtype should be the same unless specified.
  - Add pipe_open/close() to use instead of less efficient/secure popen().
  - Ignore previous LV seg with alloc contiguous & cling when num stripes varies.
  - Do not zero init 4KB of thin snapshot for non-zeroing thin pool (2.02.94).
  - Correct thin creation error paths.
  - Add whole log_lv and metadata_lv sub volumes when creating partial tree.
  - Properly use snapshot layer for origin which is also thin volume.
  - Avoid generating metadata backup when calling update_pool_lv().
  - Send thin messages also for active thin pool and inactive thin volume.
  - Avoid creation of multiple archives for one command.
  - Avoid flushing thin pool when just requesting transaction_id.
  - Fix use of too big chunks of memory when communication with lvmetad.
  - Also filter partitions on mpath components if multipath_component_detection=1.
  - Do not use persistent filter with lvmetad.
  - Move syslog code out of signal handle in dmeventd.
  - Fix lvresize --use-policies of VALID but 100% full snapshot.
  - Skip monitoring of snapshots that are already bigger then origin.
  - Refuse to init a snapshot merge in lvconvert if there's no kernel support.
  - Fix alignment of PV data area if detected alignment less than 1 MB (2.02.74).
  - Fix premature DM version checking which caused useless mapper/control access.
  - Fix creation and removal of clustered snapshot.
  - Fix clvmd caching of metadata when suspending inactive volumes.
  - Fix lvmetad error path in lvmetad_vg_lookup() for null vgname.
  - Fix clvmd _cluster_request() return code in memory fail path.
  - Fix vgextend to not allow a PV with 0 MDAs to be used while already in a VG.
  - Fix PV alignment to incorporate alignment offset if the PV has zero MDAs.
  - Fix missing cleanup of flags when the LV is detached from pool.
  - Fix check for some forbidden discards conversion of thin pools.
  - Fix blkdeactivate to handle nested mountpoints and mangled mount paths.
  - Synchronize with udev in pvscan --cache and fix dangling udev_sync cookies.
  - Fix autoactivation to not autoactivate VG/LV on each change of the PVs used.
  - Limit RAID device replacement to repair only if LV is not in-sync.
  - Disallow RAID device replacement or repair on inactive LVs.
  - Unlock vg mutex in error path when lvmetad tries to lock_vg.
  - Detect key string duplication failure in config_make_nodes_v in libdaemon.
  - Disallow pvmove on RAID LVs until they are addressed properly
  - Recognize DM_DISABLE_UDEV environment variable for a complete fallback.
  - Do not verify udev operations if --noudevsync command option is used.
  - When no --stripes argument is given when creating a RAID10 volume, default to 2 stripes.
  - Do not allow lvconvert --splitmirrors on RAID10 logical volumes.
  - Skip mlocking [vectors] on arm architecture.
  - Repair a mirrored log before the mirror itself when both fail.
  - Don't use lvmetad in lvm2-monitor.service ExecStop to avoid a systemd issue.
  - Exit pvscan --cache immediately if cluster locking used or lvmetad not used.
  - Hardcode use_lvmetad=0 if cluster locking used and issue a warning msg.
  - Avoid trying to read a mirror that has a failed device in its mirrored log.
  - Fix 'dmsetup splitname -o' to not fail if used without '-c' switch (1.02.68).
  - Fix segfault for truncated string token in config file after the first '"'.
  - Fix config node lookup inside empty sections to not return the section itself.
  - Fix parsing of 64bit snapshot status in dmeventd snapshot plugin.
  - Always return success on dmeventd -V command call.
  -  o Fixes (segfaults/crashes/deadlocks/races):
  - Fix metadata area offset/size overflow if it's >= 4g and while using lvmetad.
  - Fix segfault if devices/global_filter is not specified correctly.
  - Fix segfault when reporting raid_syncaction for older kernels.
  - Fix vgcfgrestore crash when specified incorrect vg name.
  - Avoid crash-inducing race in lvmetad when VG disappears during rename.
  - Fix possible race while removing metadata from lvmetad.
  - Fix possible deadlock when querying and updating lvmetad at the same time.
  - Check for memory failure of dm_config_write_node() in lvmetad.
  - Fix crash in pvscan --cache -aay triggered by non-mda PV.
  - Prevent double free error after dmeventd call of _fill_device_data().
  -  o Fixes (resource leaks/memleaks):
  - Fix clogd descriptor leak when daemonizing.
  - Fix clvmd descriptor leak on restart.
  - Release memory allocated with _cached_info().
  - Release memory and unblock signals in lock_vol error path.
  - Fix memory resource leak in memlocking error path.
  - Fix memleak in dmeventd thin plugin in device list obtaining err path.
  - Fix socket leak on error path in lvmetad's handle_connect.
  - Fix memleak on error path for lvmetad's pv_found.
  - Fix memleak in device_is_usable mirror testing function.
  - Fix memory leak on error path for pvcreate with invalid uuid.
  - Fix resource leak in error path of dmeventd's umount of thin volume.
  - Close open dmeventd FIFO file descriptors on exec (FD_CLOEXEC).
  -  o Testing:
  - Fix test for active snapshot in cluster before resizing it.
  - Add python-lvm unit test case
  -  o Other:
  - Require confirmation for vgchange -c when no VGs listed explicitly.
  - Also skip /var and /var/log by default in blkdeactivate when unmounting.
  - Add support for bind mounts in blkdeactivate.
  - Add blkdeactivate -v/--verbose for debug output from external tools used.
  - Add blkdeactivate -e/--errors for error messages from external tools used.
  - Suppress messages from external tools called in blkdeactivate by default.
  - Workaround gcc v4.8 -O2 bug causing failures if config/checks=1 (32bit arch).
  - Add --with-thin-repair and --with-thin-dump configure options.
  - Use local activation for clearing snapshot COW device.
  - Add configure --with-default-profile-subdir to select dir to keep profiles in.
  - Creation of snapshot takes at most 100% origin coverage.
  - Use LC_ALL to set locale in daemons and fsadm instead of lower priority LANG.
  - Remove dependency on fedora-storage-init.service in lvm2 systemd units.
  - Depend on lvm2-lvmetad.socket in lvm2-monitor.service systemd unit.
  - Optimize out setting the same value of read_ahead.
  - Automatically deactivate failed preloaded dm tree node.
  - Process thin messages once to active thin pool target for dm_tree.
  - Move common functionality for thin lvcreate and lvconvert to toollib.
  -  o Packaging:
  - Do not include /lib/udev and /lib/udev/rules.d in device-mapper package.
  - Change Source0 link to ftp://sources.redhat.com/pub/lvm2/releases/LVM2.<version>.tgz
  - Fix some incorrect changelog dates.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-2
changelog:
  - Refresh existing VG before autoactivating (event retrigger/device reappeared).
  - Move mpath device filter before partitioned filter (which opens devices).
  - Fix vgck to notice on-disk corruption even if lvmetad is used.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-3
changelog:
  - Do not allow passing empty new name for dmsetup rename.
  - Check for exactly one lv segment in validation of thin pools and volumes.
  - Fix dmeventd unmonitoring of thin pools.
  - Fix lvresize for stacked thin pool volumes (i.e. mirrors).
  - Support most of lvchange operations on stacked thin pool meta/data LVs.
  - Disable pvmove of merging or converting logical volumes.
  - Enable pvmove of snapshots and snapshot origins.
  - Fix inability to specify LV name when pvmove'ing a RAID, mirror, or thin-LV.
  - Add ability to pvmove RAID, mirror, and thin volumes.
  - Avoid unlimited recursion when creating dtree containing inactive pvmove LV.
  - Add man page entries for lvmdump's -u and -l options.
  - Remove "mpath major is not dm major" msg for mpath component scan (2.02.94).
  - Don't assume stdin file descriptor is readable.
  - Write Completed debug message before reinstating log defaults after command.
  - Use pvscan -b in udev rules to avoid a deadlock on udev process count limit.
  - Add pvscan -b/--background for the command to be processed in the background.
  - Direct udev to use 3min timeout for LVM devices. Recent udev has default 30s.
  - Do not scan multipath or RAID components and avoid incorrect autoactivation.
  - Fix MD/loop udev handling to fire autoactivation after setup or coldplug only.
  - Fix ignored lvmetad update on loop device configuration (2.02.99)
  - Fix lvm2app segfault while using lvm_list_pvs_free fn if there are no PVs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-4
changelog:
  - Fix RAID calculation for sufficient allocatable space.
  - Conversion from linear to mirror or RAID1 now honors mirror_segtype_default.
  - Fix contiguous & cling allocation policies for parity RAID. (2.02.100)
  - lvconvert no longer converts LVs of "mirror" segment type to thinpool.
  - lvconvert no longer converts thinpool sub-LVs to "mirror" segment type.
  - Make RAID capable of single-machine exclusive operations in a cluster.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-5
changelog:
  - Fix failing metadata repair when lvmetad is used.
  - Fix incorrect memory handling when reading messages from lvmetad.
  - Fix locking in lvmetad when handling the PV which is gone.
  - Fix lvconvert when converting to a thin pool and thin LV at once.
  - Recognize new flag to skip udev scanning in udev rules and act appropriately.
  - Add support for flagging an LV to skip udev scanning during activation.
  - Improve message when unable to change discards setting on active thin pool.
  - Add --ignoreskippedcluster for exit status success when clustered VGs skipped.
  - Define symbolic names for subsystem udev flags in libdevmapper for easier use.
  - Make subsystem udev rules responsible for importing DM_SUBSYSTEM_UDEV_FLAG*.
  - Remove extra GOTO jump in lvmetad udev rules causing incorrect lvmetad update.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-6
changelog:
  - Fix lvconvert swap of poolmetadata volume for active thin pool
  - Check for open count with a timeout before removal/deactivation of an LV.
  - Add workaround for deactivation problem of opened virtual snapshot.
  - Report RAID images split with tracking as out-of-sync ("I").
  - Recognise NVM Express devices in filter.
  - Fix possible race while creating/destroying memory pools.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.100-7
changelog:
  - Add ignore_lvm_mirrors to config file to read/ignore labels on mirrors.
  - Revert to using devices/obtain_device_list_from_udev=0 by default.
  - Add internal flag for temporary LVs to properly direct udev to not interfere.
  - Fix endless loop in blkdeactivate <device>... if unable to umount/deactivate.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.107-2
changelog:
  - Add report/list_item_separator lvm.conf option.
  - Add lv_active_{locally,remotely,exclusively} LV reporting fields.
  - Comment out devices/{preferred_names,filter} in default lvm.conf file.
  - Enhance lvconvert thin, thinpool, cache and cachepool command line support.
  - Display 'C' only for cache and cache-pool target types in lvs.
  - Prompt for confirmation before change LV into a snapshot exception store.
  - Return proper error codes for some failing lvconvert funtions.
  - Add initial code to use cache tools (cache_check|dump|repair|restore).
  - Add --activationmode degraded to activate degraded raid volumes by default.
  - Add separate lv_active_{locally,remotely,exclusively} LV reporting fields.
  - Recognize "auto"/"unmanaged" values in selection for appropriate fields only.
  - Add report/binary_values_as_numeric lvm.conf option for binary values as 0/1.
  - Add --binary arg to pvs,vgs,lvs and {pv,vg,lv}display -C for 0/1 on reports.
  - Add separate reporting fields for each each {pv,vg,lv}_attr bit.
  - Separate LV device status reporting fields out of LV fields.
  - Fix regression causing PVs not in VGs to be marked as allocatable (2.02.59).
  - Fix VG component of lvid in vgsplit/vgmerge and check in vg_validate.
  - Add lv_full_name, lv_parent and lv_dm_path fields to reports.
  - Change lv_path field to suppress devices that never appear in /dev/vg.
  - Postpone thin pool lvconvert prompts (2.02.107).
  - Require --yes option to skip prompt to lvconvert thin pool chunksize.
  - Support lvremove -ff to remove thin volumes from broken thin pools.
  - Require --yes to skip raid repair prompt.
  - Change makefile %.d generation to handle filename changes without make clean.
  - Fix use of buildir in make pofile.
  - Enhance private volumes UUIDs with suffixed for easier detection.
  - Do not use reserved _[tc]meta volumes for temporary LVs.
  - Leave backup pool metadata with _meta%d suffix instead of reserved _tmeta%d.
  - Allow RAID repair to reuse PVs from same image that suffered a failure.
  - New RAID images now avoid allocation on any PVs in the same parent RAID LV.
  - Always reevaluate filters just before creating PV.
  - Fix dm_report_field_string_list to handle delimiter with multiple chars.
  - Add dm_report_field_reserved_value for per-field reserved value definition.


author: Alasdair Kergon <agk@redhat.com> - 2.02.108-1
changelog:
  - Add lvscan --cache which re-scans constituents of a particular LV.
  - Make dmeventd's RAID plugin re-scan failed PVs when lvmetad is in use.
  - Improve lvconvert --merge and --splitsnapshot validation.


author: Alasdair Kergon <agk@redhat.com> - 2.02.109-1
changelog:
  - Allow approximate allocation with +%FREE in lvextend.
  - Fix a segfault in lvscan --cache when devices were already missing. (2.02.108)
  - Display actual size changed when resizing LV.
  - Remove possible spurious "not found" message on PV create before wiping.
  - Handle upgrade from 2.02.105 when an LV now gaining a uuid suffix is active.
  - Remove lv_volume_type field from reports. (2.02.108)
  - Fix incorrect persistent .cache after vgcreate with PV creation. (2.02.108)
  - Add dm_tree_set_optional_uuid_suffixes to libdevmapper to handle upgrades.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.109-2
changelog:
  - Fix pvcreate_check() to update cache correctly after signature wiping.
  - Fix primary device lookup failure for partition when processing mpath filter.
  - Remove spurious "Skipping mirror LV" message on pvmove of clustered mirror.
  - If LV inactive and non-clustered, do not issue "Cannot deactivate" on -aln.
  - Cleanly error when creating RAID with stripe size < PAGE_SIZE.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.110-1
changelog:
  - Fix manipulation with thin-pools which are excluded via volume_list.
  - Support lv/vgremove -ff to remove thin vols from broken/inactive thin pools.
  - Fix typo breaking configure --with-lvm1=shared.
  - Modify lvresize code to handle raid/mirrors and physical extents.
  - Don't allow pvcreate to proceed if scanning or filtering fails.
  - Print name of LV which on activation triggers delayed snapshot merge.
  - Add lv_layout and lv_role LV reporting fields.
  - Properly display lvs lv_attr volume type and target type bit for cache origin.
  - Improve libdevmapper-event select() error handling.
  - Add extra check for matching transation_id after message submitting.
  - Add dm_report_field_string_list_unsorted for str. list report without sorting.
  - Support --deferred with dmsetup remove to defer removal of open devices.
  - Update dm-ioctl.h to include DM_DEFERRED_REMOVE flag.
  - Add support for selection to match string list subset, recognize { } operator.
  - Fix string list selection with '[value]' to not match list that's superset.
  - Fix string list selection to match whole words only, not prefixes.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.111-1
changelog:
  - Reinstate nosync logic when extending mirror. (2.02.110)
  - Fix total area extent calculation when allocating cache pool. (2.02.110)
  - Pass properly sized char buffers for sscanf when initializing clvmd.
  - Restore proper buffer size for parsing mountinfo line (1.02.89)


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.117-1
changelog:
  - Update to latest upstream release with various fixes and
    enhancementsdetailed in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-1
changelog:
  - Fix LV processing with selection to always do the selection on initial state.
  - Store metadata size + checksum in lvmcache and add struct lvmcache_vgsummary.
  - Remove inaccessible clustered PVs from 'pvs -a'.
  - Don't invalidate cached orphan information while global lock is held.
  - Avoid rescan of all devices when requested pvscan for removed device.
  - Measure configuration timestamps with nanoseconds when available.
  - Disable lvchange of major and minor of pool LVs.
  - Fix pvscan --cache to not scan and read ignored metadata areas on PVs.
  - Disallow vgconvert from changing metadata format when lvmetad is used.
  - Don't do a full read of VG when creating a new VG with an existing name.
  - Reduce amount of VG metadata parsing when looking for vgname on a PV.
  - Avoid reparsing same metadata when reading same metadata from multiple PVs.
  - Save extra device open/close when scanning device for size.
  - Fix seg_monitor field to report status also for mirrors and thick snapshots.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-2
changelog:
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Add --enable-halvm and --disable-halvm options to lvmconf script.
  - Add --services, --mirrorservice and --startstopservices option to lvmconf.
  - Use proper default value of global/use_lvmetad when processing lvmconf script.
  - Set correct vgid when updating cache when writing PV metadata.
  - Don't silently accept lvcreate -m with raid4/5/6.
  - Add A_PARTITION_BY_TAGS set when allocated areas should not share tags.
  - Respect allocation/cling_tag_list during intial contiguous allocation.
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Log relevant PV tags when using cling allocation.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-3.el6_7.2
changelog:
  - Fix alloc segfault when extending LV with fewer stripes than in first seg.
  - Fix regression in cache causing some PVs to bypass filters (2.02.105).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-7
changelog:
  - fix invalid access to memory in tcpListenerTable (#551030)
  - fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
    (#549390)
  - fix responding to broadcast SNMP requests (#549390)
  - port patches from RHEL-5 to avoid regressions


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-14
changelog:
  - store temporary files in /var/run/net-snmp instead of /tmp (SELinux does
    not allow writing /tmp) (#560081)
  - fix filedescriptor leak in RMON-MIB and Etherlike-MIB (#562108)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-15
changelog:
  - remove net-snmp-gui subpackage, perl-Tk is being removed from
    distro (#568786)
  - fix IF-MIB::ifSpeed of inactive interfaces (#561884)
  - correct the package license


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-19
changelog:
  - fixed exit code of snmp utilities when wrong argument to '-A' option
    is specified (#574061)
  - fixed BER parsing of incoming packets - siletnly discard the invalid ones
    according to RFC (#568651)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-21
changelog:
  - fixed hrFSTable and hrStorageTable to provide persistent table indexes
    according to RFS 2790 (#595325)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-22
changelog:
  - fixed value of ipIfStatsTable.Ip6ReasmReqds (#597265)
  - added missing include files from util_funcs directory (#604636)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-23
changelog:
  - fixed segfault when parsing snmpd.conf with disman entries (#607080)
  - fixed value of IP-MIB::ipv6InterfaceForwarding (#607074)
  - fixed output of snmptranslate tool when displaying ranges of UNSIGNED
    type (#606874)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-27.1
changelog:
  - fixed truncation of sysObjectID (#641113)
  - fixed assertions in calculating of statistics in IF-MIB (#621664)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-28
changelog:
  - fixed recompilation of the package on machine without IPv6 (#657835)
  - fixed SMUX getting stuck on big-endian platforms (#665053)
  - fixed OID comparsion in snmpwalk, now the output does not include
    objects outside requested subtree (#636890)
  - fixed IPv4 address creation in ipAddressTable (#616764)
  - added IPv6 address creation to ipAddressTable (#616336)
  - fixed value of ipAddressPrefixAutonomousFlag OID (#625262)
  - fixed ipv6IfTable - new interfaces were not added there (#627564)
  - extended BRIDGE-MIB implementation to cover RFC 4363 (#630157)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  - fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-38
changelog:
  - fixed snmpd crashing with many AgentX subagent (#749227)
  - fixed SNMPv2-MIB::sysObjectID value when "sysObjectID" config file
    option with long OID was used (#786931)
  - fixed value of BRIDGE-MIB::dot1dBasePortIfIndex.1 (#740172)
  - fixed parsing of "proxy" snmpd.conf option not to enable
    verbose logging by default (#746903)
  - added new "realStorageUnits" config file option to support
    disks > 16 TB in hrStorageTable (#741789)
  - added vxfs, reiserfs and ocfs2 filesystem support to hrStorageTable
    (#746903)
  - fixed snmpd sigsegv when embedded perl script registers one handler
    twice (#748907)
  - fixed setting of SNMP-TARGET-MIB::snmpTargetAddrRowStatus via
    SNMP-SET request on 64-bit platforms (#754275)
  - fixed crash when /var/lib/net-snmp/mib_indexes/ files have wrong
    SELinux context (#754971)
  - fixed memory leak when agentx subagent disconnects in the middle
    of request processing (#736580)
  - fixed slow (re-)loads of TCP-MIB::tcpConnectionTable (#789909)
  - removed 'error finding row index in _ifXTable_container_row_restore'
    error message (#788954)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-43
changelog:
  - fixed value of UCD-SNMP-MIB::extCommand to contain full command
    line (#842279)
  - fixed rpath to perl.so (#848319)
  - added support for port numbers in 'clientaddr' configuration
    option (#833013)
  - fixed rare snmptrapd crash on SIGHTERM handling when embedded perl
    is used (#824402)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#800671)
  - updated documentation of '-c' option of snmptrapd (#784502)
  - fixed endless loop when SIGTEM arrives in middle of internal query
    processing (#851637)
  - fixed UCD-DISKIO-MIB::diskIOLA values (#848155)
  - removed various error log messages related to counte64 expansions
    (#846906)
  - removed various error log messages when IPv6 is disabled (#845157)
  - added support of cvfs filesystem in hrStorageTable (#846532)
  - fixed rare race condintion when populating UCD-SNMP-MIB::prTable,
    which could result in some entries missing in the table (#846436)
  - added support of simfs filesystem in hrStorageTable (#861152)
  - fixed responding to requests on a multihost machine (#825889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-14
changelog:
  - Fix bug where user was prompted for a password when listing keys on an empty system database (#527048)
  - Fix setup-nsssysinit to handle more general flags formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.8
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Fix nsssysinit to enable apps to use the system cert store, patch contributed by David Woodhouse (#546221)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)
  - Sysinit requires coreutils for post install scriplet (#547067)
  - Remove redundant header from the pem module


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.1
changelog:
  - Updated to 3.12.5 from CVS import from Fedora 12
  - Moved blank legacy databases to the lookaside cache
  - Reenabled the full test suite
  - Retagging for a RHEL-6-test-build


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.3
changelog:
  - Resolves: #551784 rebuilt after nss-softokn and nss-util builds
  - this will generate the coorect nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Appying the changes in previous log
  - Changing some BuildRequires to >= as well
  - Temporarily disabling all tests for faster builds


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - Resolves: Bug 784674 - nss should protect against being called before nss_Init
  - Resolves: Bug 784490 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-1
changelog:
  - Rebase to nss-3.14.0.0-1
  - Resolves: rhbz#837089
  - Update ssl-cbc-random-iv patch for new sources
  - Remove patches rendered obsoleted by rebase to 3.14
  - Add a patch to enforce no pkcs11 bypass


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Syncup with uptream changes for aes gcm and ecc suiteb
  - Enable ecc support for suite b
  - Apply several upstream AES GCM fixes
  - Use the pristine nss upstream sources with ecc included
  - Export NSS_ENABLE_ECC=1 in both the build and the check sections
  - Make failed requests for unsupoprted ssl pkcs 11 bypass non fatal
  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must preserve ABI
  - Related:  rhbz#918950  - rebase nss to 3.14.3


author: Kai Engert <kaie@redhat.com> - 3.14.3-33
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.
    Please ensure that older packages that don't use the alternatives
    system for libnssckbi.so have a smaller n-v-r.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-34
changelog:
  - Fix race condition in cert code related to smart cards
  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-37
changelog:
  - Do not hold issuer certificate handles in the crl cache
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-1
changelog:
  - Rebase to NSS_3.15.1_RTM
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x) 
  - Update patches on account of the shallow tree with the rebase to 3.15.1
  - Update the pem module sources  nss-pem-20130405.tar.bz2 with latest patches applied
  - Remove patches rendered obsolete by the nss rebase and the updated nss-pem sources
  - Enable the iquote.patch to access newly introduced types


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix relative path in %check section to prevent undetected test failures
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Disable the cipher suite already run as part of the nss-softokn build
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-6
changelog:
  - Fix all.sh test for which application was last build by updating nss-versus-softoken-test.path
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Kai Engert <kaie@redhat.com> - 3.15.1-7
changelog:
  - Additional syntax fixes in nss-versus-softoken-test.patch
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-8
changelog:
  - Don't require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-9
changelog:
  - Rebuild for the pem module to link with freel from nss-softokn-3.14.3-6.el6
  - Related: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]
  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP clients


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-10
changelog:
  - Restore a mistakenly removed patch
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-11
changelog:
  - Fix the test for zero failures in the %check section
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to NSS_3_15_3_RTM
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741
  - Resolves: Bug 1031238 - deadlock in trust domain lock and object lock


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Build nss without softoken, freebl, or util sources in the build source tree
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042686 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - make derEncodingsMatch work with encrypted keys
  - rename a patch, dropped the experimental moniker from it
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Fix the numbering and naming of the patches
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Install man pages for the nss security tools
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Improve support for ECDSA algorithm via pluggable ECC
  - Document the purpose of the iquote.patch
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-10
changelog:
  - Prevent users from disabling the internal crypto module
  - Resolves: Bug 1059176 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-11
changelog:
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree
  - Add define-uint32.patch to deal with using older version of nss-softokn
  - Fix suboptimal test failure detection shell code in the %check
  unset DISPLAY
   section


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-2
changelog:
  - Restore use of indentation patch until another bug is resolved
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-3
changelog:
  - Fix pem module trashing of private keys on failed login
  - Resolves: Bug 1002205 - PEM module trashes private keys if login fails


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-5
changelog:
  - Move removal of directories to the end of the %prep section
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-6
changelog:
  - Update pem sources to the same ones used on rhel-7
  - Remove no longer needed patches on account of this update
  - Resolves: Bug 1002205


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-15
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Rebase to NSS 3.18
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1202488 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686
  - Resolves: Bug 1182902 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-4
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Fix the required nspr version to be 4.10.6


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-36
changelog:
  - add ldap backend (#455350)
  - skip sshd init's rsa1 creation in fips mode (#672870)
  - improve audit session key destroy (#642792)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-71
changelog:
  - enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI (#756929)
  - add CAVS test driver for the aes-ctr ciphers (#782091)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-73
changelog:
  - remove openssh-4.3p2-no-v6only.patch (#732955)
  - adjust Linux out-of-memory killer (#744236)
  - fix sshd init script - check existence of crypto (#797384)
  - add RequiredAuthentications[12] (#657378)
  - run privsep slave process as the users SELinux context (#798241)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-82
changelog:
  - check return value of PK11_Authenticate in ssh-add -n (#782912)
  - document available methods to RequiredAuthentications[12] (#821641)
  - fix ssh-copy-id (#836650)
  - fix segmentation fault in ssh client (#836655)
  - update pam_ssh_agent_auth to 0.9.3 upstream version
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running (#834404)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-85
changelog:
  - fix chroot logging issue (#872169)
  - change the bad key permissions error message (#880575)
  - fix a race condition in ssh-agent (#896561)
  - backport support for PKCS11 from openssh-5.4p1 (#908038)
  - add a KexAlgorithms knob to the client and server configuration (#951704)
  - fix parsing logic of ldap.conf file (#954094)
  - Add HMAC-SHA2 algorithm support (#969565)
  - store krb5 credentials after a pam session is created (#974096)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-86
changelog:
  - Add support for certificate key types for users and hosts (#906872)
  - Apply RFC3454 stringprep to banners when possible (#955792)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-87
changelog:
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A (#993577)
  - fixed an issue with broken 'ssh -I pkcs11' (#908038)
  - abort non-subsystem sessions to forced internal sftp-server (#993509)
  - reverted 'store krb5 credentials after a pam session is created (#974096)'


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-90
changelog:
  - change default value of MaxStartups - CVE-2010-5107 - #908707
  - add -fips subpackages that contains the FIPS module files (#1001565)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-95
changelog:
  - adjust the key echange DH groups and ssh-keygen according to SP800-131A (#993580)
  - log failed integrity test if /etc/system-fips exists (#1020803)
  - backport ECDSA and ECDH support (#1028335)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-96
changelog:
  - prevent a server from skipping SSHFP lookup (#1081338) CVE-2014-2653
  - ignore environment variables with embedded '=' or '\0' characters CVE-2014-2532
  - backport ControlPersist option (#953088)
  - log when a client requests an interactive session and only sftp is allowed (#997377)
  - don't try to load RSA1 host key in FIPS mode (#1009959)
  - restore Linux oom_adj setting when handling SIGHUP to maintain behaviour over restart
    (#1010429)
  - ssh-keygen -V - relative-specified certificate expiry time should be relative to current time
    (#1022459)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-97
changelog:
  - x11 forwarding - be less restrictive when can't bind to one of available addresses
    (#1027197)
  - better fork error detection in audit patch (#1028643)
  - fix openssh-5.3p1-x11.patch for non-linux platforms (#1100913)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-98
changelog:
  - add possibility to autocreate only RSA key into initscript (#1111568)
  - fix several issues reported by coverity


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Weiping Pan <wpan@redhat.com> 2.0.8.rh1 2
changelog:
  - rebuild oracleasm for RHEL6.5, sync to upstream commit d368091e98dc
  - (oracleasm: Add support for new error return codes from block/SCSI)


author: Weiping Pan <wpan@redhat.com> 2.0.8 4
changelog:
  - add  .clear_inode callback, fix bug 1157408.
  - rebuild oracleasm for RHEL6.6 in brew, update the version to 2.0.8-4


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - changed /dev/cdrom default user permissions back to 0600 in console.perms
    because some cdrom players open O_RDWR.


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - fixed glob/regexp confusion in pam_console, added kbd and fixed fb devices
  - added pam_xauth module


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - many bug fixes in pam_xauth
  - pam_console can now handle broken applications that do not set
    the PAM_TTY item.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.72
  - fix pam_unix password-changing bug
  - fix pam_unix's cracklib support
  - change package URL


author: Elliot Lee <sopwith@redhat.com>
changelog:
  - Add a patch to accept 'pts/N' in /etc/securetty as a match for tty '5'
    (which is what other pieces of the system think it is). Fixes bug #7641.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add new pam_stack module.
  - Install pwdb_chkpwd and unix_chkpwd as the current user for non-root builds


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add system-auth control file
  - let gethostname() call in pam_access.c be implicitly declared to avoid
    conflicting types if unistd.c declares it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add account management wrappers for pam_listfile, pam_nologin, pam_securetty,
    pam_shells, and pam_wheel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - symlink libpam.so to libpam.so.%{version}, and likewise for libpam_misc
  - reverse order of checks in _unix_getpwnam for pam_unix


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix installation of pam_xauth man pages (#12417)
  - forcibly strip helpers (#12430)
  - try to make pam_console a little more discriminating


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_console's extra checks disableable
  - simplify extra check to just check if the device owner is root
  - add a debug log when pam_stack comes across a NULL item
  - have pam_stack hand items up to the parent from the child


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - need to make pam_console's checking a little stronger
  - only pass data up from pam_stack if the parent didn't already define it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a broken_shadow option to pam_unix
  - add all module README files to the documentation list (#16456)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move pam_filter modules to /lib/security/pam_filter (#16111)
  - add pam_tally's application to allow counts to be reset (#16456)
  - move README files to the txts subdirectory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - give users /dev/cdrom* instead of /dev/cdrom in console.perms (#16768)
  - add nvidia control files to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix problems when looking for headers in /usr/include (#17236)
  - clean up a couple of compile warnings


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modify the files list to make sure #16456 stays fixed
  - make pam_stack track PAM_AUTHTOK and PAM_OLDAUTHTOK items
  - add pam_chroot module
  - self-hosting fixes from the -devel split
  - update generated docs in the tree


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch from Dmitry V. Levin to have pam_stack propagate the PAM fail_delay
  - roll back the README for pam_xauth to actually be the right one
  - tweak pam_stack to use the parent's service name when calling the substack


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak pre script to be called in all upgrade cases
  - get pam_unix to only care about the significant pieces of passwords it checks
  - add /usr/include/db1/db.h as a build prereq to pull in the right include
    files, no matter whether they're in glibc-devel or db1-devel
  - pam_userdb.c: include db1/db.h instead of db.h


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add RLIMIT_LOCKS to pam_limits (patch from Jes Sorensen) (#20542)
  - link pam_userdb to Berkeley DB 2.x to match 6.2's setup correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix similar() function in pam_cracklib (#14740)
  - fix example in access.conf (#21467)
  - add conditional compilation for building for 6.2 (for pam_userdb)
  - tweak post to not use USESHADOW any more


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix handling of "nis" when changing passwords by adding the checks for the
    data source to the password-updating module in pam_unix
  - add the original copyright for pam_access (fix from Michael Gerdts)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge to 0.74
  - make console.perms match perms set by MAKEDEV, and add some devfs device names
  - add 'sed' to the buildprereq list (#24666)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually time out when attempting to lckpwdf() (#25889)
  - include time.h in pam_issue (#25923)
  - update the default system-auth to the one generated by authconfig 4.1.1
  - handle getpw??? and getgr??? failures more gracefully (#26115)
  - get rid of some extraneous {set,end}{pw,gr}ent() calls


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: change the documented default config file to reflect the defaults
  - pam_limits: you should be able to log in a total of maxlogins times, not
    (maxlogins - 1)
  - handle group limits on maxlogins correctly (#25690)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - own /etc/security
  - be more descriptive when logging messages from pam_limits
  - pam_listfile: remove some debugging code (#28346)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add pam_console_apply
  - /dev/pilot's usually a serial port (or a USB serial port), so revert its
    group to 'uucp' instead of 'tty' in console.perms
  - change pam_console's behavior wrt directories -- directories which are
    mount points according to /etc/fstab are taken to be synonymous with
    their device special nodes, and directories which are not mount points
    are ignored


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: error out on undefined classes in pam_console config file
  - console.perms: actually change the permissions on the new device classes
  - pam_console: add an fstab= argument, and -f and -c flags to pam_console_apply
  - pam_console: use g_log instead of g_critical when bailing out
  - console.perms: logins on /dev/vc/* are also console logins, from Douglas
    Gilbert via Tim Waugh


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: make 'trust' and 'deny' work together correctly
  - pam_wheel: also check the user's primary gid
  - pam_group: also initialize groups when called with PAM_REINITIALIZE_CRED


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove /dev/dri from console.perms -- XFree86 munges it, so it's outside of
    our control (reminder from Daryll Strauss)
  - add /dev/3dfx to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge up to 0.75
  - pam_unix: temporarily ignore SIGCHLD while running the helper
  - pam_pwdb: temporarily ignore SIGCHLD while running the helper
  - pam_dispatch: default to uncached behavior if the cached chain is empty


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_access: compare IP addresses with the terminating ".", as documented
    (patch from Carlo Marcelo Arenas Belon, I think) (#16505)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: add apm_bios to the list of devices the console owner can use
  - console.perms: add beep to the list of sound devices


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: change js* to js[0-9]*
  - include pam_aconf.h in more modules (patches from Harald Welte)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: fix logic bug when changing permissions on single
    file and/or lists of files
  - pam_console: return the proper error code (reported and patches
    for both from Frederic Crozat)
  - change deprecated Copyright: tag in .spec file to License:


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: don't error out if the group has no members, but is the user's
    primary GID (reported by David Vos)
  - pam_unix: preserve permissions on files which are manipulated (#43706)
  - pam_securetty: check if the user is the superuser before checking the tty,
    thereby allowing regular users access to services which don't set the
    PAM_TTY item (#39247)
  - pam_access: define NIS and link with libnsl (#36864)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: use /var/run/console instead of /var/lock/console for lock files
  - pam_issue: read the right number of bytes from the file


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-10
changelog:
  - pam_xauth: fix errors due to uninitialized data structure (fix from Tse Huong
    Choo)
  - pam_xauth: random cleanups
  - pam_console: use /var/run/console instead of /var/lock/console at install-time
  - pam_unix: fix preserving of permissions on files which are manipulated


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_stack: perform deep copy of conversation structures
  - include the static libpam in the -devel subpackage (#52321)
  - move development .so and .a files to %{_libdir}
  - pam_unix: don't barf on empty passwords (#51846)
  - pam_unix: redo compatibility with "hash,age" data wrt bigcrypt (#42394)
  - console.perms: add usb camera, scanner, and rio devices (#15528)
  - pam_cracklib: initialize all options properly (#49613)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modules: use getpwnam_r and friends instead of non-reentrant versions
  - pam_console: clear generated .c and .h files in "clean" makefile target


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-12
changelog:
  - noreplace configuration files in /etc/security
  - pam_console: update pam_console_apply and man pages to reflect
    /var/lock -> /var/run move


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_unix: use crypt() instead of bigcrypt() when salted field is less than
    the critical size which lets us know it was generated with bigcrypt()
  - use a wrapper to handle ERANGE errors when calling get....._r functions:
    defining PAM_GETPWNAM_R and such (for getpwnam, getpwuid, getgrnam,
    getgrgid, and getspnam) before including _pam_macros.h will cause them
    to be implemented as static functions, similar to how defining PAM_SM_xxx
    is used to control whether or not PAM declares prototypes for certain
    functions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_userdb: fix the key_only flag so that the null-terminator of the
    user-password string isn't expected to be part of the key in the db file,
    matching the behavior of db_load 3.2.9


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: rewrite to skip refcounting and just use a temporary file
    created using mkstemp() in /tmp


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: close a possible DoS due to use of dotlock-style locking in
    world-writable directories by relocating the temporary file to the target
    user's home directory
  - general: include headers local to this tree using relative paths so that
    system headers for PAM won't be pulled in, in case include paths don't
    take care of it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add cracklib as a buildprereq
  - pam_wheel: don't ignore out if the user is attempting to switch to a
    unprivileged user (this lets pam_wheel do its thing when users attempt
    to get to system accounts or accounts of other unprivileged users)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_mkhomedir: recurse into subdirectories properly
  - pam_mkhomedir: handle symlinks
  - pam_mkhomedir: skip over special items in the skeleton directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: don't just return if the user is root -- we'll want to set the
    priority (it could be negative to elevate root's sessions)
  - pam_issue: fix off-by-one error allocating space for the prompt string


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_tally: don't try to read past the end of faillog -- it probably contains
    garbage, which if written into the file later on will confuse /usr/bin/faillog


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_rhosts: allow "+hostname" as a synonym for "hostname" to jive better
    with the hosts.equiv(5) man page
  - use the automake install-sh instead of the autoconf install-sh, which
    disappeared somewhere between 2.50 and now


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-15
changelog:
  - reorder patches so that the reentrancy patch is applied last -- we never
    came to a consensus on how to guard against the bugs in calling applications
    which this sort of change addresses, and having them last allows for dropping
    in a better strategy for addressing this later on


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-16
changelog:
  - pam_xauth: always return PAM_SUCCESS or PAM_SESSION_ERR instead of PAM_IGNORE,
    matching the previous behavior (libpam treats PAM_IGNORE from a single module
    in a stack as a session error, leading to false error messages if we just
    return PAM_IGNORE for all cases)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-19
changelog:
  - fix a bug in the getpwnam_r wrapper which sometimes resulted in false
    positives for non-existent users


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-20
changelog:
  - pam_stack: fix some memory leaks (reported by Fernando Trias)
  - pam_chroot: integrate Owl patch to report the more common causes of failures


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-31
changelog:
  - libpam_misc: fix possible infinite loop in misc_conv (#62195)
  - pam_xauth: fix cases where DISPLAY is "localhost:screen" and the xauth
    key is actually stored using the system's hostname (#61524)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-36
changelog:
  - pam_timestamp: chown intermediate directories when creating them
  - pam_timestamp_check: add -d flag to poll


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-40
changelog:
  - pam_timestamp_check: check that stdio descriptors are open before we're
    invoked
  - add missing chroot.conf


author: Elliot Lee <sopwith@redhat.com> 0.75-42
changelog:
  - Since cracklib-dicts location will not be correctly detected without 
    that package being installed, add buildreq for cracklib-dicts.
  - Add patch57: makes configure use $LIBNAME when searching for cracklib 
    dicts, and error out if not found.


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-44
changelog:
  - fix syntax errors in pam_console's yacc parser which newer bison chokes on
  - forcibly set FAKEROOT at make install time


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-45
changelog:
  - create /lib/security, even if it isn't /%{_lib}/security, because we
    can't locate /lib/security/$ISA without it (noted by Arnd Bergmann)
  - clear out the duplicate docs directory created during %install


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-46
changelog:
  - pam_xauth: reintroduce ACL support, per the original white paper
  - pam_xauth: default root's export ACL to none instead of everyone


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-49
changelog:
  - modify calls to getlogin() to check the directory of the current TTY before
    searching for an entry in the utmp/utmpx file (#98020, #98826, CAN-2003-0388)


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-0
changelog:
  - update to 0.77 upstream release
    - pam_limits: limits now affect root as well
    - pam_nologin: returns PAM_IGNORE instead of PAM_SUCCESS unless "successok"
      is given as an argument
    - pam_userdb: correctly return PAM_AUTH_ERR instead of PAM_USER_UNKNOWN when
      invoked with the "key_only" argument and the database has an entry of the
      form "user-<wrongpassword>"
  - use a bundled libdb for pam_userdb.so because the system copy uses threads,
    and demand-loading a shared library which uses threads into an application
    which doesn't is a Very Bad Idea


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_succeed_if: fix thinko in argument parsing which would walk past the
    end of the argument list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_pwdb.so link with libnsl again so that it loads (#107093)
  - remove now-bogus buildprereq on db4-devel (we use a bundled copy for
    pam_userdb to avoid symbol collisions with other db libraries in apps)


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-15
changelog:
  - don't install _pam_aconf.h -- apps don't use it, other PAM headers which
    are installed don't use it, and its contents may be different for arches
    on a multilib system
  - check for linkage problems in modules at %install-time (kill #107093 dead)
  - add buildprereq on flex (#101563)


author: Dan Walsh <dwalsh@redhat.com> 0.77-19.sel
changelog:
  - Change unix_chkpwd to handle unix_passwd and unix_acct
  - This eliminates the need for pam modules to have read/write access to /etc/shadow.


author: Tomas Mraz <tmraz@redhat.com> 0.77-56
changelog:
  - #75454 fixed locking when changing password
  - #127054 
  - #125653 removed unnecessary getgrouplist call
  - #124979 added quiet option to pam_succeed_if


author: Tomas Mraz <tmraz@redhat.com> 0.77-61
changelog:
  - #129328 pam_env shouldn't abort on missing /etc/environment
  - #126985 pam_stack should always copy the conversation function 
  - #127524 add /etc/security/opasswd to files


author: Tomas Mraz <tmraz@redhat.com> 0.77-63
changelog:
  - Fix checking of group %group syntax in pam_limits
  - Drop fencepost patch as it was already fixed 
    by upstream change from 0.75 to 0.77
  - Fix brokenshadow patch


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - #87628 pam_timestamp remembers authorization after logout
  - #116956 fixed memory leaks in pam_stack


author: Tomas Mraz <tmraz@redhat.com> 0.77-66
changelog:
  - #77646 log failures when renaming the files when changing password
  - Log failure on missing /etc/security/opasswd when remember option is present


author: Tomas Mraz <tmraz@redhat.com> 0.78-1
changelog:
  - update to Linux-PAM-0.78
  - #140451 parse passwd entries correctly and test for failure
  - #137802 allow using pam_console for authentication


author: Tomas Mraz <tmraz@redhat.com> 0.78-5
changelog:
  - echo why tests failed when rebuilding
  - fixed some warnings and errors in pam_console for gcc4 build
  - improved parsing pam_console config file


author: Tomas Mraz <tmraz@redhat.com> 0.78-6
changelog:
  - add functionality for running handler executables from pam_console
    when console lock was obtained/lost
  - removed patches merged to pam-redhat


author: Tomas Mraz <tmraz@redhat.com> 0.78-8
changelog:
  - remove ownership and permissions handling from pam_console call
    pam_console_apply as a handler instead


author: Tomas Mraz <tmraz@redhat.com> 0.78-9
changelog:
  - fix wrong logging in pam_console handlers
  - add executing ainit handler for alsa sound dmix
  - #147879, #112777 - change permissions for dri devices


author: Tomas Mraz <tmraz@redhat.com> 0.79-3
changelog:
  - make pam_unix LSB 2.0 compliant even when SELinux enabled
  - #88127 - change both local and NIS passwords to keep them in sync,
    also fix a regression in passwd functionality on NIS master server


author: Tomas Mraz <tmraz@redhat.com> 0.79-5
changelog:
  - added auditing patch by Steve Grubb
  - added cleanup patches for bugs found by Steve Grubb
  - don't clear the shadow option of pam_unix if nis option used


author: Tomas Mraz <tmraz@redhat.com> 0.79-7
changelog:
  - pam_xauth: unset the XAUTHORITY variable on error, fix
    potential memory leaks
  - modify path to IDE floppy devices in console.perms (#155560)


author: Tomas Mraz <tmraz@redhat.com> 0.79-9
changelog:
  - update the pam audit patch to support newest audit library,
    audit also pam_setcred calls (Steve Grubb)
  - don't use the audit_fd as global static variable
  - don't unset the XAUTHORITY when target user is root


author: Tomas Mraz <tmraz@redhat.com> 0.79-10
changelog:
  - add the Requires dependency on audit-libs (#159885)
  - pam_loginuid shouldn't report error when /proc/self/loginuid
    is missing (#159974)


author: Tomas Mraz <tmraz@redhat.com> 0.80-1
changelog:
  - upgrade to new upstream sources
  - removed obsolete patches
  - pam_selinux module shouldn't fail on broken configs unless
    policy is set to enforcing (Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.80-2
changelog:
  - fixed module tests so the pam doesn't require itself to build (#163502)
  - added buildprereq for building the documentation (#163503)
  - relaxed permissions of binaries (u+w)


author: Tomas Mraz <tmraz@redhat.com> 0.80-8
changelog:
  - process limit values other than RLIMIT_NICE correctly (#168790)
  - pam_unix: always honor nis flag on password change (by Aaron Hope)


author: Tomas Mraz <tmraz@redhat.com> 0.80-9
changelog:
  - don't include ps and pdf docs (#168823)
  - new common config file for configuration utilities
  - remove glib2 dependency (#166979)


author: Tomas Mraz <tmraz@redhat.com> 0.80-13
changelog:
  - fixed CAN-2005-2977 unix_chkpwd should skip user verification only if
    run as root (#168181)
  - link pam_loginuid to libaudit
  - support no tty in pam_access (#170467)
  - updated audit patch (by Steve Grubb)
  - the previous pam_selinux change was not applied properly
  - pam_xauth: look for the xauth binary in multiple directories (#171164)


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-1
changelog:
  - support netgroup matching in pam_succeed_if
  - upgrade to new release
  - drop pam_pwdb as it was obsolete long ago
  - we don't build static libraries anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-2
changelog:
  - fix dangling symlinks in -devel (#175929)
  - link libaudit only where necessary
  - actually compile in audit support


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-1
changelog:
  - new upstream version
  - updated db4 to 4.3.29
  - added module pam_tally2 with auditing support
  - added manual pages for system-auth and config-util (#179584)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-2
changelog:
  - added try_first_pass option to pam_cracklib
  - use try_first_pass for pam_unix and pam_cracklib in
    system-auth (#182350)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-3
changelog:
  - added pam_namespace module written by Janak Desai (per-user /tmp
  support)
  - new pam-redhat modules version


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-4
changelog:
  - fixed console device class for irda (#189966)
  - make pam_console_apply fail gracefully when a class is missing


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-5
changelog:
  - the namespace instance init script is now in /etc/security (#190148)
  - pam_namespace: added missing braces (#190026)
  - pam_tally(2): never call fclose twice on the same FILE (from upstream)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-1
changelog:
  - upgrade to new upstream version
  - make pam_console_apply not dependent on glib
  - support large uids in pam_tally, pam_tally2


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-2
changelog:
  - pam_console_apply shouldn't access /var when called with -r (#191401)
  - actually apply the large-uid patch
  - don't build hmactest in pam_timestamp so openssl-devel is not required
  - add missing buildrequires (#191915)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-3
changelog:
  - use md5 implementation from pam_unix in pam_namespace
  - pam_namespace should call setexeccon only when selinux is enabled


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-5
changelog:
  - updated pam_namespace with latest patch by Janak Desai
  - merged pam_namespace patches
  - added buildrequires libtool
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-1
changelog:
  - updated to a new upstream release
  - added service as value to be matched and list matching to
    pam_succeed_if
  - namespace.init was missing from EXTRA_DIST


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-3
changelog:
  - don't report error in pam_selinux for nonexistent tty (#188722)
  - add pam_keyinit to the default system-auth file (#198623)


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-6
changelog:
  - revoke keyrings properly when pam_keyinit called more than once (#201048)
    patch by David Howells


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-7
changelog:
  - revoke keyrings properly when pam_keyinit called as root (#201048)
  - pam_succeed_if should return PAM_USER_UNKNOWN when getpwnam fails (#197748)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-1
changelog:
  - upgrade to new upstream version, as there are mostly bugfixes except
    improved documentation
  - add support for session and password service for pam_access and
    pam_succeed_if
  - system-auth: skip session pam_unix for crond service


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-2
changelog:
  - silence pam_succeed_if in default system-auth (#205067)
  - round the pam_timestamp_check sleep up to wake up at the start of the
    wallclock second (#205068)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.1
changelog:
  - preserve effective uid in namespace.init script (LSPP for newrole)
  - include /var/log/faillog and tallylog to filelist (#209646)
  - add ids to .xml docs so the generated html is always the same (#210569)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-4
changelog:
  - update internal db4 to 4.5.20 version
  - move setgid before setuid in pam_keyinit (#212329)
  - make username check in pam_unix consistent with useradd (#212153)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-5
changelog:
  - add select-context option to pam_selinux (#213812)
  - autoreconf won't work with autoconf-2.61 as configure.in is not yet adjusted
    for it


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-8
changelog:
  - properly include /var/log/faillog and tallylog as ghosts
    and create them in post script (#209646)
  - update gmo files as we patch some po files (#218271)
  - add use_current_range option to pam_selinux (#220487)
  - improve the role selection in pam_selinux
  - remove shortcut on Password: in ja locale (#218271)
  - revert to old euid and not ruid when setting euid in pam_keyinit (#219486)
  - rename selinux-namespace patch to namespace-level


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.0-1
changelog:
  - upgrade to new upstream version
  - drop pam_stack module as it is obsolete
  - some changes to silence rpmlint


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-1
changelog:
  - upgrade to new upstream version resolving CVE-2007-0003
  - pam_namespace: unmount poly dir for override users


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-3
changelog:
  - correctly relabel tty in the default case (#229542)
  - pam_unix: cleanup of bigcrypt support
  - pam_unix: allow modification of '*' passwords to root


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-4
changelog:
  - pam_console: always decrement use count (#230823)
  - pam_namespace: use raw context for poly dir name (#227345)
  - pam_namespace: truncate long poly dir name (append hash) (#230120)
  - we don't patch any po files anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-5
changelog:
  - pam_selinux: improve context change auditing (#234781)
  - pam_namespace: fix parsing config file with unknown users (#234513)


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-6
changelog:
  - pam_namespace: better document behavior on failure (#237249)
  - pam_unix: split out passwd change to a new helper binary (#236316)
  - pam_namespace: add support for temporary logons (#241226)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-3
changelog:
  - updated db4 to 4.6.18 (#249740)
  - added user and new instance parameters to namespace init
  - document the new features of pam_namespace
  - do not log an audit error when uid != 0 (#249870)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-5
changelog:
  - most devices are now handled by HAL and not pam_console (patch by davidz)
  - license tag fix
  - multifunction scanner device support (#251468)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-6
changelog:
  - do not ask for blank password when SELinux confined (#254044)
  - initialize homedirs in namespace init script (original patch by dwalsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-9
changelog:
  - do not preserve contexts when copying skel and other namespace.init
    fixes (#298941)
  - do not free memory sent to putenv (#231698)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-17
changelog:
  - test for setkeycreatecon correctly
  - add exclusive login mode of operation to pam_selinux_permit (original
    patch by Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-1
changelog:
  - new upstream release
  - add default soft limit for nproc of 1024 to prevent
    accidental fork bombs (#432903)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-2
changelog:
  - if shadow is readable for an user do not prevent him from
    authenticating any user with unix_chkpwd (#433459)
  - call audit from unix_chkpwd when appropriate


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-4
changelog:
  - pam_namespace: fix problem with level polyinst (#438264)
  - pam_namespace: improve override checking for umount
  - pam_selinux: fix syslogging a context after free() (#438338)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-4
changelog:
  - pam_namespace: allow safe creation of directories owned by user (#437116)
  - pam_unix: fix multiple error prompts on password change (#443872)


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-1
changelog:
  - pam_loginuid: uids are unsigned (#460241)
  - new minor upstream release
  - use external db4
  - drop tests for not pulling in libpthread (as NPTL should
    be safe)


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-2
changelog:
  - new password quality checks in pam_cracklib
  - report failed logins from btmp in pam_lastlog
  - allow larger groups in modutil functions
  - fix leaked file descriptor in pam_tally


author: Tomas Mraz <tmraz@redhat.com> 1.0.90-4
changelog:
  - fix parsing of config files containing non-ASCII characters
  - fix CVE-2009-0579 (mininimum days for password change ignored) (#487216)
  - pam_access: improve handling of hostname resolution


author: Tomas Mraz <tmraz@redhat.com> 1.0.91-6
changelog:
  - add password-auth, fingerprint-auth, and smartcard-auth
    for applications which can use them namely gdm (#494874)
    patch by Ray Strode


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-5
changelog:
  - do not change permissions with pam_console_apply
  - drop obsolete pam_tally module and the faillog file (#461258)


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-7
changelog:
  - pam_console: fix memory corruption when executing handlers (patch by
    Stas Sergeev) and a few more fixes in the handler execution code (#532302)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-5
changelog:
  - fix insecure dropping of priviledges in pam_xauth, pam_env,
    and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335)
  - fix insecure executing of scripts with user supplied environment
    variables in pam_namespace - CVE-2010-3853 (#643043)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-6
changelog:
  - do not overwrite /var/log/tallylog on package update (#614766)
  - add support for uid and gid ranges in limits.conf (#622847)
  - add new pam_faillock module (#644971)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-7
changelog:
  - fix a few memory leaks in error paths and other mistakes
    found by a code review
  - add rhost and tty to auditing data in modules (#677664)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-12
changelog:
  - add character sequence test to pam_cracklib
  - drop unused difignore option from pam_cracklib (#811243)
  - add enforce_for_root option to pam_cracklib (#588893)
  - mention limits.d in the limits.conf(5) manpage (#723297)
  - add ability to lock out inactive accounts to pam_lastlog
  - fix require_selinux option in pam_namespace (#750601)
  - add mntopts flag for tmpfs polyinstantiation method
  - preserve authtok_type in pam_get_authtok() (#811168)
  - fix username mismatch in pam_unix remember feature (#815516)
  - relax restriction of root in pam_pwhistory
  - relax soft nproc limit for root in 90-nproc.conf


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-18
changelog:
  - pam_cracklib: improve documentation (#889233)
  - unbreak authentication if ld.so.preload is not empty
  - correct off by one error in account expiration calculation (#947011)
  - pam_console_apply: do not print error if console.perms.d is empty
  - properly handle all cases where crypt() might return NULL (#1026203)
  - pam_limits: clarify documentation of maxsyslogins limit (#1028490)
  - pam_access: call DNS resolution only when necessary and cache
    results (#1029817)
  - pam_limits: nofile applies to file descriptors not files (#1040664)
  - pam_limits: check whether the utmp login entry is valid (#1054936)
  - correct URLs in spec file (#1071770)
  - pam_userdb: correct the example in man page (#1078779)
  - pam_selinux: canonicalize username for getseuser() (#1083981)
  - pam_access: fix netgroup matching and @user@@netgroup parsing (#740233)


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com>
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)


author: Joe Orton <jorton@redhat.com> - 5.3.2-6
changelog:
  - add security fixes for CVE-2010-1866, CVE-2010-2094, CVE-2010-1917,
    CVE-2010-2531, MOPS-2010-060 (#624469)


author: Joe Orton <jorton@redhat.com> - 5.3.3-1
changelog:
  - update to 5.3.3 (#645591)
  - add security fixes for CVE-2010-3709, CVE-2010-3710,
    CVE-2010-3870, CVE-2009-5016 (#651953)
  - prevent extract() cloberring $GLOBALS (#655118)
  - ensure correct mysql_config is used in biarch builds


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 5.3.3-6
changelog:
  - merge Joe's changes:
  - improve CVE-2011-1466 fix to cover CAL_GREGORIAN, CAL_JEWISH
  - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148,
    CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470,
    CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740732)


author: Joe Orton <jorton@redhat.com> - 5.3.3-11
changelog:
  - add security fixes for CVE-2012-0781, CVE-2011-4153, CVE-2012-0057,
    CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2386


author: Remi Collet <rcollet@redhat.com> - 5.3.3-15
changelog:
  - fix permission on source files (#676364)
  - fix negative keys with var_export (#771738)
  - fix setDate when DateTime created from timestamp (#812819)
  - add php(language) and missing provides (#837042)
  - use arch-specific requires (#833545)
  - fix possible buffer overflow in pdo_odbc (#836264)
  - fix possible segfault in pdo_mysql (#824199)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-16
changelog:
  - fix stream support in fileinfo (#858653)
  - fix imap_open DISABLE_AUTHENTICATOR param ignores array (#859371)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-22
changelog:
  - php-xml provides php-xmlreader and php-xmlwriter (#874987)
  - fix possible NULL derefence and buffer overflow (#879179)
  - fix zend garbage collector (#848186, #868375)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - fix buffer overflow in _pdo_pgsql_error (#969110)
  - fix double free when destroy_zend_class fails (#910466)
  - fix segfault in error_handler with
    allow_call_time_pass_reference = Off (#892158)
  - fix copy doesn't report failure on partial copy (#947428)
  - add rpm macros for packagers: %php_inidir,
    %php_incldir and %__php (#953814)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-29
changelog:
  - drop unneeded part of CVE-2006-724.patch and fileinfo.patch
    extension not provided or git binary patches (#1064027)
  - odbc: fix incompatible pointer type (#1053982)
  - mysqli: fix possible segfault in mysqli_stmt::bind_result
    php bug 66762 (#1069167)
  - mysql: fix php_mysql_fetch_hash writes long value into int
    php bug 52636 (#1054953)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-31
changelog:
  - soap: fixRFC2616 transgression (#1045019)
  - fix static calling in non-static method (#953786)
  - fix autoload called from closing session (#954027)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-34
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Jan Kaluza <jkaluza@redhat.com> - 5.3.3-35
changelog:
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480


author: Remi Collet <rcollet@redhat.com> - 5.3.3-36
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.3.3-37
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-38
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Kaj J. Niemi <kajtzu@fi.basen.net> 7.4-0.1
changelog:
  - 7.4
  - Fixed Patch #1 (now rpm-pgsql-7.4.patch)
  - Fixed Patch #2 (now rpm-multilib-7.4.patch):
  - Patch #4 is unnecessary (upstream)
  - Fixed Patch #6 (now postgresql-7.4-src-tutorial.patch)
  - Added Patch #8 (postgresql-7.4-com_err.patch) as com_err()
    is provided by e2fsprogs and CPPFLAGS gets lost somewhere
    inside configure (bad macro?)
  - No 7.4 PDF docs available yet (Source #17)
  - PyGreSQL is separated from the upstream distribution but
    we include it as usual (Source #18)
  - Default to compiling libpq and ECPG as fully thread-safe

  - 7.4 Origin.  See previous spec files for previous history. Adapted
  - from Red Hat and PGDG's 7.3.4 RPM, directly descended from 
  - postgresql-7.3.4-2 as shipped in Fedora Core 1.


author: Lamar Owen <lowen@pari.edu> <lamar.owen@wgcr.org>
changelog:
  - 7.4-0.1PGDG
  - Development JDBC jars in addition to the 7.3 jars; will replace the
  - 7.3 jars once 7.4 official jars are released.
  - Changed to use the bzip2 source to save a little size.
  - Removed some commented out portions of the specfile.
  - Removed the 7.3.4 PDF docs.  Will replace with 7.4 PDF's once they
  - are ready.


author: David Jee <djee@redhat.com> 7.4-4
changelog:
  - Add PyGreSQL patch for deprecated column pg_type.typprtlen [Bug #111263]
  - Add headers patch which moves ecpg headers to /usr/include/ecpg
    [Bug #111195]


author: Lamar Owen <lowen@pari.edu>
changelog:
  - 7.4.1-1PGDG
  - Merge Sander Steffann's changes up to 7.4-0.5PGDG
  - Proper 7.4.1 JDBC jars this time.
  - Patch for no pl/python from Alvaro


author: Tom Lane <tgl@redhat.com> 7.4.2-1
changelog:
  - Update to PostgreSQL 7.4.2; sync with community SRPM as much as possible.
  - Support PGOPTS from /etc/sysconfig/pgsql, per bug 111504.
  - Fix permissions on /etc/sysconfig/pgsql, per bug 115278.
  - SELinux patch in init file: always su </dev/null, per bug 117901.
  - Rebuilt


author: Tom Lane <tgl@redhat.com> 7.4.3-1
changelog:
  - Update to PostgreSQL 7.4.3.
  - Uninstalling server RPM stops postmaster first, per bug 114846.
  - Fix su commands to not assume PG user's shell is sh-like, per bug 124024.
  - Fix permissions on postgresql-python doc files, per bug 124822.
  - Minor postgresql.init improvements.


author: Tom Lane <tgl@redhat.com> 7.4.3-3
changelog:
  - Undo ill-considered chkconfig change that causes server to start
    immediately upon install.  Mea culpa (bug 127552).


author: Tom Lane <tgl@redhat.com> 7.4.5-1
changelog:
  - Update to PostgreSQL 7.4.5.
  - Update JDBC jars to driver build 215.
  - Add Obsoletes: entries for rh-postgresql packages, per bug 129278.


author: Tom Lane <tgl@redhat.com> 7.4.5-3
changelog:
  - Solve the stale lockfile problem (bugs 71295, 96981, 134090)
  - Use runuser instead of su for SELinux (bug 134588)


author: Tom Lane <tgl@redhat.com> 7.4.5-4
changelog:
  - Remove contrib/oidjoins stuff from installed fileset; it's of no use
    to ordinary users and has a security issue (bugs 136300, 136301)
  - adjust chkconfig priority (bug 128852)


author: Tom Lane <tgl@redhat.com> 7.4.6-1
changelog:
  - Update to PostgreSQL 7.4.6 (bugs 136947, 136949)
  - Make init script more paranoid about mkdir step of initializing a new
    database (bugs 136947, 136949)


author: Tom Lane <tgl@redhat.com> 7.4.6-3
changelog:
  - Update to PyGreSQL 3.6 (to fix bug #142711)
  - Adjust a few file permissions (bug #142431)
  - Assign %{_libdir}/pgsql to base package instead of -server (bug #74003)


author: Tom Lane <tgl@redhat.com> 8.0.0-1
changelog:
  - Update to PostgreSQL 8.0.0, PyGreSQL 3.6.1, pgtcl 1.5.2,
    and jdbc driver build 309.
  - Extensive cleanout of obsolete cruft in patch set.
  - Regression tests are run during RPM build (NOTE: cannot build as root when
    this is enabled).
  - Postmaster stderr goes someplace useful, not /dev/null (bz#76503, #103767)
  - Make init script return a useful exit status (bz#80782)
  - Move docs' tutorial directory to %{_libdir}/pgsql/tutorial, since it
    includes .so files that surely do not belong under /usr/share.
  - Remove useless .sgml files from docs RPM (bz#134450)
  - Put regression tests under /usr/lib64 on 64-bit archs, since .so files
    are not architecture-independent.


author: Tom Lane <tgl@redhat.com> 8.0.1-2
changelog:
  - Repair improper error message in init script when PGVERSION doesn't match.
  - Arrange for auto update of version embedded in init script.


author: Tom Lane <tgl@redhat.com> 8.0.1-4
changelog:
  - Attach Obsoletes: declarations for rh-postgresql to subpackages (bz#144435)
  - Make Requires: and Prereq: package linkages specify release not only
    version, as per recent mailing list discussion.


author: Tom Lane <tgl@redhat.com> 8.0.3-1
changelog:
  - Update to PostgreSQL 8.0.3 (includes security and data-loss fixes; see
    bz#156727, CAN-2005-1409, CAN-2005-1410)
  - Update to jdbc driver build 311
  - Recreate postgres user after superseding an rh-postgresql install (bug #151911)
  - Ensure postgresql server is restarted if running during an upgrade


author: Tom Lane <tgl@redhat.com> 8.0.4-1
changelog:
  - Update to PostgreSQL 8.0.4, PyGreSQL 3.6.2, and jdbc driver build 312
  - Adjust pgtcl link command to ensure it binds to correct libpq (bug #166665)
  - Remove obsolete Conflicts: against other python versions (bug #166754)
  - Add /etc/pam.d/postgresql (bug #167040)
  - Include contrib/xml2 in build (bug #167492)


author: Tom Lane <tgl@redhat.com> 8.1.0-1
changelog:
  - Update to PostgreSQL 8.1.0, PyGreSQL 3.7, and jdbc driver build 404
  - Fix PAM config file (must have account not only auth) (bug #167040)
  - Add BuildPrereq: libxslt-devel (bug #170141)
  - Sync with PGDG SRPM as much as feasible


author: Tom Lane <tgl@redhat.com> 8.1.1-1
changelog:
  - Update to PostgreSQL 8.1.1
  - Make pg_config.h architecture-independent for multilib installs;
    put the original pg_config.h into pg_config_$ARCH.h


author: Tom Lane <tgl@redhat.com> 8.1.1-3
changelog:
  - fix pg_config.h for 64-bit and ppc platforms
  - update Makefile.regress (needs to --load-language=plpgsql)


author: Tom Lane <tgl@redhat.com> 8.1.2-1
changelog:
  - Update to PostgreSQL 8.1.2
  - Repair extraneous quote in pgtcl configure script ... odd that bash
    didn't use to spit up on this.


author: Tom Lane <tgl@redhat.com> 8.1.3-1
changelog:
  - Update to PostgreSQL 8.1.3 (fixes bug #180617, CVE-2006-0553)
  - Update to jdbc driver build 405
  - Modify multilib header hack to not break non-RH arches, per bug #177564


author: Tom Lane <tgl@redhat.com> 8.1.4-1
changelog:
  - Update to PostgreSQL 8.1.4 (includes fixes for CVE-2006-2313, CVE-2006-2314;
    see bug #192173)
  - Update to PyGreSQL 3.8
  - Suppress noise from chcon, per bug #187744


author: Tom Lane <tgl@redhat.com> 8.2.0-1
changelog:
  - Update to PostgreSQL 8.2.0
  - Update to PyGreSQL 3.8.1
  - Fix chcon arguments in test/regress/Makefile
  Related: #201035
  - Adjust init script to not fool /etc/rc.d/rc
  Resolves: #161470
  - Change init script to not do initdb automatically, but require
    manual "service postgresql initdb" for safety.  Per upstream discussions.


author: Tom Lane <tgl@redhat.com> 8.2.1-1
changelog:
  - Update to PostgreSQL 8.2.1
  - Update to pgtcl 1.5.3
  - Be sure we link to libncurses, not libtermcap which is disappearing in Fedora


author: Tom Lane <tgl@redhat.com> 8.2.1-2
changelog:
  - Split -pl subpackage into three new packages to reduce dependencies
    and track upstream project's packaging.


author: Tom Lane <tgl@redhat.com> 8.2.4-2
changelog:
  - Fix oversight in postgresql-test makefile: pg_regress isn't a shell script
    anymore.  Per upstream bug 3398.


author: Tom Lane <tgl@redhat.com> 8.2.4-4
changelog:
  - Use tzdata package's data files instead of private copy, so that
    postgresql-server need not be turned for routine timezone updates
  - Don't remove postgres user/group during RPM uninstall, per Fedora
    packaging guidelines
  - Seems we need an explicit BuildRequires on gawk now
  - Rebuild to fix Fedora toolchain issues


author: Tom Lane <tgl@redhat.com> 8.2.4-5
changelog:
  - Use nicer solution for tzdata file substitution: upstream discussion
    concluded that hardwiring the path was better than a symlink after all.


author: Tom Lane <tgl@redhat.com> 8.2.6-1
changelog:
  - Update to PostgreSQL 8.2.6 to fix CVE-2007-4769, CVE-2007-4772,
    CVE-2007-6067, CVE-2007-6600, CVE-2007-6601
  - Make initscript and pam config files be installed unconditionally;
    seems new buildroots don't necessarily have those directories in place


author: Tom Lane <tgl@redhat.com> 8.3RC2-1
changelog:
  - Update to PostgreSQL 8.3RC2 (not waiting for 8.3.0 because Fedora 9 alpha
    should be 8.3-based not 8.2-based).
  - Update to pgtcl 1.6.2


author: Tom Lane <tgl@redhat.com> 8.3.1-2
changelog:
  - Clean up cross-subpackage Requires: to ensure that updating any one
    subpackage brings in the matching versions of others.
  Resolves: #444271


author: Tom Lane <tgl@redhat.com> 8.3.1-4
changelog:
  - Enable LDAP support
  Resolves: #445315
  - Use -Wl,--as-needed to suppress bogus dependencies for libraries that
    are really only needed by some of the subpackages


author: Tom Lane <tgl@redhat.com> 8.3.3-1
changelog:
  - Update to PostgreSQL 8.3.3.
  - Remove postgresql-prefer-ncurses.patch, no longer needed in recent
    Fedora releases because libtermcap is gone.


author: Tom Lane <tgl@redhat.com> 8.3.3-2
changelog:
  - Install Pgtcl in /usr/lib/tcl$TCL_VERSION, not directly in /usr/lib.
    Needed because tcl 8.5 no longer puts /usr/lib into its package search path.
    NOTE: do not back-port this change into branches using pre-8.5 tcl, because
    /usr/lib/tcl8.4 had been a symlink to /usr/share/tcl8.4, and /usr/share
    is exactly where we must not put Pgtcl.
  Resolves: #228263


author: Tom Lane <tgl@redhat.com> 8.3.5-1
changelog:
  - Update to PostgreSQL 8.3.5.
  - Improve display from init script's initdb action, per Michael Schwendt


author: Tom Lane <tgl@redhat.com> 8.3.6-1
changelog:
  - Update to PostgreSQL 8.3.6, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-6.html


author: Tom Lane <tgl@redhat.com> 8.3.6-4
changelog:
  - Prevent dependent packages from needing to include sys/sdt.h
    (unintended side effect of previous patch)
  - Use -O1 on alpha, per report from Oliver Falk; -O2 tickles gcc bugs


author: Tom Lane <tgl@redhat.com> 8.3.7-1
changelog:
  - Update to PostgreSQL 8.3.7, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-7.html
    notably the fix for CVE-2009-0922


author: Tom Lane <tgl@redhat.com> 8.4.0-1
changelog:
  - Update to PostgreSQL 8.4.0.  See release notes at
    http://www.postgresql.org/docs/8.4/static/release-8-4.html


author: Tom "spot" Callaway <tcallawa@redhat.com> 8.4.0-2
changelog:
  - update License tag to MIT (PostgreSQL calls it "BSD", but it is MIT)
  - Note: This changes nothing from a license compatibility perspective.


author: Tom Lane <tgl@redhat.com> 8.4.1-1
changelog:
  - Update to PostgreSQL 8.4.1, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-1.html
    including two security issues
  Related: #522085
  Related: #522092


author: Tom Lane <tgl@redhat.com> 8.4.2-4
changelog:
  - Sync with Fedora devel, including:
  - Update to PostgreSQL 8.4.2, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-2.html
    including two security issues
  Resolves: #552617
  - Remove the postgresql-python and postgresql-tcl subpackages.  These files
    are now broken out as their own packages (PyGreSQL and tcl-pgtcl,
    respectively), to reflect the now longstanding split of upstream projects.
  Related: #554431
  - Arrange for the postmaster, but not any of its child processes, to be run
    with oom_adj -17.  This compensates for the OOM killer not being smart about
    accounting for shared memory usage.
  - Remove static libraries (.a files) from package, per packaging guidelines
  - Change %define to %global, per packaging guidelines
  - Use -N not the obsolete -n in useradd call
  - Clean up specfile to eliminate rpmlint gripes, mainly by removing
    no-longer-needed provisions for superseding rh-postgresql
  - add sparc/sparc64 to multilib header support


author: Tom Lane <tgl@redhat.com> 8.4.2-5
changelog:
  - Latest version of systemtap needs the probes.o file to be built again
  Resolves: #557297
  - Provide script and instructions for building the documentation PDF


author: Tom Lane <tgl@redhat.com> 8.4.3-1
changelog:
  - Update to PostgreSQL 8.4.3, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-3.html
  Resolves: #565558
  - Bring init script into some modicum of compliance with Fedora/LSB standards
  Resolves: #561010
  - adjust license tag to reflect OSI decision


author: Tom Lane <tgl@redhat.com> 8.4.4-1
changelog:
  - Update to PostgreSQL 8.4.4, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-4.html
    including fixes for CVE-2010-1169 and CVE-2010-1170
  Resolves: #593033


author: Tom Lane <tgl@redhat.com> 8.4.4-2
changelog:
  - Add -p "$pidfile" to initscript's status call to improve corner cases.
    (Note: can't be fixed in Fedora until 595597 is fixed there.)
  Resolves: #561010


author: Tom Lane <tgl@redhat.com> 8.4.5-1
changelog:
  - Update to PostgreSQL 8.4.5, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-5.html
    including the fix for CVE-2010-3433
  Resolves: #640090
  - Duplicate COPYRIGHT in -libs subpackage, per revised packaging guidelines


author: Tom Lane <tgl@redhat.com> 8.4.7-1
changelog:
  - Update to PostgreSQL 8.4.7, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-7.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
    including the fix for CVE-2010-4015
  Resolves: #672635


author: Tom Lane <tgl@redhat.com> 8.4.7-2
changelog:
  - Add fix to make plpgsql cope with dropped columns in rowtypes
  Resolves: #694249
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines,
    and add explicit dependencies on the -libs subpackage to pacify rpmdiff


author: Tom Lane <tgl@redhat.com> 8.4.9-1
changelog:
  - Update to PostgreSQL 8.4.9, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-9.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-8.html
    including the fix for CVE-2011-2483
  Resolves: #740736


author: Tom Lane <tgl@redhat.com> 8.4.11-1
changelog:
  - Update to PostgreSQL 8.4.11, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-10.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #812082


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830726


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852021


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.0-14
changelog:
  - Merge Pacemaker cluster resource agents:
    * Add Source1.
    * Drop noarch. We have real binaries now.
    * Update BuildRequires.
    * Update all relevant prep/build/install/files/description sections.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.0-16
changelog:
  - Create an ldirectord package
  - Update Pacameker agents to upstream version: 2198dc90bec4
    + Build: Import ldirectord.
    + Ensure HA_VARRUNDIR has a value to substitute
    + High: Add findif tool (mandatory for IPaddr/IPaddr2)
    + High: IPv6addr: new nic and cidr_netmask parameters
    + High: postfix: new resource agent
    + Include license information
    + Low (LF 2159): Squid: make the regexp match more precisely output of netstat
    + Low: configure: Fix package name.
    + Low: ldirectord: add dependency on $remote_fs.
    + Low: ldirectord: add mandatory required header to init script.
    + Medium (LF 2165): IPaddr2: remove all colons from the mac address before passing it to send_arp
    + Medium: VirtualDomain: destroy domain shortly before timeout expiry
    + Medium: shellfuncs: Make the mktemp wrappers work.
    + Remove references to Echo function
    + Remove references to heartbeat shellfuncs.
    + Remove useless path lookups
    + findif: actually include the right header. Simplify configure.
    + ldirectord: Remove superfluous configure artifact.
    + ocf-tester: Fix package reference and path to DTD.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.3-3
changelog:
  - Update Pacameker agents to upstream version: 099c0e5d80db
    + Add the ha_parameter function back into .ocf-shellfuncs.
    + Bug bnc#534803 - Provide a default for MAILCMD
    + Fix use of undefined macro @HA_NOARCHDATAHBDIR@
    + High (LF 2138): IPsrcaddr: replace 0/0 with proper ip prefix (thanks to Michael Ricordeau and Michael Schwartzkopff)
    + Import shellfuncs from heartbeat as badly written RAs use it
    + Medium (LF 2173): nfsserver: exit properly in nfsserver_validate
    + Medium: RA: Filesystem: implement monitor operation
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable (addendum)
    + Medium: RA: iSCSILogicalUnit: use a 16-byte default SCSI ID
    + Medium: RA: iSCSITarget: be more persistent deleting targets on stop
    + Medium: RA: portblock: add per-IP filtering capability
    + Medium: mysql-proxy: log_level and keepalive parameters
    + Medium: oracle: drop spurious output from sqlplus
    + RA: Filesystem: allow configuring smbfs mounts as clones


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.4-2
changelog:
  - Update Pacameker agents to upstream version: e2338892f59f
    + High: send_arp - turn on unsolicited mode for compatibilty with the libnet version's exit codes
    + High: Trap sigterm for compatibility with the libnet version of send_arp
    + Medium: Bug - lf#2147: IPaddr2: behave if the interface is down
    + Medium: IPv6addr: recognize network masks properly
    + Medium: RA: VirtualDomain: avoid needlessly invoking "virsh define"


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.5-2
changelog:
  - Update Pacameker agents to upstream version: bc00c0b065d9
    + High: RA: introduce OCF_FUNCTIONS_DIR, allow it to be overridden (LF2239)
    + High: doc: add man pages for all RAs (LF2237)
    + High: syslog-ng: new RA
    + High: vmware: make meta-data work and several cleanups (LF 2212)
    + Medium: .ocf-shellfuncs: add ocf_is_probe function
    + Medium: Dev: make RAs executable (LF2239)
    + Medium: IPv6addr: ifdef out the ip offset hack for libnet v1.1.4 (LF 2034)
    + Medium: add mercurial repository version information to .ocf-shellfuncs
    + Medium: build: add perl-MailTools runtime dependency to ldirectord package (LF 1469)
    + Medium: iSCSITarget, iSCSILogicalUnit: support LIO
    + Medium: nfsserver: use check_binary properly in validate (LF 2211)
    + Medium: nfsserver: validate should not check if nfs_shared_infodir exists (thanks to eelco@procolix.com) (LF 2219)
    + Medium: oracle/oralsnr: export variables properly
    + Medium: pgsql: remove the previous backup_label if it exists
    + Medium: postfix: fix double stop (thanks to Dinh N. Quoc)
    + RA: LVM: Make monitor operation quiet in logs (bnc#546353)
    + RA: Xen: Remove instance_attribute "allow_migrate" (bnc#539968)
    + ldirectord: OCF agent: overhaul


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.6-1
changelog:
  - New rgmanager resource agents upstream release
  - spec file update:
    * use global instead of define
    * use new Source0 url
    * use resource-agents macro more aggressively


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.6-2
changelog:
  - Update Pacameker agents to upstream version: c76b4a6eb576
    + High: RA: VirtualDomain: fix forceful stop (LF 2283)
    + High: apache: monitor operation of depth 10 for web applications (LF 2234)
    + Medium: IPaddr2: CLUSTERIP/iptables rule not always inserted on failed monitor (LF 2281)
    + Medium: RA: Route: improve validate (LF 2232)
    + Medium: mark obsolete RAs as deprecated (LF 2244)
    + Medium: mysql: escalate stop to KILL if regular shutdown doesn't work


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.7-2
changelog:
  - Drop support for drbd and smb (PM-drop-support-for-drbd-and-smb-resource-agents.patch)
  - Explicitly list python as BuildRequires


author: Marek Grac <mgrac@redhat.com> - 3.0.7-4
changelog:
  - Checksum error occurs on HA-LVM
  - status on clusterfs "gfs" returned 1 (generic error)
  - Resolves rhbz#563555 rhbz#558664


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.9-1
changelog:
  - new upstream release
    Resolves: rhbz#569959
  - spec file update:
    * update spec file copyright date
    * use bz2 tarball


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-1
changelog:
  - Rebase on top of new upstream bug fix only release:
    * drop all bug fix patches.
    * refresh patches with official SHA1 git commits from RHEL6
      upstream branch:
      - drop_support_for_drbd_and_smb.patch
    * Addresses the follwing issues:
      from 3.0.12 release:
    Resolves: rhbz#582754, rhbz#582753, rhbz#585217, rhbz#583789
    * Rebase:
    Resolves: rhbz#582353
  - Stop build on ppc and ppc64.
    Resolves: rhbz#590997
  - Switch to file based Requires.
    Also address several other problems related to missing runtime
    components in different agents.
    With the current Requires: set, we guarantee all basic functionalities
    out of the box for lvm/fs/clusterfs/netfs/networking.
    Resolves: rhbz#584800
  - New pacemaker agents upstream release
    * Patched build process to correctly generate ldirectord man page
    + High: pgsql: properly implement pghost parameter
    + High: RA: mysql: fix syntax error
    + High: SAPInstance RA: do not rely on op target rc when monitoring clones (lf#2371)
    + High: set the HA_RSCTMP directory to /var/run/resource-agents (lf#2378)
    + High: RA: vmware: fix set_environment() invocation (LF 2342)
    + High: RA: vmware: update to version 0.2
    + Medium: IPaddr/IPaddr2: add a description of the assumption in meta-data
    + Medium: IPaddr: return the correct code if interface delete failed
    + Medium: nfsserver: rpc.statd as the notify cmd does not work with -v (thanks to Carl Lewis)
    + Medium: oracle: reduce output from sqlplus to the last line for queries (bnc#567815)
    + Medium: pgsql: implement "config" parameter
    + Medium: RA: iSCSITarget: follow changed IET access policy
    + Medium: Filesystem: prefer /proc/mounts to /etc/mtab for non-bind mounts (lf#2388)
    + Medium: IPaddr2: don't bring the interface down on stop (thanks to Lars Ellenberg)
    + Medium: IPsrcaddr: modify the interface route (lf#2367)
    + Medium: ldirectord: Allow multiple email addresses (LF 2168)
    + Medium: ldirectord: fix setting defaults for configfile and ldirectord (lf#2328)
    + Medium: meta-data: improve timeouts in most resource agents
    + Medium: nfsserver: use default values (lf#2321)
    + Medium: ocf-shellfuncs: don't log but print to stderr if connected to a terminal
    + Medium: ocf-shellfuncs: don't output to stderr if using syslog
    + Medium: oracle/oralsnr: improve exit codes if the environment isn't valid
    + Medium: RA: iSCSILogicalUnit: fix monitor for STGT
    + Medium: RA: make sure that OCF_RESKEY_CRM_meta_interval is always defined (LF 2284)
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: VirtualDomain: bail out early if config file can't be read during probe (Novell 593988)
    + Medium: RA: VirtualDomain: fix incorrect use of __OCF_ACTION
    + Medium: RA: VirtualDomain: improve error messages
    + Medium: RA: VirtualDomain: spin on define until we definitely have a domain name
    + Medium: Route: add route table parameter (lf#2335)
    + Medium: sfex: don't use pid file (lf#2363,bnc#585416)
    + Medium: sfex: exit with success on stop if sfex has never been started (bnc#585416)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-2
changelog:
  - Drop Requires on xfsprogs since package moved to another channel
    Resolves: rhbz#593433
  - Fix HALVM: lvm agent incorrectly reports vg is in volume_list
    (halvm_lvm_agent_incorrectly_reports_vg_in_volume_list.patch)
    Resolves: rhvz#593108


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.12-4
changelog:
  - Add missing man pages
    (Add Source2: ocf-tester.8 and Source3: sfex_init.8)
    Resolves: rhbz#594332


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-5
changelog:
  - Fix incorrect default for VM.sh agent
    (resolve_incorrect_default_for_vm_agent.patch)
    Resolves: rhbz#599643


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-6
changelog:
  - Add missing documentation for resource agents
    (add_missing_resource_docs.patch)
  - Clean up recursion in scheman output and documentation
    (clean_up_recursion_and_documentation.patch)
    Resolves: rhbz#606470


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-7
changelog:
  - Make vm.sh honor start and stop timeouts
    (Make_vm.sh_use_stop_start_timeouts.patch)
    Resolves: rhbz#606754


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-8
changelog:
  - Make fs-lib resolve links before checking for block devices
    (fix_incorrect_link_resolution_in_fs_lib.patch)
    Resolves: rhbz#609579


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-9
changelog:
  - Add NFSv4 server support
    (add_nfsv4_support.patch)
    (install_nfsv4_agent.patch)
    Resolves: rhbz#595547
  - Fix migration mapping behavior
    (fix_migration_mapping_behavior.patch)
    Resolves: rhbz#596918


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-10
changelog:
  - Fix changelog for 3.0.12-9 date
  - Add RHEVM status program
    (add_rhevm_status_program.patch)
    Resolves: rhbz#609497


author: Marek Grac <mgrac@redhat.com> - 3.0.12-12
changelog:
  - postgres RA will fail to stop gracefully if there 
    is active client connected
    (sigquit_if_sigterm_was_not_fast_enough.patch)
    Resolves: rhbz#612165
  - new RA for tomcat6
    (resource_agent_tomcat-6.patch)
    (tomcat-6_change_build_system.patch)
    Resolves: rhbz#593721


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-13
changelog:
  - Allow other values for "yes" in fs-lib when unmounting
    file systems
    (fs-lib_allow_other_values_for_yes.patch)
    Resolves: rhbz#614421


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-14
changelog:
  - resource-agents: Drop tomcat-5 from build
    (drop_tomcat_5_from_build.patch)
    Resolves: rhbz#593721


author: Marek Grac <mgrac@redhat.com> - 3.0.12-15
changelog:
  - postgresql RA does not work correctly with netmask
    (psql_does_not_work_correctly_with_netmask.patch)
    Resolves: rhbz#614457


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-16
changelog:
  - resource-agents: fix utility to obtain data from ccs_tool
    (fix_utility_to_obtain_data_from_ccs_tool.patch)
    Resolves: rhbz#631943


author: Marek Grac <mgrac@redhat.com> - 3.0.12-17
changelog:
  - fix resource agent for named
    (resource-agents-fix-resource-agent-for-named.patch)
    Resolves: rhbz#648897


author: Marek Grac <mgrac@redhat.com> - 3.0.12-18
changelog:
  - Disable updates to static routes by RHCS IP tooling
    (resource-agents-Add-option-disable_rdisc-to-ip.sh.patch)
    Resolves: rhbz#621538


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-19
changelog:
  - resource-agents: Add multi-instance Oracle database agents
    (add_multi_instance_oracle_database_agents.patch)
    Resolves: rhbz#629275
  - resource-agents: Stop using '-' as 1st char of log messages
    (stop_using_as_1st_char_of_log_messages.patch)
    Resolves: rhbz#633856
  - resource-agents: Use literal quotes for tr calls
    (use_literal_quotes_for_tr_calls.patch)
    Resolves: rhbz#639252
  - resource-agents: Fix migrateuriopt setting
    (fix_migrateuriopt_setting.patch)
    Resolves: rhbz#660337
  - resource-agents: Support convalesce w/ central_processing
    (support_convalesce_w_central_processing.patch)
    rgmanager: Add failure tolerances to resources.rng
    (add_failure_tolerances_to_resources_rng.patch)
    Resolves: rhbz#674710


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-20
changelog:
  - resource-agents: fs-lib: fix do_monitor device mapping
    (fs_lib_fix_do_monitor_device_mapping.patch)
    Resolves: rhbz#669832


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-21
changelog:
  - Mirror dev failure in HA LVM can cause service failur
    (fix_bug_683213_mirror_dev_failure_in_ha_lvm_can_cause_service_failure.patch)
    Resolves: rhbz#683213


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12.1-1
changelog:
  - Rebase package on top of new upstream:
    resource-agents: Improve LD_LIBRARY_PATH handling by SAP*
    resource-agents: Add resource type to logging
    oracledb.sh resource script should attempt a clean shutdown first
    resource-agent does not remove nfs service temp dirs when using nfslock=1
    Listen line in generated httpd.conf incorrect
    Include rhev-check upstream
  - spec file update:
    * drop all patches
    * resync with upstream spec file. See top section for local deltas
    Resolves: rhbz#707127, rhbz#705763, rhbz#667217
  - Move rgmanager S/Lang from resource-agents to rgmanager:
    * Add versioned Conflicts on rgmanager to avoid file conflicts
    Resolves: rhbz#693518


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-1
changelog:
  - Rebase package on top of new upstream
    * ship xsl and rng files required to build relaxng schema
    * drop local copy of sfex_init.8
    * drop bz711852-Fix-ASEHAagent-to-allow-for-multiple-ASEHA-agents-on.patch
      included upstream
  - spec file update:
    add %post to generate new relaxng schema
    Resolves: rhbz#707127


author: Chris Feist <cfeist@redhat.com> - 3.9.2-2
changelog:
  - Postgres-8 resource agent now properly detects if postgresql was started
  - fs.sh resource agent now returns the proper response code when a device
    does not yet exist.
  - Resolves: rhbz#709400 rhbz#694816


author: Chris Feist <cfeist@redhat.com> - 3.9.2-3
changelog:
  - Main rgmanager resource agents now use proper return codes for use with
    pacemaker.
  - NFS mounts now unmount faster when the network is lost.
  - Resolves: rhbz#678497 rhbz#727643


author: Chris Feist <cfeist@redhat.com> - 3.9.2-4
changelog:
  - Create a link for the modified dtd for rgmanager
  - Fix ocf-tester so rgmanager agents requiring bash don't cause syntax errors
  - Resolves: rhbz#727643


author: Chris Feist <cfeist@redhat.com> - 3.9.2-9
changelog:
  - More SAPDatabase updates to fix SAP workloads
  - Allow rgmanager SAP resource agent to manage SAP Webdispatcher & TREX
  - Resolves: rhbz#726500 rhbz#746996


author: Chris Feist <cfeist@redhat.com> - 3.9.2-10
changelog:
  - Fix to prevent /dev/shm being filled up by ocf_log debug messages
  - NFS client resource are now recovered properly when they are missing in
    /var/lib/nfs/etab
  - Resolves: rhbz#797922 rhbz#749713


author: Chris Feist <cfeist@redhat.com> - 3.9.2-11
changelog:
  - In LVM HA agent, remove missing PVs before attempting to remove the tag
  - Rgmanager now properly detects when clvmd is not running when using HA LVM
  - vm.sh now supports a 'tunnelled' option
  - Resource agent script now have common directory set properly
  - Fixed apache resource agent configuration with IPv6
  - fs-lib.sh now will now properly work with all return codes of mount
  - netfs now allows you to have the same NFS export mounted in different locations
  - The timeout in rhev-check has been increased to 90 seconds
  - Resolves: rhbz#772773 rhbz#729481 rhbz#712174 rhbz#784357 rhbz#742859 rhbz#728086 rhbz#799998 rhbz#727546


author: Chris Feist <cfeist@redhat.com> - 3.9.2-12
changelog:
  - Fix for LVM HA agent for service relocation after leg failure (we now
    properly remove tag).
  - Resolves: rhbz#772773


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-13
changelog:
  - Add nfsrestart option to fs and clustefs agents as last resource to umount the filesystem
  - Resolves: rhbz#822053


author: Chris Feist <cfeist@redhat.com> - 3.9.2-14
changelog:
  - Fixed issue causing fs.sh to fail when a device is still mounted
  - Fixed random servie failures when starting multiple HA LVM services
  - Tomcat resource now uses the proper defaults
  - The pacemaker SAPInstance and SAPDatabase resources were updated to their
    latest version
  - Updated lvm resource agent to not produce errors when used with pacemaker
  - oracledb.sh script now properly checks the status of the Oracle database
  - HA-LVM now supports RAID logical volumes
  - ip.sh now properly assignes the ip address to the correct interface on
    hosts with multiple interfaces on the same network
  - Stopping a filesystem when a device doesn't exist no longer results in
    failure
  - Log output from the 'status' action from netfs is now properly logged
  - In HA LVM clusters using tags, changing the lvm.conf file is now possible
  - Using rg_test with HA LVM resources no longer results in a
    "too many arguments" error 
  - Resolves: rhbz#728365 rhbz#714156 rhbz#853249 rhbz#843049 rhbz#817550 rhbz#729812 rhbz#839181 rhbz#824153 rhbz#822244 rhbz#860328 rhbz#847335 rhbz#834293


author: Chris Feist <cfeist@redhat.com> - 3.9.2-15
changelog:
  - Fixes issue with rgmanager not recognizing a mounted cifs share due to
    trailing slashes
  - Resolves: rhbz#848642


author: Chris Feist <cfeist@redhat.com> - 3.9.2-16
changelog:
  - Add support for 'volume group per service HA-LVM support for RAID logical
    volumes'
  - Resolves: rhbz#824153


author: Chris Feist <cfeist@redhat.com> - 3.9.2-17
changelog:
  - HA LVM is now able to properly shutdown when device failures cause LVs
    to go missing which allows the service to migrate to another machine
  - Resolves: rhbz#860981


author: Chris Feist <cfeist@redhat.com> - 3.9.2-19
changelog:
  - Better error messages for the script resource have been added to aid
    debugging
  - Resolves: rhbz#773478


author: Chris Feist <cfeist@redhat.com> - 3.9.2-20
changelog:
  - Update the rgmanager SAPInstance agent so resource limits configured in
    /usr/sap/services are properly applied.
  - Resolves: rhbz#869695


author: Chris Feist <cfeist@redhat.com> - 3.9.2-21
changelog:
  - Fixed missing '$' in lvm_by_vg.sh script
  - Retry VG shutdown to cope with udev collisions
  - Resolves: rhbz#729812


author: David Vossel <dvossel@redhat.com> - 3.9.2-25
changelog:
  - fast filesystem mounts
  - properly handle NFS v4 mounts
  - fix uppercase ipv6 addresses
  - named transfer source options
  - fix restart postgres
  - fix honor self fence option
  - fix mount log level
  - fix wrong selinux context for nfs directory

    Resolves: rhbz#919231
    Resolves: rhbz#851188
    Resolves: rhbz#895075
    Resolves: rhbz#711586
    Resolves: rhbz#871659
    Resolves: rhbz#908457
    Resolves: rhbz#948730
    Resolves: rhbz#959520


author: David Vossel <dvossel@redhat.com> - 3.9.2-31
changelog:
  - Fixes lvm agent unncessarily removing PVs/LVs when some
    PVs in VG fail.

    Resolves: rhbz#884326


author: David Vossel <dvossel@redhat.com> - 3.9.2-35
changelog:
  - Fixes invalid return statement in LVM retry clvmd activation
  - Adds ability to disable findmnt to avoid autofs complications
    for fs-util based rgmanager agents.

    Resolves: rhbz#974941
    Resolves: rhbz#989284


author: David Vossel <dvossel@redhat.com> - 3.9.2-37
changelog:
  - Fixes lvm metadata corruption caused when activating by lv
    using tags.

    Resolves: rhbz#1009772


author: David Vossel <dvossel@redhat.com> - 3.9.2-38
changelog:
  - Removes usage of fuser -kvm from fs-lib.sh based agents.
    This resolves issue with fuser blocking netfs mounts.
  - tomcat-6.sh, Do not fail on stop if config validation fails.
  - tomcat-6.sh, Set tomcat usr correctly.

    Resolves: rhbz#981717 
    Resolves: rhbz#983273
    Resolves: rhbz#1014298


author: David Vossel <dvossel@redhat.com> - 3.9.2-39
changelog:
  - Fixes issue with mysql agent not being able to set transient
    attributes on local node correctly.

    Resolves: rhbz#989284


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-40.2
changelog:
  - Fix netnfs unmount self_fence integration in netfs.sh
  - Ship send_ua helper binary to allow IPaddr2 to manage IPv6 addresses

    Resolves: rhbz#1027410
    Resolves: rhbz#1027412


author: David Vossel <dvossel@redhat.com> - 3.9.2-41
changelog:
  - Add no_unmount functionality back into netfs.sh agent
  - Use crm_node instead of uname -n when referencing cluster nodes.
  - Adds Delay agent back into package.
  - Drops nginx rsyslog mysql-proxy tomcat and slapd agents.

    Resolves: rhbz#993329
    Resolves: rhbz#1023340
    Resolves: rhbz#1028421
    Resolves: rhbz#1022793


author: David Vossel <dvossel@redhat.com> - 3.9.2-42
changelog:
  - High: fs-lib.sh: Fixes failure to unmount local fs
    when process runs with cwd inside fs mount.

    Resolves: rhbz#1051115


author: David Vossel <dvossel@redhat.com> - 3.9.2-44
changelog:
  - New 'httpd' option for rgmanager apache.sh agent that allows
    custom httpd binary path to be set.
  - Fixes issue with pending sm-notify processes preventing
    nfs-server instances from stopping.
  - Fixes issue reported by coverity. 
  - Fixes syntax error in some log error messages in the LVM agent
  - Optimize fs-lib based agent's monitor operation
  - Allow monitoring of kvm based virtual machines using the
    VirtualDomain agent without requiring libvirtd.
  - Allows named to run as user other than root.

    Resolves: rhbz#952132
    Resolves: rhbz#974239
    Resolves: rhbz#999537
    Resolves: rhbz#1022277
    Resolves: rhbz#1023099
    Resolves: rhbz#1054327
    Resolves: rhbz#1067023


author: David Vossel <dvossel@redhat.com> - 3.9.2-46
changelog:
  - Updates the ocf:heartbeat:tomcat agent so it can be used
    in rhel6 with Pacemaker.

    Resolves: rhbz#1022792


author: David Vossel <dvossel@redhat.com> - 3.9.2-47
changelog:
  - Allow vm.sh to monitor kvm domains without requiring libvirtd
  - Adds 'no_kill' option to vm.sh to prevent force killing vm
    during stop operation after timeout expires.

    Resolves: rhbz#853698
    Resolves: rhbz#1079039


author: David Vossel <dvossel@redhat.com> - 3.9.2-48
changelog:
  - Configurable startup_wait timeout for rgmanager's 
    postgres-8.sh resource-agent
  - Allow non rhel builds to included unsupported agents.
  - Add bind-mount.sh rgmanager resource-agent.
  - Add 'statdport' option to nfsserver resource.

    Resolves: rhbz#1035380
    Resolves: rhbz#1069621
    Resolves: rhbz#1094789
    Resolves: rhbz#918315


author: David Vossel <dvossel@redhat.com> - 3.9.5-1
changelog:
  - Package cleanup. This change is a no-op. The heartbeat
    agents were updated to the 3.9.5 upstream release in this
    package months ago. The release number is now being
    incremented to reflect this.

    Resolves: rhbz#993431


author: David Vossel <dvossel@redhat.com> - 3.9.5-3
changelog:
  - Fix usage of findmnt in fs-lib.sh based rgmanager agents.
  - When executing force kill of processes using a mountpoint,
    take into account those processes accessing shared memory.
  - Add force_unount=safe option to avoid blocking Filesystem
    agent during the stop operation.
  - Do not fail during stop if oracle listener is already down. 
  - Correctly detect oracledb and orainstanch.sh shutdown.
  - Remove unused patches left over from before patches were
    consolidated into the new source files.

    Resolves: rhbz#1038474
    Resolves: rhbz#1089004
    Resolves: rhbz#1095943
    Resolves: rhbz#1047999
    Resolves: rhbz#960186
    Resolves: rhbz#993431


author: David Vossel <dvossel@redhat.com> - 3.9.5-5
changelog:
  - Add support for pacemaker db2 agent
  - Fix syntax error in nfsserver.sh
  - Updates pacemaker nfs server agents. Adds support for
    nfsnotify agent.

    Resolves: rhbz#1059981
    Resolves: rhbz#1091102
    Resolves: rhbz#974239


author: David Vossel <dvossel@redhat.com> - 3.9.5-7
changelog:
  - Update force_unmount=safe option so it does not process
    duplicate process ids.

    Resolves: rhbz#1095943


author: David Vossel <dvossel@redhat.com> - 3.9.5-8
changelog:
  - Revert accidental modification of exportfs's
    unlock_on_stop option.
  - Add on/off as valid value for ip.sh monitor_link

    Resolves: rhbz#1091102
    Resolves: rhbz#1039119


author: David Vossel <dvossel@redhat.com> - 3.9.5-9
changelog:
  - When signalling pids accessing a mount_point to exit,
    make sure to only signal each pid once.

    Resolves: rhbz#1089004


author: David Vossel <dvossel@redhat.com> - 3.9.5-11
changelog:
  - Updates required, unique, and primary fields in bind-mount.sh
    metadata

    Resolves: rhbz#1094789


author: David Vossel <dvossel@redhat.com> - 3.9.5-14
changelog:
  - For lv_by_vg, only strip tag on stop if we are owner.
  - NFS custom port config options
  - Fixes typo preventing passing "noload" or "data=..." mount options
  - Fixes undefined variable warning in fs-lib
  - Fixes mysql not stopped if data fs unavailable
  - Fixes postgres agent not detected correct user group
  - Handle nfs path ending in '/' correctly

    Resolves: rhbz#1161727
    Resolves: rhbz#1096376
    Resolves: rhbz#1096990
    Resolves: rhbz#1134960
    Resolves: rhbz#1150702
    Resolves: rhbz#1159018
    Resolves: rhbz#1173128


author: David Vossel <dvossel@redhat.com> - 3.9.5-16
changelog:
  - Fixes unreliable detection of nic device in IPaddr2
  - Fix fs-lib.sh regression in is_alive write test failure detection
  - Fix properly handle mysql when alternate user is specified.

    Resolves: rhbz#1181187
    Resolves: rhbz#1183735
    Resolves: rhbz#1183148


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Fixes rgmanager lvm agent's ability to exclusively activate
    volume groups on nodes with aliases

    Resolves: rhbz#1085109


author: Sherry Yu <syu@redhat.com> - 0.91
changelog:
  - Naming change from sap_prepare to sap-prepare
  - Detailed log output
  - In function virtrpms: for RHEV Hypervisor, recommend to check SAP Note
    1400911 for setting up host monitoring on RHEV
  - New function check_utilrpms: install utility rpms used in the sap-prepare
    script, e.g. syslinux rpm for gethostid()
  - Add one section Recommendations at the end of the log file, containing
    recommended changes that have to be carried out manually
  - Add a Recommendations section at the end of the log file, for CHECK_ONLY
    mode, that contains the recommended settings
  - Add command-line argument "-h" for Help Message
  - Move java rpms to variable JAVARPMS, as IBM JDK becomes obsolete on Oct. 2012
  - Add global variable VIRTRPMS
  - Remove [-f config] argument in usage - recommended configurations are not to
    be changed
  - In check_fqdn: keep the backup file as
    /etc/sysconfig/network.sap-prepare-<timestamp>
  - In check_security add: if SELINUX=disabled in /etc/sysconfig/selinux, give
    recommendation to set it to Permissive. If SELINUX=permissive but getenforce
    returns 1, setenforce 0. For SELINUX=enforcing, to update the config file,
    keep backup file as /etc/sysconfig/selinux.sap-prepare-<timestamp>; if
    CHECK_ONLY==1, give recommendations
  - Split check_rhn into check_rhn, check_rpms, check_ibmjdk, and check_links
  - Add a variable SAP_NOTE_RHEL6
  - Remove check_users which is not used to keep the script clean
  - Remove variable VERBOSE
  - Rename prepare_environment to check_env, to be consistent with the naming
    convention
  - Move the code of setting kernel parameters from main body to check_env
  - Add SYB_VARS
  - In check_env add the setting of kernel parameters for Sybase
  - In check_ntp ntpdate is removed as ntpd is preferred
  - Remove update_limits_conf because it's no longer needed in RHEL6


author: Sherry Yu <syu@redhat.com> - 0.92
changelog:
  - Changed the name to sapconf
  - Move kernel parameters to /etc/sysconfig/sap, other than /etc/sysctl.conf
  - Add /etc/rc.d/init.d/sapconf and S99sapconf links in /etc/rc2.d, /etc/rc3.d,
    and /etc/rc5.d
  - Removed check_utilrpms() and defined the util rpms as dependency in the rpm
    spec file
  - Removed check_ibmjdk()


author: Frank Danapfel <fdanapfe@redhat.com> - 0.93
changelog:
  - removed /etc/init.d/sapconf service, since this is now done via tuned
  - cleaned up requirements section in spec file
  - added changelog to spec file


author: Frank Danapfel <fdanapfe@redhat.com> - 0.93
changelog:
  - replaced vhostmd with vm-dump-metrics for KVM guest installs
  - re-added function to set user/process limits
  - changed check_ntp to only check if ntpd is running


author: Nils Philippsen <nils@redhat.com> - 0.93-1
changelog:
  - remove obsolete tuned patch
  - fix changelog dates
  - require specific tuned version, prep for upcoming RHEL versions
  - clean up script header
  - don't mess around with SELinux settings, just report
  - use bzipped tarball


author: Nils Philippsen <nils@redhat.com> - 0.95-1
changelog:
  - ignore whitespace and empty lines when checking /etc/hosts
  - use mktemp to create temporary host file
  - add release numbers to changelog entries


author: Jan Grulich <jgrulich@redhat.com> - 0.98-1
changelog:
  - add Man-Page
  - correctly detect VMware virtual guest
  - do not write to /etc/security/limits.conf directly
  - correctly edit /etc/hosts


author: Jan Grulich <jgrulich@redhat.com> - 0.98-5
changelog:
  - add information about KVM to manpage 
    resolves: bz#1123917
  - set correct vm.max_map_count value
    resolves: bz#1168422
  - do not wait for input from keyboard and read from file instead
    resolves: bz#1173861
  - add information about sapconf version
    resolves: bz#1174321


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-23
changelog:
  - Add cmirrord policy
  - Fixes for accountsd policy
  - Fixes for boinc policy
  - Allow cups-pdf to set attributes on fonts cache directory
  - Allow radiusd to setrlimit
  - Allow nscd sys_ptrace capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-24
changelog:
  - Add support for /dev/vhost-net
  - Allow psad to read files in /usr
  - Allow systat to use nscd socket
  - Fixes for boinc policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-25
changelog:
  - Fixes for cmirrord policy
  - Dontaudit xauth to list inotifyfs filesystem.
  - Allow xserver to translate contexts.
  - Allow kdumpgui domain sys_admin capability
  - Allow vpnc to relabelfrom tun_socket
  - Allow prelink_cron_system_t to signal
  - Fixes for gitolite
  - Allow virt domain to read symbolic links in device directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-26
changelog:
  - Allow krb5kdc to write krb5kdc_principal_t file
  - Allow hald to send generic signal to dhcp client
  - Fix dev_rw_vhost interface
  - Add /var/run/abrt.socket label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-27
changelog:
  - Allow ftpd ipc_lock capability
  - Allow audisp-remote to getcap and setcap
  - Allow iscsid to read and write raw memory devices
  - Fixes for bitlbee policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-30
changelog:
  - Allow sysadm to run ncftool
  - Fixes for cobbler policy
  - Allow Network Manager to transition to ipsec_mgmt domain
  - Add label for /usr/libexec/nm-openswan-service
  - Add label for /dev


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-31
changelog:
  - Remove daemons dontaudit to search all dirs 
  - Add support for epylog
  - All all domains to read lib files
  - Allow denyhosts to send syslog messages
  - Allow mysql-safe setrlimit
  - Allow rpm to execute rpm_tmp_t
  - Allow dmesg to appen abrt_var_cache files
  - Fixed label for abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-32
changelog:
  - Allow sectool to connect to users over unix stream socket
  - Add label for /var/spool/abrt-upload
  - Add audio_home_t type for homedir/Music files
  - Allow aiccu to read network config files
  - Allow qpidd to setsched
  - Allow virt domains to manage svirt_image_t fifo files
  - Fixes for NM-openswan
  - Fixes for admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-36
changelog:
  - Allow netutils to read and write USB monitor devices
  - Fix label for /rhev
  - Add user_setrlimit boolean
  - Allow initrc to manage virt lib files
  - Add support for ebtables
  - Add label for /bin/mksh
  - Dontaudit aiccu sys_tty_config capability
  - Add httpd_setrlimit boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-37
changelog:
  - Redefine hi_reserved_port_t to include ports from 512 to 599 
  - Add label for /sbin/sushell
  - Fixes for munin plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-38
changelog:
  - Allow xdm_t to manage gnome homedir content
  - Allow s-c-firewall to read and write virtual memory sysctls
  - Fixes for logwatch policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-39
changelog:
  - Allow munin_system_plugin to read files in /usr
  - Do not audit insmod attempts to write virt daemon unnamed pipes
  - Allow corosync to read ricci lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-40
changelog:
  - Fixes for puppetmaster
  - Fix label for kadmin init script
  - Fixes for logwatch-mail policy
  - Allow arpwatch to request the kernel to load modules
  - Allow cron jobs to run with context of user that started them


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-41
changelog:
  - Allow logwatch_mail to read read the networking state information.
  - Add label for /usr/bin/dosbox
  - Allow systat sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-42
changelog:
  - Allow kdump to read information from the debugging filesystem
  - Update boinc policy
  - Fixes for logwatch-mail policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-43
changelog:
  - Allow ncftool to run brctl
  - Fixes for ricci-modclusterd policy
  - Allow uucpd to execute ssh client
  - Add label for dayplanner
  - Allow sandbox_xserver execstack


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-45
changelog:
  - Fixes for cgroup policy
  - Fixes for ncftool policy
  - Add ncftool_read_user_content boolean
  - Fix label for boinc init script
  - Fix label for fence_tool
  - Allow vhostmd to write virt content
  - Allow ricci domtrans ot shutdown


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-47
changelog:
  - Fixes for boinc-project policy
  - Allow swat to read nmbd pid file
  - Allow fail2ban to read BIND log files
  - Fix cert handling from Dan 
  - Remove transition from unconfined to ncftool domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-48
changelog:
  - Fixes for shorewall policy
  - Allow sssd chown capability
  - Fix label for /usr/bin/mutter
  - Label dead.letter as mail_home_t
  - Allow pcscd to read  hardware state information 
  - Fixes for ulogd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-49
changelog:
  - Add label for /var/cache/rpcbind directory
  - Add chrome_role for xguest
  - Fix amavis_read_spool_files interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-55
changelog:
  - Add cluster_var_lib_t type and label for /var/lib/cluster
  - Add labeling for /root/.debug
  - Remove permissive from cmirrord domain
  - Dontaudit cmirrord_t sys_tty_config capability
  - Allow virtd to read from processes up to its clearance
  - Allow dovecot-deliver to create tmp files
  - Allow tor to send signals to itself
  - Handle /var/db/sudo
  - Remove allow_corosync_rw_tmpfs boolean
  Resolves: #631564


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-56
changelog:
  - Allow smartd to read usr files
  - Allow devicekit-power transition to dhcpc
  - Add label for /etc/timezone
  - Remove transition from unconfined_t to iptables_t
  - Allow domains with different mcs levels to send each other signals as long as they are not identified as mcsconstrainproc
  Resolves: #634945
  - Allow nrpe to send signal and sigkill to the plugins
  - Fix up xguest to allow it to read hwdata and gconf_etc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-57
changelog:
  - Allow system_mail_t to append ~/dead.letter
  - Allow mount to communicate with gfs_controld
  Resolves: #636683
  - Dontaudit hal leaks in setfiles
  - gpm needs to use the user terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-58
changelog:
  - Fix httpd_setrlimit boolean to allow sys_resource capability
  - Fix label for ip6tables.save
  - Allow ssh_t to exec ssh_exec_t
  - Dontaudit init leaks
  Resolves: #639083


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-59
changelog:
  - Allow cdrecord setrlimiit
  Resolves: #615731
  - Define debugfs_t as mountpoint
  Resolves: #646856
  - Fix fenced_can_network_connect boolean description
  Resolves: #650136
  - Add label for /var/run/faillock
  - Add dirsrv and dirsrv-admin policy
  Resolves: #655206
  - Fixes for cobbler policy
  - Allow certmonger to manage dirsrv config
  Resolves: #658591


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-60
changelog:
  - Fixes for certmonger
  - Backport passenger policy
  - Allow run_init to read console_device
  Resolves: #657568
  - Add label for /var/lib/dkim-milter
  - Fixes for munin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-61
changelog:
  - Fixes for passenger policy
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  Resolves: #663054


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-64
changelog:
  - Add namespace policy
  - Allow udev to stream connect to init
  Resolves: #667370
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-69
changelog:
  - Make Spacewalk to work with selinux-policy
  Resolves: #673112
  - Fix /root/.ssh labeling
  Resolves: #637109	
  - Fix for the spec file


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-71
changelog:
  - Allow cmirrord to create physical disk devices in /dev
  - Allow cluster domains to use the system bus and send each other dbus messages
  - Add label for /dev/tgt


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-74
changelog:
  - Add virt_home_ type files located in ~/.libvirt directory
  - virt creates monitor sockets in the users home dir
  - Allow lvm setfscreate
  Resolves: #680388
  - Make lsusb and lsblk working on MLS
  Resolves: #680426


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-75
changelog:
  - Allow svirt to manage sock_file in ~/.libvirt directory
  - Allow sysamd to run udev in udev_t domain
  - Remove capability from svirt
  - Add lvm_exec_t label for kpartx


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-76
changelog:
  - Fixes for ssh_keygen policy
  - Allow sysadm_t to run ssh-keygen in ssh_keygen_t domain
  - Backport spice vdagent policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-79
changelog:
  - Fixes for sandbox/seunshare policy 
  Resolves:#684919
  - Allow ssh_keygen_t dac_override
  - Add matahari policy 
  - Add label for /etc/securetty 
  - Fixes for pirahna-pulse policy
  - Fixes for radius, samba, dirsrv, kerberos policies 
  - Allow console login on MLS
  - Fix file context to show several labels as SystemHigh
  - Add port definition for dogtag, matahari, movaz ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-80
changelog:
  - Add support for a new cluster service - foghorn
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - Add support for vdsm
  - Allow syslogd setrlimit, sys_nice
  Resolves: #689431
  - ipsec_mgmt_t wants to cause ipsec_t to dump core, needs to be allowed


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-81
changelog:
  - Add allow_sysadm_manage_security boolean
  - Add label for /dev/dlm.*
  - Allow auditadm_screen_t and secadm_screen_t dac_override capability
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Fixes for nslcd policy
  Resolves: #693368
  - Allow qpidd to manage pid and lib matahari files
  - Allow rgmanager to send the kill signal to all users


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-83
changelog:
  - Add label for matahari-broker.pid file
  - Allow foghor to read snmp lib files
  - Make sysadm security admin
  - Fix ssh_sysadm_login boolean
  Resolves: #694551


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-87
changelog:
  - Allow $1_sudo_t to read default SELinux context
  - Allow tgtd to create a sock file
  - Allow initrc_t to manage faillock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-95
changelog:
  - Allow secadm to manage selinux config files
  - Allow apache to use jboss management port
  - Add fenced_can_ssh boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-97
changelog:
  - Allow postfix-pickup to write files and directories regardless of their MCS category set.
  - Make xinetd trusted to write outbound packets regardless of the network's or node's MLS range
  Resolves: #705772


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-104
changelog:
  - Allow puppet to Check access to the passwd executable
  - Add label for /var/www/html/logs directory
  - Add label for /var/lib/squeezeboxserver directory
  - Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-107
changelog:
  - Make new domains as unconfined
  - Add abrt_handle_event_t domain for ABRT event script
  - Add selinux_mysql man page
  - Fix httpd selinux man page
  - Fix interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-108
changelog:
  - Add squid man page
  - Add git man page
  - Make puppet working with passenger
  - Allow procmail to execute hostname command


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-110
changelog:
  - Add label for passwd.adjunct
  - Allow pulse to execute  /usr/sbin/fos
  - Fix labeling for passenger
  - Add selinux policy support for IP-in-SSH tunnelling
  - Allow sulogin to write /dev/pts/0 in single user mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-111
changelog:
  - Add git_cgit_read_gitosis_content boolean
  - Add support for cma port
  - Add virt_use_sanlock boolean and make sanlock working together libvirt
  - Make passenger and puppet working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-112
changelog:
  - Fix description of allow_* booleans
  - Allow sanlock to manage libvirt lib files
  - Fix bug in lsassd policy
  - Add label for /var/run/luci
  - move port 18001 from http_port_t to jboss_management_port_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-114
changelog:
  - Fix httpd_selinux man page
  - Add corenet_packet() interface
  - Add support for Clustered Samba commands


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-115
changelog:
  - Add unlabelednet policy module
  - Add chrome role for xguest
  - Fix for vdagent policy
  - Add fix to allow confined apps to execmod on chrome


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-118
changelog:
  - Fix label for /root/.hushlogin
  - Allow domain to send/recv unlabeled packet
  - Allow sshd to relabel tun socket
  - Allow puppetmasterd to relabel puppet config files
  - Add label for lvs.conf
  - Fix labeling for matahari-netd agents


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-123
changelog:
  - MLS Overrides needed for a user running at a level to be able to use sudo and talk to sssd
  - Allow initrc_t to manage dirsrv pid files with disabled unconfined module
  - Fixed for deltacloudd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-125
changelog:
  - Change the postinstall to load_policy separately from the semodule command
  - This will put the proper files in place even if the kernel rejects the policy.
  - Allow login programs to connect to the pki_ca_port
  - Allow vhostmd to read /dev/rand and signal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-128
changelog:
  - Add cronjob_role for sysadm
  - Change label for /var/spool/cron
  - Add interface to allow exec of mongod


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-131
changelog:
  - Fixes for rhev policy
  - Make ssh-keygen as unconfined domain
  - Add sanlock_use_nfs boolean
  - Add ssh_dontaudit_search_user_home_dir interface
  - namespace_init and MLS fix


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-132
changelog:
  - Fixes for nagios policy
  - Add a new interface for libra
  - Fix spec file to be testing SELinux status correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-134
changelog:
  - Backport ABRT policy
  - Backport matahari policy
  - Add interfaces for libra
  - Add jboss_dubeg port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-135
changelog:
  - Add fixes for qpidd policy, support for tmpfs_t
  Resolves:#769352
  - Add fixes for mcelog policy, for new location of pid,sock files
  - Make sendmail and postfix working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-136
changelog:
  - backport mozilla_plugin policy
  - backport sandbox policy to support nacl
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow system cronjobs to read kernel network state
  - Allow corosync to read and write to qpidd shared memory
  - More fixes for qpidd
  Resolves:#769352
  - Add policy for quota-nld


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-137
changelog:
  - Remove nfs_* booleans because nfs runs in kernel_t domain
  Resolves:#760405
  - Add httpd_manage_ipa boolean
  - Dontaudit sys_ptrace for matahari-netd
  - Allow vhostmd to getattr on virtd
  - Allow snmpd to connect to the ricci_modcluster
  - qpidd should be allowed to connect to the amqp port


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-138
changelog:
  - Add new policy for cfengine
  - Add new policy for sge gridengine jobs
  - Add support for nagios eventhandlers
  - Make system cron jobs run in the proper domain
  - Add policy to support privsep ssh process running in user domain
  - Add fixes relates to nss/FIPS
  - Add new rsync_use_* booleans
  - Allow qpidd to connect to matahari ports
  - Allow sysadm_u to read system_r in MLS
  - Remove razor labeling because we treat razor with spam policy
  - Add support for matahari-qmf-sysconfig-consoled, clean up matahari policy
  - Fixes for interfaces
  Resolves:#791294
  Resolves:#796351


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-139
changelog:
  - Allow nfsd_t to getattr on all fs
  Resolves:#738628
  - Make mailx working together with cron without unconfined module
  - Allow sssd sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-140
changelog:
  - Add additional fixes for nagios handlers
  Resolves:#749311
  - Add 7600 and 4447 as jboss_management ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-141
changelog:
  - Add man pages for apps, services
  - Allow nagios to use user terminals
  Resolves:#782325
  - Add support for unconfined certmonger scripts
  - Add support for matahari-qmf-rpcd service
  - Allow chsh to use PAM
  - Allow rpc.statd to execute sm-notify which has bin_t label
  - Make sure files which are created by /usr/bin/R get proper label in home directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-142
changelog:
  - Fixes for man pages
  - Allow rpcd to execute sm-notify
  Resolves:#802247
  - Add support for matahari-qmf-rpcd
  - Add support matahari vios-proxy-* apps
  - Allow quota-check to create files on nonxattr filesystems
  - Add support for ~/Maildir
  - Allow unconfined dyntransition
  - Fixes for certmonger_unconfined and certmonger
  - Fixes for certmonger policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-144
changelog:
  - Fixes for cfengine policy
    * changed labeling for /var/cfengine/outputs from var_log to cfengine_var_log_t
    * re-arranged policy to use template and cfengine_domain 
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Bacport libvirt-qmf policy for Fedora
  - Remove labeling for postmaster.pid file 
  - Fix for virtual network which looses network connection
  - Add man pages for SELinux users
  - cgconfig needs to use getpw calls
  - Allow lvm and fsadm to write sysfs_t
  - Allow rpc.mounted to list user tmp files
  - Fix permissivedomains declarations
  Resolves:#806220
  - Fix spec file to instal minimum policy properly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-146
changelog:
  - Add sysadm_secadm policy module to separate in secadm_r, sysadm_r
  Resolves:#787413
  - Fixes for libvirt-qmf
  - Add label for package-cleanup 
  - Add support for zfs
  - Make cfengine domains as unconfined
  Resolves:#753184
  - Allow sshd_t to dyntransition to sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-147
changelog:
  - Fix man pages for SELinux users
  - Allow all user domains to setexec
  - Allow cobblerd to get SELinux status and booleans
  - Add labeling for /etc/zipl.conf
  Resolves:#813803
  - Allow fenced to read SNMP lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-149
changelog:
  - Add labeling for /usr/sbin/matahari-dbus-sysconfigd
  - Add additional labeling for zarafa
  - Allow guest_t to fix labeling
  - Corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - squashfs does not support xattr in RHEL6
  Resolves:#815898
  - Remove pyzor labeling and move it to spamassassin.fc
  - Fix config.tgz


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-151
changelog:
  - Add openstack-nova, openstack-keystone, openstack-glance, openstack-quantum policies
  - Allow sysadm_t to create other crontabs
  - Allow nfsd_t to read defaul_t link files
  - Fix labeling for /var/run/heartbeat
  - Fixes for admin_template() interface to make sysadm_secadm.pp module working correctly
  - More fixes for condor policy
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Fix auth_role() interface
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-152
changelog:
  - Add label for condor_starter
  Resolves:#807682
  - Dontaudit sys_module for brctl
  - Allow winbind to send signull to smbd
  - Add jacorb port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-154
changelog:
  - Allow fenced to manage snmpd lib files
  - Allow certmonger to get attributes on init script files
  Resolves:#790967
  - Fix labeling for Firefox plugins
  Resolves:#747993
  - Add mta_signal_user_agent() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-155
changelog:
  - Allow setroubleshootd to execute rpm
  Resolves:#833053
  - Add labeling for /usr/lib/flash-plugin/libflashplayer.so


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-156
changelog:
  - Allow user to login using ssh with random MLS range
  Resolves:#837815
  - Allow virtd_t to create mtab with the proper labeling
  - Add support for check_icmp nagios plugin
  - Make chkconfig working on MLS for sysadm_t
  - Allow dovecot to manage mail_home_rw_t
  - Add support for fsav
  - Allow clamscan to use amavisd-new
  - Add support for rhnsd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-157
changelog:
  - Allow procmail to manage mail home data
  - We should only block MCS node_bind on mcsuntrustedproc
  - Fixes for amavis
  Resolves:#837815


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-159
changelog:
  - Allow munin_stats to read munin logs
  - Allow updpwd to write all MLS levels
  - Make piranha_web_t as nsswitch domain
  - Allow munin mail plugins to read exim log files
  - Backport sanlock policy from Fedora
  Resolves:#831908
  - Allos dac_override, sys_nice for sasl
  - Add labeling for /var/named/chroot/usr/lib64
  - Add support for gitolite3
  - Allow confined users to send mail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-160
changelog:
  - Add named_bind_http_port boolean
  - Add port definition for 8953/tcp
  - spice-vdagent(d)'s are going to log over to syslog
  - Fix labeling for /usr/sbin/rpc.* binaries to label them as rpcd_exec_t
  - Add sensord policy
  - Allow oddjob_mkhomedir to write on nfs share
  - Add virt_bridgehelper policy
  - Allow clamd to write/delete own pid file with clamd_var_run_t label
  - Add support for wdmd tmpfs
  - Add initrc_domain attribute 
  - Add bcfg2 policy
  - Modify ssh_chroot_rw_homedirs boolean to allow manage apache system r/w content if for /var/www as home
  - Add pacemaker policy
  - Allow snmpd to connect to corosync over unix stream socket
  - Allow crontab to read NFS
  - Add new type selinux_login_config_t for /etc/selinux/TYPE/logins directory and allow sssd to manage files in this directory
  Resolves:#843814
  - Add labeling for /opt/sartest directory
  - Add initrc_domain attribute to allow domains to work as initrc_t domain
  - heartbeat should be running as rgmanager_t instead of corosync_t
  - Add glusterd policy
  - Add l2tpd policy
  - Add numad policy
  Resolves:#801493


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-162
changelog:
  - Add pkcslotd policy
  Resolves:#851483
  - Allow cyrus-imapd init script to write cyrus data
  - Fix labeling for /dev/twa


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-166
changelog:
  - More fixes for openshift and add support for opeshift labeling instead of stickshift
  - /etc/selinux/<type>/logins should be owned by the policy package
  Resolves:#855889
  - Add labeling for /var/tmp/DNS_25      
  - Allow postfix_local_t to execute files on nfs_t
  - Add fixes for kadmind
  - Add rhnsd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-167
changelog:
  - Allow postfix_locat to search stickshift lib files
  - Dontaudit sys_ptrace cap for httpd if httpd_stickshift is on
  - Allow openshift domains change process identity
  - SELinux is reporting that openshift domains are trying to write into their proc directories
  Resolves:#855889


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-168
changelog:
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - pppd wants to read /usr/share/radiusclient-ng/dictionary
  - Add ssh_chroot_manage_apache_content and ssh_chroot_full_access booleans
  - snmp wants to also manage snmp dirs for amavisd-snmp support
  - Add labeling for virsh_fenced
  - Allow nmbd_t to crate dirs with samba_var_t labeling
  - Add clamscan_can_scan_system boolean
  - Allow all domains to getattr on prelink_exec_t
  - Add postgresql_can_rsync boolean
  - Allow pulse to domain transition to iptables
  - Allow nslcd sys_nice capability
  - Allow corosync to connect to saphostctrl ports
  - Allow passwd to read generic /tmp dirs
  - Add policy for qemu-qa
  - Add new antivirus policy module for antivirus programs
  Resolves:#838260


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-169
changelog:
  - Fix spec file to silent restorecon errors on files which do not exist
  - Fix passenger backport
  Resolves:#839831


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-172
changelog:
  - Update httpd_runstickshift boolean
  - Remove transition from sysadm_t to fsadm_t
  Resolves:#852763
  - Make vmware-host as unconfined domain
  - Allow all domains to read usr_t
  - Fix labeling for all log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-173
changelog:
  - syslogd_t now support kerberos
  Resolves:#867001
  - Fix openshift labeling for binaries
  - Allow passwd to read usr_t links/files
  - Add labeling for /var/lib/sss/mc


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-174
changelog:
  - openshift user domains wants to r/w ssh tcp sockets
  - Allow mount to relabelfrom unlabeled file systems
  - Additional fix for syslog/kerberos
  Resolves:#867001


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-175
changelog:
  - Add initial openswitch policy. Domains are unconfined
  Resolves:#845417
  - Add labeling for /usr/sbin/mcollectived
  - Allow openshift domains to read /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-177
changelog:
  - Allow dnsmasq to manage virt run files
  Resolves:#843543
  - Allow setroubleshootd to read /proc/irq
  - Backport fixes for virt_use_* booleans
  - Allow qemu-ga to use ttyS0
  - Allow dhcpc to manage dhclient-eth0.pid labeled as virt_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-178
changelog:
  - Fix labeling for OpenShift binaries
  - Add samba_portmapper boolean and labeling for /var/run/samba
  Resolves:#871816
  - Backport dspam policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-180
changelog:
  - Allow openshift domains to execute tmux
  - Allow wdmd to getattr on tmpfs_t
  Resolves:#831908
  - Add labeling for /var/nmbd/unexpected
  - Allow winbind to create samba pid dir
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes for syslogd
  - Fenced communicates with libvirt
  - Fix labeling for libflashplayer.so
  - Add labeling for /var/lib/zarafa-webapp
  - Allow dspam to read localization
  - Add labeling for Z-Push
  - Allow rpc.svcgssd to search nfsd_fs_t dirs
  - Allo cgred to read all sysctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-181
changelog:
  - Allow kdumpgui to read/write to zipl.conf
  Resolves:#877108
  - Add /proc/numactl support for confined users
  - Make proc_numa_t an MLS Trusted Object
  - Make ccs_tool and cman_tool labeled as rgmanager_exec_t
  - Fix cron_admin_role interface
  - Add support for opendkim


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-182
changelog:
  - Fix labeling for /var/named/chroot/usr/lib
  Resolves:#843732
  - Allow amavis to stream connect to snmpd
  Resolves:#839250
  - Additional fixes for log files related to logrotate
  - Allow all domains to read base etc_t file type
  - Allow logrotate to list root home directory
  - Fix labeling for /var/log/z-push
  - Allow cyrus init scriptu to manage cyrus data files
  - Dontaudit leaks of locks or generic log files to systemprocesses
  - Allow ricci-modrpm to send syslog msgs
  - Allow munin to have kill capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-184
changelog:
  - Add support for tcp/10026 port as dspam_port_t
  - Allow dspam to connect/bind to dspam_port_t
  - Add uconfined_munin_plugin_exec_t for all plugins which are not covered by munin plugins policy
  - Allow domains that can read sssd_public_t files to also list the directory
  Resolves:#881413
  - Allow programs to run in fips_mode using fips_mode boolean
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow sshd to look into the mysql home directory for authorized_keys
  - Make rsync as homemanager which allows to manage CIFS/NFS	  
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-185
changelog:
  - Apache is sending sinal to openshift_initrc_t now
  -  Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Allow winbind to manage samba_var_t sock files
  - Allow git-daemon and httpd to serve the same dir
  Resolves:#883143
  - Allow dac_override for nrpe


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-186
changelog:
  - Allow virtd to manage dnsmasq pid files
  - Allow all samba domains to create samba directory in var_t directory
  - Dontaudit attempts by openshift to read apache logs
  - Add labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-187
changelog:
  - Add missing labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432
  - Add labeling for /var/nmbd
  - apache/drupal can run clamscan on uploaded content


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-188
changelog:
  - Allow rpcd_t to read /var/run/utmp
  - Make glance domains as permissive instead of just glance_t
  - Allow kill capability for ftpd
  - Add labeling for prespawn helper script
  Resolves:#886619
  - Allow winbind to stream connect to nmbd
  - Allow transition from virt domains to bridgehelper domain
  - Add support for watchdog script from sanlock
  - Add labeling for tmp-inst
  - Fix rhev policy
  - Update virt_qemu_ga policy
  - Backport wm_domain policy
  - Backport virtd_lxc_t and make it as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-189
changelog:
  - Allow virt_qemu_ga to execute shutdown
  - sssd needs to connect to kerberos password port if a user changes his password
  - More fixes for the dspam domain
  - Allow dovecot to execute bash
  - Additional fixes for passenger
  Resolves:#886619
  - Add labeling for /var/run/checkquorum-timer


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-190
changelog:
  - Allow virtd to settattr on virt image dirs in MLS
  Resolves:#885045
  - Allow all postfix domains to connect to mysql stream
  - Call init_daemon_domain for rsync_t
  - Add labeling for /var/lib/pgsql/ssh 
  - Allow certmonger to send signal to itself
  - Allow rsyslog to read user tmp files using logging_syslog_can_read_tmp boolean
  - Add support for 1228/tcp and 1228/udp ports and allow corosync touse them
  - Allow corosync to read wdmd tmpfs
  - Allow wdmd to execute consoletype
  - Update man pages using sepolicy from Fedora
  - Fix admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-191
changelog:
  - Remove pam_selinux due to conflict
  - Add labeling for /etc/multipath - lvm_metadata_t
  Resolves:#880407
  - Add additional gitolite3 labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-192
changelog:
  - Label /usr/lib/yaboot/addnote as bin_t
  - Allow postfix_local to read/write /var/spool/postfix/active
  - Allow postfix domains to list /tmp
  - Allow wdmd to transition to kdump
  Resolves:#887793
  - Add labeling for /var/named/chroot/etc/localtime


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-193
changelog:
  - Fix ssh_sysadm_login boolean for MLS
  Resolves:#865759
  - Allow rpm_script_t to dbus communicate with certmonger_t
  - More fixes for qemu-ga to make "guest-fsfreeze-freeze" working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-194
changelog:
  - qdiskd needs to read usr_t/bin_t files
  - Allow dpsam to connect/bind to spamd ports
  - Allow munin services plugins to bind to generic node
  Resolves:#865759


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-195
changelog:
  - Make matahari domains as unconfined
  - Allow nscd to connect to nmbd
  Resolves:#901565
  - Allow setcap/getcap for syslogd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-196
changelog:
  - Backport openshfit fixes
  - Allow cgred to use notify 
  Resolves:#913673
  - Allow mount to transition to gluster 
  - Fix tuned policy to make it working with the lastet tuned package


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-197
changelog:
  - Fix /etc/dhcp labeling
  - Back port openshift fixes
  - Make dirsrv-admin server restarted from console working
  - Add ftpd_use_fusefs boolean
  Resolves:#913673
  - openshift_cron_t needs dac_override


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-198
changelog:
  - Allow dirsrv-admin script to exec apache modules
  - Add labeling for dirsrv-admin lock file
  - Add labeling for /var/lib/owncloud
  - Add labeling for /var/www/moodle
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-199
changelog:
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow dovecot-auth to execute bin_t
  - Allow mysqld-safe to execute bin_t
  - Allow procmail to manage user tmp files
  - Allow sanlock to kill svirt_t
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-203
changelog:
  - Allow dnsmasq to stream connect to quantum
  - Allow ifconfig domtrans to iptables and execute ldconfig
  Resolves:#966106
  - Make openshift_initrc_t as initrc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-204
changelog:
  - Allow iptables to read and write quantum inherited pipes
  - Allow iptables to send sigchld to quantum
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-205
changelog:
  - Remove domtrans for quantum which needs to stay in the same domain
  - Allow qemu to manage nova lib files
  - Allow hald to read svirt images
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-208
changelog:
  - Merge cluster administrative domains to cluster_t. Back ported from Fedora
  Resolves:#915151
  - Aadd additinal rules for disk plugins
  - Allow setuid/setgid caps for syslogd_t
  - Dontaudit sendmail to  write dovecote-deliver tmp files
  - Add suppport for /var/lib/openvpn
  - /var/spool/snmptt is a directory which snmdp needs to write to


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-210
changelog:
  - Allow nrpe to list /var
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Add support for strongswan
  - Fix description of ftpd_use_fusefs boolean
  - Allow kdumpgui to write dos files for /boot/efi/EFI/fedora/grub.cfg
  - Back port tgtd fixes from Fedora to allow sys_rawio cap
  - Add support for OpenDMARCD
  Resolves:#983551
  - Allow openvpn to run unconfined scripts
  - Allow amavis to execute shell
  Resolves:#979421
  - man pages should be owned only by selinux-policy-doc package
  - Fix fs_manage_nfs_files and fs_manage_nfs_dirs boolean to allow to search autofs
  - Allow mysqld-safe sys_nice/sys_resource caps
  Resolves:#975921
  - Add labeling for /boot/etc/yaboot.conf
  Resolves:#973156
  - /var/log/syslog-ng should be labeled var_log_t
  - Back port munin-cgi fixes
  - Fix ftp_home_dir boolean 
  - Allow kdump to read kcore on MLS system
  - Add support for svn ports
  - Add labels for /dev/ptp*
  - Add labels for /etc/security/opasswd
  - Fix labeling for /etc/localtime lnk file
  - Add  tftp booleans for NFS/CIFS access
  - Merge amavis,clamd,clamscan,freshclam policies to antivirus policy
  - Label all nagios plugins as nagios_unconfined_plugin_exec_t by default
  - Add additional ports as mongod_port_t
  - Allow sandbox domains to use inherted terminals
  - Allow pegasus to execute mount in pegasus_t domain
  - Fix *_admin interfaces  and interface descriptions
  - Allow yppasswdd to use NIS
  - Allow nagios to manage nagios spool files
  - Allow ABRT to domtrans to prelink
  Resolves:#921234
  - Fix labeling for /var/lib/dspam/
  Resolves:#919456
  - Label postfix-policyd-spf-perl as bin_t
  - Allow nrpe to run sudo
  - Label /usr/bin/yum-builddep as rpm_exec_t
  - Label /usr/local/bin/x11vnc as xserver_exec_t
  - Allow logwatch to domtrans to mdadm
  - Allow postfix-master to list /tmp dir
  - Add lldpad policy and make it as unconfined domain
  - Allow sysadm to admin postfix
  - ALlow postfix_virtual to stream connect to mysql
  - Update zabbix policy
  - Activate watchod policy and make it as unconfined
  - Add httpd_serve_cobbler_files boolean
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add oracleasm policy
  - Add support for pand
  - Add awstats_purge_apache_log_files boolean
  - Back port smstools policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-212
changelog:
  - Update rules for antivirus domains
  Resolves:#999471
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow chroot_user_t to read/write inherited user domain pty
  - Allow to start guest while the libvirtd is started with valgrind
  - Allow lldpad to talk with fcoemon
  - Allow chronyd sched_setscheduler


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-213
changelog:
  - Add openhpid policy
  Resolves:#1000521
  - Fix rhcs_domain_template to allow cluster_t to create socket in /var/run with correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-214
changelog:
  - Allow git daemons to read localization
  - Allow tgtd_t to connect to isns ports
  Resolves:#1003571
  - Cleanup antivirus policy and add additional fixes
  - Fix labeling for munin CGI scripts
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Fix fs_search_auto_mountpoints to allow search automount tmp dirs
  Resolves:#990661


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-215
changelog:
  - Add port definition of pka_ca to port 829 for openshift
  - Rename quantum to neutron
  - Allow rpcd to request the kernel to load a module
  - Allow ovsdb-server to create dirs/files in /tmp directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-216
changelog:
  - Remove transition from virtd_t to qemu_t to stay in virtd_t if selinux_driver is None in qemu.conf
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-217
changelog:
  - Fix virtd_lxc_t to be able to communicate with hal
  - Allow NM and wireless working together
  Resolves:#1009661
  - Allow my_print_default to read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-218
changelog:
  - Add support for /var/log/qemu-ga directory
  - Regenerate man pages for domains
  Resolves:#880728
  - Allow setgid capability for ipsec_t
  - Allow ipsec to send signull to itself
  - Add tcp/9000 as http_port_t
  - Allow dirsrv_t to create tmpfs_t directories
  - Fix git_role() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-219
changelog:
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Allow tzdate to unlink etc_t lnk files
  - Allow jabberd to connect to jabber_interserver port
  - Fix description for logging_syslog_can_read_tmp boolean
  - Update ipsec rules and labels
  Resolves:#986883
  - Allow pegasus transition to mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-220
changelog:
  - Allow cobblerd to stream connect to MySQL
  - Allow cobblerd to execute ldconfig
  - Allow openstack-glance to access to amqp
  - Add labeling for /var/run/charon.*
  - Make munin "df" plugins working
  Resolves:#908095


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-221
changelog:
  - Fix /var/run/charon labeling
  - More fix for strongswant and ipsec.secretes
  - Allow sandbox domain to use inherited user terminals


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-223
changelog:
  - Fix dovecot_rw_pipes() interface
  - Allow piranha_pulse_t to search tmpfs
  - Allow sysadm to stream connect to postfix-master process
  - Label /usr/sbin/fence_sanlockd as fenced_exec_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-225
changelog:
  - Re-write rules to create tmpfs for all piranha tmpfs files/dirs
  - Allow piranha-lvs to manage piranha_tmpfs_t
  Resolves:#1018306


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-226
changelog:
  - Label /usr/sbin/fence_scsi as fenced_exec_t
  - Fix cluster domains to create dirs in /var/run/cluster as var_run_t to make resource scripts working
  Resolves:#915151


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-227
changelog:
  - Resource agents needs to manage /etc/cluster to place own config files
  Resolves:#915151
  - tgtd needs ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-228
changelog:
  - Add daemons_enable_cluster_mode boolean and turn on it by default until RHEL6.6
  Resolves:#915151
  - Add tcp/8893 as milter port
  - Allow antivirus domain to read localization without the boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-229
changelog:
  - Add bootloader_exec_t labeling for /sbin/grubby
  Resolves:#915729
  - Add etc_runtime_t label for zipl.conf
  - Allow daemons to manage cluster lib files if daemons_enable_cluster_mode is enabled


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-231
changelog:
  - Add named_cache_t label for /var/lib/unbound
  - Fix puppet_domtrans_master() interface to make passenger working correctly if it wants to read puppet config files
  - Allow anitvirus domains to manage own log dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-232
changelog:
  - Add more fixes for zabbix-agent
  - Fix neutron labeling
  - Allow all domains to read sysfs_t due to glibc change
  - Allow ping to read inherited zabbix tmp files
  Resolves:#1039851
  - Allow hostname to read/write inherited rpm script files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-233
changelog:
  - Add support for OpenShift syslog plugin
  - Allow snmpd to getattr on removeable and fixed disks
  - Add shmemnetgrp and getnetgrp to access_vectors
  Resolves:#1025758


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-235
changelog:
  - Add support for nginx
  Resolves:#1045041
  - Change shutdown_t to also read wtmp
  - Added support for hypervkvpd
  - Add preupgrade policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-236
changelog:
  - Added conman policy
  - Added label for conman port
  - Added support for mip6d policy
  - Added support for isns
  - Added rtas_errd policy
  - Added support for keepalived policy
  - Add label samba_spool_t for /var/spool/samba
  - Allow httpd_t to bind preupgrade port if httpd_run_preupgrade boolean is enabled
  - Allow openshift_cron_t to append to openshift log files
  - dontaudit sudo domains listing /dev
  - Allow read/write to login records
  - Allow auditctl getattr access on blk_file
  - Allow nova-scheduler to read utmp
  - Added stapserver policy
  - Added support for freeipmi services
  - Added lsm policy
  - Added support for pcp service
  - Added chown capability to dhcpd_t domain
  - Add boolean to allow openshift domains nfs access
  - Allow abrt to read man pages and getcap
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Dontaudit smbd_t sending out random signuls
  - Backport all zabbix changes
  - Allow mcelog write access to nscd socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-237
changelog:
  - Fixes for mirrormanager
  - Fix swift interface
  - Allow lsmd_plugin_t to read localization
  - Allow keepalived read snmp libs, Allow keepalived connect to agentx port
  - Allow keepalived read localization
  - Added setuid capability to lsm service
  - Added some swift rules to rsync policy
  - Remove duplicate line entry in .fc
  - Do not send/receive packets when ftpd_use_passive_mode is disabled
  - Add mirrormanager policy to RHEL6 Fixes Bug 1042864
  - Update permissivedomains by mirrormanager
  - Add mirrormanager policy
  - Added support for openwsmand
  - Added policy for swift
  - Added support for sblim
  - label also 64bit heartbeat libs
  - Allow kill capability on varnish
  - Added haveged policy
  - Add missing kernel_rw_stream_socket_perms
  - Label tcp/udp port no. 3052 as apc, Allow apcups to bind on apc port
  - Allow logwatch stream connect to courier service
  - Fix mcelog policy
  - Back port rsyslog fixes from RHEL7 for rsyslog7
  - Fix whitespace
  - Add support for osad
  - Fix automount policy
  - Added policy for bacula
  - add radvd_read_pid_files inteface
  - Add missing syslog-conn port
  - Allow httpd_t write to kernel keyring
  - Allow httpd_sys_script_t domain to send system log messages 
  - Allow passwd_t to write to ipa trusted user files in /tmp 
  - Boolean to allow mcelog use all the user ttys 
  - Allow icecast to use any tcp ports 
  - Define oracleasm_t as a device node 
  - Allow sudomain to getattr of kernel interface
  - Add squid directory in /var/run
  - Allow automount read nfs symlinks
  - Allow asterisk to connect to the apache ports
  - allow abrt to read mcelog log file 
  - allow udev to search radvd files under the /run dir 
  - allow auditctl getattr access on blk_file 
  Resolves:#1080555
  - Allow ssh to manage nfs links


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-238
changelog:
  - Allow domain to read an append inherited tmp files
  - Dontauit leaks of var_t into ifconfig_t
  - Allow fsdaemon_t to read/write device_t char files 
  Resolves:#1035363
  - Remove sblim_filetrans_named_content in RHEL6
  - We don't have systemd in RHEL6.
  - one more fix for bacula_admin()
  - fix bacula_run_admin()
  - Remove shadow_t label from /etc/security/opasswd 
  - Fix logrotate_use_nfs boolean
  - Allow userdom to read inherited users files in /tmp 
  - Allow certmonger_t read puppet libs
  - Allow in logging_inherit_append_all_logs also ioctl and append
  - Label pacemaker_remoted as cluster_exec_t
  - Tag some conman exec files
  - Allow conman to read localization
  - Should use rw_socket_perms rather then sock_file on a unix_stream_socket
  - Added conman fixes
  - Allow apache to manage passenger sock_files
  - Allow bacula to bind on 9103 tcp port
  - Allow postfix stream connect to antivirus
  - Allow osad to read localization


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-239
changelog:
  - Fixed lsmd_plugin_t
  Resolves:#1111619
  - Added glusterd_conf_t alias glusterd_etc_t
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory 
  Resolves:#982160
  - Label zabbix-proxy files
  Resolves:#1018211
  - allow sshd to write to all process levels in order to change passwd when running at a level
  Resolves:#837616
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range 
  Resolves:#837616
  - Rename quantum port to neutron 
  Resolves:#1024927
  - Added zarafa_read_lib_files interface
  - Added dont audit list non security files in xdm_t 
  Resolves:#1030760
  - Added more fixes relates to 
  Resolves:#1060656
  - Added dontaudit rules to xdm_t 
  Resolves:#1030760
  - Allow procmail to run zarafa-degent 
  Resolves:#1060656
  - Add userdom_user_application_domain in xauth 
  Resolves:#1013832
  - Allow dmesg read raw memory 
  Resolves:#1030762
  - Allow communication between postfix and cyrus 
  Resolves:#1057307


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-240
changelog:
  - Allow nagios to stream connect to postgresqlBZ #1015708
  Resolves:#1015708
  - Allow hypervkvp read localization
  - Fix postfix_admin()
  - Add lldpad policy for MLS


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-241
changelog:
  - Remove deny_ptrace from interfaces
  - Add setpgid procces to mip6d_t
  - Added support for hv_vss_daemon
  - Allow keepalived also managed snmp lib dirs
  - Allow chroot_user_t unconfined shell domtrans
  Resolves:#1082183
  - Label swift-object-expirer as swift_exec_t
  - Allow keepalived manage snmp files, dontaudit list tmp files
  Resolves:#1053450
  - Additional fix for calling postfix interfaces in sysadm.te to make postfix_admin() working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-243
changelog:
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-244
changelog:
  - Add support for vdsm 
  Resolves:#1064270
  - Allow userdomain role to access prelink_mask_t
  - Rename module glusterfs to glusterd 
  Resolves:#1052206
  - Allow gfs_controld_t to getattr on all file systems 
  Resolves:#1110886
  - Allow apache to manage pid sock files 
  Resolves:#1042864
  - Bind TCP/UDP sockets to the nfs port
  - The /var/run/tuned directory is not a regular file 
  Resolves:#1117685
  - Allow utilize winbind for authentication to AD. 
  Resolves:#1084177
  - Dont audit access on /etc/init.d/mcollective for kdump_t
  - FIx labeling in networkmanager.fc
  - Allow passenger to connect to MySQL
  - ALlow passenger to read locales
  - Dontaudit relabelfrom/relabelto for all variablefiles for prelink_map_t
  - Change all var_lib_t types to have also variablestatefile attribute
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-245
changelog:
  - Allow setpgid for all sandbox domains.
  - Allow sandbox domains read all mountpoint symlinks to make symlinked homedirs working with sandbox.
  - One more fix for osad.te
  - Back port osad changes from RHEL7.
  - Rename svirt_lxc_file_t to svirt_sandbox_file_t.
  - Label nginx init script as httpd_initrc_exec_t 
  Resolves:#1045041
  - Allow postfix_smtpd to stream connect to antivirus 
  Resolves:#1105889
  - Label init thttpd file as httpd_initrc_exec_t 
  Resolves:#1069843
  - Allow httpd to setattr on httpd_log files
  Resolves:#1111581
  - Add tomcat
  - Allow zabbix to read system network state
  - Allow ndc to read random and urandom device 
  Resolves:#1110397
  - Add kerberos support for radiusd.
  - Allow procmail to ioctl on zarafa-deliver executable.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-246
changelog:
  - Add boolean to allow user login programs access to /etc/shadow
  - Use old icecast_connect_any boolean name and dontaudit list /tmp with tmp_t labeling
  - Remove unused interface rtas_errd_systemctl 
  Resolves:#1121169
  - Allow prelink_mask to use user terminals and dontaudit relabel tmpfiles.
  - Dontaudit r/w inherited lockfiles/tmpfiles for prelink_mask_t.
  - Allow prelink_mask to append all log files.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-247
changelog:
  - Add all login domain auth_can_read_shadow_passwords attribute.
  - Added support for dhcrelay service
  Resolves: #1123338
  - We need to call auth_tunable_read_shadow in auth_shadow boolean.
  - Move authlogin_shadow to authlogin.if.
  - Add filetrans also for bacula log files.
  - Dontaudit kdumpgui to read openshift_initrc_exec_t
  Resolves: #1023336
  - Allow squid to manage squid_var_run_t sock_file
  Resolves: #1102346
  - Alloe bacula manage bacula_log_t dirs
  Resolves: #1122545
  - Added sys_ptrace cap. to stapserver_t
  Resolves: #811366
  - Label also /var/run/glusterd.socket file as glusterd_var_run_t
  Resolves: #1052206
  - Added support for collectd daemon
  Resolves: #1024715
  - Label conmans pid file as conman_var_run_t, Resolves: #1122106
  - Fix authlogin_shadow boolean to have it for all login_pgm domains
  - Dontaudit r/w inherited all log files for prelink_mask_t
  - Label zabbix_var_lib_t directories
  Resolves: #1053205
  - Allow all sblim domain to read localization data
  Resolves:##1122022


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-248
changelog:
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift 
  Resolves: #1034206
  - Do not send/receive packets when ftpd_use_passive_mode is disabled 
  Resolves: #1105544
  - Allow qemu-ga domtrans to hwclock 
  Resolves: #1062384
  - Allow sshd read access to files on ftp directory 
  Resolves: #1097387
  - dontaudit r/w inherited certs for prelink_mask_t.
  - Allow sblim_gatherd_t to search all mountpoints. This is caused by ps. Should not be needed in Fedora.
  - Fix labeling in dhcpc.fc.
  - Add labels also for glusterd sockets.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-249
changelog:
  - Add support for luci.
  - Add support for rhsmd and treat it with rhsmcertd_t.
  - Make zabbix_agent_t as unconfined domain for rhel6.6.
  - Allow chroot_user_t to change process identity.
  Resolves:#1082183
  - Revert "Remove shadow_t label from /etc/security/opasswd
  - Dontaudit relabel lib_t files for prelink_mask_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-250
changelog:
  - Dontaudit read/write/setattr all pipes for prelink domains on all domains
  Resolves:#1103674
  - Allow chroot_user_t to change the role.
  - Add sys_time caps for virt_qemu_ga_t
  - Add label for /usr/sbin/luci


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-251
changelog:
  - Allow tgtd service to read kernel network state
  Resolves: 1130040
  - Allow mail-servers policies to read pcp libs
  Resolves: 1130934
  - Allow passwd_t to read/write stream sockets
  Resolves: #1129296
  - Add support for zabbix external scripts for which zabbix_script_t domain has been created. This domain is unconfined by default and user needs to run 'semodule -d unconfined' to make system running without unconfined domains. 
  - Dontaudit zebra to read getattr for all files and dirs
  Resolves: 1122031
  - Allow zebra to read /dev/urandom
  Resolves: #1122031
  - Label /var/lib/asterisk/agi-bin as bin_t
  - Added to lldpad policy sys_resource cap. and allow read localization 
  Resolves:1021984
  - Fix path to luci(/usr/sbin/luci) 
  Resolves:1023202
  - Add auth_can_read_shadow_passwords for rlogind.
  - Add authlogin_shadow boolean for all login domains.
  - Dontaudit rw all non security leaks.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-252
changelog:
  - Allow aide_t to read /dev/random and /dev/urandom.
  - Allow sysadm to talk with lldpad over unix dgram socket.
  - Allow sysadm to send/recv with unix dgram socket.
  - Allow crond_t to read lastlog.
  - Allow xdm_t to read plymouthd_spool_t files
  Resolves:#1131195
  - Allow hald to rpm dbus chat
  - Additional dontaudits for prelink_mask_t.
  - Add samba_domain attribute also for smbcontrol_t and winbind_helper_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-253
changelog:
  - Add additional dontaudits for prelink_mask_t
  Resolves:#1103674
  - Allow local_login_t and xdm_t to manage shadow_t because of PAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-254
changelog:
  - Dontaudit to read/write all dev nodes for prelink_mask_t.
  - Add label for path /var/lib/ctdb
  - Allow escd access to /var/run/pcscd.events directory
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-255
changelog:
  - Allow couriertcpd to read /var/spool/courier dir.
  - Allow prelink domain to rea /dev/mem.
  - ALlow transition to prelink_t instead of prelink_mask_t to ABRT domains/rpm.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-257
changelog:
  - Add fixes for sblim_sfcbd to make libvirt-cim working.
  - Allow keepalived stream connect to snmpd
  - Allow local_login_t and xdm_t to manage etc_t if authlogin_can_shadow boolean.
  - Allow prelink_transition_domain to send signal to prelink_mask_t.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-258
changelog:
  - Allow unlink lib_t located in /tmp for prelink_mask_t.
  Resolves:#1103674
  - Add support for pnp4nagios
  - Allow mysql to read all domain state
  - Allow sblim_sfcbd_t to search virt images
  - Revert "Remove shadow_t label from /etc/security/opasswd "


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260
changelog:
  - Add virt_getattr_images and call it for sblim_sfcbd_t.
  - We also need to call virt_search_images for sblim.
  Resolves:#1140614


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-261
changelog:
  - Allow sys_ptrace and dac_override caps for collectd.
  - Add labeling for /etc/rc\.d/init\.d/htcacheclean.
  - Allow /usr/sbin/sfcbd to send audit msgs.
  - Allow postdrop to connect to master process over unix stream socket.
  - Allow ssh_t to connect to all unreserved ports.
  - Allow setfiles domain to access files with admin_home_t. semanage -i /root/testfile.
  - Don't relabel files under /dev/shm/
  - Allow munin_disk_plugin_t getattr access on blk_file 
  - Allow xauth_t and sshd_t to search automount_tmp_t if use_nfs_home_dirs boolean.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow antivirus domains to read all dirs/files regardless of their MCS category set.
  - Add labeling for mariadb log/pid files/dirs.
  - Allow rsyslogd to read /proc/sys/vm/overcommit_memory file.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Remove ftpd_use_passive_mode boolean. It does not make sense due to ephemeral port handling.
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it.
  - Allow qpidd to read network state and sysctls dirs
  Resolves:#1171275
  - Add labeling for /var/bacula directory.
  - mcelog runs as a daemon domain 
  - Allow shutdown to r/w iherited rhev-agetnd pipes.
  - Allow sshd to seind signull itself.
  - Add the 'base_ro_file_type' and 'base_file_type' attributes to RHEL6.
  - Allow prelink_mask_t getattr on filesystems that support xattrs
  - Allow radious to connect to apache ports to do OCSP check.
  - remove transition from unconfined user to auditctl.
  - Backport RHEL7 sblim-sfcb fixes.
  - Add bacula fixes related to unconfined scripts based on ssekidde@redhat.com patch.
  - Allow zebra to communicate with sssd 
  - Add interfaces fixes.
  - Added some optional blogs from timemaster policy to chronyd.
  - Added linuxptp policy
  - Add interface to read mysql db link files
  - Added cinder policy
  - Make munin yum plugin as unconfined by default.
  - Allow bitlbee connections to the system DBUS.
  - Allow hv_vss_daemon to call ioctl(FIFREEZE) on /boot.
  - Add rsync_server boolean to don't have a transition from initrc by default.
  - Dontaudit to r/w inherited pipes from httpd because of certmonger unconfined scripts.
  - Backport all capabilities for cvs from RHEL7.
  - Allow dccproc to execute bash.
  - Fix labeling for /usr/libexec/nm-dispatcher.action.
  - Allow logrotate to manage virt_cache.
  - Allow osad to execute rhn_check.
  - Make osad_t as unconfined domain.
  - Allow osad connect to jabber client port.
  - Allow rhev-agentd to access /dev/.udev/db/block:sr0.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-262
changelog:
  - Allow lsmd_t getattr all exec.
  Resolves:#1141719
  - Update afs policy
  Resolves:#1136396
  - Add support for /usr/sbin/named-sdb.
  - Add support for mongos service.
  - Allow cyrus to use tcp/2005 port.
  - More service wants to auth_use_nsswitch.
  - Allow apps that need to read sysctl_vm_overcommit_t be able to read it.
  - Update passenger rules from RHEL7.
  - Allow smartd to manage generich devices if they are created with wrong label.
  - Allow sblim-sfcb to execute itself.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-263
changelog:
  - Allow userdomain to manage pcscd pid fifo files.
  - Allow prelink domain access to /dev/console 
  Resolves:#1145662
  - Allow httpd search access on tomcat6 directory
  - Allow apcupsd to get attributes of filesystems with xattrs
  - Allow qemu-ga getattr access of all filesystems
  - Allow abrt to read network state information
  - Make collectd_t as unconfined domain.
  - Make rpcbind as nsswitch domain.
  - Back port labeling for /etc/my.cnf.d dir.
  - Allow dhcpd kill capability.
  - Allow cachefilesd to create cachefilesd_var_t
  - cvs_home backport from RHEL7.
  - Add support for new fence agent fence_mpath which is executed by fence_node
  - Allow lsmd plugin to run with configured SSSD.
  - Allow bacula access to tape devices
  - Allow sblim-sfcb setuid.
  - Allow sblim domain to read sysctls.
  - Allow ntp to read localtime and allow timemaster send a signal to ntpd.
  - Add cobblerd_t fixes
  - Allow mysqld_t to use pam
  - Dontaudit xguest_t communication with avahi_t via dbus
  - Allow cobblerd_t to communicate with sssd
  - Allow pmwebd to send and receive messages from avahi over dbus
  - Allow conman_t to commmunicate with sssd
  - Allow mysqld_t to send audit messages
  - Allow load_policy rw access to inherited sssd pipes
  - Update label for /etc/mcelog/.* files
  - Allow bacula_t to connect to psql via tcp/unix socket
  - Remove type to only match directories on /boot
  - Add more labels for ownCloud
  - Dontaudit net_admin capability for munin


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-264
changelog:
  - Allow qpidd to read own init script file.
  - Allow passenger to accept connection
  - Back port hypervkvp fixes from RHEL7
  - ALlow load_policy to list inotifyfs filesystem
  - Allow cluster domain to execute ldconfig and update lvm_read_config() interface
  -  Allow sssd_t to connect to samba TCP port
  - Allow NetworkManager to run arping
  Resolves:#1209854
  - Backport RHEL7 redis policy
  - Add apache log and lib labels for roundcubemail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-265
changelog:
  - Allow redis to create /var/run/redis/redis.sock
  - Allow fence_mpathpersist to run mpathpersist which requires sys_admin capability.
  Resolves:#1206244
  - Allow rhn_check running as rpm to domtrans to shutdown domain
  - openshift_cache_t does exist


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-266
changelog:
  - Add audit_access permissions
  - Allow cupsd_t access to files in /etc dir
  - Allow hplip to dbus chat with all users.
  - Allow sblim-gathered sys_ptrace capability.
  - Allow sys_admin capability for gfs_controld
  - Add more cobbler labels to /var/lib/tftpboot/
  - Add new smbd_tmpfs_t type.
  - Add more fixes related to timemaster+ntp+ptp4l.
  - Fix cgdcbxd_admin() interface.
  - Add labeling for /var/tmp/kadmin_0 and /var/tmp/kiprop_0.
  - Dontaudit read access on admin_home_t for load_policy.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-267
changelog:
  - Allow ctdb to create rawip socket.
  - ALlow nmbd_t to crate nmbd_var_run_t dir under smbd_var_run_t.
  - Make ctdbd as userdom_home_reader.
  - Allow ctdbd to bind  smbd port.
  Resolves:#1219317


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-268
changelog:
  - Add labeling for /var/run/ctdb and allow samba domains to connect to ctdbd.
  Resolves:#1221929
  - Allow glusterd to read/write samba config files.
  - Update mysqld rules related to mysqld log files.
  - Add fixes for hypervkvp realed to ifdown/ifup scripts.
  - Update netlink_route_socket for ptp4l.
  - Allow sosreport to dbus chat with NM.
  - Allow glusterd to connect to /var/run/dbus/system_bus_socket.
  - ALlow glusterd to have sys_ptrace capability. Needed by gluster+samba configuration.
  - Add new boolean samba_load_libgfapi to allow smbd load libgfapi from gluster. Allow smbd to read gluster config files by default.
  - Allow gluster to transition to smbd. It is needed for smbd+gluster configuration.
  - Allow glusterd to read /dev/random.
  - Label all gluster hooks in /var/lib/gluster as bin_t. Thy are not created on the fly.
  - Update nagios_run_sudo boolean to allow run chkpwd.
  - Add labeling for /usr/sbin/kpropd.
  - Add nagios_run_sudo boolean
  - Allow ctdb to create rawip socket.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-269
changelog:
  - Fix labeling for /var/tmp/kiprop_0 to kadmind_tmp_t.
  - Allow postdrop runinng as postfix_postdrop_t to access /var/spool/postfix/public/pickup socket.
  - Allow gluster hooks scripts to transition to ctdbd_t.
  - Update policy rules for afs_fserver_t to allow connectto on unix_stream_socket.
  - Allow gluster transition to smbd_t also using samba init script.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-270
changelog:
  - Update policy rules for afs_fserver_t to allow connectto on unix_stream_socket instead of afs_t.
  - Allow smbd to access /var/lib/ctdb/persistent/secrets.tdb.0.
  - Allow glusterd to execute consoletype.
  - Glusterd wants to manage samba config files if they are setup together.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-271
changelog:
  - Remove ctdbd_manage_var_files() interface which is not used and is declared for the wrong type.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-272
changelog:
  - Allow hypervkvp to read default SELinux contexts.
  - Allow hypervkvp to write to /etc directories.
  - Update all man pages for RHEL6.7 SELinux domains/roles using the latest sepolicy-manpage from RHEL7.
  - Fix labeling for /var/lib/graphite-web
  - ALlow kpropd to connect to tcp/754 port.
  Resolves:#1220691
  - Allow php-fpm write access to /var/run/redis/redis.sock
  - Update fs_rw_inherited_nfs_files() to allow search auto mountpoints.
  - Dontaudit rpm leaks for prelink_mask_t.
  - Allow sysctl to have running under hypervkvp_t domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-273
changelog:
  - Fix redis_stream_connect interface.
  Resolves:#1220691
  - Allow kadmind to bind to kprop port.
  - Add new man pages for bacula


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have mknod capability. It creates a special file using mknod in a brick.
   - Update rules related to glusterd_brick_t.
   - Allow glusterd to execute lvm tools in the lvm_t target domain.
   - Allow glusterd to execute xfs_growfs in the target domain.
   - Add support for /usr/sbin/xfs_growfs.
   - Allow glusterd to create samba config files if it is started by service script and running with unconfined_u.
  Resolves:#1228109
  - Fix description for ftpd_use_passive_mode boolean.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have transition to insmod.
  - Allow glusterd to use geo-replication gluster tool.
  - Remove gluster from permissive domains.
  Resolves:#1229605


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-276
changelog:
  - Allow gluster to manage own log files.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  - Label gluster python hooks also as bin_t.
  - Allow samba_t net_admin capability to make CIFS mount working.
  Resolves:#1229605
  - Allow ssh_keygen_t to manage keys located in /var/lib/gluster.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-278
changelog:
  - Allow logrotate get attributes of all unallocated tty device nodes.
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  - Allow glusterd to connect to init.
  Resolves:#1230371
  - Allow gluster do dbus chat with domain running as initrc_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.1
changelog:
  - Backport gluster fixes from RHEL7
   - execute showmount in own domain
  Resolves:#1248520
   - execute nsfd in own domain
   - allow gluster to connect to all ports
   - Add support for /usr/sbin/ctdbd_wrapper.
   - nrpe needs kill capability to make gluster moniterd nodes working.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.2
changelog:
  - Allow nmbd to create pids files/dirs under /var/run/samba with correct labeling.
  Resolves:#1248520


author: Paul Nasrat <pnasrat@redhat.com> - 3.3.6-1
changelog:
  - Update to 3.3.6
  - Fix typo  (#189647)
  - Enable threading fixes (#181298)
  - Conditionalize static library


author: Panu Matilainen <pmatilai@redhat.com> - 3.5.9-2
changelog:
  - Remove references to temporary registers from cache on release (#463061)
  - Enable loading of external extensions (#457433)


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.6.2-2
changelog:
  - require tcl(abi) in sqlite-tcl subpackage (#474034)
  - move tcl extensions to arch-specific location
  - enable dependency extraction on the tcl dso
  - require pkgconfig in sqlite-devel


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.12-2
changelog:
  - disable strict aliasing to work around brokenness on 3.6.12 (#494266)
  - run test-suite on build but let it fail for now


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Jeff Johnson <jbj@redhat.com> 0.15-3687.0
changelog:
  - first build from adapted spec file, only client and libraries for now.
  - internal apr/apr-utils/neon until incompatibilities sort themselves out.
  - avoid libdir issues on x86_64 for the moment.


author: Joe Orton <jorton@redhat.com> 0.22.2-1
changelog:
  - update to 0.22.2; add mod_dav_svn subpackage
  - include Python bindings
  - neon: force use of expat, enable SSL
  - drop check for specific apr version added in -3


author: Jeff Johnson <jbj@redhat.com> 0.22.2-2
changelog:
  - use external neon-0.23.9-2 (i.e. with neon-config), drop internal neon.
  - use db-4.1.25, not db-4.0.14.
  - do "make check" (but ignore failure for now).
  - s390x knows not of httpd >= 2.0.45.


author: Joe Orton <jorton@redhat.com> 1.0.0-2
changelog:
  - add fix for lack of apr_dir_read ordering guarantee (Philip Martin)
  - enable compression in ra_dav by default (Tobias Ringström)


author: Joe Orton <jorton@redhat.com> 1.0.2-2
changelog:
  - add perl MODULE_COMPAT requirement for -perl subpackage
  - move perl man pages into -perl subpackage
  - clean up -perl installation and dependencies (Ville Skyttä, #123045)


author: Joe Orton <jorton@redhat.com> 1.1.3-7
changelog:
  - restore swig bindings support (from upstream via Max Bowsher, #141343)
  - tweak SELinux commentary in default subversion.conf


author: Joe Orton <jorton@redhat.com> 1.1.3-8
changelog:
  - further swig bindings fix (upstream via Max Bowsher, #151798)
  - fix perl File::Path dependency in filter-requires.sh


author: Joe Orton <jorton@redhat.com> 1.2.0-3
changelog:
  - update to 1.2.1
  - fix BuildRequires for ruby and apr-util (#163126)
  - drop static library archives


author: Joe Orton <jorton@redhat.com> 1.2.3-3
changelog:
  - update to 1.2.3
  - update to psvn.el r16070 from Stefan Reichoer
  - merge subversion.conf changes from RHEL4
  - merge filter-requires.sh changes from FC4 updates


author: Joe Orton <jorton@redhat.com> 1.3.2-2
changelog:
  - update to 1.3.2
  - fix Ruby sitelibdir (Garrick Staples, #191611)
  - own /etc/subversion (#189071)
  - update to psvn.el r19857


author: Joe Orton <jorton@redhat.com> 1.4.3-3
changelog:
  - update to 1.4.3 (#228691)
  - remove trailing dot from Summary
  - use current preferred standard BuildRoot
  - add post/postun ldconfig scriptlets for -ruby and -javahl


author: Joe Orton <jorton@redhat.com> 1.4.4-2
changelog:
  - update to 1.4.4
  - add Provides: svn (#245087)
  - fix without-java build (Lennert Buytenhek, #245467)


author: Joe Orton <jorton@redhat.com> 1.4.4-3
changelog:
  - fix build with new glibc open()-as-macro
  - build all swig code in %build, not %install
  - BuildRequire perl(Test::More), perl(ExtUtils::MakeMaker)


author: Joe Orton <jorton@redhat.com> 1.4.4-4
changelog:
  - trim dependencies from .la files
  - detabify spec file
  - test suite disabled to ease stress on builders


author: Joe Orton <jorton@redhat.com> 1.5.6-3
changelog:
  - update to 1.5.6
  - autoload psvn (#238491, Tom Tromey)
  - regenerate swig bindings (#480503)
  - fix build with libtool 2.2 (#469524)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.5-3
changelog:
  - Apply svn2cl upstream patch to fix newline issues with libxml2 2.7.4+,
    see http://bugs.debian.org/546990 for details.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Joe Orton <jorton@redhat.com> - 1.6.11-4
changelog:
  - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709221)
  - add security fix for CVE-2011-0715 (#681174)
  - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672679)


author: Joe Orton <jorton@redhat.com> - 1.6.11-5
changelog:
  - add init script for svnserve (#720790, #711904)
  - fix segfault with "AuthzForceUsernameCase lower" (#751321)
  - fix parent directory access with merges (#749494)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
  - remove absolute path names from the PAM configuration, ensuring that the
    right modules get used for whichever arch we're built for
  - don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
  - Enhance sesh.c to fork/exec children itself, to avoid
    having sudo reap all domains.
  - Only reinstall default signal handlers immediately before
    exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
  - new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
  - Remove selinux patch.  It has been decided that the SELinux patch for sudo is
  - no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
  - We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
  - fix #198755 - make login processes (sudo -i) initialise session keyring
    (thanks for PAM config files to David Howells)
  - add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
  - adjust audit patch, do not scream when kernel is
    compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
  - fixed building with new libtool
  - fix for incorrect handling of groups in Runas_User
  - added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
  - moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
  - epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
  - new upstream version
    Resolves: rhbz#554321
  - drop *.pod man page duplicates from docs
  - commented out unused aliases in sudoers to make visudo happy (#550239)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5
changelog:
  - added patch that fixes insufficient environment sanitization issue (#598154)
    Resolves: rhbz#598383


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-7
changelog:
  - move the sudo_end* calls before closefrom()
  - close audit_fd before exec
  - fixed typo in Makefile.in
    Resolves: rhbz#569313


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-1
changelog:
  - rebase to latest stable version
  - sudo now uses /var/db/sudo for timestamps
  - new command available: sudoreplay
  - use native audit support
  - sync configuration paths with the nss_ldap package
    Resolves: rhbz#615087
    Resolves: rhbz#652726
    Resolves: rhbz#634159
    Resolves: rhbz#603823


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-6
changelog:
  - removed the --with-ldap-*conf options
  - added RELRO flags
    Resolves: rhbz#709235
    Resolves: rhbz#709859


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-8
changelog:
  - created a separate ldap configuration file, sudo-ldap.conf
  - visudo: mark unused aliases as warnings, not errors
  - backported signal handling from 1.7.5
  - don't disable coredumping from the code, rely on /proc/sys/fs/suid_dumpable
  - use correct SELinux context when editing files with sudoedit
  - fixed visudo syntax checks
  - fixed typos and inconsistencies in documentation
  - switched to an updated -getgrouplist patch to fix sudo -l -U <user> behavior 
    Resolves: rhbz#760843
    Resolves: rhbz#736030
    Resolves: rhbz#697775
    Resolves: rhbz#726634
    Resolves: rhbz#708515
    Resolves: rhbz#736653
    Resolves: rhbz#667120
    Resolves: rhbz#769701
    Resolves: rhbz#751680
    Resolves: rhbz#604297
    Resolves: rhbz#797511


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-9
changelog:
  - fixed uninitialized value warning introduced with the sudoedit-selinux patch
    Resolves: rhbz#806386


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-10
changelog:
  - fixed bug in Runas_Spec group matching (#810147)
  - disable `sudo -l' output word wrapping if the output
    is piped (#810326)
  - fixed `sudo -i' command escaping (#806095)
    Resolves: rhbz#806095
    Resolves: rhbz#810147
    Resolves: rhbz#810326


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-10.1
changelog:
  - backported ldap code modifications that fix an issue with tls_checkpeer (#810372)
    Resolves: rhbz#810372


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-11
changelog:
  - use SIG_SETMASK when resetting signal mask instead of SIG_UNBLOCK (#821976)
    Resolves: rhbz#821976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-1
changelog:
  - rebase to 1.8.6p3
  - new -devel subpackage
  - new configuration file: /etc/sudo.conf
    Resolves: rhbz#852045 - ulimit -c got Operation not permitted
    Resolves: rhbz#804123 - sudo does not call pam_close_session() or pam_end()
    Resolves: rhbz#828707 - sudo fails to report error correctly when execv(3) fails
    Resolves: rhbz#844691 - Cannot set RLIMIT_NPROC to unlimited via pam_limits when running sudo
    Resolves: rhbz#759480 - Rebase sudo to 1.8 in RHEL 6.4
    Resolves: rhbz#846117 - Sudo interpretation of wildcard command arguments is more lenient providing a security risk
    Resolves: rhbz#789937 - [RFE] Add ability to treat files authoritatively in sudoers.ldap
    Resolves: rhbz#836242 - sudo -s -u USERNAME can't change ulimit -c


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
changelog:
  - extended the default sudo-ldap.conf file
  - corrected default file permissions on sudo.conf, sudo-ldap.conf
  - added patch that introduces the cmnd_no_wait Defaults option
    Resolves: rhbz#840980 - sudo creates a new parent process
    Resolves: rhbz#860397 - new /etc/sudo-ldap.conf configuration file problems


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-5
changelog:
  - Include just one sample plugin in the documentation for the -devel
    subpackage. Don't include architecture specific files.
  - patch: Do not inform the user that the command was not permitted by
    the policy if they do not successfully authenticate.
    Resolves: rhbz#759480
    Resolves: rhbz#871303
    Resolves: rhbz#872740


