# changelog

author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-4
changelog:
  - Revert some changes which are causing the wrong policy version file to be created
  - Switch sandbox to start using openbox rather then matchbox
  - Make sepolgen a symlink to sepolicy
  - update translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-6
changelog:
  - Fix newrole to retain cap_audit_write when compiled with namespace, also
  do not drop capabilities when run as root.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-7
changelog:
  - Add --root/-r flag to sepolicy manpage,
  - This allows us to generate man pages on the fly in the selinux-policy build


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-8
changelog:
  - Sepolixy should not throw an exception on an SELinux disabled machine
  - Switch from using console app to using pkexec, so we will work better
  with policykit.
  - Add missing import to fix system-config-selinux startup
  - Add comment to pamd files about pam_rootok.so
  - Fix sepolicy generate to not comment out the first line


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-10
changelog:
  - Fix sepolicy to be able to work on an SELinux disabled system.
  - Needed to be able to build man pages in selinux-policy package


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-12
changelog:
  - Do not load interface file by default when sepolicy is called, mov get_all_methods to the sepolicy package


author: Rahul Sundaram <sundaram@fedoraproject.org> - 2.1.14-13
changelog:
  - remove vendor tag from desktop file. https://fedorahosted.org/fpc/ticket/247
  - clean up spec to follow current guidelines


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-14
changelog:
  - Allow users with symlinked homedirs to work. call realpath on homedir
  - Fix sepolicy reorganization of helper functions.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-20
changelog:
  - Mention creation of permissive domains in sepolicy generate man page
  - Change sepolicy manpage to use shortname with an "_" to stop accidently grabbing unrelated types for a domain.
  - Fix audit2allow to show better information on constraint violations.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-21
changelog:
  - sepolicy generate should look for booleans that effect equivalence names, and add them to the man page


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-22
changelog:
  - Fix newrole to not drop capabilities from the bounding set.
  - Stop dropping capabilities from its children.
  - Add better error messages.
  - Change location of bash_completion files to /usr/share/bash-completion/compl


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-23
changelog:
  - sepolicy manpage:
  -   use nroff instead of man2html
  -   Remove checking for name of person who created the man page
  - audit2allow
  -   Fix output to show the level that is different.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-26
changelog:
  - Can not unshare IPC in sandbox, since it blows up Xephyr
  - Remove bogus error message sandbox about reseting setfsuid


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-28
changelog:
  - Fix audit2allow output to better align analysys with the allow rules
  - Apply Miroslav Grepl patch to clean up sepolicy generate usage
  - Apply Miroslav Grepl patch to fixupt handing of admin_user generation
  - Update Tranlslations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-30
changelog:
  - Add buildrequires for OpenBox to prevent me from accidently building into RHEL7
  - Add support for returning alias data to sepolicy.info python bindings


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-31
changelog:
  - Add post install scripts for gui to make sure Icon Cache is refreshed.
  - Fix grammar issue in secon man page
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-32
changelog:
  - Move sepolicy to policycoreutils-devel pacage, since most of it is used for devel
  - Apply Miroslav Grepl Patches for sepolicy
  -- Fix generate mutually groups option handling
  -- EUSER is used for existing policy
  -- customize options can be used together with admin_domain option
  -- Fix manpage.py to generate correct man pages for SELinux users
  -- Fix policy *.te file generated by customize+writepaths options
  -- Fix install script for confined_admin option


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-34
changelog:
  - Update translations
  - Add patch inspired by Miroslav Grepl to add extended information for sepolicy interface command.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-35
changelog:
  - Update translations
  - Add patch by Miroslav Grepl to add compile test for sepolicy interface command.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-37
changelog:
  - Fix exceptionion hanling in audit2allow -o
  - Generate Man pages for everydomain, not just ones with exec_t entrypoints
  - sepolicy comunicate should return ValueError not TypeError
  - Trim header line in sepolicy manpage to use less space
  - Add missing options to restorecon man page


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-38
changelog:
  - No longer run sepolgen-ifgen at install time.
  - Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed.
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-39
changelog:
  - Run sepolgen-ifgen in audit2allow and sepolicy generate, if needed, first time
  - Add  Sven Vermeulen  patches to cleanup man pages


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-40
changelog:
  - Only require selinux-policy-devel for policycoreutils-devel, this will shrink the size of the livecd.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-42
changelog:
  - Add support for Xephyr -resizable, so sandbox can now resize window
  - Add support for compressed policy.xml
  - Miroslav Grepl patch to allow sepolicy interface on individual interface fil
  - Also add capability to test interfaces for correctness.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-44
changelog:
  - Fix sepolicy-generate man page to clear up options/policy type
  - Add Miroslav Grepl to not generate man page when doing
    sepolicy generate --customize
  - Add support for executing semanage user within spec file
  - Fix generation of confined admin domains, to handle booleans properly.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-46
changelog:
  - Fix the name of the spec file generated in the build script
  - Add mgrepl patch to support argparse for semanage command parsing


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-48
changelog:
  - Fix audit2allow -o to open file for append
  - Fix the name of the spec file generated in the build script


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-50
changelog:
  - Fix sepolicy generate --confined_admin to generate tunables
  - Add new interface to generate entrypoints for use with new gui


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-56
changelog:
  - Fix semanage export/import commands
  - Fix semange module command
  - Remove --version option from sandbox


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-57
changelog:
  - Remove requires for systemd-sysv
  - Move systemd-units require to restorecond section
  - Update Tranlasions
  - More sepolicy interfaces for gui
  - Cleanup man pages for sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-63
changelog:
  - Update sepolicy gui.
  - Error out of you call sepolicy gui without policycoreutils-gui package installed
  - Fix semanage login -d command
  - Update Translations


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-65
changelog:
  - Do not generate shell script or spec file for sepolicy generate --newtype
  - Update translations
  - Fix sepolicy generate --admin_user man page again
  - Fix setsebool to print less verbose error messages by default, add -V for ve


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-68
changelog:
  - Fix bugs introduced by previous patch.  semanage port
  - Update Translations
  - Add test suite for sepolicy command lines


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-75
changelog:
  - Update sepolicy gui code, cleanups and add file transition tab
  - Fix semanage fcontext -a --ftype code to work.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-79
changelog:
  - Add Miroslav Grepl setsebool patch to give better error message on bad boolean names
  - Additional help screens for sepolicy gui


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-80
changelog:
  - Random fixes for sepolicy gui
    * Do not prompt for password until you make a change
    * Add user mappings and selinux users page
    * lots of code cleanup

  - Verify homedir is owned by user before mounting over it with seunshare
  - Fix fixfiles to handle Relabel properly
  - Fix semanage fcontext -e / command to allow "/"


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-82
changelog:
  - Improvements to sepolicy gui
    - Add more help information
    - Cleanup code
    - Add deny_ptrace on lockdown screen
    - Make unconfined/permissivedomains lockdown work
    - Add more support for file equivalency


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-85
changelog:
  - Fixes for fixfiles
    * exclude_from_dirs should apply to all types of restorecon calls
    * fixfiles check now works
    * exit with the correct status

  - semanage no longer import selinux


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-86
changelog:
  - sepolicy gui
    - mgrepl added delete screens for users and login
    - Fix lots of bugs.
  - Update Translations.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-88
changelog:
  - Cleanup errors found by pychecker
  - Apply patch from Michal Trunecka to allow restorecon to handle {} in globs
  Resolves: #1018913


author: Dan Walsh <dwalsh@redhat.com> - 2.1.14-89
changelog:
  - Update to latest sepolicy tool chain.
  - Document semodule -P
  - Verify input to semanage permissive -a is a valid domain.
  - Assigning login user with semanage login, range should default to user record


author: Dan Walsh <dwalsh@redhat.com> - 2.2-1
changelog:
  - Update to upstream 
  	* Properly build the swig exception file from Laurent Bigonville.
  	* Fix man pages from Laurent Bigonville.
  	* Support overriding PATH and INITDIR in Makefile from Laurent Bigonville.
  	* Fix LDFLAGS usage from Laurent Bigonville.
  	* Fix init_policy warning from Laurent Bigonville.
  	* Fix semanage logging from Laurent Bigonville.
  	* Open newrole stdin as read/write from Sven Vermeulen.
  	* Fix sepolicy transition from Sven Vermeulen.
  	* Support overriding CFLAGS from Simon Ruderich.
  	* Create correct man directory for run_init from Russell Coker.
  	* restorecon GLOB_BRACE change from Michal Trunecka.
  	* Extend audit2why to report additional constraint information.
  	* Catch IOError errors within audit2allow from Dan Walsh.
  	* semanage export/import fixes from Dan Walsh.
  	* Improve setfiles progress reporting from Dan Walsh.
  	* Document setfiles -o option in usage from Dan Walsh.
  	* Change setfiles to always return -1 on failure from Dan Walsh.
  	* Improve setsebool error r eporting from Dan Walsh.
  	* Major overhaul of gui from Dan Walsh.
  	* Fix sepolicy handling of non-MLS policy from Dan Walsh.
  	* Support returning type aliases from Dan Walsh.
  	* Add sepolicy tests from Dan Walsh.
  	* Add org.selinux.config.policy from Dan Walsh.
  	* Improve range and user input checking by semanage from Dan Walsh.
  	* Prevent source or target arguments that end with / for substitutions from Dan Walsh.
  	* Allow use of <<none>> for semanage fcontext from Dan Walsh.
          * Report customized user levels from Dan Walsh.
  	* Support deleteall for restoring disabled modules from Dan Walsh.
  	* Improve semanage error reporting from Dan Walsh.
  	* Only list disabled modules for module locallist from Dan Walsh.
  	* Fix logging from Dan Walsh.
  	* Define new constants for file type character codes from Dan Walsh.
  	* Improve bash completions from Dan Walsh.
  	* Convert semanage to argparse from Dan Walsh (originally by Dave Quigley).
  	* Add semanage tests from Dan Walsh.
  	* Split semanage man pages from Dan Walsh.
  	* Move bash completion scripts from Dan Walsh.
  	* Replace genhomedircon script with a link to semodule from Dan Walsh.
  	* Fix fixfiles from Dan Walsh.
  	* Add support for systemd service for restorecon from Dan Walsh.
  	* Spelling corrections from Dan Walsh.
  	* Improve sandbox support for home dir symlinks and file caps from Dan Walsh.
  	* Switch sandbox to openbox window manager from Dan Walsh.
  	* Coalesce audit2why and audit2allow from Dan Walsh.
  	* Change audit2allow to append to output file from Dan Walsh.
  	* Update translations from Dan Walsh.
  	* Change audit2why to use selinux_current_policy_path from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.2-2
changelog:
  - Shift around some of the files to more appropriate packages.
          * semodule_* packages are required for devel.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.2-1
changelog:
  Resolves: #1002529
  Resolves: #924105
  Resolves: #918140
  Resolves: #1028096

  - Speed up startup time of sepolicy gui
  - Clean up ports screen to only show enabled ports.
  - Update to upstream 
  	* Remove import policycoreutils.default_encoding_utf8 from semanage from Dan Walsh.
  	* Make yum/extract_rpms optional for sepolicy generate from Dan Walsh.
  	* Add test suite for audit2allow and sepolgen-ifgen from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.3-1
changelog:
  - Update to upstream 
  	* Apply polkit check on all dbus interfaces and restrict to active user from Dan Walsh.
  	* Fix typo in sepolicy gui dbus.relabel_on_boot call from Dan Walsh.
  - Apply Miroslav Grepl patch to fix TEMPLATETYPE_domtrans description in sepolicy generate


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-1
changelog:
  - Update to upstream 
  	* Revert automatic setting of serange and seuser in seobject; was breaking non-MLS systems.
  - Add patches for sepolicy gui from mgrepl to
    Fix advanced_item_button_push() to allow to select an application in advanced search menu
    Fix previously_modified_initialize() to show modified changes properly for all selections


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-5
changelog:
  - Fix semanage man page description of import command
  - Fix policy kit file to allow changing to permissive mode


author: Dan Walsh <dwalsh@redhat.com> - 2.2.4-6
changelog:
  - Fix sepolicy gui selection for advanced screen
  - Update Translations
  - Move requires checkpolicy requirement into policycoreutils-python
  Resolves: #1043489


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-1
changelog:
  - Fix Mass Rebuild problems
  - Update to upstream 
  	* Ignore selevel/serange if MLS is disabled from Sven Vermeulen.
  Resolves: #1043489


author: Dan Walsh <dwalsh@redhat.com> - 2.2.5-3
changelog:
  - Add Miroslav patch to
  - Fix previously_modified_initialize() to show modified changes properly for all selections
  Resolves: #1049977


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-5
changelog:
  - Remove default s0 range from semanage-login command. It is handled in seobject.py.
  Resolves:#1028106


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-12
changelog:
  - Make selinux-policy build working also on another architectures related to sepolicy-manpage generate
  Resolves:#1103292


author: Miroslav Grepl <mgrepl@redhat.com> - 2.2.5-13
changelog:
  - If the user attempts to restorecon the label of a file that does not exist, do not report this as an error
  Resolves:#1082956
  - Make fixfiles_exclude_dirs working if there is a substituion for the given directory
  Resolves:#1082676
  - Add ability to list the actual active modules
  Resolves:#1075023
  - Update XDG_RUNTIME_DIR directory
  Resolves:#1112811
  - Fix semanage man page to talk about  semanage-* (8) man pages.
  Resolves:#1084390


author: Petr Lautrbach <plautrba@redhat.com> 2.2.5-16
changelog:
  - semanage: Use OrderedDict for list of fcontexts
  Resolves: rhbz#1206769
  - fixfiles: Cover file_context.XXX.homedir
  Resolves: rhbz#1186640


author: Petr Lautrbach <plautrba@redhat.com> 2.2.5-17
changelog:
  - Fix handling of Forking daemon, to allow systemd to handle it better
  Resolves: rhbz#1186648
  - Fix typo in semanage args for minimum policy store
  Resolves: rhbz#1208797
  - Allow to define sock file in /etc directory
  Resolves: rhbz#1188360


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-2
changelog:
  - sepolgen: Add support for TYPEBOUNDS statement in INTERFACE policy
    files (#1319338)
  - Add documentation for MCS separated domains
  - Move svirt man page out of libvirt into its own


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Update sandbox types in sandbox manual
  - Fix typos in semanage manpages
  - Fix the documentation of -l,--list for semodule
  - Minor fix in a French translation
  - Fix the extract example in semodule.8
  - Update sandbox.8 man page
  - Remove typos from chcat --help
  - Fix multiple spelling errors
  - hll/pp: Warn if module name different than output filename


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6.2
changelog:
  - open_init_pty: Do not error on EINTR
  - Fix [-s STORE] typos in semanage
  - Don't use subprocess.getstatusoutput() in Python 2 code


author: Petr Lautrbach <plautrba@redhat.com> 2.5-7
changelog:
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - audit2allow: tests should use local copy not system
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: David Woodhouse <dwmw2@infradead.org> 0.7.0-2
changelog:
  - Proper fix for GCC 4 putting 'blr' or 'ret' in the middle of the function,
    for i386, x86_64 and PPC.


author: David Woodhouse <dwmw2@infradead.org> 0.8.0-3
changelog:
  - Use -mcpu= instead of -mtune= on x86_64 too
  - Disable SPARC targets on x86_64, because dyngen doesn't like fnegs


author: Matthias Saou <http://freshrpms.net/> 0.8.2-1
changelog:
  - Update to 0.8.2 (#200065).
  - Drop upstreamed syscall-macros patch2.
  - Put correct scriplet dependencies.
  - Force install mode for the init script to avoid umask problems.
  - Add %postun condrestart for changes to the init script to be applied if any.
  - Update description with the latest "about" from the web page (more current).
  - Update URL to qemu.org one like the Source.
  - Add which build requirement.
  - Don't include texi files in %doc since we ship them in html.
  - Switch to using gcc34 on devel, FC5 still has gcc32.
  - Add kernheaders patch to fix linux/compiler.h inclusion.
  - Add target-sparc patch to fix compiling on ppc (some int32 to float).


author: Matthias Saou <http://freshrpms.net/> 0.8.2-2
changelog:
  - Remove the target-list iteration for x86_64 since they all build again.
  - Make gcc32 vs. gcc34 conditional on %{fedora} to share the same spec for
    FC5 and FC6.


author: Hans de Goede <j.w.r.degoede@hhs.nl> 0.9.0-2
changelog:
  - Fix direct loading of a linux kernel with -kernel & -initrd (bz 234681)
  - Remove spurious execute bits from manpages (bz 222573)


author: Daniel P. Berrange <berrange@redhat.com> - 0.9.0-3.fc8
changelog:
  - Added backport of VNC password auth, and TLS+x509 cert auth
  - Switch to rtl8139 NIC by default for linkstate reporting
  - Fix rtl8139 mmio region mappings with multiple NICs


author: Glauber Costa <glommer@redhat.com> - 1.0-0.1.svn6666
changelog:
  - Updated to tip svn (release 6666). Featuring split packages for qemu.
    Unfortunately, still using binary blobs for the bioses.


author: Glauber Costa <glommer@redhat.com> - 0.10-0.1.kvm20090303git
changelog:
  - Set Epoch to 1
  - Build KVM (basic build, no tools yet)
  - Set ppc in ExcludeArch. This is temporary, just to fix one issue at a time.
    ppc users (IBM ? ;-)) please wait a little bit.


author: Glauber Costa <glommer@redhat.com> - 0.92-0.1.kvm20090303git
changelog:
  - Set Epoch to 2
  - Set version to 0.92. It seems upstream keep changing minds here, so pick the lowest
  - Provides KVM, Obsoletes KVM
  - Only install qemu-kvm in ix86 and x86_64
  - Remove pkgdesc macros, as they were generating bogus output for rpm -qi.
  - fix ppc and ppc64 builds


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.5.kvm20090303git
changelog:
  - kvm.modules were being wrongly mentioned at %install.
  - update description for the x86 system package to include kvm support
  - build kvm's own bios. It is still necessary while kvm uses a slightly different
    irq routing mechanism


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.8.kvm20090310git
changelog:
  - fix Obsolete/Provides pair
  - Use kvm bios from bochs-bios package.
  - Using RPM_OPT_FLAGS in configure
  - Picked back audio-drv-list from kvm package


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.11.kvm20090323git
changelog:
  - Update to snapshot kvm20090323.
  - Removed patch2 (upstream).
  - use upstream's new split package.
  - --with-patched-kernel flag not needed anymore
  - Tell how to get the sources.


author: Glauber Costa <glommer@redhat.com> - 2:0.10-1
changelog:
  - Include debuginfo for qemu-img
  - Do not require qemu-common for qemu-img
  - Explicitly own each of the firmware files
  - remove firmwares for ppc and sparc. They should be provided by an external package.
    Not that the packages exists for sparc in the secondary arch repo as noarch, but they
    don't automatically get into main repos. Unfortunately it's the best we can do right
    now.
  - rollback a bit in time. Snapshot from avi's maint/2.6.30
    - this requires the sasl patches to come back.
    - with-patched-kernel comes back.


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10-5
changelog:
  - Fix vga segfault under kvm-autotest (#494002)
  - Kill kernelrelease hack; it's not needed
  - Build with "make V=1" for more verbose logs


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-1.kvm85
changelog:
  - Update to qemu-kvm-devel-85
  - kvm-85 is based on qemu development branch, currently version 0.10.50
  - Include new qemu-io utility in qemu-img package
  - Re-instate -help string for boot=on to fix virtio booting with libvirt
  - Drop upstreamed patches
  - Fix missing kernel/include/asm symlink in upstream tarball
  - Fix target-arm build
  - Fix build on ppc
  - Disable preadv()/pwritev() until bug #497429 is fixed
  - Kill more .kernelrelease uselessness
  - Make non-kvm qemu build verbose


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-5.kvm86
changelog:
  - Prevent locked cdrom eject - fixes hang at end of anaconda installs (#501412)
  - Avoid harmless 'unhandled wrmsr' warnings (#499712)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-6.kvm86
changelog:
  - Fix 'kernel requires an x86-64 CPU' error
  - BuildRequires ncurses-devel to enable '-curses' option (#504226)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-7.kvm87
changelog:
  - Update to kvm-87
  - Drop upstreamed patches
  - Cherry-pick new ppc build fix from upstream
  - Work around broken linux-user build on ppc
  - Fix hw/pcspk.c build with --disable-kvm
  - Re-enable preadv()/pwritev() since #497429 is long since fixed
  - Kill petalogix-s3adsp1800.dtb, since we don't ship the microblaze target


author: Daniel Berrange <berrange@lettuce.camlab.fab.redhat.com> - 2:0.10.50-10.kvm87
changelog:
  - Add udev rules to make /dev/kvm world accessible & group=kvm (rhbz #497341)
  - Create a kvm group if it doesn't exist (rhbz #346151)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-11.kvm88
changelog:
  - Update to kvm-88, see http://www.linux-kvm.org/page/ChangeLog
  - Package mutiboot.bin
  - Update for how extboot is built
  - Fix sf.net source URL
  - Drop qemu-fix-ppc-softmmu-kvm-disabled-build.patch
  - Drop qemu-fix-pcspk-build-with-kvm-disabled.patch
  - Cherry-pick fix for esound support build failure


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.1.rc1.rc0
changelog:
  - Update to qemu-kvm-0.11.0-rc1-rc0
  - This is a pre-release of the official -rc1
  - A vista installer regression is blocking the official -rc1 release
  - Drop qemu-prefer-sysfs-for-usb-host-devices.patch
  - Drop qemu-fix-build-for-esd-audio.patch
  - Drop qemu-slirp-Fix-guestfwd-for-incoming-data.patch
  - Add patch to ensure extboot.bin is installed


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-1
changelog:
  - Update to qemu-kvm-0.11.0-rc2
  - Drop upstreamed patches
  - extboot install now fixed upstream
  - Re-place TCG init fix (#516543) with the one gone upstream


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-4
changelog:
  - Use rtl8029 PXE rom for ne2k_pci, not ne (#526777)
  - Also, replace the gpxe-roms-qemu pkg requires with file-based requires


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
changelog:
  - Fix fs errors with virtio and qcow2 backing file (#524734)
  - Fix ksm initscript errors on kernel missing ksm (#527653)
  - Add missing Requires(post): getent, useradd, groupadd (#527087)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-12
changelog:
  - Fix a use-after-free crasher in the slirp code (#539583)
  - Fix overflow in the parallels image format support (#533573)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-5
changelog:
  - Avoid creating too large iovecs in multiwrite merge (#559717)
  - Don't try to set max_kernel_pages during ksm init on newer kernels (#558281)
  - Add logfile options for ksmtuned debug.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-1
changelog:
  - Update to 0.12.3 upstream
  - vhost-net migration/restart fixes
  - Add F-13 machine type
  - virtio-serial fixes


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-6
changelog:
  - Change requires to the noarch seabios-bin
  - Add ownership of docdir to qemu-common (#572110)
  - Fix "Cannot boot from non-existent NIC" error when using virt-install (#577851)


author: Dan Horák <dan[at]danny.cz> - 2:0.12.3-8
changelog:
  - Add avoid-llseek patch from upstream needed for building on s390(x)
  - Don't use parallel make on s390(x)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.3.20100809git25fdf4a
changelog:
  - Updates from upstream towards 0.13 stable
  - Fix requires on gpxe
  - enable spice now that buildreqs are in the repository.
  - ksmtrace has moved to a separate upstream package


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-1
changelog:
  - Update to 0.13.0 upstream release
  - Fixes for vhost
  - Fix mouse in certain guests (#636887)
  - Fix issues with WinXP guest install (#579348)
  - Resolve build issues with S390 (#639471)
  - Fix Windows XP on Raw Devices (#631591)


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.13.0-2
changelog:
  - Revert previous change
  - Make qemu-common own the /etc/qemu directory
  - Add /etc/qemu/target-x86_64.conf to qemu-system-x86 regardless
    of host architecture.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-0.1.20110210git7aa8c46
changelog:
  - Update git snapshot
  - Temporarily disable qemu-cris and qemu-sparc due to build errors (to be resolved shorly)


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.14.0-9
changelog:
  - Add BR libattr-devel.  This caused the -fstype option to be disabled.
    https://www.redhat.com/archives/libvir-list/2011-June/thread.html#01017


author: Hans de Goede <hdegoede@redhat.com> - 2:0.15.0-0.2.20110718525e3df
changelog:
  - Add support usb redirection over the network, see:
    http://fedoraproject.org/wiki/Features/UsbNetworkRedirection
  - Restore chardev flow control patches


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.15.0-2
changelog:
  - Add upstream qemu patch 'Allow to leave type on default in -machine'
    (2645c6dcaf6ea2a51a3b6dfa407dd203004e4d11).


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-4
changelog:
  - Enable DTrace tracing backend for SystemTAP (rhbz #737763)
  - Enable build with curl (rhbz #737006)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-1
changelog:
  - Require seabios-bin >= 0.6.0-2 (#741992)
  - Replace init scripts with systemd units (#741920)
  - Update to 0.15.1 stable upstream


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-4
changelog:
  - Disable tests since they hang intermittently.
  - Add kvmvapic.bin (replaces vapic.bin).
  - Add cpus-x86_64.conf.  qemu now creates /etc/qemu/target-x86_64.conf
    as an empty file.
  - Add qemu-icon.bmp.
  - Add qemu-bridge-helper.
  - Build and include virtfs-proxy-helper + man page (thanks Hans de Goede).


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-7
changelog:
  - Add patch to fix default machine options.  This fixes libvirt
    detection of qemu.
  - Back out patch 1 which conflicts.


author: Cole Robinson <crobinso@redhat.com> - 1.1.1-1
changelog:
  - Upstream stable release 1.1.1
  - Fix systemtap tapsets (bz 831763)
  - Fix VNC audio tunnelling (bz 840653)
  - Don't renable ksm on update (bz 815156)
  - Bump usbredir dep (bz 812097)
  - Fix RPM install error on non-virt machines (bz 660629)
  - Obsolete openbios to fix upgrade dependency issues (bz 694802)


author: Adam Jackson <ajax@redhat.com> 1.2.0-0.5.rc1
changelog:
  - Flip Requires: ceph >= foo to Conflicts: ceph < foo, so we pull in only the
    libraries which we need and not the rest of ceph which we don't.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-1
changelog:
  - New upstream release 1.2.0 final
  - Add support for Spice seamless migration
  - Add support for Spice dynamic monitors
  - Add support for usb-redir live migration


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.2.0-8
changelog:
  - Use 'global' instead of 'define', and underscore in definition name,
    n-v-r, and 'dist' tag of SLOF, all to fix RHBZ#855252.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-11
changelog:
  - Rebuild against latest spice-server and spice-protocol
  - Fix non-seamless migration failing with vms with usb-redir devices,
    to allow boxes to load such vms from disk


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-13
changelog:
  - Add ppc support to kvm.modules (original patch by David Gibson)
  - Replace x86only build with kvmonly build: add separate defines and
    conditionals for all packages, so that they can be chosen and
    renamed in kvmonly builds and so that qemu has the appropriate requires
  - Automatically pick libfdt dependancy
  - Add knob to disable spice+seccomp


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-16
changelog:
  - add s390x KVM support
  - distribute pre-built firmware or device trees for Alpha, Microblaze, S390
  - add missing system targets
  - add missing linux-user targets
  - fix previous commit


author: Cole Robinson <crobinso@redhat.com> - 2:1.2.0-18
changelog:
  - Fix loading arm initrd if kernel is very large (bz #862766)
  - Don't use reserved word 'function' in systemtap files (bz #870972)
  - Drop assertion that was triggering when pausing guests w/ qxl (bz


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-19
changelog:
  - Sync spice patches with upstream, minor bugfixes and set the qxl pci
    device revision to 4 by default, so that guests know they can use
    the new features


author: Cole Robinson <crobinso@redhat.com> - 2:1.3.0-1
changelog:
  - Switch base tarball from qemu-kvm to qemu
  - qemu 1.3 release
  - Option to use linux VFIO driver to assign PCI devices
  - Many USB3 improvements
  - New paravirtualized hardware random number generator device.
  - Support for Glusterfs volumes with "gluster://" -drive URI
  - Block job commands for live block commit and storage migration


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-3
changelog:
  - Remove dependency on bogus qemu-kvm-kvm package [bz#870343]
  - Resolves: bz#870343
    (qemu-kvm-1.2.0-16.el7 cant be installed)


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-5
changelog:
  - Fix patch contents for usb-redir (bz#895491)
  - Resolves: bz#895491
    (PATCH: 0110-usb-redir-Add-flow-control-support.patch has been mangled on rebase !!)


author: Alon Levy <alevy@redhat.com> - 3:1.3.0-6
changelog:
  - Bump epoch back to 3 since there has already been a 3 package release:
    3:1.2.0-20.el7 https://brewweb.devel.redhat.com/buildinfo?buildID=244866
  - Mark explicit libcacard dependency on new enough qemu-img to avoid conflict
    since /usr/bin/vscclient was moved from qemu-img to libcacard subpackage.


author: Michal Novotny <minovotn@redhat.com> - 3:1.3.0-8
changelog:
  - Missing package qemu-system-x86 in hardware certification kvm testing (bz#912433)
  - Resolves: bz#912433
    (Missing package qemu-system-x86 in hardware certification kvm testing)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.4.0-4
changelog:
  - Enable build of libcacard subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-img subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-guest-agent subpackage for non-x86_64 archs (bz #873174)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.5.0-2
changelog:
  - Enable werror (bz #948290)
  - Enable nbd driver (bz #875871)
  - Fix udev rules file location (bz #958860)
  - Remove +x bit from systemd unit files (bz #965000)
  - Drop unneeded kvm.modules on x86 (bz #963642)
  - Fix build flags
  - Enable libusb


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.1-2
changelog:
  - Fix package package version info (bz #952996)
  - pc: Replace upstream machine types by RHEL-7 types (bz #977864)
  - target-i386: Update model values on Conroe/Penryn/Nehalem CPU model (bz #861210)
  - target-i386: Set level=4 on Conroe/Penryn/Nehalem (bz #861210)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-2
changelog:
  - SPEC file prepared for RHEL/RHEV split (rhbz #987165)
  - RHEL guest( sata disk ) can not boot up (rhbz #981723)
  - Kill the "use flash device for BIOS unless KVM" misfeature (rhbz #963280)
  - Provide RHEL-6 machine types (rhbz #983991)
  - Change s3/s4 default to "disable". (rhbz #980840)  
  - Support Virtual Memory Disk Format in qemu (rhbz #836675)
  - Glusterfs backend for QEMU (rhbz #805139)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-3
changelog:
  - query mem info from monitor would cause qemu-kvm hang [RHEL-7] (rhbz #970047)
  - Throttle-down guest to help with live migration convergence (backport to RHEL7.0) (rhbz #985958)
  - disable (for now) EFI-enabled roms (rhbz #962563)
  - qemu-kvm "vPMU passthrough" mode breaks migration, shouldn't be enabled by default (rhbz #853101)
  - Remove pending watches after virtserialport unplug (rhbz #992900)
  - Containment of error when an SR-IOV device encounters an error... (rhbz #984604)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-4
changelog:
  - qemu: guest agent creates files with insecure permissions in deamon mode [rhel-7.0] (rhbz 974444)
  - update qemu-ga config & init script in RHEL7 wrt. fsfreeze hook (rhbz 969942)
  - RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump (rhbz 903910)
  - SEP flag behavior for CPU models of RHEL6 machine types should be compatible (rhbz 960216)
  - crash command can not read the dump-guest-memory file when paging=false [RHEL-7] (rhbz 981582)
  - RHEL 7 qemu-kvm fails to build on F19 host due to libusb deprecated API (rhbz 996469)
  - Live migration support in virtio-blk-data-plane (rhbz 995030)
  - qemu-img resize can execute successfully even input invalid syntax (rhbz 992935)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-2.el7
changelog:
  - kvm-osdep-add-qemu_get_local_state_pathname.patch [bz#964304]
  - kvm-qga-determine-default-state-dir-and-pidfile-dynamica.patch [bz#964304]
  - kvm-configure-don-t-save-any-fixed-local_statedir-for-wi.patch [bz#964304]
  - kvm-qga-create-state-directory-on-win32.patch [bz#964304]
  - kvm-qga-save-state-directory-in-ga_install_service-RHEL-.patch [bz#964304]
  - kvm-Makefile-create-.-var-run-when-installing-the-POSIX-.patch [bz#964304]
  - kvm-qemu-option-Fix-qemu_opts_find-for-null-id-arguments.patch [bz#980782]
  - kvm-qemu-option-Fix-qemu_opts_set_defaults-for-corner-ca.patch [bz#980782]
  - kvm-vl-New-qemu_get_machine_opts.patch [bz#980782]
  - kvm-Fix-machine-options-accel-kernel_irqchip-kvm_shadow_.patch [bz#980782]
  - kvm-microblaze-Fix-latent-bug-with-default-DTB-lookup.patch [bz#980782]
  - kvm-Simplify-machine-option-queries-with-qemu_get_machin.patch [bz#980782]
  - kvm-pci-add-VMSTATE_MSIX.patch [bz#838170]
  - kvm-xhci-add-XHCISlot-addressed.patch [bz#838170]
  - kvm-xhci-add-xhci_alloc_epctx.patch [bz#838170]
  - kvm-xhci-add-xhci_init_epctx.patch [bz#838170]
  - kvm-xhci-add-live-migration-support.patch [bz#838170]
  - kvm-pc-set-level-xlevel-correctly-on-486-qemu32-CPU-mode.patch [bz#918907]
  - kvm-pc-Remove-incorrect-rhel6.x-compat-model-value-for-C.patch [bz#918907]
  - kvm-pc-rhel6.x-has-x2apic-present-on-Conroe-Penryn-Nehal.patch [bz#918907]
  - kvm-pc-set-compat-CPUID-0x80000001-.EDX-bits-on-Westmere.patch [bz#918907]
  - kvm-pc-Remove-PCLMULQDQ-from-Westmere-on-rhel6.x-machine.patch [bz#918907]
  - kvm-pc-SandyBridge-rhel6.x-compat-fixes.patch [bz#918907]
  - kvm-pc-Haswell-doesn-t-have-rdtscp-on-rhel6.x.patch [bz#918907]
  - kvm-i386-fix-LAPIC-TSC-deadline-timer-save-restore.patch [bz#972433]
  - kvm-all.c-max_cpus-should-not-exceed-KVM-vcpu-limit.patch [bz#996258]
  - kvm-add-timestamp-to-error_report.patch [bz#906937]
  - kvm-Convert-stderr-message-calling-error_get_pretty-to-e.patch [bz#906937]
  - Resolves: bz#838170
    (Add live migration support for USB [xhci, usb-uas])
  - Resolves: bz#906937
    ([Hitachi 7.0 FEAT][QEMU]Add a time stamp to error message (*))
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#964304
    (Windows guest agent service failed to be started)
  - Resolves: bz#972433
    ("INFO: rcu_sched detected stalls" after RHEL7 kvm vm migrated)
  - Resolves: bz#980782
    (kernel_irqchip defaults to off instead of on without -machine)
  - Resolves: bz#996258
    (boot guest with maxcpu=255 successfully but actually max number of vcpu is 160)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-1.5.3-4.el7
changelog:
  - kvm-block-package-preparation-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-move-input-parsing-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-package-committing-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-package-rollback-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-make-all-steps-in-qmp_transaction-as-callback.patch [bz#1005818]
  - kvm-blockdev-drop-redundant-proto_drv-check.patch [bz#1005818]
  - kvm-block-Don-t-parse-protocol-from-file.filename.patch [bz#1005818]
  - kvm-Revert-block-Disable-driver-specific-options-for-1.5.patch [bz#1005818]
  - kvm-qcow2-Add-refcount-update-reason-to-all-callers.patch [bz#1005818]
  - kvm-qcow2-Options-to-enable-discard-for-freed-clusters.patch [bz#1005818]
  - kvm-qcow2-Batch-discards.patch [bz#1005818]
  - kvm-block-Always-enable-discard-on-the-protocol-level.patch [bz#1005818]
  - kvm-qapi.py-Avoid-code-duplication.patch [bz#1005818]
  - kvm-qapi.py-Allow-top-level-type-reference-for-command-d.patch [bz#1005818]
  - kvm-qapi-schema-Use-BlockdevSnapshot-type-for-blockdev-s.patch [bz#1005818]
  - kvm-qapi-types.py-Implement-base-for-unions.patch [bz#1005818]
  - kvm-qapi-visit.py-Split-off-generate_visit_struct_fields.patch [bz#1005818]
  - kvm-qapi-visit.py-Implement-base-for-unions.patch [bz#1005818]
  - kvm-docs-Document-QAPI-union-types.patch [bz#1005818]
  - kvm-qapi-Add-visitor-for-implicit-structs.patch [bz#1005818]
  - kvm-qapi-Flat-unions-with-arbitrary-discriminator.patch [bz#1005818]
  - kvm-qapi-Add-consume-argument-to-qmp_input_get_object.patch [bz#1005818]
  - kvm-qapi.py-Maintain-a-list-of-union-types.patch [bz#1005818]
  - kvm-qapi-qapi-types.py-native-list-support.patch [bz#1005818]
  - kvm-qapi-Anonymous-unions.patch [bz#1005818]
  - kvm-block-Allow-driver-option-on-the-top-level.patch [bz#1005818]
  - kvm-QemuOpts-Add-qemu_opt_unset.patch [bz#1005818]
  - kvm-blockdev-Rename-I-O-throttling-options-for-QMP.patch [bz#1005818]
  - kvm-qemu-iotests-Update-051-reference-output.patch [bz#1005818]
  - kvm-blockdev-Rename-readonly-option-to-read-only.patch [bz#1005818]
  - kvm-blockdev-Split-up-cache-option.patch [bz#1005818]
  - kvm-qcow2-Use-dashes-instead-of-underscores-in-options.patch [bz#1005818]
  - kvm-qemu-iotests-filter-QEMU-version-in-monitor-banner.patch [bz#1006959]
  - kvm-tests-set-MALLOC_PERTURB_-to-expose-memory-bugs.patch [bz#1006959]
  - kvm-qemu-iotests-Whitespace-cleanup.patch [bz#1006959]
  - kvm-qemu-iotests-Fixed-test-case-026.patch [bz#1006959]
  - kvm-qemu-iotests-Fix-test-038.patch [bz#1006959]
  - kvm-qemu-iotests-Remove-lsi53c895a-tests-from-051.patch [bz#1006959]
  - Resolves: bz#1005818
    (qcow2: Backport discard command line options)
  - Resolves: bz#1006959
    (qemu-iotests false positives)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-7.el7
changelog:
  - kvm-spice-fix-display-initialization.patch [bz#974887]
  - kvm-Remove-i82550-network-card-emulation.patch [bz#921983]
  - kvm-Remove-usb-wacom-tablet.patch [bz#903914]
  - kvm-Disable-usb-uas.patch [bz#903914]
  - kvm-Disable-vhost-scsi.patch [bz#994642]
  - kvm-Remove-no-hpet-option.patch [bz#947441]
  - kvm-Disable-isa-parallel.patch [bz#1002286]
  - kvm-xhci-implement-warm-port-reset.patch [bz#949514]
  - kvm-usb-add-serial-bus-property.patch [bz#953304]
  - kvm-rhel6-compat-usb-serial-numbers.patch [bz#953304]
  - kvm-vmdk-fix-comment-for-vmdk_co_write_zeroes.patch [bz#995866]
  - kvm-gluster-Add-image-resize-support.patch [bz#1007226]
  - kvm-block-Introduce-bs-zero_beyond_eof.patch [bz#1007226]
  - kvm-block-Produce-zeros-when-protocols-reading-beyond-en.patch [bz#1007226]
  - kvm-gluster-Abort-on-AIO-completion-failure.patch [bz#1007226]
  - kvm-Preparation-for-usb-bt-dongle-conditional-build.patch [bz#1001131]
  - kvm-Remove-dev-bluetooth.c-dependency-from-vl.c.patch [bz#1001131]
  - kvm-exec-Fix-Xen-RAM-allocation-with-unusual-options.patch [bz#1009328]
  - kvm-exec-Clean-up-fall-back-when-mem-path-allocation-fai.patch [bz#1009328]
  - kvm-exec-Reduce-ifdeffery-around-mem-path.patch [bz#1009328]
  - kvm-exec-Simplify-the-guest-physical-memory-allocation-h.patch [bz#1009328]
  - kvm-exec-Drop-incorrect-dead-S390-code-in-qemu_ram_remap.patch [bz#1009328]
  - kvm-exec-Clean-up-unnecessary-S390-ifdeffery.patch [bz#1009328]
  - kvm-exec-Don-t-abort-when-we-can-t-allocate-guest-memory.patch [bz#1009328]
  - kvm-pc_sysfw-Fix-ISA-BIOS-init-for-ridiculously-big-flas.patch [bz#1009328]
  - kvm-virtio-scsi-Make-type-virtio-scsi-common-abstract.patch [bz#903918]
  - kvm-qga-move-logfiles-to-new-directory-for-easier-SELinu.patch [bz#1009491]
  - kvm-target-i386-add-cpu64-rhel6-CPU-model.patch [bz#918907]
  - kvm-fix-steal-time-MSR-vmsd-callback-to-proper-opaque-ty.patch [bz#903889]
  - Resolves: bz#1001131
    (Disable or remove device usb-bt-dongle)
  - Resolves: bz#1002286
    (Disable or remove device isa-parallel)
  - Resolves: bz#1007226
    (Introduce bs->zero_beyond_eof)
  - Resolves: bz#1009328
    ([RFE] Nicer error report when qemu-kvm can't allocate guest RAM)
  - Resolves: bz#1009491
    (move qga logfiles to new /var/log/qemu-ga/ directory [RHEL-7])
  - Resolves: bz#903889
    (The value of steal time in "top" command always is "0.0% st" after guest migration)
  - Resolves: bz#903914
    (Disable or remove usb related devices that we will not support)
  - Resolves: bz#903918
    (Disable or remove emulated SCSI devices we will not support)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#921983
    (Disable or remove emulated network devices that we will not support)
  - Resolves: bz#947441
    (HPET device must be disabled)
  - Resolves: bz#949514
    (fail to passthrough the USB3.0 stick to windows guest with xHCI controller under pc-i440fx-1.4)
  - Resolves: bz#953304
    (Serial number of some USB devices must be fixed for older RHEL machine types)
  - Resolves: bz#974887
    (the screen of guest fail to display correctly when use spice + qxl driver)
  - Resolves: bz#994642
    (should disable vhost-scsi)
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-8.el7
changelog:
  - kvm-vmdk-Make-VMDK3Header-and-VmdkGrainMarker-QEMU_PACKE.patch [bz#995866]
  - kvm-vmdk-use-unsigned-values-for-on-disk-header-fields.patch [bz#995866]
  - kvm-qemu-iotests-add-poke_file-utility-function.patch [bz#995866]
  - kvm-qemu-iotests-add-empty-test-case-for-vmdk.patch [bz#995866]
  - kvm-vmdk-check-granularity-field-in-opening.patch [bz#995866]
  - kvm-vmdk-check-l2-table-size-when-opening.patch [bz#995866]
  - kvm-vmdk-check-l1-size-before-opening-image.patch [bz#995866]
  - kvm-vmdk-use-heap-allocation-for-whole_grain.patch [bz#995866]
  - kvm-vmdk-rename-num_gtes_per_gte-to-num_gtes_per_gt.patch [bz#995866]
  - kvm-vmdk-Move-l1_size-check-into-vmdk_add_extent.patch [bz#995866]
  - kvm-vmdk-fix-L1-and-L2-table-size-in-vmdk3-open.patch [bz#995866]
  - kvm-vmdk-support-vmfsSparse-files.patch [bz#995866]
  - kvm-vmdk-support-vmfs-files.patch [bz#995866]
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-9.el7
changelog:
  - kvm-qxl-fix-local-renderer.patch [bz#1005036]
  - kvm-spec-include-userspace-iSCSI-initiator-in-block-driv.patch [bz#923843]
  - kvm-linux-headers-update-to-kernel-3.10.0-26.el7.patch [bz#1008987]
  - kvm-target-i386-add-feature-kvm_pv_unhalt.patch [bz#1008987]
  - kvm-warn-if-num-cpus-is-greater-than-num-recommended.patch [bz#1010881]
  - kvm-char-move-backends-io-watch-tag-to-CharDriverState.patch [bz#1007222]
  - kvm-char-use-common-function-to-disable-callbacks-on-cha.patch [bz#1007222]
  - kvm-char-remove-watch-callback-on-chardev-detach-from-fr.patch [bz#1007222]
  - kvm-block-don-t-lose-data-from-last-incomplete-sector.patch [bz#1017049]
  - kvm-vmdk-fix-cluster-size-check-for-flat-extents.patch [bz#1017049]
  - kvm-qemu-iotests-add-monolithicFlat-creation-test-to-059.patch [bz#1017049]
  - Resolves: bz#1005036
    (When using “-vga qxl” together with “-display vnc=:5” or “-display  sdl” qemu displays  pixel garbage)
  - Resolves: bz#1007222
    (QEMU core dumped when do hot-unplug virtio serial port during transfer file between host to guest with virtio serial through TCP socket)
  - Resolves: bz#1008987
    (pvticketlocks: add kvm feature kvm_pv_unhalt)
  - Resolves: bz#1010881
    (backport vcpu soft limit warning)
  - Resolves: bz#1017049
    (qemu-img refuses to open the vmdk format image its created)
  - Resolves: bz#923843
    (include userspace iSCSI initiator in block driver whitelist)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-10.el7
changelog:
  - kvm-xhci-fix-endpoint-interval-calculation.patch [bz#1001604]
  - kvm-xhci-emulate-intr-endpoint-intervals-correctly.patch [bz#1001604]
  - kvm-xhci-reset-port-when-disabling-slot.patch [bz#1001604]
  - kvm-Revert-usb-hub-report-status-changes-only-once.patch [bz#1001604]
  - kvm-target-i386-Set-model-6-on-qemu64-qemu32-CPU-models.patch [bz#1004290]
  - kvm-pc-rhel6-doesn-t-have-APIC-on-pentium-CPU-models.patch [bz#918907]
  - kvm-pc-RHEL-6-had-x2apic-set-on-Opteron_G-123.patch [bz#918907]
  - kvm-pc-RHEL-6-don-t-have-RDTSCP.patch [bz#918907]
  - kvm-scsi-Fix-scsi_bus_legacy_add_drive-scsi-generic-with.patch [bz#1009285]
  - kvm-seccomp-fine-tuning-whitelist-by-adding-times.patch [bz#1004175]
  - kvm-block-add-bdrv_write_zeroes.patch [bz#921465]
  - kvm-block-raw-add-bdrv_co_write_zeroes.patch [bz#921465]
  - kvm-rdma-export-qemu_fflush.patch [bz#921465]
  - kvm-block-migration-efficiently-encode-zero-blocks.patch [bz#921465]
  - kvm-Fix-real-mode-guest-migration.patch [bz#921465]
  - kvm-Fix-real-mode-guest-segments-dpl-value-in-savevm.patch [bz#921465]
  - kvm-migration-add-autoconvergence-documentation.patch [bz#921465]
  - kvm-migration-send-total-time-in-QMP-at-completed-stage.patch [bz#921465]
  - kvm-migration-don-t-use-uninitialized-variables.patch [bz#921465]
  - kvm-pc-drop-external-DSDT-loading.patch [bz#921465]
  - kvm-hda-codec-refactor-common-definitions-into-a-header-.patch [bz#954195]
  - kvm-hda-codec-make-mixemu-selectable-at-runtime.patch [bz#954195]
  - kvm-audio-remove-CONFIG_MIXEMU-configure-option.patch [bz#954195]
  - kvm-pc_piix-disable-mixer-for-6.4.0-machine-types-and-be.patch [bz#954195]
  - kvm-spec-mixemu-config-option-is-no-longer-supported-and.patch [bz#954195]
  - Resolves: bz#1001604
    (usb hub doesn't work properly (win7 sees downstream port #1 only).)
  - Resolves: bz#1004175
    ('-sandbox on'  option  cause  qemu-kvm process hang)
  - Resolves: bz#1004290
    (Use model 6 for qemu64 and intel cpus)
  - Resolves: bz#1009285
    (-device usb-storage,serial=... crashes with SCSI generic drive)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#921465
    (Migration can not finished even the "remaining ram" is already 0 kb)
  - Resolves: bz#954195
    (RHEL machines <=6.4 should not use mixemu)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-11.el7
changelog:
  - kvm-chardev-fix-pty_chr_timer.patch [bz#994414]
  - kvm-qemu-socket-zero-initialize-SocketAddress.patch [bz#922010]
  - kvm-qemu-socket-drop-pointless-allocation.patch [bz#922010]
  - kvm-qemu-socket-catch-monitor_get_fd-failures.patch [bz#922010]
  - kvm-qemu-char-check-optional-fields-using-has_.patch [bz#922010]
  - kvm-error-add-error_setg_file_open-helper.patch [bz#922010]
  - kvm-qemu-char-use-more-specific-error_setg_-variants.patch [bz#922010]
  - kvm-qemu-char-print-notification-to-stderr.patch [bz#922010]
  - kvm-qemu-char-fix-documentation-for-telnet-wait-socket-f.patch [bz#922010]
  - kvm-qemu-char-don-t-leak-opts-on-error.patch [bz#922010]
  - kvm-qemu-char-use-ChardevBackendKind-in-CharDriver.patch [bz#922010]
  - kvm-qemu-char-minor-mux-chardev-fixes.patch [bz#922010]
  - kvm-qemu-char-add-chardev-mux-support.patch [bz#922010]
  - kvm-qemu-char-report-udp-backend-errors.patch [bz#922010]
  - kvm-qemu-socket-don-t-leak-opts-on-error.patch [bz#922010]
  - kvm-chardev-handle-qmp_chardev_add-KIND_MUX-failure.patch [bz#922010]
  - kvm-acpi-piix4-Enable-qemu-kvm-compatibility-mode.patch [bz#1019474]
  - kvm-target-i386-support-loading-of-cpu-xsave-subsection.patch [bz#1004743]
  - Resolves: bz#1004743
    (XSAVE migration format not compatible between RHEL6 and RHEL7)
  - Resolves: bz#1019474
    (RHEL-7 can't load piix4_pm migration section from RHEL-6.5)
  - Resolves: bz#922010
    (RFE: support hotplugging chardev & serial ports)
  - Resolves: bz#994414
    (hot-unplug chardev with pty backend caused qemu Segmentation fault)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-12.el7
changelog:
  - kvm-vl-Clean-up-parsing-of-boot-option-argument.patch [bz#997817]
  - kvm-qemu-option-check_params-is-now-unused-drop-it.patch [bz#997817]
  - kvm-vl-Fix-boot-order-and-once-regressions-and-related-b.patch [bz#997817]
  - kvm-vl-Rename-boot_devices-to-boot_order-for-consistency.patch [bz#997817]
  - kvm-pc-Make-no-fd-bootchk-stick-across-boot-order-change.patch [bz#997817]
  - kvm-doc-Drop-ref-to-Bochs-from-no-fd-bootchk-documentati.patch [bz#997817]
  - kvm-libqtest-Plug-fd-and-memory-leaks-in-qtest_quit.patch [bz#997817]
  - kvm-libqtest-New-qtest_end-to-go-with-qtest_start.patch [bz#997817]
  - kvm-qtest-Don-t-reset-on-qtest-chardev-connect.patch [bz#997817]
  - kvm-boot-order-test-New-covering-just-PC-for-now.patch [bz#997817]
  - kvm-qemu-ga-execute-fsfreeze-freeze-in-reverse-order-of-.patch [bz#1019352]
  - kvm-rbd-link-and-load-librbd-dynamically.patch [bz#989608]
  - kvm-rbd-Only-look-for-qemu-specific-copy-of-librbd.so.1.patch [bz#989608]
  - kvm-spec-Whitelist-rbd-block-driver.patch [bz#989608]
  - Resolves: bz#1019352
    (qemu-guest-agent: "guest-fsfreeze-freeze" deadlocks if the guest have mounted disk images)
  - Resolves: bz#989608
    ([7.0 FEAT] qemu runtime support for librbd backend (ceph))
  - Resolves: bz#997817
    (-boot order and -boot once regressed since RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-13.el7
changelog:
  - kvm-seabios-paravirt-allow-more-than-1TB-in-x86-guest.patch [bz#989677]
  - kvm-scsi-prefer-UUID-to-VM-name-for-the-initiator-name.patch [bz#1006468]
  - kvm-Fix-incorrect-rhel_rhev_conflicts-macro-usage.patch [bz#1017693]
  - Resolves: bz#1006468
    (libiscsi initiator name should use vm UUID)
  - Resolves: bz#1017693
    (incorrect use of rhel_rhev_conflicts)
  - Resolves: bz#989677
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-14.el7
changelog:
  - kvm-target-i386-remove-tabs-from-target-i386-cpu.h.patch [bz#928867]
  - kvm-migrate-vPMU-state.patch [bz#928867]
  - kvm-blockdev-do-not-default-cache.no-flush-to-true.patch [bz#1009993]
  - kvm-virtio-blk-do-not-relay-a-previous-driver-s-WCE-conf.patch [bz#1009993]
  - kvm-rng-random-use-error_setg_file_open.patch [bz#907743]
  - kvm-block-mirror_complete-use-error_setg_file_open.patch [bz#907743]
  - kvm-blockdev-use-error_setg_file_open.patch [bz#907743]
  - kvm-cpus-use-error_setg_file_open.patch [bz#907743]
  - kvm-dump-qmp_dump_guest_memory-use-error_setg_file_open.patch [bz#907743]
  - kvm-savevm-qmp_xen_save_devices_state-use-error_setg_fil.patch [bz#907743]
  - kvm-block-bdrv_reopen_prepare-don-t-use-QERR_OPEN_FILE_F.patch [bz#907743]
  - kvm-qerror-drop-QERR_OPEN_FILE_FAILED-macro.patch [bz#907743]
  - kvm-rhel-Drop-ivshmem-device.patch [bz#787463]
  - kvm-usb-remove-old-usb-host-code.patch [bz#1001144]
  - kvm-Add-rhel6-pxe-roms-files.patch [bz#997702]
  - kvm-Add-rhel6-pxe-rom-to-redhat-rpm.patch [bz#997702]
  - kvm-Fix-migration-from-rhel6.5-to-rhel7-with-ipxe.patch [bz#997702]
  - kvm-pc-Don-t-prematurely-explode-QEMUMachineInitArgs.patch [bz#994490]
  - kvm-pc-Don-t-explode-QEMUMachineInitArgs-into-local-vari.patch [bz#994490]
  - kvm-smbios-Normalize-smbios_entry_add-s-error-handling-t.patch [bz#994490]
  - kvm-smbios-Convert-to-QemuOpts.patch [bz#994490]
  - kvm-smbios-Improve-diagnostics-for-conflicting-entries.patch [bz#994490]
  - kvm-smbios-Make-multiple-smbios-type-accumulate-sanely.patch [bz#994490]
  - kvm-smbios-Factor-out-smbios_maybe_add_str.patch [bz#994490]
  - kvm-hw-Pass-QEMUMachine-to-its-init-method.patch [bz#994490]
  - kvm-smbios-Set-system-manufacturer-product-version-by-de.patch [bz#994490]
  - kvm-smbios-Decouple-system-product-from-QEMUMachine.patch [bz#994490]
  - kvm-rhel-SMBIOS-type-1-branding.patch [bz#994490]
  - kvm-Add-disable-rhev-features-option-to-configure.patch []
  - Resolves: bz#1001144
    (Disable or remove device usb-host-linux)
  - Resolves: bz#1009993
    (RHEL7 guests do not issue fdatasyncs on virtio-blk)
  - Resolves: bz#787463
    (disable ivshmem (was: [Hitachi 7.0 FEAT] Support ivshmem (Inter-VM Shared Memory)))
  - Resolves: bz#907743
    (qemu-ga: empty reason string for OpenFileFailed error)
  - Resolves: bz#928867
    (Virtual PMU support during live migration - qemu-kvm)
  - Resolves: bz#994490
    (Set per-machine-type SMBIOS strings)
  - Resolves: bz#997702
    (Migration from RHEL6.5 host to RHEL7.0 host is failed with virtio-net device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-15.el7
changelog:
  - kvm-cow-make-reads-go-at-a-decent-speed.patch [bz#989646]
  - kvm-cow-make-writes-go-at-a-less-indecent-speed.patch [bz#989646]
  - kvm-cow-do-not-call-bdrv_co_is_allocated.patch [bz#989646]
  - kvm-block-keep-bs-total_sectors-up-to-date-even-for-grow.patch [bz#989646]
  - kvm-block-make-bdrv_co_is_allocated-static.patch [bz#989646]
  - kvm-block-do-not-use-total_sectors-in-bdrv_co_is_allocat.patch [bz#989646]
  - kvm-block-remove-bdrv_is_allocated_above-bdrv_co_is_allo.patch [bz#989646]
  - kvm-block-expect-errors-from-bdrv_co_is_allocated.patch [bz#989646]
  - kvm-block-Fix-compiler-warning-Werror-uninitialized.patch [bz#989646]
  - kvm-qemu-img-always-probe-the-input-image-for-allocated-.patch [bz#989646]
  - kvm-block-make-bdrv_has_zero_init-return-false-for-copy-.patch [bz#989646]
  - kvm-block-introduce-bdrv_get_block_status-API.patch [bz#989646]
  - kvm-block-define-get_block_status-return-value.patch [bz#989646]
  - kvm-block-return-get_block_status-data-and-flags-for-for.patch [bz#989646]
  - kvm-block-use-bdrv_has_zero_init-to-return-BDRV_BLOCK_ZE.patch [bz#989646]
  - kvm-block-return-BDRV_BLOCK_ZERO-past-end-of-backing-fil.patch [bz#989646]
  - kvm-qemu-img-add-a-map-subcommand.patch [bz#989646]
  - kvm-docs-qapi-document-qemu-img-map.patch [bz#989646]
  - kvm-raw-posix-return-get_block_status-data-and-flags.patch [bz#989646]
  - kvm-raw-posix-report-unwritten-extents-as-zero.patch [bz#989646]
  - kvm-block-add-default-get_block_status-implementation-fo.patch [bz#989646]
  - kvm-block-look-for-zero-blocks-in-bs-file.patch [bz#989646]
  - kvm-qemu-img-fix-invalid-JSON.patch [bz#989646]
  - kvm-block-get_block_status-set-pnum-0-on-error.patch [bz#989646]
  - kvm-block-get_block_status-avoid-segfault-if-there-is-no.patch [bz#989646]
  - kvm-block-get_block_status-avoid-redundant-callouts-on-r.patch [bz#989646]
  - kvm-qcow2-Restore-total_sectors-value-in-save_vmstate.patch [bz#1025740]
  - kvm-qcow2-Unset-zero_beyond_eof-in-save_vmstate.patch [bz#1025740]
  - kvm-qemu-iotests-Test-for-loading-VM-state-from-qcow2.patch [bz#1025740]
  - kvm-apic-rename-apic-specific-bitopts.patch [bz#1001216]
  - kvm-hw-import-bitmap-operations-in-qdev-core-header.patch [bz#1001216]
  - kvm-qemu-help-Sort-devices-by-logical-functionality.patch [bz#1001216]
  - kvm-devices-Associate-devices-to-their-logical-category.patch [bz#1001216]
  - kvm-Mostly-revert-qemu-help-Sort-devices-by-logical-func.patch [bz#1001216]
  - kvm-qdev-monitor-Group-device_add-help-and-info-qdm-by-c.patch [bz#1001216]
  - kvm-qdev-Replace-no_user-by-cannot_instantiate_with_devi.patch [bz#1001216]
  - kvm-sysbus-Set-cannot_instantiate_with_device_add_yet.patch [bz#1001216]
  - kvm-cpu-Document-why-cannot_instantiate_with_device_add_.patch [bz#1001216]
  - kvm-apic-Document-why-cannot_instantiate_with_device_add.patch [bz#1001216]
  - kvm-pci-host-Consistently-set-cannot_instantiate_with_de.patch [bz#1001216]
  - kvm-ich9-Document-why-cannot_instantiate_with_device_add.patch [bz#1001216]
  - kvm-piix3-piix4-Clean-up-use-of-cannot_instantiate_with_.patch [bz#1001216]
  - kvm-vt82c686-Clean-up-use-of-cannot_instantiate_with_dev.patch [bz#1001216]
  - kvm-isa-Clean-up-use-of-cannot_instantiate_with_device_a.patch [bz#1001216]
  - kvm-qdev-Do-not-let-the-user-try-to-device_add-when-it-c.patch [bz#1001216]
  - kvm-rhel-Revert-unwanted-cannot_instantiate_with_device_.patch [bz#1001216]
  - kvm-rhel-Revert-downstream-changes-to-unused-default-con.patch [bz#1001076]
  - kvm-rhel-Drop-cfi.pflash01-and-isa-ide-device.patch [bz#1001076]
  - kvm-rhel-Drop-isa-vga-device.patch [bz#1001088]
  - kvm-rhel-Make-isa-cirrus-vga-device-unavailable.patch [bz#1001088]
  - kvm-rhel-Make-ccid-card-emulated-device-unavailable.patch [bz#1001123]
  - kvm-x86-fix-migration-from-pre-version-12.patch [bz#1005695]
  - kvm-x86-cpuid-reconstruct-leaf-0Dh-data.patch [bz#1005695]
  - kvm-kvmvapic-Catch-invalid-ROM-size.patch [bz#920021]
  - kvm-kvmvapic-Enter-inactive-state-on-hardware-reset.patch [bz#920021]
  - kvm-kvmvapic-Clear-also-physical-ROM-address-when-enteri.patch [bz#920021]
  - kvm-block-optionally-disable-live-block-jobs.patch [bz#987582]
  - kvm-rpm-spec-template-disable-live-block-ops-for-rhel-en.patch [bz#987582]
  - kvm-migration-disable-live-block-migration-b-i-for-rhel-.patch [bz#1022392]
  - kvm-Build-ceph-rbd-only-for-rhev.patch [bz#987583]
  - kvm-spec-Disable-host-cdrom-RHEL-only.patch [bz#760885]
  - kvm-rhel-Make-pci-serial-2x-and-pci-serial-4x-device-una.patch [bz#1001180]
  - kvm-usb-host-libusb-Fix-reset-handling.patch [bz#980415]
  - kvm-usb-host-libusb-Configuration-0-may-be-a-valid-confi.patch [bz#980383]
  - kvm-usb-host-libusb-Detach-kernel-drivers-earlier.patch [bz#980383]
  - kvm-monitor-Remove-pci_add-command-for-Red-Hat-Enterpris.patch [bz#1010858]
  - kvm-monitor-Remove-pci_del-command-for-Red-Hat-Enterpris.patch [bz#1010858]
  - kvm-monitor-Remove-usb_add-del-commands-for-Red-Hat-Ente.patch [bz#1010858]
  - kvm-monitor-Remove-host_net_add-remove-for-Red-Hat-Enter.patch [bz#1010858]
  - kvm-fw_cfg-add-API-to-find-FW-cfg-object.patch [bz#990601]
  - kvm-pvpanic-use-FWCfgState-explicitly.patch [bz#990601]
  - kvm-pvpanic-initialization-cleanup.patch [bz#990601]
  - kvm-pvpanic-fix-fwcfg-for-big-endian-hosts.patch [bz#990601]
  - kvm-hw-misc-make-pvpanic-known-to-user.patch [bz#990601]
  - kvm-gdbstub-do-not-restart-crashed-guest.patch [bz#990601]
  - kvm-gdbstub-fix-for-commit-87f25c12bfeaaa0c41fb857713bbc.patch [bz#990601]
  - kvm-vl-allow-cont-from-panicked-state.patch [bz#990601]
  - kvm-hw-misc-don-t-create-pvpanic-device-by-default.patch [bz#990601]
  - kvm-block-vhdx-add-migration-blocker.patch [bz#1007176]
  - kvm-qemu-kvm.spec-add-vhdx-to-the-read-only-block-driver.patch [bz#1007176]
  - kvm-qemu-kvm.spec-Add-VPC-VHD-driver-to-the-block-read-o.patch [bz#1007176]
  - Resolves: bz#1001076
    (Disable or remove other block devices we won't support)
  - Resolves: bz#1001088
    (Disable or remove display devices we won't support)
  - Resolves: bz#1001123
    (Disable or remove device ccid-card-emulated)
  - Resolves: bz#1001180
    (Disable or remove devices pci-serial-2x, pci-serial-4x)
  - Resolves: bz#1001216
    (Fix no_user or provide another way make devices unavailable with -device / device_add)
  - Resolves: bz#1005695
    (QEMU should hide CPUID.0Dh values that it does not support)
  - Resolves: bz#1007176
    (Add VPC and VHDX file formats as supported in qemu-kvm (read-only))
  - Resolves: bz#1010858
    (Disable unused human monitor commands)
  - Resolves: bz#1022392
    (Disable live-storage-migration in qemu-kvm (migrate -b/-i))
  - Resolves: bz#1025740
    (Saving VM state on qcow2 images results in VM state corruption)
  - Resolves: bz#760885
    (Disable host cdrom passthrough)
  - Resolves: bz#920021
    (qemu-kvm segment fault when reboot guest after hot unplug device with option ROM)
  - Resolves: bz#980383
    (The usb3.0 stick can't be returned back to host after shutdown guest with usb3.0 pass-through)
  - Resolves: bz#980415
    (libusbx: error [_open_sysfs_attr] open /sys/bus/usb/devices/4-1/bConfigurationValue failed ret=-1 errno=2)
  - Resolves: bz#987582
    (Initial Virtualization Differentiation for RHEL7 (Live snapshots))
  - Resolves: bz#987583
    (Initial Virtualization Differentiation for RHEL7 (Ceph enablement))
  - Resolves: bz#989646
    (Support backup vendors in qemu to access qcow disk readonly)
  - Resolves: bz#990601
    (pvpanic device triggers guest bugs when present by default)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-16.el7
changelog:
  - kvm-block-drop-bs_snapshots-global-variable.patch [bz#1026524]
  - kvm-block-move-snapshot-code-in-block.c-to-block-snapsho.patch [bz#1026524]
  - kvm-block-fix-vvfat-error-path-for-enable_write_target.patch [bz#1026524]
  - kvm-block-Bugfix-format-and-snapshot-used-in-drive-optio.patch [bz#1026524]
  - kvm-iscsi-use-bdrv_new-instead-of-stack-structure.patch [bz#1026524]
  - kvm-qcow2-Add-corrupt-bit.patch [bz#1004347]
  - kvm-qcow2-Metadata-overlap-checks.patch [bz#1004347]
  - kvm-qcow2-Employ-metadata-overlap-checks.patch [bz#1004347]
  - kvm-qcow2-refcount-Move-OFLAG_COPIED-checks.patch [bz#1004347]
  - kvm-qcow2-refcount-Repair-OFLAG_COPIED-errors.patch [bz#1004347]
  - kvm-qcow2-refcount-Repair-shared-refcount-blocks.patch [bz#1004347]
  - kvm-qcow2_check-Mark-image-consistent.patch [bz#1004347]
  - kvm-qemu-iotests-Overlapping-cluster-allocations.patch [bz#1004347]
  - kvm-w32-Fix-access-to-host-devices-regression.patch [bz#1026524]
  - kvm-add-qemu-img-convert-n-option-skip-target-volume-cre.patch [bz#1026524]
  - kvm-bdrv-Use-Error-for-opening-images.patch [bz#1026524]
  - kvm-bdrv-Use-Error-for-creating-images.patch [bz#1026524]
  - kvm-block-Error-parameter-for-open-functions.patch [bz#1026524]
  - kvm-block-Error-parameter-for-create-functions.patch [bz#1026524]
  - kvm-qemu-img-create-Emit-filename-on-error.patch [bz#1026524]
  - kvm-qcow2-Use-Error-parameter.patch [bz#1026524]
  - kvm-qemu-iotests-Adjustments-due-to-error-propagation.patch [bz#1026524]
  - kvm-block-raw-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-win32-Employ-error-parameter.patch [bz#1026524]
  - kvm-blkdebug-Employ-error-parameter.patch [bz#1026524]
  - kvm-blkverify-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-posix-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-win32-Always-use-errno-in-hdev_open.patch [bz#1026524]
  - kvm-qmp-Documentation-for-BLOCK_IMAGE_CORRUPTED.patch [bz#1004347]
  - kvm-qcow2-Correct-snapshots-size-for-overlap-check.patch [bz#1004347]
  - kvm-qcow2-CHECK_OFLAG_COPIED-is-obsolete.patch [bz#1004347]
  - kvm-qcow2-Correct-endianness-in-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Switch-L1-table-in-a-single-sequence.patch [bz#1004347]
  - kvm-qcow2-Use-pread-for-inactive-L1-in-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Remove-wrong-metadata-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Use-negated-overflow-check-mask.patch [bz#1004347]
  - kvm-qcow2-Make-overlap-check-mask-variable.patch [bz#1004347]
  - kvm-qcow2-Add-overlap-check-options.patch [bz#1004347]
  - kvm-qcow2-Array-assigning-options-to-OL-check-bits.patch [bz#1004347]
  - kvm-qcow2-Add-more-overlap-check-bitmask-macros.patch [bz#1004347]
  - kvm-qcow2-Evaluate-overlap-check-options.patch [bz#1004347]
  - kvm-qapi-types.py-Split-off-generate_struct_fields.patch [bz#978402]
  - kvm-qapi-types.py-Fix-enum-struct-sizes-on-i686.patch [bz#978402]
  - kvm-qapi-types-visit.py-Pass-whole-expr-dict-for-structs.patch [bz#978402]
  - kvm-qapi-types-visit.py-Inheritance-for-structs.patch [bz#978402]
  - kvm-blockdev-Introduce-DriveInfo.enable_auto_del.patch [bz#978402]
  - kvm-Implement-qdict_flatten.patch [bz#978402]
  - kvm-blockdev-blockdev-add-QMP-command.patch [bz#978402]
  - kvm-blockdev-Separate-ID-generation-from-DriveInfo-creat.patch [bz#978402]
  - kvm-blockdev-Pass-QDict-to-blockdev_init.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-media-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-if-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Moving-parsing-of-geometry-options-to-drive.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-boot-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Move-bus-unit-index-processing-to-drive_ini.patch [bz#978402]
  - kvm-blockdev-Move-virtio-blk-device-creation-to-drive_in.patch [bz#978402]
  - kvm-blockdev-Remove-IF_-check-for-read-only-blockdev_ini.patch [bz#978402]
  - kvm-qemu-iotests-Check-autodel-behaviour-for-device_del.patch [bz#978402]
  - kvm-blockdev-Remove-media-parameter-from-blockdev_init.patch [bz#978402]
  - kvm-blockdev-Don-t-disable-COR-automatically-with-blockd.patch [bz#978402]
  - kvm-blockdev-blockdev_init-error-conversion.patch [bz#978402]
  - kvm-sd-Avoid-access-to-NULL-BlockDriverState.patch [bz#978402]
  - kvm-blockdev-fix-cdrom-read_only-flag.patch [bz#978402]
  - kvm-block-fix-backing-file-overriding.patch [bz#978402]
  - kvm-block-Disable-BDRV_O_COPY_ON_READ-for-the-backing-fi.patch [bz#978402]
  - kvm-block-Don-t-copy-backing-file-name-on-error.patch [bz#978402]
  - kvm-qemu-iotests-Try-creating-huge-qcow2-image.patch [bz#980771]
  - kvm-block-move-qmp-and-info-dump-related-code-to-block-q.patch [bz#980771]
  - kvm-block-dump-snapshot-and-image-info-to-specified-outp.patch [bz#980771]
  - kvm-block-add-snapshot-info-query-function-bdrv_query_sn.patch [bz#980771]
  - kvm-block-add-image-info-query-function-bdrv_query_image.patch [bz#980771]
  - kvm-qmp-add-ImageInfo-in-BlockDeviceInfo-used-by-query-b.patch [bz#980771]
  - kvm-vmdk-Implement-.bdrv_has_zero_init.patch [bz#980771]
  - kvm-qemu-iotests-Add-basic-ability-to-use-binary-sample-.patch [bz#980771]
  - kvm-qemu-iotests-Quote-TEST_IMG-and-TEST_DIR-usage.patch [bz#980771]
  - kvm-qemu-iotests-fix-test-case-059.patch [bz#980771]
  - kvm-qapi-Add-ImageInfoSpecific-type.patch [bz#980771]
  - kvm-block-Add-bdrv_get_specific_info.patch [bz#980771]
  - kvm-block-qapi-Human-readable-ImageInfoSpecific-dump.patch [bz#980771]
  - kvm-qcow2-Add-support-for-ImageInfoSpecific.patch [bz#980771]
  - kvm-qemu-iotests-Discard-specific-info-in-_img_info.patch [bz#980771]
  - kvm-qemu-iotests-Additional-info-from-qemu-img-info.patch [bz#980771]
  - kvm-vmdk-convert-error-code-to-use-errp.patch [bz#980771]
  - kvm-vmdk-refuse-enabling-zeroed-grain-with-flat-images.patch [bz#980771]
  - kvm-qapi-Add-optional-field-compressed-to-ImageInfo.patch [bz#980771]
  - kvm-vmdk-Only-read-cid-from-image-file-when-opening.patch [bz#980771]
  - kvm-vmdk-Implment-bdrv_get_specific_info.patch [bz#980771]
  - Resolves: bz#1004347
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1026524
    (Backport block layer error parameter patches)
  - Resolves: bz#978402
    ([RFE] Add discard support to qemu-kvm layer)
  - Resolves: bz#980771
    ([RFE]  qemu-img should be able to tell the compat version of a qcow2 image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-17.el7
changelog:
  - kvm-pci-assign-Add-MSI-affinity-support.patch [bz#1025877]
  - kvm-Fix-potential-resource-leak-missing-fclose.patch [bz#1025877]
  - kvm-pci-assign-remove-the-duplicate-function-name-in-deb.patch [bz#1025877]
  - kvm-Remove-s390-ccw-img-loader.patch [bz#1017682]
  - kvm-Fix-vscclient-installation.patch [bz#1017681]
  - kvm-Change-qemu-bridge-helper-permissions-to-4755.patch [bz#1017689]
  - kvm-net-update-nic-info-during-device-reset.patch [bz#922589]
  - kvm-net-e1000-update-network-information-when-macaddr-is.patch [bz#922589]
  - kvm-net-rtl8139-update-network-information-when-macaddr-.patch [bz#922589]
  - kvm-virtio-net-fix-up-HMP-NIC-info-string-on-reset.patch [bz#1026689]
  - kvm-vfio-pci-VGA-quirk-update.patch [bz#1025477]
  - kvm-vfio-pci-Add-support-for-MSI-affinity.patch [bz#1025477]
  - kvm-vfio-pci-Test-device-reset-capabilities.patch [bz#1026550]
  - kvm-vfio-pci-Lazy-PCI-option-ROM-loading.patch [bz#1026550]
  - kvm-vfio-pci-Cleanup-error_reports.patch [bz#1026550]
  - kvm-vfio-pci-Add-dummy-PCI-ROM-write-accessor.patch [bz#1026550]
  - kvm-vfio-pci-Fix-endian-issues-in-vfio_pci_size_rom.patch [bz#1026550]
  - kvm-linux-headers-Update-to-include-vfio-pci-hot-reset-s.patch [bz#1025472]
  - kvm-vfio-pci-Implement-PCI-hot-reset.patch [bz#1025472]
  - kvm-linux-headers-Update-for-KVM-VFIO-device.patch [bz#1025474]
  - kvm-vfio-pci-Make-use-of-new-KVM-VFIO-device.patch [bz#1025474]
  - kvm-vmdk-Fix-vmdk_parse_extents.patch [bz#995866]
  - kvm-vmdk-fix-VMFS-extent-parsing.patch [bz#995866]
  - kvm-e1000-rtl8139-update-HMP-NIC-when-every-bit-is-writt.patch [bz#922589]
  - kvm-don-t-disable-ctrl_mac_addr-feature-for-6.5-machine-.patch [bz#1005039]
  - Resolves: bz#1005039
    (add compat property to disable ctrl_mac_addr feature)
  - Resolves: bz#1017681
    (rpmdiff test "Multilib regressions": vscclient is a libtool script on s390/s390x/ppc/ppc64)
  - Resolves: bz#1017682
    (/usr/share/qemu-kvm/s390-ccw.img need not be distributed)
  - Resolves: bz#1017689
    (/usr/libexec/qemu-bridge-helper permissions should be 4755)
  - Resolves: bz#1025472
    (Nvidia GPU device assignment - qemu-kvm - bus reset support)
  - Resolves: bz#1025474
    (Nvidia GPU device assignment - qemu-kvm - NoSnoop support)
  - Resolves: bz#1025477
    (VFIO MSI affinity)
  - Resolves: bz#1025877
    (pci-assign lacks MSI affinity support)
  - Resolves: bz#1026550
    (QEMU VFIO update ROM loading code)
  - Resolves: bz#1026689
    (virtio-net: macaddr is reset but network info of monitor isn't updated)
  - Resolves: bz#922589
    (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest)
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-19.el7
changelog:
  - kvm-qapi-qapi-visit.py-fix-list-handling-for-union-types.patch [bz#848203]
  - kvm-qapi-qapi-visit.py-native-list-support.patch [bz#848203]
  - kvm-qapi-enable-generation-of-native-list-code.patch [bz#848203]
  - kvm-net-add-support-of-mac-programming-over-macvtap-in-Q.patch [bz#848203]
  - Resolves: bz#848203
    (MAC Programming for virtio over macvtap - qemu-kvm support)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-20.el7
changelog:
  - kvm-pc-drop-virtio-balloon-pci-event_idx-compat-property.patch [bz#1029539]
  - kvm-virtio-net-only-delete-bh-that-existed.patch [bz#922463]
  - kvm-virtio-net-broken-RX-filtering-logic-fixed.patch [bz#1029370]
  - kvm-block-Avoid-unecessary-drv-bdrv_getlength-calls.patch [bz#1025138]
  - kvm-block-Round-up-total_sectors.patch [bz#1025138]
  - kvm-doc-fix-hardcoded-helper-path.patch [bz#1016952]
  - kvm-introduce-RFQDN_REDHAT-RHEL-6-7-fwd.patch [bz#971933]
  - kvm-error-reason-in-BLOCK_IO_ERROR-BLOCK_JOB_ERROR-event.patch [bz#971938]
  - kvm-improve-debuggability-of-BLOCK_IO_ERROR-BLOCK_JOB_ER.patch [bz#895041]
  - kvm-vfio-pci-Fix-multifunction-on.patch [bz#1029275]
  - kvm-qcow2-Change-default-for-new-images-to-compat-1.1.patch [bz#1026739]
  - kvm-qcow2-change-default-for-new-images-to-compat-1.1-pa.patch [bz#1026739]
  - kvm-rng-egd-offset-the-point-when-repeatedly-read-from-t.patch [bz#1032862]
  - kvm-Fix-rhel-rhev-conflict-for-qemu-kvm-common.patch [bz#1033463]
  - Resolves: bz#1016952
    (qemu-kvm man page guide wrong path for qemu-bridge-helper)
  - Resolves: bz#1025138
    (Read/Randread/Randrw performance regression)
  - Resolves: bz#1026739
    (qcow2: Switch to compat=1.1 default for new images)
  - Resolves: bz#1029275
    (Guest only find one 82576 VF(function 0) while use multifunction)
  - Resolves: bz#1029370
    ([whql][netkvm][wlk] Virtio-net device handles RX multicast filtering improperly)
  - Resolves: bz#1029539
    (Machine type rhel6.1.0 and  balloon device cause migration fail from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#1032862
    (virtio-rng-egd: repeatedly read same random data-block w/o considering the buffer offset)
  - Resolves: bz#1033463
    (can not upgrade qemu-kvm-common to qemu-kvm-common-rhev due to conflicts)
  - Resolves: bz#895041
    (QMP: forward port I/O error debug messages)
  - Resolves: bz#922463
    (qemu-kvm core dump when virtio-net multi queue guest hot-unpluging vNIC)
  - Resolves: bz#971933
    (QMP: add RHEL's vendor extension prefix)
  - Resolves: bz#971938
    (QMP: Add error reason to BLOCK_IO_ERROR event)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-21.el7
changelog:
  - kvm-scsi-Allocate-SCSITargetReq-r-buf-dynamically-CVE-20.patch [bz#1007334]
  - Resolves: bz#1007334
    (CVE-2013-4344 qemu-kvm: qemu: buffer overflow in scsi_target_emulate_report_luns [rhel-7.0])


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-22.el7
changelog:
  - Fix ksmtuned with set_process_name=1 [bz#1027420]
  - Fix committed memory when no qemu-kvm running [bz#1027418]
  - kvm-virtio-net-fix-the-memory-leak-in-rxfilter_notify.patch [bz#1033810]
  - kvm-qom-Fix-memory-leak-in-object_property_set_link.patch [bz#1033810]
  - kvm-fix-intel-hda-live-migration.patch [bz#1036537]
  - kvm-vfio-pci-Release-all-MSI-X-vectors-when-disabled.patch [bz#1029743]
  - kvm-Query-KVM-for-available-memory-slots.patch [bz#921490]
  - kvm-block-Dont-ignore-previously-set-bdrv_flags.patch [bz#1039501]
  - kvm-cleanup-trace-events.pl-New.patch [bz#997832]
  - kvm-slavio_misc-Fix-slavio_led_mem_readw-_writew-tracepo.patch [bz#997832]
  - kvm-milkymist-minimac2-Fix-minimac2_read-_write-tracepoi.patch [bz#997832]
  - kvm-trace-events-Drop-unused-events.patch [bz#997832]
  - kvm-trace-events-Fix-up-source-file-comments.patch [bz#997832]
  - kvm-trace-events-Clean-up-with-scripts-cleanup-trace-eve.patch [bz#997832]
  - kvm-trace-events-Clean-up-after-removal-of-old-usb-host-.patch [bz#997832]
  - kvm-net-Update-netdev-peer-on-link-change.patch [bz#1027571]
  - Resolves: bz#1027418
    (ksmtuned committed_memory() still returns "", not 0, when no qemu running)
  - Resolves: bz#1027420
    (ksmtuned can’t handle libvirt WITH set_process_name=1)
  - Resolves: bz#1027571
    ([virtio-win]win8.1 guest network can not resume automatically after do "set_link tap1 on")
  - Resolves: bz#1029743
    (qemu-kvm core dump after hot plug/unplug 82576 PF about 100 times)
  - Resolves: bz#1033810
    (memory leak in using object_get_canonical_path())
  - Resolves: bz#1036537
    (Cross version migration from RHEL6.5 host to RHEL7.0 host with sound device failed.)
  - Resolves: bz#1039501
    ([provisioning] discard=on broken)
  - Resolves: bz#921490
    (qemu-kvm core dumped after hot plugging more than 11 VF through vfio-pci)
  - Resolves: bz#997832
    (Backport trace fixes proactively to avoid confusion and silly conflicts)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-23.el7
changelog:
  - kvm-qdev-monitor-Unref-device-when-device_add-fails.patch [bz#1003773]
  - kvm-qdev-Drop-misleading-qdev_free-function.patch [bz#1003773]
  - kvm-blockdev-fix-drive_init-opts-and-bs_opts-leaks.patch [bz#1003773]
  - kvm-libqtest-rename-qmp-to-qmp_discard_response.patch [bz#1003773]
  - kvm-libqtest-add-qmp-fmt-.-QDict-function.patch [bz#1003773]
  - kvm-blockdev-test-add-test-case-for-drive_add-duplicate-.patch [bz#1003773]
  - kvm-qdev-monitor-test-add-device_add-leak-test-cases.patch [bz#1003773]
  - kvm-qtest-Use-display-none-by-default.patch [bz#1003773]
  - Resolves: bz#1003773
    (When virtio-blk-pci device with dataplane is failed to be added, the drive cannot be released.)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-24.el7
changelog:
  - kvm-range-add-Range-structure.patch [bz#1034876]
  - kvm-range-add-Range-to-typedefs.patch [bz#1034876]
  - kvm-range-add-min-max-operations-on-ranges.patch [bz#1034876]
  - kvm-qdev-Add-SIZE-type-to-qdev-properties.patch [bz#1034876]
  - kvm-qapi-make-visit_type_size-fallback-to-type_int.patch [bz#1034876]
  - kvm-pc-move-IO_APIC_DEFAULT_ADDRESS-to-include-hw-i386-i.patch [bz#1034876]
  - kvm-pci-add-helper-to-retrieve-the-64-bit-range.patch [bz#1034876]
  - kvm-pci-fix-up-w64-size-calculation-helper.patch [bz#1034876]
  - kvm-refer-to-FWCfgState-explicitly.patch [bz#1034876]
  - kvm-fw_cfg-move-typedef-to-qemu-typedefs.h.patch [bz#1034876]
  - kvm-arch_init-align-MR-size-to-target-page-size.patch [bz#1034876]
  - kvm-loader-store-FW-CFG-ROM-files-in-RAM.patch [bz#1034876]
  - kvm-pci-store-PCI-hole-ranges-in-guestinfo-structure.patch [bz#1034876]
  - kvm-pc-pass-PCI-hole-ranges-to-Guests.patch [bz#1034876]
  - kvm-pc-replace-i440fx_common_init-with-i440fx_init.patch [bz#1034876]
  - kvm-pc-don-t-access-fw-cfg-if-NULL.patch [bz#1034876]
  - kvm-pc-add-I440FX-QOM-cast-macro.patch [bz#1034876]
  - kvm-pc-limit-64-bit-hole-to-2G-by-default.patch [bz#1034876]
  - kvm-q35-make-pci-window-address-size-match-guest-cfg.patch [bz#1034876]
  - kvm-q35-use-64-bit-window-programmed-by-guest.patch [bz#1034876]
  - kvm-piix-use-64-bit-window-programmed-by-guest.patch [bz#1034876]
  - kvm-pc-fix-regression-for-64-bit-PCI-memory.patch [bz#1034876]
  - kvm-cleanup-object.h-include-error.h-directly.patch [bz#1034876]
  - kvm-qom-cleanup-struct-Error-references.patch [bz#1034876]
  - kvm-qom-add-pointer-to-int-property-helpers.patch [bz#1034876]
  - kvm-fw_cfg-interface-to-trigger-callback-on-read.patch [bz#1034876]
  - kvm-loader-support-for-unmapped-ROM-blobs.patch [bz#1034876]
  - kvm-pcie_host-expose-UNMAPPED-macro.patch [bz#1034876]
  - kvm-pcie_host-expose-address-format.patch [bz#1034876]
  - kvm-q35-use-macro-for-MCFG-property-name.patch [bz#1034876]
  - kvm-q35-expose-mmcfg-size-as-a-property.patch [bz#1034876]
  - kvm-i386-add-ACPI-table-files-from-seabios.patch [bz#1034876]
  - kvm-acpi-add-rules-to-compile-ASL-source.patch [bz#1034876]
  - kvm-acpi-pre-compiled-ASL-files.patch [bz#1034876]
  - kvm-acpi-ssdt-pcihp-updat-generated-file.patch [bz#1034876]
  - kvm-loader-use-file-path-size-from-fw_cfg.h.patch [bz#1034876]
  - kvm-i386-add-bios-linker-loader.patch [bz#1034876]
  - kvm-loader-allow-adding-ROMs-in-done-callbacks.patch [bz#1034876]
  - kvm-i386-define-pc-guest-info.patch [bz#1034876]
  - kvm-acpi-piix-add-macros-for-acpi-property-names.patch [bz#1034876]
  - kvm-piix-APIs-for-pc-guest-info.patch [bz#1034876]
  - kvm-ich9-APIs-for-pc-guest-info.patch [bz#1034876]
  - kvm-pvpanic-add-API-to-access-io-port.patch [bz#1034876]
  - kvm-hpet-add-API-to-find-it.patch [bz#1034876]
  - kvm-hpet-fix-build-with-CONFIG_HPET-off.patch [bz#1034876]
  - kvm-acpi-add-interface-to-access-user-installed-tables.patch [bz#1034876]
  - kvm-pc-use-new-api-to-add-builtin-tables.patch [bz#1034876]
  - kvm-i386-ACPI-table-generation-code-from-seabios.patch [bz#1034876]
  - kvm-ssdt-fix-PBLK-length.patch [bz#1034876]
  - kvm-ssdt-proc-update-generated-file.patch [bz#1034876]
  - kvm-pc-disable-pci-info.patch [bz#1034876]
  - kvm-acpi-build-fix-build-on-glib-2.22.patch [bz#1034876]
  - kvm-acpi-build-fix-build-on-glib-2.14.patch [bz#1034876]
  - kvm-acpi-build-fix-support-for-glib-2.22.patch [bz#1034876]
  - kvm-acpi-build-Fix-compiler-warning-missing-gnu_printf-f.patch [bz#1034876]
  - kvm-exec-Fix-prototype-of-phys_mem_set_alloc-and-related.patch [bz#1034876]
  - Resolves: bz#1034876
    (export acpi tables to guests)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-25.el7
changelog:
  - kvm-Change-package-description.patch [bz#1017696]
  - kvm-seccomp-add-kill-to-the-syscall-whitelist.patch [bz#1026314]
  - kvm-json-parser-fix-handling-of-large-whole-number-value.patch [bz#997915]
  - kvm-qapi-add-QMP-input-test-for-large-integers.patch [bz#997915]
  - kvm-qapi-fix-visitor-serialization-tests-for-numbers-dou.patch [bz#997915]
  - kvm-qapi-add-native-list-coverage-for-visitor-serializat.patch [bz#997915]
  - kvm-qapi-add-native-list-coverage-for-QMP-output-visitor.patch [bz#997915]
  - kvm-qapi-add-native-list-coverage-for-QMP-input-visitor-.patch [bz#997915]
  - kvm-qapi-lack-of-two-commas-in-dict.patch [bz#997915]
  - kvm-tests-QAPI-schema-parser-tests.patch [bz#997915]
  - kvm-tests-Use-qapi-schema-test.json-as-schema-parser-tes.patch [bz#997915]
  - kvm-qapi.py-Restructure-lexer-and-parser.patch [bz#997915]
  - kvm-qapi.py-Decent-syntax-error-reporting.patch [bz#997915]
  - kvm-qapi.py-Reject-invalid-characters-in-schema-file.patch [bz#997915]
  - kvm-qapi.py-Fix-schema-parser-to-check-syntax-systematic.patch [bz#997915]
  - kvm-qapi.py-Fix-diagnosing-non-objects-at-a-schema-s-top.patch [bz#997915]
  - kvm-qapi.py-Rename-expr_eval-to-expr-in-parse_schema.patch [bz#997915]
  - kvm-qapi.py-Permit-comments-starting-anywhere-on-the-lin.patch [bz#997915]
  - kvm-scripts-qapi.py-Avoid-syntax-not-supported-by-Python.patch [bz#997915]
  - kvm-tests-Fix-schema-parser-test-for-in-tree-build.patch [bz#997915]
  - Resolves: bz#1017696
    ([branding] remove references to dynamic translation and user-mode emulation)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#997915
    (Backport new QAPI parser proactively to help developers and avoid silly conflicts)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-26.el7
changelog:
  - Add BuildRequires to libRDMAcm-devel for RDMA support [bz#1011720]
  - kvm-add-a-header-file-for-atomic-operations.patch [bz#1011720]
  - kvm-savevm-Fix-potential-memory-leak.patch [bz#1011720]
  - kvm-migration-Fail-migration-on-bdrv_flush_all-error.patch [bz#1011720]
  - kvm-rdma-add-documentation.patch [bz#1011720]
  - kvm-rdma-introduce-qemu_update_position.patch [bz#1011720]
  - kvm-rdma-export-yield_until_fd_readable.patch [bz#1011720]
  - kvm-rdma-export-throughput-w-MigrationStats-QMP.patch [bz#1011720]
  - kvm-rdma-introduce-qemu_file_mode_is_not_valid.patch [bz#1011720]
  - kvm-rdma-introduce-qemu_ram_foreach_block.patch [bz#1011720]
  - kvm-rdma-new-QEMUFileOps-hooks.patch [bz#1011720]
  - kvm-rdma-introduce-capability-x-rdma-pin-all.patch [bz#1011720]
  - kvm-rdma-update-documentation-to-reflect-new-unpin-suppo.patch [bz#1011720]- kvm-rdma-bugfix-ram_control_save_page.patch [bz#1011720]
  - kvm-rdma-introduce-ram_handle_compressed.patch [bz#1011720]
  - kvm-rdma-core-logic.patch [bz#1011720]
  - kvm-rdma-send-pc.ram.patch [bz#1011720]
  - kvm-rdma-allow-state-transitions-between-other-states-be.patch [bz#1011720]
  - kvm-rdma-introduce-MIG_STATE_NONE-and-change-MIG_STATE_S.patch [bz#1011720]
  - kvm-rdma-account-for-the-time-spent-in-MIG_STATE_SETUP-t.patch [bz#1011720]
  - kvm-rdma-bugfix-make-IPv6-support-work.patch [bz#1011720]
  - kvm-rdma-forgot-to-turn-off-the-debugging-flag.patch [bz#1011720]
  - kvm-rdma-correct-newlines-in-error-statements.patch [bz#1011720]
  - kvm-rdma-don-t-use-negative-index-to-array.patch [bz#1011720]
  - kvm-rdma-qemu_rdma_post_send_control-uses-wrongly-RDMA_W.patch [bz#1011720]
  - kvm-rdma-use-DRMA_WRID_READY.patch [bz#1011720]
  - kvm-rdma-memory-leak-RDMAContext-host.patch [bz#1011720]
  - kvm-rdma-use-resp.len-after-validation-in-qemu_rdma_regi.patch [bz#1011720]
  - kvm-rdma-validate-RDMAControlHeader-len.patch [bz#1011720]
  - kvm-rdma-check-if-RDMAControlHeader-len-match-transferre.patch [bz#1011720]
  - kvm-rdma-proper-getaddrinfo-handling.patch [bz#1011720]
  - kvm-rdma-IPv6-over-Ethernet-RoCE-is-broken-in-linux-work.patch [bz#1011720]
  - kvm-rdma-remaining-documentation-fixes.patch [bz#1011720]
  - kvm-rdma-silly-ipv6-bugfix.patch [bz#1011720]
  - kvm-savevm-fix-wrong-initialization-by-ram_control_load_.patch [bz#1011720]
  - kvm-arch_init-right-return-for-ram_save_iterate.patch [bz#1011720]
  - kvm-rdma-clean-up-of-qemu_rdma_cleanup.patch [bz#1011720]
  - kvm-rdma-constify-ram_chunk_-index-start-end.patch [bz#1011720]
  - kvm-migration-Fix-debug-print-type.patch [bz#1011720]
  - kvm-arch_init-make-is_zero_page-accept-size.patch [bz#1011720]
  - kvm-migration-ram_handle_compressed.patch [bz#1011720]
  - kvm-migration-fix-spice-migration.patch [bz#1011720]
  - kvm-pci-assign-cap-number-of-devices-that-can-be-assigne.patch [bz#678368]
  - kvm-vfio-cap-number-of-devices-that-can-be-assigned.patch [bz#678368]
  - kvm-Revert-usb-tablet-Don-t-claim-wakeup-capability-for-.patch [bz#1039513]
  - kvm-mempath-prefault-pages-manually-v4.patch [bz#1026554]
  - Resolves: bz#1011720
    ([HP 7.0 Feat]: Backport RDMA based live guest migration changes from upstream to RHEL7.0 KVM)
  - Resolves: bz#1026554
    (qemu: mempath: prefault pages manually)
  - Resolves: bz#1039513
    (backport remote wakeup for ehci)
  - Resolves: bz#678368
    (RFE: Support more than 8 assigned devices)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-27.el7
changelog:
  - Change systemd service location [bz#1025217]
  - kvm-vmdk-Allow-read-only-open-of-VMDK-version-3.patch [bz#1007710 bz#1029852]
  - Resolves: bz#1007710
    ([RFE] Enable qemu-img to support VMDK version 3)
  - Resolves: bz#1025217
    (systemd can't control ksm.service and ksmtuned.service)
  - Resolves: bz#1029852
    (qemu-img fails to convert vmdk image with "qemu-img: Could not open 'image.vmdk'")


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-28.el7
changelog:
  - kvm-virtio_pci-fix-level-interrupts-with-irqfd.patch [bz#1035132]
  - Resolves: bz#1035132
    (fail to boot and call trace with x-data-plane=on specified for rhel6.5 guest)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-29.el7
changelog:
  - kvm-QMP-Forward-port-__com.redhat_drive_del-from-RHEL-6.patch [bz#889051]
  - kvm-QMP-Forward-port-__com.redhat_drive_add-from-RHEL-6.patch [bz#889051]
  - kvm-HMP-Forward-port-__com.redhat_drive_add-from-RHEL-6.patch [bz#889051]
  - kvm-QMP-Document-throttling-parameters-of-__com.redhat_d.patch [bz#889051]
  - kvm-HMP-Disable-drive_add-for-Red-Hat-Enterprise-Linux.patch [bz#889051]
  - Resolves: bz#889051
    (Commands "__com.redhat_drive_add/del" don' t exist in RHEL7.0)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-30.el7
changelog:
  - kvm-Revert-HMP-Disable-drive_add-for-Red-Hat-Enterprise-2.patch.patch [bz#889051]
  - Resolves: bz#889051
    (Commands "__com.redhat_drive_add/del" don' t exist in RHEL7.0)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-32.el7
changelog:
  - kvm-block-change-default-of-.has_zero_init-to-0.patch.patch [bz#1007815]
  - kvm-iscsi-factor-out-sector-conversions.patch.patch [bz#1007815]
  - kvm-iscsi-add-logical-block-provisioning-information-to-.patch.patch [bz#1007815]
  - kvm-iscsi-add-.bdrv_get_block_status.patch.patch.patch [bz#1007815]
  - kvm-iscsi-split-discard-requests-in-multiple-parts.patch.patch.patch [bz#1007815]
  - kvm-block-make-BdrvRequestFlags-public.patch.patch.patch [bz#1007815]
  - kvm-block-add-flags-to-bdrv_-_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-introduce-BDRV_REQ_MAY_UNMAP-request-flag.patch.patch.patch [bz#1007815]
  - kvm-block-add-logical-block-provisioning-info-to-BlockDr.patch.patch.patch [bz#1007815]
  - kvm-block-add-wrappers-for-logical-block-provisioning-in.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-add-.bdrv_get_info.patch.patch [bz#1007815]
  - kvm-block-add-BlockLimits-structure-to-BlockDriverState.patch.patch.patch [bz#1007815]
  - kvm-block-raw-copy-BlockLimits-on-raw_open.patch.patch.patch [bz#1007815]
  - kvm-block-honour-BlockLimits-in-bdrv_co_do_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-honour-BlockLimits-in-bdrv_co_discard.patch.patch.patch [bz#1007815]
  - kvm-iscsi-set-limits-in-BlockDriverState.patch.patch.patch [bz#1007815]
  - kvm-iscsi-simplify-iscsi_co_discard.patch.patch.patch [bz#1007815]
  - kvm-iscsi-add-bdrv_co_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-introduce-bdrv_make_zero.patch.patch.patch [bz#1007815]
  - kvm-block-get_block_status-fix-BDRV_BLOCK_ZERO-for-unall.patch.patch.patch [bz#1007815]
  - kvm-qemu-img-add-support-for-fully-allocated-images.patch.patch.patch [bz#1007815]
  - kvm-qemu-img-conditionally-zero-out-target-on-convert.patch.patch.patch [bz#1007815]
  - kvm-block-generalize-BlockLimits-handling-to-cover-bdrv_.patch.patch.patch [bz#1007815]
  - kvm-block-add-flags-to-BlockRequest.patch.patch.patch [bz#1007815]
  - kvm-block-add-flags-argument-to-bdrv_co_write_zeroes-tra.patch.patch.patch [bz#1007815]
  - kvm-block-add-bdrv_aio_write_zeroes.patch.patch.patch [bz#1007815]
  - kvm-block-handle-ENOTSUP-from-discard-in-generic-code.patch.patch.patch [bz#1007815]
  - kvm-block-make-bdrv_co_do_write_zeroes-stricter-in-produ.patch.patch.patch [bz#1007815]
  - kvm-vpc-vhdx-add-get_info.patch.patch.patch [bz#1007815]
  - kvm-block-drivers-add-discard-write_zeroes-properties-to.patch.patch.patch [bz#1007815]
  - kvm-block-drivers-expose-requirement-for-write-same-alig.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-remove-.bdrv_has_zero_init.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-updated-copyright.patch.patch.patch [bz#1007815]
  - kvm-block-iscsi-check-WRITE-SAME-support-differently-dep.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-catch-write-protection-errors-in-UNMAP.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-reject-ANCHOR-1-for-UNMAP-and-WRITE-SAME-c.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-correctly-implement-WRITE-SAME.patch.patch.patch [bz#1007815]
  - kvm-scsi-disk-fix-WRITE-SAME-with-large-non-zero-payload.patch.patch.patch [bz#1007815]
  - kvm-raw-posix-implement-write_zeroes-with-MAY_UNMAP-for-.patch.patch.patch.patch [bz#1007815]
  - kvm-raw-posix-implement-write_zeroes-with-MAY_UNMAP-for-.patch.patch.patch.patch.patch [bz#1007815]
  - kvm-raw-posix-add-support-for-write_zeroes-on-XFS-and-bl.patch.patch [bz#1007815]
  - kvm-qemu-iotests-033-is-fast.patch.patch [bz#1007815]
  - kvm-qemu-img-add-support-for-skipping-zeroes-in-input-du.patch.patch [bz#1007815]
  - kvm-qemu-img-fix-usage-instruction-for-qemu-img-convert.patch.patch [bz#1007815]
  - kvm-block-iscsi-set-bdi-cluster_size.patch.patch [bz#1007815]
  - kvm-block-add-opt_transfer_length-to-BlockLimits.patch.patch [bz#1039557]
  - kvm-block-iscsi-set-bs-bl.opt_transfer_length.patch.patch [bz#1039557]
  - kvm-qemu-img-dynamically-adjust-iobuffer-size-during-con.patch.patch [bz#1039557]
  - kvm-qemu-img-round-down-request-length-to-an-aligned-sec.patch.patch [bz#1039557]
  - kvm-qemu-img-decrease-progress-update-interval-on-conver.patch.patch [bz#1039557]
  - Resolves: bz#1007815
    (fix WRITE SAME support)
  - Resolves: bz#1039557
    (optimize qemu-img for thin provisioned images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-33.el7
changelog:
  - kvm-block-qemu-iotests-for-vhdx-read-sample-dynamic-imag.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG-usage-io-p.patch [bz#879234]
  - kvm-block-qemu-iotests-fix-_make_test_img-to-work-with-s.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG.base-usage.patch [bz#879234]
  - kvm-block-qemu-iotests-add-quotes-to-TEST_IMG-usage-in-0.patch [bz#879234]
  - kvm-block-qemu-iotests-removes-duplicate-double-quotes-i.patch [bz#879234]
  - kvm-block-vhdx-minor-comments-and-typo-correction.patch [bz#879234]
  - kvm-block-vhdx-add-header-update-capability.patch [bz#879234]
  - kvm-block-vhdx-code-movement-VHDXMetadataEntries-and-BDR.patch [bz#879234]
  - kvm-block-vhdx-log-support-struct-and-defines.patch [bz#879234]
  - kvm-block-vhdx-break-endian-translation-functions-out.patch [bz#879234]
  - kvm-block-vhdx-update-log-guid-in-header-and-first-write.patch [bz#879234]
  - kvm-block-vhdx-code-movement-move-vhdx_close-above-vhdx_.patch [bz#879234]
  - kvm-block-vhdx-log-parsing-replay-and-flush-support.patch [bz#879234]
  - kvm-block-vhdx-add-region-overlap-detection-for-image-fi.patch [bz#879234]
  - kvm-block-vhdx-add-log-write-support.patch [bz#879234]
  - kvm-block-vhdx-write-support.patch [bz#879234]
  - kvm-block-vhdx-remove-BAT-file-offset-bit-shifting.patch [bz#879234]
  - kvm-block-vhdx-move-more-endian-translations-to-vhdx-end.patch [bz#879234]
  - kvm-block-vhdx-break-out-code-operations-to-functions.patch [bz#879234]
  - kvm-block-vhdx-fix-comment-typos-in-header-fix-incorrect.patch [bz#879234]
  - kvm-block-vhdx-add-.bdrv_create-support.patch [bz#879234]
  - kvm-block-vhdx-update-_make_test_img-to-filter-out-vhdx-.patch [bz#879234]
  - kvm-block-qemu-iotests-for-vhdx-add-write-test-support.patch [bz#879234]
  - kvm-block-vhdx-qemu-iotest-log-replay-of-data-sector.patch [bz#879234]
  - Resolves: bz#879234
    ([RFE] qemu-img: Add/improve support for VHDX format)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-34.el7
changelog:
  - kvm-block-stream-Don-t-stream-unbacked-devices.patch [bz#965636]
  - kvm-qemu-io-Let-open-pass-options-to-block-driver.patch [bz#1004347]
  - kvm-qcow2.py-Subcommand-for-changing-header-fields.patch [bz#1004347]
  - kvm-qemu-iotests-Remaining-error-propagation-adjustments.patch [bz#1004347]
  - kvm-qemu-iotests-Add-test-for-inactive-L2-overlap.patch [bz#1004347]
  - kvm-qemu-iotests-Adjust-test-result-039.patch [bz#1004347]
  - kvm-virtio-net-don-t-update-mac_table-in-error-state.patch [bz#1048671]
  - kvm-qcow2-Zero-initialise-first-cluster-for-new-images.patch [bz#1032904]
  - Resolves: bz#1004347
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1032904
    (qemu-img can not create libiscsi qcow2_v3 image)
  - Resolves: bz#1048671
    (virtio-net: mac_table change isn't recovered in error state)
  - Resolves: bz#965636
    (streaming with no backing file should not do anything)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-35.el7
changelog:
  - kvm-option-Add-assigned-flag-to-QEMUOptionParameter.patch [bz#1033490]
  - kvm-qcow2-refcount-Snapshot-update-for-zero-clusters.patch [bz#1033490]
  - kvm-qemu-iotests-Snapshotting-zero-clusters.patch [bz#1033490]
  - kvm-block-Image-file-option-amendment.patch [bz#1033490]
  - kvm-qcow2-cache-Empty-cache.patch [bz#1033490]
  - kvm-qcow2-cluster-Expand-zero-clusters.patch [bz#1033490]
  - kvm-qcow2-Save-refcount-order-in-BDRVQcowState.patch [bz#1033490]
  - kvm-qcow2-Implement-bdrv_amend_options.patch [bz#1033490]
  - kvm-qcow2-Correct-bitmap-size-in-zero-expansion.patch [bz#1033490]
  - kvm-qcow2-Free-only-newly-allocated-clusters-on-error.patch [bz#1033490]
  - kvm-qcow2-Add-missing-space-in-error-message.patch [bz#1033490]
  - kvm-qemu-iotest-qcow2-image-option-amendment.patch [bz#1033490]
  - kvm-qemu-iotests-New-test-case-in-061.patch [bz#1033490]
  - kvm-qemu-iotests-Preallocated-zero-clusters-in-061.patch [bz#1033490]
  - Resolves: bz#1033490
    (Cannot upgrade/downgrade qcow2 images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-36.el7
changelog:
  - kvm-Add-support-statement-to-help-output.patch [bz#972773]
  - kvm-__com.redhat_qxl_screendump-add-docs.patch [bz#903910]
  - kvm-vl-Round-memory-sizes-below-2MiB-up-to-2MiB.patch [bz#999836]
  - kvm-seccomp-exit-if-seccomp_init-fails.patch [bz#1044845]
  - kvm-redhat-qemu-kvm.spec-require-python-for-build.patch [bz#1034876]
  - kvm-redhat-qemu-kvm.spec-require-iasl.patch [bz#1034876]
  - kvm-configure-make-iasl-option-actually-work.patch [bz#1034876]
  - kvm-redhat-qemu-kvm.spec-add-cpp-as-build-dependency.patch [bz#1034876]
  - kvm-acpi-build-disable-with-no-acpi.patch [bz#1045386]
  - kvm-ehci-implement-port-wakeup.patch [bz#1039513]
  - kvm-qdev-monitor-Fix-crash-when-device_add-is-called-wit.patch [bz#1026712 bz#1046007]
  - kvm-block-vhdx-improve-error-message-and-.bdrv_check-imp.patch [bz#1035001]
  - kvm-docs-updated-qemu-img-man-page-and-qemu-doc-to-refle.patch [bz#1017650]
  - kvm-enable-pvticketlocks-by-default.patch [bz#1052340]
  - kvm-fix-boot-strict-regressed-in-commit-6ef4716.patch [bz#997817]
  - kvm-vl-make-boot_strict-variable-static-not-used-outside.patch [bz#997817]
  - Resolves: bz#1017650
    (need to update qemu-img man pages on "VHDX" format)
  - Resolves: bz#1026712
    (Qemu core dumpd when boot guest with driver name as "virtio-pci")
  - Resolves: bz#1034876
    (export acpi tables to guests)
  - Resolves: bz#1035001
    (VHDX: journal log should not be replayed by default, but rather via qemu-img check -r all)
  - Resolves: bz#1039513
    (backport remote wakeup for ehci)
  - Resolves: bz#1044845
    (QEMU seccomp sandbox - exit if seccomp_init() fails)
  - Resolves: bz#1045386
    (qemu-kvm: hw/i386/acpi-build.c:135: acpi_get_pm_info: Assertion `obj' failed.)
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)
  - Resolves: bz#1052340
    (pvticketlocks: default on)
  - Resolves: bz#903910
    (RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump)
  - Resolves: bz#972773
    (RHEL7: Clarify support statement in KVM help)
  - Resolves: bz#997817
    (-boot order and -boot once regressed since RHEL-6)
  - Resolves: bz#999836
    (-m 1 crashes)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-37.el7
changelog:
  - kvm-bitmap-use-long-as-index.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_flags-result-is.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-return-vo.patch [bz#997559]
  - kvm-exec-use-accessor-function-to-know-if-memory-is-dirt.patch [bz#997559]
  - kvm-memory-create-function-to-set-a-single-dirty-bit.patch [bz#997559]
  - kvm-exec-drop-useless-if.patch [bz#997559]
  - kvm-exec-create-function-to-get-a-single-dirty-bit.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_is_dirty-return-bool.patch [bz#997559]
  - kvm-memory-all-users-of-cpu_physical_memory_get_dirty-us.patch [bz#997559]
  - kvm-memory-set-single-dirty-flags-when-possible.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-always-di.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_mask_dirty_range-always-c.patch [bz#997559]
  - kvm-memory-use-bit-2-for-migration.patch [bz#997559]
  - kvm-memory-make-sure-that-client-is-always-inside-range.patch [bz#997559]
  - kvm-memory-only-resize-dirty-bitmap-when-memory-size-inc.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_clear_dirty_flag-result-i.patch [bz#997559]
  - kvm-bitmap-Add-bitmap_zero_extend-operation.patch [bz#997559]
  - kvm-memory-split-dirty-bitmap-into-three.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_clear_dirty_flag-i.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_set_dirty-in-its-o.patch [bz#997559]
  - kvm-memory-unfold-cpu_physical_memory_set_dirty_flag.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_get_dirty-the-main-f.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_get_dirty-is-used-as-retu.patch [bz#997559]
  - kvm-memory-s-mask-clear-cpu_physical_memory_mask_dirty_r.patch [bz#997559]
  - kvm-memory-use-find_next_bit-to-find-dirty-bits.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_range-now-uses-.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_clear_dirty_range-now-use.patch [bz#997559]
  - kvm-memory-s-dirty-clean-in-cpu_physical_memory_is_dirty.patch [bz#997559]
  - kvm-memory-make-cpu_physical_memory_reset_dirty-take-a-l.patch [bz#997559]
  - kvm-exec-Remove-unused-global-variable-phys_ram_fd.patch [bz#997559]
  - kvm-memory-cpu_physical_memory_set_dirty_tracking-should.patch [bz#997559]
  - kvm-memory-move-private-types-to-exec.c.patch [bz#997559]
  - kvm-memory-split-cpu_physical_memory_-functions-to-its-o.patch [bz#997559]
  - kvm-memory-unfold-memory_region_test_and_clear.patch [bz#997559]
  - kvm-use-directly-cpu_physical_memory_-api-for-tracki.patch [bz#997559]
  - kvm-refactor-start-address-calculation.patch [bz#997559]
  - kvm-memory-move-bitmap-synchronization-to-its-own-functi.patch [bz#997559]
  - kvm-memory-syncronize-kvm-bitmap-using-bitmaps-operation.patch [bz#997559]
  - kvm-ram-split-function-that-synchronizes-a-range.patch [bz#997559]
  - kvm-migration-synchronize-memory-bitmap-64bits-at-a-time.patch [bz#997559]
  - Resolves: bz#997559
    (Improve live migration bitmap handling)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-38.el7
changelog:
  - kvm-intel-hda-fix-position-buffer.patch [bz#947785]
  - kvm-The-calculation-of-bytes_xfer-in-qemu_put_buffer-is-.patch [bz#1003467]
  - kvm-migration-Fix-rate-limit.patch [bz#1003467]
  - kvm-audio-honor-QEMU_AUDIO_TIMER_PERIOD-instead-of-wakin.patch [bz#1017636]
  - kvm-audio-Lower-default-wakeup-rate-to-100-times-second.patch [bz#1017636]
  - kvm-audio-adjust-pulse-to-100Hz-wakeup-rate.patch [bz#1017636]
  - kvm-pc-Fix-rhel6.-3dnow-3dnowext-compat-bits.patch [bz#918907]
  - kvm-add-firmware-to-machine-options.patch [bz#1038603]
  - kvm-switch-rhel7-machine-types-to-big-bios.patch [bz#1038603]
  - kvm-add-bios-256k.bin-from-seabios-bin-1.7.2.2-10.el7.no.patch [bz#1038603]
  - kvm-pci-fix-pci-bridge-fw-path.patch [bz#1034518]
  - kvm-hw-cannot_instantiate_with_device_add_yet-due-to-poi.patch [bz#1031098]
  - kvm-qdev-Document-that-pointer-properties-kill-device_ad.patch [bz#1031098]
  - kvm-Add-back-no-hpet-but-ignore-it.patch [bz#1044742]
  - Resolves: bz#1003467
    (Backport migration fixes from post qemu 1.6)
  - Resolves: bz#1017636
    (PATCH: fix qemu using 50% host cpu when audio is playing)
  - Resolves: bz#1031098
    (Disable device smbus-eeprom)
  - Resolves: bz#1034518
    (boot order wrong with q35)
  - Resolves: bz#1038603
    (make seabios 256k for rhel7 machine types)
  - Resolves: bz#1044742
    (Cannot create guest on remote RHEL7 host using F20 virt-manager, libvirt's qemu -no-hpet detection is broken)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#947785
    (In rhel6.4 guest  sound recorder doesn't work when  playing audio)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-39.el7
changelog:
  - kvm-Revert-qdev-monitor-Fix-crash-when-device_add-is-cal.patch [bz#669524]
  - kvm-Revert-qdev-Do-not-let-the-user-try-to-device_add-wh.patch [bz#669524]
  - kvm-qdev-monitor-Clean-up-qdev_device_add-variable-namin.patch [bz#669524]
  - kvm-qdev-monitor-Fix-crash-when-device_add-is-called.2.patch.patch [bz#669524]
  - kvm-qdev-monitor-Avoid-qdev-as-variable-name.patch [bz#669524]
  - kvm-qdev-monitor-Inline-qdev_init-for-device_add.patch [bz#669524]
  - kvm-qdev-Do-not-let-the-user-try-to-device_add-when-it.2.patch.patch [bz#669524]
  - kvm-qdev-monitor-Avoid-device_add-crashing-on-non-device.patch [bz#669524]
  - kvm-qdev-monitor-Improve-error-message-for-device-nonexi.patch [bz#669524]
  - kvm-exec-change-well-known-physical-sections-to-macros.patch [bz#1003535]
  - kvm-exec-separate-sections-and-nodes-per-address-space.patch [bz#1003535]
  - Resolves: bz#1003535
    (qemu-kvm core dump when boot vm with more than 32 virtio disks/nics)
  - Resolves: bz#669524
    (Confusing error message from -device <unknown dev>)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-40.el7
changelog:
  - kvm-avoid-a-bogus-COMPLETED-CANCELLED-transition.patch [bz#1053699]
  - kvm-introduce-MIG_STATE_CANCELLING-state.patch [bz#1053699]
  - kvm-vvfat-use-bdrv_new-to-allocate-BlockDriverState.patch [bz#1041301]
  - kvm-block-implement-reference-count-for-BlockDriverState.patch [bz#1041301]
  - kvm-block-make-bdrv_delete-static.patch [bz#1041301]
  - kvm-migration-omit-drive-ref-as-we-have-bdrv_ref-now.patch [bz#1041301]
  - kvm-xen_disk-simplify-blk_disconnect-with-refcnt.patch [bz#1041301]
  - kvm-nbd-use-BlockDriverState-refcnt.patch [bz#1041301]
  - kvm-block-use-BDS-ref-for-block-jobs.patch [bz#1041301]
  - kvm-block-Make-BlockJobTypes-const.patch [bz#1041301]
  - kvm-blockjob-rename-BlockJobType-to-BlockJobDriver.patch [bz#1041301]
  - kvm-qapi-Introduce-enum-BlockJobType.patch [bz#1041301]
  - kvm-qapi-make-use-of-new-BlockJobType.patch [bz#1041301]
  - kvm-mirror-Don-t-close-target.patch [bz#1041301]
  - kvm-mirror-Move-base-to-MirrorBlockJob.patch [bz#1041301]
  - kvm-block-Add-commit_active_start.patch [bz#1041301]
  - kvm-commit-Support-commit-active-layer.patch [bz#1041301]
  - kvm-qemu-iotests-prefill-some-data-to-test-image.patch [bz#1041301]
  - kvm-qemu-iotests-Update-test-cases-for-commit-active.patch [bz#1041301]
  - kvm-commit-Remove-unused-check.patch [bz#1041301]
  - kvm-blockdev-use-bdrv_getlength-in-qmp_drive_mirror.patch [bz#921890]
  - kvm-qemu-iotests-make-assert_no_active_block_jobs-common.patch [bz#921890]
  - kvm-block-drive-mirror-Check-for-NULL-backing_hd.patch [bz#921890]
  - kvm-qemu-iotests-Extend-041-for-unbacked-mirroring.patch [bz#921890]
  - kvm-qapi-schema-Update-description-for-NewImageMode.patch [bz#921890]
  - kvm-block-drive-mirror-Reuse-backing-HD-for-sync-none.patch [bz#921890]
  - kvm-qemu-iotests-Fix-test-041.patch [bz#921890]
  - kvm-scsi-bus-fix-transfer-length-and-direction-for-VERIF.patch [bz#1035644]
  - kvm-scsi-disk-fix-VERIFY-emulation.patch [bz#1035644]
  - kvm-block-ensure-bdrv_drain_all-works-during-bdrv_delete.patch [bz#1041301]
  - kvm-use-recommended-max-vcpu-count.patch [bz#998708]
  - kvm-pc-Create-pc_compat_rhel-functions.patch [bz#1049706]
  - kvm-pc-Enable-x2apic-by-default-on-more-recent-CPU-model.patch [bz#1049706]
  - kvm-Build-all-subpackages-for-RHEV.patch [bz#1007204]
  - Resolves: bz#1007204
    (qemu-img-rhev  qemu-kvm-rhev-tools are not built for qemu-kvm-1.5.3-3.el7)
  - Resolves: bz#1035644
    (rhel7.0host + windows guest + virtio-win + 'chkdsk' in the guest gives qemu assertion in scsi_dma_complete)
  - Resolves: bz#1041301
    (live snapshot merge (commit) of the active layer)
  - Resolves: bz#1049706
    (MIss CPUID_EXT_X2APIC in Westmere cpu model)
  - Resolves: bz#1053699
    (Backport Cancelled race condition fixes)
  - Resolves: bz#921890
    (Core dump when block mirror with "sync" is "none" and mode is "absolute-paths")
  - Resolves: bz#998708
    (qemu-kvm: maximum vcpu should be recommended maximum)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-41.el7
changelog:
  - kvm-help-add-id-suboption-to-iscsi.patch [bz#1019221]
  - kvm-scsi-disk-add-UNMAP-limits-to-block-limits-VPD-page.patch [bz#1037503]
  - kvm-qdev-Fix-32-bit-compilation-in-print_size.patch [bz#1034876]
  - kvm-qdev-Use-clz-in-print_size.patch [bz#1034876]
  - Resolves: bz#1019221
    (Iscsi miss id sub-option in help output)
  - Resolves: bz#1034876
    (export acpi tables to guests)
  - Resolves: bz#1037503
    (fix thin provisioning support for block device backends)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-43.el7
changelog:
  - kvm-piix-gigabyte-alignment-for-ram.patch [bz#1026548]
  - kvm-pc_piix-document-gigabyte_align.patch [bz#1026548]
  - kvm-q35-gigabyle-alignment-for-ram.patch [bz#1026548]
  - kvm-virtio-bus-remove-vdev-field.patch [bz#983344]
  - kvm-virtio-pci-remove-vdev-field.patch [bz#983344]
  - kvm-virtio-bus-cleanup-plug-unplug-interface.patch [bz#983344]
  - kvm-virtio-blk-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-serial-switch-exit-callback-to-VirtioDeviceCl.patch [bz#983344]
  - kvm-virtio-net-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-scsi-switch-exit-callback-to-VirtioDeviceClas.patch [bz#983344]
  - kvm-virtio-balloon-switch-exit-callback-to-VirtioDeviceC.patch [bz#983344]
  - kvm-virtio-rng-switch-exit-callback-to-VirtioDeviceClass.patch [bz#983344]
  - kvm-virtio-pci-add-device_unplugged-callback.patch [bz#983344]
  - kvm-block-use-correct-filename-for-error-report.patch [bz#1051438]
  - Resolves: bz#1026548
    (i386: pc: align gpa<->hpa on 1GB boundary)
  - Resolves: bz#1051438
    (Error message contains garbled characters when unable to open image due to bad permissions (permission denied).)
  - Resolves: bz#983344
    (QEMU core dump and host will reboot when do hot-unplug a virtio-blk disk which use  the switch behind switch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-44.el7
changelog:
  - kvm-Partially-revert-rhel-Drop-cfi.pflash01-and-isa-ide-.patch [bz#1032346]
  - kvm-Revert-pc-Disable-the-use-flash-device-for-BIOS-unle.patch [bz#1032346]
  - kvm-memory-Replace-open-coded-memory_region_is_romd.patch [bz#1032346]
  - kvm-memory-Rename-readable-flag-to-romd_mode.patch [bz#1032346]
  - kvm-isapc-Fix-non-KVM-qemu-boot-read-write-memory-for-is.patch [bz#1032346]
  - kvm-add-kvm_readonly_mem_enabled.patch [bz#1032346]
  - kvm-support-using-KVM_MEM_READONLY-flag-for-regions.patch [bz#1032346]
  - kvm-pc_sysfw-allow-flash-pflash-memory-to-be-used-with-K.patch [bz#1032346]
  - kvm-fix-double-free-the-memslot-in-kvm_set_phys_mem.patch [bz#1032346]
  - kvm-sysfw-remove-read-only-pc_sysfw_flash_vs_rom_bug_com.patch [bz#1032346]
  - kvm-pc_sysfw-remove-the-rom_only-property.patch [bz#1032346]
  - kvm-pc_sysfw-do-not-make-it-a-device-anymore.patch [bz#1032346]
  - kvm-hw-i386-pc_sysfw-support-two-flash-drives.patch [bz#1032346]
  - kvm-i440fx-test-qtest_start-should-be-paired-with-qtest_.patch [bz#1032346]
  - kvm-i440fx-test-give-each-GTest-case-its-own-qtest.patch [bz#1032346]
  - kvm-i440fx-test-generate-temporary-firmware-blob.patch [bz#1032346]
  - kvm-i440fx-test-verify-firmware-under-4G-and-1M-both-bio.patch [bz#1032346]
  - kvm-piix-fix-32bit-pci-hole.patch [bz#1032346]
  - kvm-qapi-Add-backing-to-BlockStats.patch [bz#1041564]
  - kvm-pc-Disable-RDTSCP-unconditionally-on-rhel6.-machine-.patch [bz#918907]
  - kvm-pc-Disable-RDTSCP-on-AMD-CPU-models.patch [bz#1056428 bz#874400]
  - kvm-block-add-.bdrv_reopen_prepare-stub-for-iscsi.patch [bz#1030301]
  - Resolves: bz#1030301
    (qemu-img can not merge live snapshot to backing file(r/w backing file via libiscsi))
  - Resolves: bz#1032346
    (basic OVMF support (non-volatile UEFI variables in flash, and fixup for ACPI tables))
  - Resolves: bz#1041564
    ([NFR] qemu: Returning the watermark for all the images opened for writing)
  - Resolves: bz#1056428
    ("rdtscp" flag defined on Opteron_G5 model and cann't be exposed to guest)
  - Resolves: bz#874400
    ("rdtscp" flag defined on Opteron_G5 model and cann't be exposed to guest)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-45.el7
changelog:
  - kvm-vfio-pci-Fail-initfn-on-DMA-mapping-errors.patch [bz#1044815]
  - kvm-vfio-Destroy-memory-regions.patch [bz#1052030]
  - kvm-docs-qcow2-compat-1.1-is-now-the-default.patch [bz#1048092]
  - kvm-hda-codec-disable-streams-on-reset.patch [bz#947812]
  - kvm-QEMUBH-make-AioContext-s-bh-re-entrant.patch [bz#1009297]
  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1009297]
  - Resolves: bz#1009297
    (RHEL7.0 guest gui can not be used in dest host after migration)
  - Resolves: bz#1044815
    (vfio initfn succeeds even if IOMMU mappings fail)
  - Resolves: bz#1048092
    (manpage of qemu-img contains error statement about compat option)
  - Resolves: bz#1052030
    (src qemu-kvm core dump after hotplug/unhotplug GPU device and do local migration)
  - Resolves: bz#947812
    (There's a shot voice after  'system_reset'  during playing music inside rhel6 guest w/ intel-hda device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-46.el7
changelog:
  - kvm-block-fix-backing-file-segfault.patch [bz#748906]
  - kvm-block-Move-initialisation-of-BlockLimits-to-bdrv_ref.patch [bz#748906]
  - kvm-raw-Fix-BlockLimits-passthrough.patch [bz#748906]
  - kvm-block-Inherit-opt_transfer_length.patch [bz#748906]
  - kvm-block-Update-BlockLimits-when-they-might-have-change.patch [bz#748906]
  - kvm-qemu_memalign-Allow-small-alignments.patch [bz#748906]
  - kvm-block-Detect-unaligned-length-in-bdrv_qiov_is_aligne.patch [bz#748906]
  - kvm-block-Don-t-use-guest-sector-size-for-qemu_blockalig.patch [bz#748906]
  - kvm-block-rename-buffer_alignment-to-guest_block_size.patch [bz#748906]
  - kvm-raw-Probe-required-direct-I-O-alignment.patch [bz#748906]
  - kvm-block-Introduce-bdrv_aligned_preadv.patch [bz#748906]
  - kvm-block-Introduce-bdrv_co_do_preadv.patch [bz#748906]
  - kvm-block-Introduce-bdrv_aligned_pwritev.patch [bz#748906]
  - kvm-block-write-Handle-COR-dependency-after-I-O-throttli.patch [bz#748906]
  - kvm-block-Introduce-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-block-Switch-BdrvTrackedRequest-to-byte-granularity.patch [bz#748906]
  - kvm-block-Allow-waiting-for-overlapping-requests-between.patch [bz#748906]
  - kvm-block-use-DIV_ROUND_UP-in-bdrv_co_do_readv.patch [bz#748906]
  - kvm-block-Make-zero-after-EOF-work-with-larger-alignment.patch [bz#748906]
  - kvm-block-Generalise-and-optimise-COR-serialisation.patch [bz#748906]
  - kvm-block-Make-overlap-range-for-serialisation-dynamic.patch [bz#748906]
  - kvm-block-Fix-32-bit-truncation-in-mark_request_serialis.patch [bz#748906]
  - kvm-block-Allow-wait_serialising_requests-at-any-point.patch [bz#748906]
  - kvm-block-Align-requests-in-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-lock-Fix-memory-leaks-in-bdrv_co_do_pwritev.patch [bz#748906]
  - kvm-block-Assert-serialisation-assumptions-in-pwritev.patch [bz#748906]
  - kvm-block-Change-coroutine-wrapper-to-byte-granularity.patch [bz#748906]
  - kvm-block-Make-bdrv_pread-a-bdrv_prwv_co-wrapper.patch [bz#748906]
  - kvm-block-Make-bdrv_pwrite-a-bdrv_prwv_co-wrapper.patch [bz#748906]
  - kvm-iscsi-Set-bs-request_alignment.patch [bz#748906]
  - kvm-blkdebug-Make-required-alignment-configurable.patch [bz#748906]
  - kvm-blkdebug-Don-t-leak-bs-file-on-failure.patch [bz#748906]
  - kvm-qemu-io-New-command-sleep.patch [bz#748906]
  - kvm-qemu-iotests-Filter-out-qemu-io-prompt.patch [bz#748906]
  - kvm-qemu-iotests-Test-pwritev-RMW-logic.patch [bz#748906]
  - kvm-block-bdrv_aligned_pwritev-Assert-overlap-range.patch [bz#748906]
  - kvm-block-Don-t-call-ROUND_UP-with-negative-values.patch [bz#748906]
  - Resolves: bz#748906
    (qemu fails on disk with 4k sectors and cache=off)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-47.el7
changelog:
  - kvm-seccomp-add-mkdir-and-fchmod-to-the-whitelist.patch [bz#1026314]
  - kvm-seccomp-add-some-basic-shared-memory-syscalls-to-the.patch [bz#1026314]
  - kvm-scsi-Support-TEST-UNIT-READY-in-the-dummy-LUN0.patch [bz#1004143]
  - kvm-usb-add-vendor-request-defines.patch [bz#1039530]
  - kvm-usb-move-usb_-hi-lo-helpers-to-header-file.patch [bz#1039530]
  - kvm-usb-add-support-for-microsoft-os-descriptors.patch [bz#1039530]
  - kvm-usb-add-microsoft-os-descriptors-compat-property.patch [bz#1039530]
  - kvm-usb-hid-add-microsoft-os-descriptor-support.patch [bz#1039530]
  - kvm-configure-add-option-to-disable-fstack-protect.patch [bz#1044182]
  - kvm-exec-always-use-MADV_DONTFORK.patch [bz#1004197]
  - kvm-pc-Save-size-of-RAM-below-4GB.patch [bz#1048080]
  - kvm-acpi-Fix-PCI-hole-handling-on-build_srat.patch [bz#1048080]
  - kvm-Add-check-for-cache-size-smaller-than-page-size.patch [bz#1017096]
  - kvm-XBZRLE-cache-size-should-not-be-larger-than-guest-me.patch [bz#1047448]
  - kvm-Don-t-abort-on-out-of-memory-when-creating-page-cach.patch [bz#1047448]
  - kvm-Don-t-abort-on-memory-allocation-error.patch [bz#1047448]
  - kvm-Set-xbzrle-buffers-to-NULL-after-freeing-them-to-avo.patch [bz#1038540]
  - kvm-migration-fix-free-XBZRLE-decoded_buf-wrong.patch [bz#1038540]
  - kvm-block-resize-backing-file-image-during-offline-commi.patch [bz#1047254]
  - kvm-block-resize-backing-image-during-active-layer-commi.patch [bz#1047254]
  - kvm-block-update-block-commit-documentation-regarding-im.patch [bz#1047254]
  - kvm-block-Fix-bdrv_commit-return-value.patch [bz#1047254]
  - kvm-block-remove-QED-.bdrv_make_empty-implementation.patch [bz#1047254]
  - kvm-block-remove-qcow2-.bdrv_make_empty-implementation.patch [bz#1047254]
  - kvm-qemu-progress-Drop-unused-include.patch [bz#997878]
  - kvm-qemu-progress-Fix-progress-printing-on-SIGUSR1.patch [bz#997878]
  - kvm-Documentation-qemu-img-Mention-SIGUSR1-progress-repo.patch [bz#997878]
  - Resolves: bz#1004143
    ("test unit ready failed" on LUN 0 delays boot when a virtio-scsi target does not have any disk on LUN 0)
  - Resolves: bz#1004197
    (Cannot hot-plug nic in windows VM when the vmem is larger)
  - Resolves: bz#1017096
    (Fail to migrate while the size of migrate-compcache less then 4096)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1038540
    (qemu-kvm aborted while cancel migration then restart it (with page delta compression))
  - Resolves: bz#1039530
    (add support for microsoft os descriptors)
  - Resolves: bz#1044182
    (Relax qemu-kvm stack protection to -fstack-protector-strong)
  - Resolves: bz#1047254
    (qemu-img failed to commit image)
  - Resolves: bz#1047448
    (qemu-kvm core  dump in src host when do migration with "migrate_set_capability xbzrle on and migrate_set_cache_size 10000G")
  - Resolves: bz#1048080
    (Qemu-kvm NUMA emulation failed)
  - Resolves: bz#997878
    (Kill -SIGUSR1 `pidof qemu-img convert` can not get progress of qemu-img)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-48.el7
changelog:
  - kvm-spec-disable-qom-cast-debug.patch [bz#1063942]
  - kvm-fix-guest-physical-bits-to-match-host-to-go-beyond-1.patch [bz#989677]
  - kvm-monitor-Cleanup-mon-outbuf-on-write-error.patch [bz#1065225]
  - Resolves: bz#1063942
    (configure qemu-kvm with --disable-qom-cast-debug)
  - Resolves: bz#1065225
    (QMP socket breaks on unexpected close)
  - Resolves: bz#989677
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-49.el7
changelog:
  - kvm-xhci-add-support-for-suspend-resume.patch [bz#1012365]
  - kvm-qcow2-remove-n_start-and-n_end-of-qcow2_alloc_cluste.patch [bz#1049176]
  - kvm-qcow2-fix-offset-overflow-in-qcow2_alloc_clusters_at.patch [bz#1049176]
  - kvm-qcow2-check-for-NULL-l2meta.patch [bz#1055848]
  - kvm-qemu-iotests-add-test-for-qcow2-preallocation-with-d.patch [bz#1055848]
  - Resolves: bz#1012365
    (xhci usb storage lost in guest after wakeup from S3)
  - Resolves: bz#1049176
    (qemu-img core dump when using "-o preallocation=metadata,cluster_size=2048k" to create image of libiscsi lun)
  - Resolves: bz#1055848
    (qemu-img core dumped when cluster size is larger than the default value with opreallocation=metadata specified)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-50.el7
changelog:
  - kvm-mempath-prefault-fix-off-by-one-error.patch [bz#1069039]
  - kvm-qemu-option-has_help_option-and-is_valid_option_list.patch [bz#1065873]
  - kvm-qemu-img-create-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-convert-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-amend-Support-multiple-o-options.patch [bz#1065873]
  - kvm-qemu-img-Allow-o-help-with-incomplete-argument-list.patch [bz#1065873]
  - kvm-qemu-iotests-Check-qemu-img-command-line-parsing.patch [bz#1065873]
  - Resolves: bz#1065873
    (qemu-img silently ignores options with multiple -o parameters)
  - Resolves: bz#1069039
    (-mem-prealloc option behaviour is opposite to expected)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-51.el7
changelog:
  - kvm-qmp-access-the-local-QemuOptsLists-for-drive-option.patch [bz#1026184]
  - kvm-qxl-add-sanity-check.patch [bz#751937]
  - kvm-Fix-two-XBZRLE-corruption-issues.patch [bz#1063417]
  - kvm-qdev-monitor-set-DeviceState-opts-before-calling-rea.patch [bz#1037956]
  - kvm-vfio-blacklist-loading-of-unstable-roms.patch [bz#1037956]
  - kvm-block-Set-block-filename-sizes-to-PATH_MAX-instead-o.patch [bz#1072339]
  - Resolves: bz#1026184
    (QMP: querying -drive option returns a NULL parameter list)
  - Resolves: bz#1037956
    (bnx2x: boot one guest to do vfio-pci with all PFs assigned in same group meet QEMU segmentation fault (Broadcom BCM57810 card))
  - Resolves: bz#1063417
    (google stressapptest vs Migration)
  - Resolves: bz#1072339
    (RHEV: Cannot start VMs that have more than 23 snapshots.)
  - Resolves: bz#751937
    (qxl triggers assert during iofuzz test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-52.el7
changelog:
  - kvm-target-i386-Move-hyperv_-static-globals-to-X86CPU.patch [bz#1004773]
  - kvm-Fix-uninitialized-cpuid_data.patch [bz#1057173]
  - kvm-fix-coexistence-of-KVM-and-Hyper-V-leaves.patch [bz#1004773]
  - kvm-make-availability-of-Hyper-V-enlightenments-depe.patch [bz#1004773]
  - kvm-make-hyperv-hypercall-and-guest-os-id-MSRs-migra.patch [bz#1004773]
  - kvm-make-hyperv-vapic-assist-page-migratable.patch [bz#1004773]
  - kvm-target-i386-Convert-hv_relaxed-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_vapic-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-hv_spinlocks-to-static-property.patch [bz#1057173]
  - kvm-target-i386-Convert-check-and-enforce-to-static-prop.patch [bz#1004773]
  - kvm-target-i386-Cleanup-foo-feature-handling.patch [bz#1057173]
  - kvm-add-support-for-hyper-v-timers.patch [bz#1057173]
  - Resolves: bz#1004773
    (Hyper-V guest OS id and hypercall MSRs not migrated)
  - Resolves: bz#1057173
    (KVM Hyper-V Enlightenment - New feature - hv-time (QEMU))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-53.el7
changelog:
  - kvm-dataplane-Fix-startup-race.patch [bz#1069541]
  - kvm-QMP-Relax-__com.redhat_drive_add-parameter-checking.patch [bz#1057471]
  - kvm-all-exit-in-case-max-vcpus-exceeded.patch [bz#993429]
  - kvm-block-gluster-code-movements-state-storage-changes.patch [bz#1031526]
  - kvm-block-gluster-add-reopen-support.patch [bz#1031526]
  - kvm-virtio-net-add-feature-bit-for-any-header-s-g.patch [bz#990989]
  - kvm-spec-Add-README.rhel6-gpxe-source.patch [bz#1073774]
  - kvm-pc-Add-RHEL6-e1000-gPXE-image.patch [bz#1073774]
  - kvm-loader-rename-in_ram-has_mr.patch [bz#1064018]
  - kvm-pc-avoid-duplicate-names-for-ROM-MRs.patch [bz#1064018]
  - kvm-qemu-img-convert-Fix-progress-output.patch [bz#1073728]
  - kvm-qemu-iotests-Test-progress-output-for-conversion.patch [bz#1073728]
  - kvm-iscsi-Use-bs-sg-for-everything-else-than-disks.patch [bz#1067784]
  - kvm-block-Fix-bs-request_alignment-assertion-for-bs-sg-1.patch [bz#1067784]
  - kvm-qemu_file-use-fwrite-correctly.patch [bz#1005103]
  - kvm-qemu_file-Fix-mismerge-of-use-fwrite-correctly.patch [bz#1005103]
  - Resolves: bz#1005103
    (Migration should fail when migrate guest offline to a file which is specified to a readonly directory.)
  - Resolves: bz#1031526
    (Can not commit snapshot when disk is using glusterfs:native backend)
  - Resolves: bz#1057471
    (fail to do hot-plug with "discard = on" with "Invalid parameter 'discard'" error)
  - Resolves: bz#1064018
    (abort from conflicting genroms)
  - Resolves: bz#1067784
    (qemu-kvm: block.c:850: bdrv_open_common: Assertion `bs->request_alignment != 0' failed. Aborted (core dumped))
  - Resolves: bz#1069541
    (Segmentation fault when boot guest with dataplane=on)
  - Resolves: bz#1073728
    (progress bar doesn't display when converting with -p)
  - Resolves: bz#1073774
    (e1000 ROM cause migrate fail  from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#990989
    (backport inline header virtio-net optimization)
  - Resolves: bz#993429
    (kvm: test maximum number of vcpus supported (rhel7))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-54.el7
changelog:
  - kvm-qdev-monitor-Set-properties-after-parent-is-assigned.patch [bz#1046248]
  - kvm-block-Update-image-size-in-bdrv_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Keep-option-in-qcow2_invalidate_cache.patch [bz#1048575]
  - kvm-qcow2-Check-bs-drv-in-copy_sectors.patch [bz#1048575]
  - kvm-block-bs-drv-may-be-NULL-in-bdrv_debug_resume.patch [bz#1048575]
  - kvm-iotests-Test-corruption-during-COW-request.patch [bz#1048575]
  - Resolves: bz#1046248
    (qemu-kvm crash when send "info qtree" after hot plug a device with invalid addr)
  - Resolves: bz#1048575
    (Segmentation fault occurs after migrate guest(use scsi disk and add stress) to des machine)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-55.el7
changelog:
  - kvm-scsi-Change-scsi-sense-buf-size-to-252.patch [bz#1058173]
  - kvm-scsi-Fix-migration-of-scsi-sense-data.patch [bz#1058173]
  - Resolves: bz#1058173
    (qemu-kvm core dump booting guest with scsi-generic disk attached when using built-in iscsi driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-56.el7
changelog:
  - kvm-configure-Fix-bugs-preventing-Ceph-inclusion.patch [bz#1078809]
  - Resolves: bz#1078809
    (can not boot qemu-kvm-rhev with rbd image)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-57.el7
changelog:
  - kvm-virtio-net-fix-guest-triggerable-buffer-overrun.patch [bz#1078308]
  - Resolves: bz#1078308
    (EMBARGOED CVE-2014-0150 qemu: virtio-net: fix guest-triggerable buffer overrun [rhel-7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-58.el7
changelog:
  - kvm-pc-Use-cpu64-rhel6-CPU-model-by-default-on-rhel6-mac.patch [bz#1080170]
  - kvm-target-i386-Copy-cpu64-rhel6-definition-into-qemu64.patch [bz#1078607 bz#1080170]
  - Resolves: bz#1080170
    (intel 82576 VF not work in windows 2008 x86 - Code 12 [TestOnly])
  - Resolves: bz#1080170
    (Default CPU model for rhel6.* machine-types is different from RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-59.el7
changelog:
  - kvm-qemu-iotests-add-.-check-cloop-support.patch [bz#1066691]
  - kvm-qemu-iotests-add-cloop-input-validation-tests.patch [bz#1066691]
  - kvm-block-cloop-validate-block_size-header-field-CVE-201.patch [bz#1079455]
  - kvm-block-cloop-prevent-offsets_size-integer-overflow-CV.patch [bz#1079320]
  - kvm-block-cloop-refuse-images-with-huge-offsets-arrays-C.patch [bz#1079455]
  - kvm-block-cloop-refuse-images-with-bogus-offsets-CVE-201.patch [bz#1079455]
  - kvm-size-off-by-one.patch [bz#1066691]
  - kvm-qemu-iotests-Support-for-bochs-format.patch [bz#1066691]
  - kvm-bochs-Unify-header-structs-and-make-them-QEMU_PACKED.patch [bz#1066691]
  - kvm-bochs-Use-unsigned-variables-for-offsets-and-sizes-C.patch [bz#1079339]
  - kvm-bochs-Check-catalog_size-header-field-CVE-2014-0143.patch [bz#1079320]
  - kvm-bochs-Check-extent_size-header-field-CVE-2014-0142.patch [bz#1079315]
  - kvm-bochs-Fix-bitmap-offset-calculation.patch [bz#1066691]
  - kvm-vpc-vhd-add-bounds-check-for-max_table_entries-and-b.patch [bz#1079455]
  - kvm-vpc-Validate-block-size-CVE-2014-0142.patch [bz#1079315]
  - kvm-vdi-add-bounds-checks-for-blocks_in_image-and-disk_s.patch [bz#1079455]
  - kvm-vhdx-Bounds-checking-for-block_size-and-logical_sect.patch [bz#1079346]
  - kvm-curl-check-data-size-before-memcpy-to-local-buffer.-.patch [bz#1079455]
  - kvm-qcow2-Check-header_length-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-backing_file_offset-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch [bz#1079455]
  - kvm-qcow2-Validate-refcount-table-offset.patch [bz#1066691]
  - kvm-qcow2-Validate-snapshot-table-offset-size-CVE-2014-0.patch [bz#1079455]
  - kvm-qcow2-Validate-active-L1-table-offset-and-size-CVE-2.patch [bz#1079455]
  - kvm-qcow2-Fix-backing-file-name-length-check.patch [bz#1066691]
  - kvm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_refc.patch [bz#1079339]
  - kvm-qcow2-Avoid-integer-overflow-in-get_refcount-CVE-201.patch [bz#1079320]
  - kvm-qcow2-Check-new-refcount-table-size-on-growth.patch [bz#1066691]
  - kvm-qcow2-Fix-types-in-qcow2_alloc_clusters-and-alloc_cl.patch [bz#1066691]
  - kvm-qcow2-Protect-against-some-integer-overflows-in-bdrv.patch [bz#1066691]
  - kvm-qcow2-Fix-new-L1-table-size-check-CVE-2014-0143.patch [bz#1079320]
  - kvm-dmg-coding-style-and-indentation-cleanup.patch [bz#1066691]
  - kvm-dmg-prevent-out-of-bounds-array-access-on-terminator.patch [bz#1066691]
  - kvm-dmg-drop-broken-bdrv_pread-loop.patch [bz#1066691]
  - kvm-dmg-use-appropriate-types-when-reading-chunks.patch [bz#1066691]
  - kvm-dmg-sanitize-chunk-length-and-sectorcount-CVE-2014-0.patch [bz#1079325]
  - kvm-dmg-use-uint64_t-consistently-for-sectors-and-length.patch [bz#1066691]
  - kvm-dmg-prevent-chunk-buffer-overflow-CVE-2014-0145.patch [bz#1079325]
  - kvm-block-vdi-bounds-check-qemu-io-tests.patch [bz#1066691]
  - kvm-block-Limit-request-size-CVE-2014-0143.patch [bz#1079320]
  - kvm-qcow2-Fix-copy_sectors-with-VM-state.patch [bz#1066691]
  - kvm-qcow2-Fix-NULL-dereference-in-qcow2_open-error-path-.patch [bz#1079333]
  - kvm-qcow2-Fix-L1-allocation-size-in-qcow2_snapshot_load_.patch [bz#1079325]
  - kvm-qcow2-Check-maximum-L1-size-in-qcow2_snapshot_load_t.patch [bz#1079320]
  - kvm-qcow2-Limit-snapshot-table-size.patch [bz#1066691]
  - kvm-parallels-Fix-catalog-size-integer-overflow-CVE-2014.patch [bz#1079320]
  - kvm-parallels-Sanity-check-for-s-tracks-CVE-2014-0142.patch [bz#1079315]
  - kvm-fix-machine-check-propagation.patch [bz#740107]
  - Resolves: bz#1066691
    (qemu-kvm: include leftover patches from block layer security audit)
  - Resolves: bz#1079315
    (CVE-2014-0142 qemu-kvm: qemu: crash by possible division by zero [rhel-7.0])
  - Resolves: bz#1079320
    (CVE-2014-0143 qemu-kvm: Qemu: block: multiple integer overflow flaws [rhel-7.0])
  - Resolves: bz#1079325
    (CVE-2014-0145 qemu-kvm: Qemu: prevent possible buffer overflows [rhel-7.0])
  - Resolves: bz#1079333
    (CVE-2014-0146 qemu-kvm: Qemu: qcow2: NULL dereference in qcow2_open() error path [rhel-7.0])
  - Resolves: bz#1079339
    (CVE-2014-0147 qemu-kvm: Qemu: block: possible crash due signed types or logic error [rhel-7.0])
  - Resolves: bz#1079346
    (CVE-2014-0148 qemu-kvm: Qemu: vhdx: bounds checking for block_size and logical_sector_size [rhel-7.0])
  - Resolves: bz#1079455
    (CVE-2014-0144 qemu-kvm: Qemu: block: missing input validation [rhel-7.0])
  - Resolves: bz#740107
    ([Hitachi 7.0 FEAT]  KVM: MCA Recovery for KVM guest OS memory)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7
changelog:
  - kvm-qcow2-fix-dangling-refcount-table-entry.patch [bz#1081793]
  - kvm-qcow2-link-all-L2-meta-updates-in-preallocate.patch [bz#1081393]
  - Resolves: bz#1081393
    (qemu-img will prompt that 'leaked clusters were found' while creating images with '-o preallocation=metadata,cluster_size<=1024')
  - Resolves: bz#1081793
    (qemu-img core dumped when creating a qcow2 image base on block device(iscsi or libiscsi))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-61.el7
changelog:
  - kvm-iscsi-fix-indentation.patch [bz#1083413]
  - kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch [bz#1083413]
  - kvm-block-iscsi-query-for-supported-VPD-pages.patch [bz#1083413]
  - kvm-block-iscsi-fix-segfault-if-writesame-fails.patch [bz#1083413]
  - kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch [bz#1083413]
  - kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch [bz#1083413]
  - kvm-iscsi-always-query-max-WRITE-SAME-length.patch [bz#1083413]
  - kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch [bz#1083413]
  - kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch [bz#1083413]
  - kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch [bz#1027565]
  - kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch [bz#1085701]
  - kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch [bz#1087980]
  - Resolves: bz#1027565
    (fail to reboot guest after migration from RHEL6.5 host to RHEL7.0 host)
  - Resolves: bz#1083413
    (qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400))
  - Resolves: bz#1085701
    (Guest hits call trace migrate from RHEL6.5 to RHEL7.0 host with -M 6.1 & balloon & uhci device)
  - Resolves: bz#1087980
    (CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-62.el7
changelog:
  - kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch [bz#1094285]
  - Resolves: bz#1094285
    (Hot plug CPU not working with RHEL6  machine types running on RHEL7 host.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-63.el7
changelog:
  - kvm-char-restore-read-callback-on-a-reattached-hotplug-c.patch [bz#1038914]
  - kvm-qcow2-Free-preallocated-zero-clusters.patch [bz#1052093]
  - kvm-qemu-iotests-Discard-preallocated-zero-clusters.patch [bz#1052093]
  - kvm-XBZRLE-Fix-qemu-crash-when-resize-the-xbzrle-cache.patch [bz#1066338]
  - kvm-Provide-init-function-for-ram-migration.patch [bz#1066338]
  - kvm-Init-the-XBZRLE.lock-in-ram_mig_init.patch [bz#1066338]
  - kvm-XBZRLE-Fix-one-XBZRLE-corruption-issues.patch [bz#1066338]
  - kvm-Count-used-RAMBlock-pages-for-migration_dirty_pages.patch [bz#1074913]
  - kvm-virtio-net-fix-buffer-overflow-on-invalid-state-load.patch [bz#1095678]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-invalid-sta.patch [bz#1095690]
  - kvm-virtio-net-out-of-bounds-buffer-write-on-load.patch [bz#1095685]
  - kvm-virtio-out-of-bounds-buffer-write-on-invalid-state-l.patch [bz#1095695]
  - kvm-virtio-avoid-buffer-overrun-on-incoming-migration.patch [bz#1095738]
  - kvm-virtio-scsi-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095742]
  - kvm-virtio-validate-config_len-on-load.patch [bz#1095783]
  - kvm-virtio-validate-num_sg-when-mapping.patch [bz#1095766]
  - kvm-virtio-allow-mapping-up-to-max-queue-size.patch [bz#1095766]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_load.patch [bz#1095747]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_l2.patch [bz#1095747]
  - kvm-vmstate-reduce-code-duplication.patch [bz#1095716]
  - kvm-vmstate-add-VMS_MUST_EXIST.patch [bz#1095716]
  - kvm-vmstate-add-VMSTATE_VALIDATE.patch [bz#1095716]
  - kvm-hpet-fix-buffer-overrun-on-invalid-state-load.patch [bz#1095707]
  - kvm-hw-pci-pcie_aer.c-fix-buffer-overruns-on-invalid-sta.patch [bz#1095716]
  - kvm-usb-fix-up-post-load-checks.patch [bz#1096829]
  - kvm-qcow-correctly-propagate-errors.patch [bz#1097230]
  - kvm-qcow1-Make-padding-in-the-header-explicit.patch [bz#1097230]
  - kvm-qcow1-Check-maximum-cluster-size.patch [bz#1097230]
  - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.patch [bz#1097230]
  - kvm-qcow1-Validate-image-size-CVE-2014-0223.patch [bz#1097237]
  - kvm-qcow1-Stricter-backing-file-length-check.patch [bz#1097237]
  - Resolves: bz#1038914
    (Guest can't receive any character transmitted from host after hot unplugging virtserialport then hot plugging again)
  - Resolves: bz#1052093
    (qcow2 corruptions (leaked clusters after installing a rhel7 guest using virtio_scsi))
  - Resolves: bz#1066338
    (Reduce the migrate cache size during migration causes qemu segment fault)
  - Resolves: bz#1074913
    (migration can not finish with 1024k 'remaining ram' left after hotunplug 4 nics)
  - Resolves: bz#1095678
    (CVE-2013-4148 qemu-kvm: qemu: virtio-net: buffer overflow on invalid state load [rhel-7.1])
  - Resolves: bz#1095685
    (CVE-2013-4149 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on load [rhel-7.1])
  - Resolves: bz#1095690
    (CVE-2013-4150 qemu-kvm: qemu: virtio-net: out-of-bounds buffer write on invalid state load [rhel-7.1])
  - Resolves: bz#1095695
    (CVE-2013-4151 qemu-kvm: qemu: virtio: out-of-bounds buffer write on invalid state load [rhel-7.1])
  - Resolves: bz#1095707
    (CVE-2013-4527 qemu-kvm: qemu: hpet: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095716
    (CVE-2013-4529 qemu-kvm: qemu: hw/pci/pcie_aer.c: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095738
    (CVE-2013-6399 qemu-kvm: qemu: virtio: buffer overrun on incoming migration [rhel-7.1])
  - Resolves: bz#1095742
    (CVE-2013-4542 qemu-kvm: qemu: virtio-scsi: buffer overrun on invalid state load [rhel-7.1])
  - Resolves: bz#1095747
    (CVE-2013-4541 qemu-kvm: qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load [rhel-7.1])
  - Resolves: bz#1095766
    (CVE-2013-4535 CVE-2013-4536 qemu-kvm: qemu: virtio: insufficient validation of num_sg when mapping [rhel-7.1])
  - Resolves: bz#1095783
    (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-7.1])
  - Resolves: bz#1096829
    (CVE-2014-3461 qemu-kvm: Qemu: usb: fix up post load checks [rhel-7.1])
  - Resolves: bz#1097230
    (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-7.1])
  - Resolves: bz#1097237
    (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-64.el7
changelog:
  - kvm-zero-initialize-KVM_SET_GSI_ROUTING-input.patch [bz#1098976]
  - kvm-skip-system-call-when-msi-route-is-unchanged.patch [bz#1098976]
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-65.el7
changelog:
  - kvm-Allow-mismatched-virtio-config-len.patch [bz#1113009]
  - Resolves: bz#1113009
    (Migration failed with virtio-blk from RHEL6.5.0 host to RHEL7.0 host)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-66.el7
changelog:
  - kvm-xhci-fix-overflow-in-usb_xhci_post_load.patch [bz#1074219]
  - kvm-migration-qmp_migrate-keep-working-after-syntax-erro.patch [bz#1086598]
  - kvm-seccomp-add-shmctl-mlock-and-munlock-to-the-syscall-.patch [bz#1026314]
  - kvm-exit-when-no-kvm-and-vcpu-count-160.patch [bz#1076326]
  - kvm-Disallow-outward-migration-while-awaiting-incoming-m.patch [bz#1086987]
  - kvm-block-Ignore-duplicate-or-NULL-format_name-in-bdrv_i.patch [bz#1088695 bz#1093983]
  - kvm-block-vhdx-account-for-identical-header-sections.patch [bz#1097020]
  - kvm-aio-Fix-use-after-free-in-cancellation-path.patch [bz#1095877]
  - kvm-scsi-disk-Improve-error-messager-if-can-t-get-versio.patch [bz#1021788]
  - kvm-scsi-Improve-error-messages-more.patch [bz#1021788]
  - kvm-memory-Don-t-call-memory_region_update_coalesced_ran.patch [bz#1096645]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-backwar.patch [bz#1098602]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock_cu.patch [bz#1098602]
  - Resolves: bz#1021788
    (the error message "scsi generic interface too old" is wrong more often than not)
  - Resolves: bz#1026314
    (qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1076326
    (qemu-kvm does not quit when booting guest w/ 161 vcpus and "-no-kvm")
  - Resolves: bz#1086598
    (migrate_cancel wont take effect on previouly wrong migrate -d cmd)
  - Resolves: bz#1086987
    (src qemu crashed when starting migration in inmigrate mode)
  - Resolves: bz#1088695
    (there are four "gluster" in qemu-img supported format list)
  - Resolves: bz#1093983
    (there are three "nbd" in qemu-img supported format list)
  - Resolves: bz#1095877
    (segmentation fault in qemu-kvm due to use-after-free of a SCSIGenericReq (host device pass-through))
  - Resolves: bz#1096645
    ([FJ7.0 Bug] RHEL7.0 guest attaching 150 or more virtio-blk disks fails to start up)
  - Resolves: bz#1097020
    ([RFE] qemu-img: Add/improve Disk2VHD tools creating VHDX images)
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-67.el7
changelog:
  - kvm-vl.c-Output-error-on-invalid-machine-type.patch [bz#990724]
  - kvm-migration-dump-vmstate-info-as-a-json-file-for-stati.patch [bz#1118707]
  - kvm-vmstate-static-checker-script-to-validate-vmstate-ch.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-dump1-and-dump2-fil.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-incompat-machine-types.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-version-error-in-ma.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-version-mismatch-inside.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-minimum_version_id-chec.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-section.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-field.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-last-field-in-a-.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-change-description-name.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Fields.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Description.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Description-insi.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-a-subsection.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-remove-Subsections.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-substructure-for-us.patch [bz#1118707]
  - kvm-tests-vmstate-static-checker-add-size-mismatch-insid.patch [bz#1118707]
  - kvm-aio-fix-qemu_bh_schedule-bh-ctx-race-condition.patch [bz#1116728]
  - kvm-block-Improve-driver-whitelist-checks.patch [bz#999789]
  - kvm-vmdk-Fix-format-specific-information-create-type-for.patch [bz#1029271]
  - kvm-virtio-pci-Report-an-error-when-msix-vectors-init-fa.patch [bz#1095645]
  - kvm-scsi-Report-error-when-lun-number-is-in-use.patch [bz#1096576]
  - kvm-util-Split-out-exec_dir-from-os_find_datadir.patch [bz#1017685]
  - kvm-rules.mak-fix-obj-to-a-real-relative-path.patch [bz#1017685]
  - kvm-rules.mak-allow-per-object-cflags-and-libs.patch [bz#1017685]
  - kvm-block-use-per-object-cflags-and-libs.patch [bz#1017685]
  - kvm-vmdk-Fix-creating-big-description-file.patch [bz#1039791]
  - Resolves: bz#1017685
    (Gluster etc. should not be a dependency of vscclient and libcacard)
  - Resolves: bz#1029271
    (Format specific information (create type) was wrong when create it specified subformat='streamOptimized')
  - Resolves: bz#1039791
    (qemu-img creates truncated VMDK image with subformat=twoGbMaxExtentFlat)
  - Resolves: bz#1095645
    (vectors of virtio-scsi-pci will be 0 when set vectors>=129)
  - Resolves: bz#1096576
    (QEMU core dumped when boot up two scsi-hd disk on the same virtio-scsi-pci controller in Intel host)
  - Resolves: bz#1116728
    (Backport qemu_bh_schedule() race condition fix)
  - Resolves: bz#1118707
    (VMstate static checker: backport -dump-vmstate feature to export json-encoded vmstate info)
  - Resolves: bz#990724
    (qemu-kvm failing when invalid machine type is provided)
  - Resolves: bz#999789
    (qemu should give a more friendly prompt when didn't specify read-only for VMDK format disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-68.el7
changelog:
  - kvm-virtio-net-Do-not-filter-VLANs-without-F_CTRL_VLAN.patch [bz#1065724]
  - kvm-virtio-net-add-vlan-receive-state-to-RxFilterInfo.patch [bz#1065724]
  - kvm-virtio-rng-check-return-value-of-virtio_load.patch [bz#1116941]
  - kvm-qapi-treat-all-negative-return-of-strtosz_suffix-as-.patch [bz#1074403]
  - Resolves: bz#1065724
    (rx filter incorrect when guest disables VLAN filtering)
  - Resolves: bz#1074403
    (qemu-kvm can not give any warning hint when set sndbuf with negative value)
  - Resolves: bz#1116941
    (Return value of virtio_load not checked in virtio_rng_load)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-69.el7
changelog:
  - kvm-rdma-bug-fixes.patch [bz#1107821]
  - kvm-virtio-serial-report-frontend-connection-state-via-m.patch [bz#1122151]
  - kvm-char-report-frontend-open-closed-state-in-query-char.patch [bz#1122151]
  - kvm-acpi-fix-tables-for-no-hpet-configuration.patch [bz#1129552]
  - kvm-mirror-Fix-resource-leak-when-bdrv_getlength-fails.patch [bz#1130603]
  - kvm-blockjob-Add-block_job_yield.patch [bz#1130603]
  - kvm-mirror-Go-through-ready-complete-process-for-0-len-i.patch [bz#1130603]
  - kvm-qemu-iotests-Test-BLOCK_JOB_READY-event-for-0Kb-imag.patch [bz#1130603]
  - kvm-block-make-top-argument-to-block-commit-optional.patch [bz#1130603]
  - kvm-qemu-iotests-Test-0-length-image-for-mirror.patch [bz#1130603]
  - kvm-mirror-Fix-qiov-size-for-short-requests.patch [bz#1130603]
  - Resolves: bz#1107821
    (rdma migration: seg if destination isn't listening)
  - Resolves: bz#1122151
    (Pass close from qemu-ga)
  - Resolves: bz#1129552
    (backport "acpi: fix tables for no-hpet configuration")
  - Resolves: bz#1130603
    (advertise active commit to libvirt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-70.el7
changelog:
  - kvm-Enforce-stack-protector-usage.patch [bz#1064260]
  - kvm-pc-increase-maximal-VCPU-count-to-240.patch [bz#1134408]
  - kvm-gluster-Add-discard-support-for-GlusterFS-block-driv.patch [bz#1136534]
  - kvm-gluster-default-scheme-to-gluster-and-host-to-localh.patch [bz#1088150]
  - kvm-qdev-properties-system.c-Allow-vlan-or-netdev-for-de.patch [bz#996011]
  - kvm-vl-process-object-after-other-backend-options.patch [bz#1128095]
  - Resolves: bz#1064260
    (Handle properly --enable-fstack-protector option)
  - Resolves: bz#1088150
    (qemu-img coredumpd when try to create a gluster format image)
  - Resolves: bz#1128095
    (chardev 'chr0' isn't initialized when we try to open rng backend)
  - Resolves: bz#1134408
    ([HP 7.1 FEAT] Increase qemu-kvm's VCPU limit to 240)
  - Resolves: bz#1136534
    (glusterfs backend does not support discard)
  - Resolves: bz#996011
    (vlan and queues options cause core dumped when qemu-kvm process quit(or ctrl+c))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-71.el7
changelog:
  - kvm-spice-move-qemu_spice_display_-from-spice-graphics-t.patch [bz#1054077]
  - kvm-spice-move-spice_server_vm_-start-stop-calls-into-qe.patch [bz#1054077]
  - kvm-spice-stop-server-for-qxl-hard-reset.patch [bz#1054077]
  - kvm-qemu-Adjust-qemu-wakeup.patch [bz#1064156]
  - kvm-vmstate_xhci_event-fix-unterminated-field-list.patch [bz#1122147]
  - kvm-vmstate_xhci_event-bug-compat-with-RHEL-7.0-RHEL-onl.patch [bz#1122147]
  - kvm-pflash_cfi01-write-flash-contents-to-bdrv-on-incomin.patch [bz#1139702]
  - kvm-ide-test-Add-enum-value-for-DEV.patch [bz#1123372]
  - kvm-ide-test-Add-FLUSH-CACHE-test-case.patch [bz#1123372]
  - kvm-ide-Fix-segfault-when-flushing-a-device-that-doesn-t.patch [bz#1123372]
  - kvm-IDE-Fill-the-IDENTIFY-request-consistently.patch [bz#852348]
  - kvm-ide-Add-resize-callback-to-ide-core.patch [bz#852348]
  - Resolves: bz#1054077
    (qemu crash when reboot win7 guest with spice display)
  - Resolves: bz#1064156
    ([qxl] The guest show black screen while resumed guest which managedsaved in pmsuspended status.)
  - Resolves: bz#1122147
    (CVE-2014-5263 vmstate_xhci_event: fix unterminated field list)
  - Resolves: bz#1123372
    (qemu-kvm crashed when doing iofuzz testing)
  - Resolves: bz#1139702
    (pflash (UEFI varstore) migration shortcut for libvirt [RHEL])
  - Resolves: bz#852348
    (fail to block_resize local data disk with IDE/AHCI disk_interface)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-72.el7
changelog:
  - kvm-vbe-make-bochs-dispi-interface-return-the-correct-me.patch [bz#1139118]
  - kvm-vbe-rework-sanity-checks.patch [bz#1139118]
  - kvm-spice-display-add-display-channel-id-to-the-debug-me.patch [bz#1139118]
  - kvm-spice-make-sure-we-don-t-overflow-ssd-buf.patch [bz#1139118]
  - Resolves: bz#1139118
    (CVE-2014-3615 qemu-kvm: Qemu: crash when guest sets high resolution [rhel-7.1])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-73.el7
changelog:
  - kvm-scsi-disk-fix-bug-in-scsi_block_new_request-introduc.patch [bz#1105880]
  - Resolves: bz#1105880
    (bug in scsi_block_new_request() function introduced by upstream commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-74.el7
changelog:
  - kvm-ide-Add-wwn-support-to-IDE-ATAPI-drive.patch [bz#1131316]
  - kvm-vmdk-Allow-vmdk_create-to-work-with-protocol.patch [bz#1098086]
  - kvm-block-make-vdi-bounds-check-match-upstream.patch [bz#1098086]
  - kvm-vdi-say-why-an-image-is-bad.patch [bz#1098086]
  - kvm-block-do-not-abuse-EMEDIUMTYPE.patch [bz#1098086]
  - kvm-cow-correctly-propagate-errors.patch [bz#1098086]
  - kvm-block-Use-correct-width-in-format-strings.patch [bz#1098086]
  - kvm-vdi-remove-double-conversion.patch [bz#1098086]
  - kvm-block-vdi-Error-out-immediately-in-vdi_create.patch [bz#1098086]
  - kvm-vpc-Implement-.bdrv_has_zero_init.patch [bz#1098086]
  - kvm-block-vpc-use-QEMU_PACKED-for-on-disk-structures.patch [bz#1098086]
  - kvm-block-allow-bdrv_unref-to-be-passed-NULL-pointers.patch [bz#1098086]
  - kvm-block-vdi-use-block-layer-ops-in-vdi_create-instead-.patch [bz#1098086]
  - kvm-block-use-the-standard-ret-instead-of-result.patch [bz#1098086]
  - kvm-block-vpc-use-block-layer-ops-in-vpc_create-instead-.patch [bz#1098086]
  - kvm-block-iotest-update-084-to-test-static-VDI-image-cre.patch [bz#1098086]
  - kvm-block-add-helper-function-to-determine-if-a-BDS-is-i.patch [bz#1122925]
  - kvm-block-extend-block-commit-to-accept-a-string-for-the.patch [bz#1122925]
  - kvm-block-add-backing-file-option-to-block-stream.patch [bz#1122925]
  - kvm-block-add-__com.redhat_change-backing-file-qmp-comma.patch [bz#1122925]
  - Resolves: bz#1098086
    (RFE: Supporting creating vmdk/vdi/vpc format disk with protocols (glusterfs))
  - Resolves: bz#1122925
    (Maintain relative path to backing file image during live merge (block-commit))
  - Resolves: bz#1131316
    (fail to specify wwn for virtual IDE CD-ROM)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-75.el7
changelog:
  - kvm-target-i386-Broadwell-CPU-model.patch [bz#1116117]
  - kvm-pc-Add-Broadwell-CPUID-compatibility-bits.patch [bz#1116117]
  - kvm-virtio-balloon-fix-integer-overflow-in-memory-stats-.patch [bz#1142290]
  - Resolves: bz#1116117
    ([Intel 7.1 FEAT] Broadwell new instructions support for KVM - qemu-kvm)
  - Resolves: bz#1142290
    (guest is stuck when setting balloon memory with large guest-stats-polling-interval)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-76.el7
changelog:
  - kvm-usb-hcd-xhci-QOM-Upcast-Sweep.patch [bz#980747]
  - kvm-usb-hcd-xhci-QOM-parent-field-cleanup.patch [bz#980747]
  - kvm-uhci-egsm-fix.patch [bz#1046873]
  - kvm-usb-redir-fix-use-after-free.patch [bz#1046574 bz#1088116]
  - kvm-xhci-remove-leftover-debug-printf.patch [bz#980833]
  - kvm-xhci-add-tracepoint-for-endpoint-state-changes.patch [bz#980833]
  - kvm-xhci-add-port-to-slot_address-tracepoint.patch [bz#980833]
  - kvm-usb-parallelize-usb3-streams.patch [bz#1075846]
  - kvm-xhci-Init-a-transfers-xhci-slotid-and-epid-member-on.patch [bz#1075846]
  - kvm-xhci-Add-xhci_epid_to_usbep-helper-function.patch [bz#980833]
  - kvm-xhci-Fix-memory-leak-on-xhci_disable_ep.patch [bz#980833]
  - kvm-usb-Also-reset-max_packet_size-on-ep_reset.patch [bz#1075846]
  - kvm-usb-Fix-iovec-memleak-on-combined-packet-free.patch [bz#1075846]
  - kvm-usb-hcd-xhci-Remove-unused-sstreamsm-member-from-XHC.patch [bz#980747]
  - kvm-usb-hcd-xhci-Remove-unused-cancelled-member-from-XHC.patch [bz#980747]
  - kvm-usb-hcd-xhci-Report-completion-of-active-transfer-wi.patch [bz#980747]
  - kvm-usb-hcd-xhci-Update-endpoint-context-dequeue-pointer.patch [bz#980747]
  - kvm-xhci-Add-a-few-missing-checks-for-disconnected-devic.patch [bz#980833]
  - kvm-usb-Add-max_streams-attribute-to-endpoint-info.patch [bz#1111450]
  - kvm-usb-Add-usb_device_alloc-free_streams.patch [bz#1111450]
  - kvm-xhci-Call-usb_device_alloc-free_streams.patch [bz#980833]
  - kvm-uhci-invalidate-queue-on-device-address-changes.patch [bz#1111450]
  - kvm-xhci-iso-fix-time-calculation.patch [bz#949385]
  - kvm-xhci-iso-allow-for-some-latency.patch [bz#949385]
  - kvm-xhci-switch-debug-printf-to-tracepoint.patch [bz#980747]
  - kvm-xhci-use-DPRINTF-instead-of-fprintf-stderr.patch [bz#980833]
  - kvm-xhci-child-detach-fix.patch [bz#980833]
  - kvm-usb-add-usb_pick_speed.patch [bz#1075846]
  - kvm-xhci-make-port-reset-trace-point-more-verbose.patch [bz#980833]
  - kvm-usb-initialize-libusb_device-to-avoid-crash.patch [bz#1111450]
  - kvm-target-i386-get-CPL-from-SS.DPL.patch [bz#1097363]
  - kvm-trace-use-unique-Red-Hat-version-number-in-simpletra.patch [bz#1088112]
  - kvm-trace-add-pid-field-to-simpletrace-record.patch [bz#1088112]
  - kvm-simpletrace-add-support-for-trace-record-pid-field.patch [bz#1088112]
  - kvm-simpletrace-add-simpletrace.py-no-header-option.patch [bz#1088112]
  - kvm-trace-extract-stap_escape-function-for-reuse.patch [bz#1088112]
  - kvm-trace-add-tracetool-simpletrace_stap-format.patch [bz#1088112]
  - kvm-trace-install-simpletrace-SystemTap-tapset.patch [bz#1088112]
  - kvm-trace-install-trace-events-file.patch [bz#1088112]
  - kvm-trace-add-SystemTap-init-scripts-for-simpletrace-bri.patch [bz#1088112]
  - kvm-simpletrace-install-simpletrace.py.patch [bz#1088112]
  - kvm-trace-add-systemtap-initscript-README-file-to-RPM.patch [bz#1088112]
  - kvm-rdma-Fix-block-during-rdma-migration.patch [bz#1152969]
  - Resolves: bz#1046574
    (fail to passthrough the USB speaker redirected from usb-redir with xhci controller)
  - Resolves: bz#1046873
    (fail to be recognized the hotpluging usb-storage device with xhci controller in win2012R2 guest)
  - Resolves: bz#1075846
    (qemu-kvm core dumped when hotplug/unhotplug USB3.0 device multi times)
  - Resolves: bz#1088112
    ([Fujitsu 7.1 FEAT]:QEMU: capturing trace data all the time using ftrace-based tracing)
  - Resolves: bz#1088116
    (qemu crash when device_del usb-redir)
  - Resolves: bz#1097363
    (qemu ' KVM internal error. Suberror: 1'  when  query cpu frequently during pxe boot in Intel "Q95xx" host)
  - Resolves: bz#1111450
    (Guest crash when hotplug usb while disable virt_use_usb)
  - Resolves: bz#1152969
    (Qemu-kvm got stuck when migrate to wrong RDMA ip)
  - Resolves: bz#949385
    (passthrough USB speaker to win2012 guest fail to work well)
  - Resolves: bz#980747
    (flood with 'xhci: wrote doorbell while xHC stopped or paused' when redirected USB Webcam from usb-host with xHCI controller)
  - Resolves: bz#980833
    (xhci: FIXME: endpoint stopped w/ xfers running, data might be lost)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-77.el7
changelog:
  - kvm-seccomp-add-semctl-to-the-syscall-whitelist.patch [bz#1026314]
  - kvm-Revert-kvmclock-Ensure-proper-env-tsc-value-for-kvmc.patch [bz#1098602 bz#1130428]
  - kvm-Revert-kvmclock-Ensure-time-in-migration-never-goes-.patch [bz#1098602 bz#1130428]
  - kvm-Introduce-cpu_clean_all_dirty.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-proper-env-tsc-value-for-kvmclock.v2.patch [bz#1098602 bz#1130428]
  - kvm-kvmclock-Ensure-time-in-migration-never-goes-back.v2.patch [bz#1098602 bz#1130428]
  - Resolves: bz#1026314
    (BUG: qemu-kvm hang when use '-sandbox on'+'vnc'+'hda')
  - Resolves: bz#1098602
    (kvmclock: Ensure time in migration never goes backward (backport))
  - Resolves: bz#1130428
    (After migration of RHEL7.1 guest with "-vga qxl", GUI console is hang)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-78.el7
changelog:
  - kvm-slirp-udp-fix-NULL-pointer-dereference-because-of-un.patch [bz#1144820]
  - kvm-hw-pci-fix-error-flow-in-pci-multifunction-init.patch [bz#1049734]
  - kvm-rhel-Drop-machine-type-pc-q35-rhel7.0.0.patch [bz#1111107]
  - kvm-virtio-scsi-Plug-memory-leak-on-virtio_scsi_push_eve.patch [bz#1088822]
  - kvm-virtio-scsi-Report-error-if-num_queues-is-0-or-too-l.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-memory-leak-when-realize-failed.patch [bz#1089606]
  - kvm-virtio-scsi-Fix-num_queue-input-validation.patch [bz#1089606]
  - kvm-Revert-linux-aio-use-event-notifiers.patch [bz#1104748]
  - kvm-specfile-Require-glusterfs-api-3.6.patch [bz#1155518]
  - Resolves: bz#1049734
    (PCI: QEMU crash on illegal operation: attaching a function to a non multi-function device)
  - Resolves: bz#1088822
    (hot-plug a virtio-scsi disk via 'blockdev-add' always cause QEMU quit)
  - Resolves: bz#1089606
    (QEMU will not reject invalid number of queues (num_queues = 0) specified for virtio-scsi)
  - Resolves: bz#1104748
    (48% reduction in IO performance for KVM guest, io=native)
  - Resolves: bz#1111107
    (Remove Q35 machine type from qemu-kvm)
  - Resolves: bz#1144820
    (CVE-2014-3640 qemu-kvm: qemu: slirp: NULL pointer deref in sosendto() [rhel-7.1])
  - Resolves: bz#1155518
    (qemu-kvm: undefined symbol: glfs_discard_async)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-79.el7
changelog:
  - kvm-libcacard-link-against-qemu-error.o-for-error_report.patch [bz#1088176]
  - kvm-error-Add-error_abort.patch [bz#1088176]
  - kvm-blockdev-Fail-blockdev-add-with-encrypted-images.patch [bz#1088176]
  - kvm-blockdev-Fix-NULL-pointer-dereference-in-blockdev-ad.patch [bz#1088176]
  - kvm-qemu-iotests-Test-a-few-blockdev-add-error-cases.patch [bz#1088176]
  - kvm-block-Add-errp-to-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Avoid-duplicate-block-device-IDs.patch [bz#1088176]
  - kvm-block-Catch-duplicate-IDs-in-bdrv_new.patch [bz#1088176]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1138691]
  - kvm-qemu-img-Allow-cache-mode-specification-for-amend.patch [bz#1138691]
  - kvm-qemu-img-clarify-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-rebase-src_cache-option-documentation.patch [bz#1138691]
  - kvm-qemu-img-fix-img_compare-flags-error-path.patch [bz#1138691]
  - kvm-ac97-register-reset-via-qom.patch [bz#1141667]
  - kvm-virtio-blk-Factor-common-checks-out-of-virtio_blk_ha.patch [bz#1085232]
  - kvm-virtio-blk-Bypass-error-action-and-I-O-accounting-on.patch [bz#1085232]
  - kvm-virtio-blk-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-Treat-read-write-beyond-end-as-invalid.patch [bz#1085232]
  - kvm-ide-only-constrain-read-write-requests-to-drive-size.patch [bz#1085232]
  - Resolves: bz#1085232
    (Ilegal guest requests on block devices pause the VM)
  - Resolves: bz#1088176
    (QEMU fail to check whether duplicate ID for block device drive using 'blockdev-add' to hotplug)
  - Resolves: bz#1138691
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))
  - Resolves: bz#1141667
    (Qemu crashed if reboot guest after hot remove AC97 sound device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-80.el7
changelog:
  - kvm-dump-RHEL-specific-fix-for-CPUState-bug-introduced-b.patch [bz#1161563]
  - kvm-dump-guest-memory-Check-for-the-correct-return-value.patch [bz#1157798]
  - kvm-dump-const-qualify-the-buf-of-WriteCoreDumpFunction.patch [bz#1157798]
  - kvm-dump-add-argument-to-write_elfxx_notes.patch [bz#1157798]
  - kvm-dump-add-API-to-write-header-of-flatten-format.patch [bz#1157798]
  - kvm-dump-add-API-to-write-vmcore.patch [bz#1157798]
  - kvm-dump-add-API-to-write-elf-notes-to-buffer.patch [bz#1157798]
  - kvm-dump-add-support-for-lzo-snappy.patch [bz#1157798]
  - kvm-RPM-spec-build-qemu-kvm-with-lzo-and-snappy-enabled-.patch [bz#1157798]
  - kvm-dump-add-members-to-DumpState-and-init-some-of-them.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-header.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump_bitmap.patch [bz#1157798]
  - kvm-dump-add-APIs-to-operate-DataCache.patch [bz#1157798]
  - kvm-dump-add-API-to-write-dump-pages.patch [bz#1157798]
  - kvm-dump-Drop-qmp_dump_guest_memory-stub-and-build-for-a.patch [bz#1157798]
  - kvm-dump-make-kdump-compressed-format-available-for-dump.patch [bz#1157798]
  - kvm-Define-the-architecture-for-compressed-dump-format.patch [bz#1157798]
  - kvm-dump-add-query-dump-guest-memory-capability-command.patch [bz#1157798]
  - kvm-dump-Drop-pointless-error_is_set-DumpState-member-er.patch [bz#1157798]
  - kvm-dump-fill-in-the-flat-header-signature-more-pleasing.patch [bz#1157798]
  - kvm-dump-simplify-write_start_flat_header.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_shift-guest-s-page-shi.patch [bz#1157798]
  - kvm-dump-eliminate-DumpState.page_size-guest-s-page-size.patch [bz#1157798]
  - kvm-dump-select-header-bitness-based-on-ELF-class-not-EL.patch [bz#1157798]
  - kvm-dump-hoist-lzo_init-from-get_len_buf_out-to-dump_ini.patch [bz#1157798]
  - kvm-dump-simplify-get_len_buf_out.patch [bz#1157798]
  - kvm-rename-parse_enum_option-to-qapi_enum_parse-and-make.patch [bz#1087724]
  - kvm-qapi-introduce-PreallocMode-and-new-PreallocModes-fu.patch [bz#1087724]
  - kvm-raw-posix-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-qcow2-Add-falloc-and-full-preallocation-option.patch [bz#1087724]
  - kvm-vga-fix-invalid-read-after-free.patch [bz#1161890]
  - kvm-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch [bz#1140618]
  - kvm-vnc-sanitize-bits_per_pixel-from-the-client.patch [bz#1157645]
  - kvm-spice-call-qemu_spice_set_passwd-during-init.patch [bz#1138639]
  - kvm-block-raw-posix-Try-both-FIEMAP-and-SEEK_HOLE.patch [bz#1160237]
  - kvm-block-raw-posix-Fix-disk-corruption-in-try_fiemap.patch [bz#1160237]
  - kvm-block-raw-posix-use-seek_hole-ahead-of-fiemap.patch [bz#1160237]
  - kvm-raw-posix-Fix-raw_co_get_block_status-after-EOF.patch [bz#1160237]
  - kvm-raw-posix-raw_co_get_block_status-return-value.patch [bz#1160237]
  - kvm-raw-posix-SEEK_HOLE-suffices-get-rid-of-FIEMAP.patch [bz#1160237]
  - kvm-raw-posix-The-SEEK_HOLE-code-is-flawed-rewrite-it.patch [bz#1160237]
  - Resolves: bz#1087724
    ([Fujitsu 7.1 FEAT]: qemu-img should use fallocate() system call for "preallocation=full" option)
  - Resolves: bz#1138639
    (fail to login spice session with password + expire time)
  - Resolves: bz#1140618
    (Should replace "qemu-system-i386" by "/usr/libexec/qemu-kvm" in manpage of qemu-kvm for our official qemu-kvm build)
  - Resolves: bz#1157645
    (CVE-2014-7815 qemu-kvm: qemu: vnc: insufficient bits_per_pixel from the client sanitization [rhel-7.1])
  - Resolves: bz#1157798
    ([FEAT RHEL7.1]: qemu: Support compression for dump-guest-memory command)
  - Resolves: bz#1160237
    (qemu-img convert intermittently corrupts output images)
  - Resolves: bz#1161563
    (invalid QEMU NOTEs in vmcore that is dumped for multi-VCPU guests)
  - Resolves: bz#1161890
    ([abrt] qemu-kvm: pixman_image_get_data(): qemu-kvm killed by SIGSEGV)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-81.el7
changelog:
  - kvm-migration-static-variables-will-not-be-reset-at-seco.patch [bz#1071776]
  - kvm-vfio-pci-Add-debug-config-options-to-disable-MSI-X-K.patch [bz#1098976]
  - kvm-vfio-correct-debug-macro-typo.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-debug-code.patch [bz#1098976]
  - kvm-vfio-pci-Fix-MSI-X-masking-performance.patch [bz#1098976]
  - kvm-vfio-Fix-MSI-X-vector-expansion.patch [bz#1098976]
  - kvm-vfio-Don-t-cache-MSIMessage.patch [bz#1098976]
  - Resolves: bz#1071776
    (Migration "expected downtime" does not refresh after reset to a new value)
  - Resolves: bz#1098976
    (2x RHEL 5.10 VM running on RHEL 7 KVM have low TCP_STREAM throughput)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-82.el7
changelog:
  - kvm-hw-pci-fixed-error-flow-in-pci_qdev_init.patch [bz#1046007]
  - kvm-hw-pci-fixed-hotplug-crash-when-using-rombar-0-with-.patch [bz#1046007]
  - Resolves: bz#1046007
    (qemu-kvm aborted when hot plug PCI device to guest with romfile and rombar=0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-83.el7
changelog:
  - kvm-xhci-add-sanity-checks-to-xhci_lookup_uport.patch [bz#1074219]
  - kvm-Revert-Build-ceph-rbd-only-for-rhev.patch [bz#1140742]
  - kvm-Revert-rbd-Only-look-for-qemu-specific-copy-of-librb.patch [bz#1140742]
  - kvm-Revert-rbd-link-and-load-librbd-dynamically.patch [bz#1140742]
  - kvm-spec-Enable-rbd-driver-add-dependency.patch [bz#1140742]
  - Resolves: bz#1074219
    (qemu core dump when install a RHEL.7 guest(xhci) with migration)
  - Resolves: bz#1140742
    (Enable native support for Ceph)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-84.el7
changelog:
  - kvm-qemu-iotests-Test-case-for-backing-file-deletion.patch [bz#1002493]
  - kvm-qemu-iotests-Add-sample-image-and-test-for-VMDK-vers.patch [bz#1134237]
  - kvm-vmdk-Check-VMFS-extent-line-field-number.patch [bz#1134237]
  - kvm-qemu-iotests-Introduce-_unsupported_imgopts.patch [bz#1002493]
  - kvm-qemu-iotests-Add-_unsupported_imgopts-for-vmdk-subfo.patch [bz#1002493]
  - kvm-vmdk-Fix-big-flat-extent-IO.patch [bz#1134241]
  - kvm-vmdk-Check-for-overhead-when-opening.patch [bz#1134251]
  - kvm-block-vmdk-add-basic-.bdrv_check-support.patch [bz#1134251]
  - kvm-qemu-iotest-Make-077-raw-only.patch [bz#1134237]
  - kvm-qemu-iotests-Don-t-run-005-on-vmdk-split-formats.patch [bz#1002493]
  - kvm-vmdk-extract-vmdk_read_desc.patch [bz#1134251]
  - kvm-vmdk-push-vmdk_read_desc-up-to-caller.patch [bz#1134251]
  - kvm-vmdk-do-not-try-opening-a-file-as-both-image-and-des.patch [bz#1134251]
  - kvm-vmdk-correctly-propagate-errors.patch [bz#1134251]
  - kvm-block-vmdk-do-not-report-file-offset-for-compressed-.patch [bz#1134251]
  - kvm-vmdk-Fix-d-and-lld-to-PRI-in-format-strings.patch [bz#1134251]
  - kvm-vmdk-Fix-x-to-PRIx32-in-format-strings-for-cid.patch [bz#1134251]
  - kvm-qemu-img-Convert-by-cluster-size-if-target-is-compre.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_write_compressed.patch [bz#1134283]
  - kvm-vmdk-Implement-.bdrv_get_info.patch [bz#1134283]
  - kvm-qemu-iotests-Test-converting-to-streamOptimized-from.patch [bz#1134283]
  - kvm-vmdk-Fix-local_err-in-vmdk_create.patch [bz#1134283]
  - kvm-fpu-softfloat-drop-INLINE-macro.patch [bz#1002493]
  - kvm-block-New-bdrv_nb_sectors.patch [bz#1002493]
  - kvm-vmdk-Optimize-cluster-allocation.patch [bz#1002493]
  - kvm-vmdk-Handle-failure-for-potentially-large-allocation.patch [bz#1002493]
  - kvm-vmdk-Use-bdrv_nb_sectors-where-sectors-not-bytes-are.patch [bz#1002493]
  - kvm-vmdk-fix-vmdk_parse_extents-extent_file-leaks.patch [bz#1002493]
  - kvm-vmdk-fix-buf-leak-in-vmdk_parse_extents.patch [bz#1002493]
  - kvm-vmdk-Fix-integer-overflow-in-offset-calculation.patch [bz#1002493]
  - kvm-migration-fix-parameter-validation-on-ram-load-CVE-2.patch [bz#1163078]
  - Resolves: bz#1002493
    (qemu-img convert rate about 100k/second from qcow2/raw to vmdk format on nfs system file)
  - Resolves: bz#1134237
    (Opening malformed VMDK description file should fail)
  - Resolves: bz#1134241
    (QEMU fails to correctly read/write on VMDK with big flat extent)
  - Resolves: bz#1134251
    (Opening an obviously truncated VMDK image should fail)
  - Resolves: bz#1134283
    (qemu-img convert from ISO to streamOptimized fails)
  - Resolves: bz#1163078
    (CVE-2014-7840 qemu-kvm: qemu: insufficient parameter validation during ram load [rhel-7.1])


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-85.el7
changelog:
  - kvm-block-delete-cow-block-driver.patch [bz#1175325]
  - Resolves: bz#1175325
    (Delete cow block driver)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7
changelog:
  - kvm-vfio-pci-Fix-interrupt-disabling.patch [bz#1180942]
  - kvm-cirrus-fix-blit-region-check.patch [bz#1169456]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1169456]
  - Resolves: bz#1169456
    (CVE-2014-8106 qemu-kvm: qemu: cirrus: insufficient blit region checks [rhel-7.1])
  - Resolves: bz#1180942
    (qemu core dumped when unhotplug gpu card assigned to guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-86.el7_1.1
changelog:
  - kvm-pc-add-rhel6.6.0-machine-type.patch [bz#1198958]
  - Resolves: bz#1198958
    (Add rhel-6.6.0 machine type to RHEL 7.1.z to support RHEL 6.6 to RHEL 7.1 live migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-87.el7
changelog:
  - kvm-trace-add-qemu_system_powerdown_request-and-qemu_sys.patch [bz#1155671]
  - kvm-virtio-net-drop-assert-on-vm-stop.patch [bz#1139562]
  - kvm-socket-shutdown.patch [bz#1086168]
  - kvm-Handle-bi-directional-communication-for-fd-migration.patch [bz#1086168]
  - kvm-migration_cancel-shutdown-migration-socket.patch [bz#1086168]
  - kvm-iscsi-Refuse-to-open-as-writable-if-the-LUN-is-write.patch [bz#1032412]
  - kvm-main-set-current_machine-before-calling-machine-init.patch [bz#1176283]
  - kvm-pc_sysfw-prevent-pflash-and-or-mis-sized-firmware-fo.patch [bz#1176283]
  - kvm-Restore-atapi_dma-flag-across-migration.patch [bz#892258]
  - kvm-atapi-migration-Throw-recoverable-error-to-avoid-rec.patch [bz#892258]
  - kvm-build-reenable-local-builds-to-pass-enable-debug-RHE.patch []
  - kvm-raw-posix-Fail-gracefully-if-no-working-alignment-is.patch [bz#1184363]
  - kvm-block-Add-Error-argument-to-bdrv_refresh_limits.patch [bz#1184363]
  - kvm-Python-lang-gdb-script-to-extract-x86_64-guest-vmcor.patch [bz#828493]
  - kvm-RPM-spec-install-dump-guest-memory.py-RHEL-only.patch [bz#828493]
  - kvm-spec-Enable-build-of-qemu-img-and-libcacard-for-ppc6.patch [bz#1190086]
  - Resolves: bz#1032412
    (opening read-only iscsi lun as read-write should fail)
  - Resolves: bz#1086168
    (qemu-kvm can not cancel migration in src host when network of dst host failed)
  - Resolves: bz#1139562
    (qemu-kvm with vhost=off and sndbuf=100 crashed when stop it during pktgen test from guest to host)
  - Resolves: bz#1155671
    ([Fujitsu 7.2 FEAT]: QEMU: Add tracepoints in system shutdown)
  - Resolves: bz#1176283
    ([migration]migration failed when configure guest with OVMF bios + machine type=rhel6.5.0)
  - Resolves: bz#1184363
    (Qemu process fails to start with a multipath device with all paths failed)
  - Resolves: bz#1190086
    (build qemu-img/libcacard on ppc64le for 7.2)
  - Resolves: bz#828493
    ([Hitachi 7.2 FEAT] Extract guest memory dump from qemu-kvm core)
  - Resolves: bz#892258
    (ide CDROM io/data errors after migration)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-88.el7
changelog:
  - kvm-vfio-warn-if-host-device-rom-can-t-be-read.patch [bz#1210503]
  - kvm-vfio-Do-not-reattempt-a-failed-rom-read.patch [bz#1210503]
  - kvm-vfio-Correction-in-vfio_rom_read-when-attempting-rom.patch [bz#1210503]
  - kvm-vfio-Fix-overrun-after-readlink-fills-buffer-complet.patch [bz#1210504]
  - kvm-vfio-use-correct-runstate.patch [bz#1210505]
  - kvm-vfio-pci-Fix-BAR-size-overflow.patch [bz#1181267]
  - kvm-vfio-Use-vfio-type1-v2-IOMMU-interface.patch [bz#1210508]
  - kvm-vfio-pci-Enable-device-request-notification-support.patch [bz#1210509]
  - kvm-vfio-pci-Further-fix-BAR-size-overflow.patch [bz#1181267]
  - kvm-vfio-pci-Fix-error-path-sign.patch [bz#1210504]
  - kvm-x86-Use-common-variable-range-MTRR-counts.patch [bz#1210510]
  - kvm-x86-kvm-Add-MTRR-support-for-kvm_get-put_msrs.patch [bz#1210510]
  - kvm-x86-Clear-MTRRs-on-vCPU-reset.patch [bz#1210510]
  - kvm-spec-Exclude-aarch64.patch [bz#1217850]
  - Resolves: bz#1181267
    (vfio-pci: Fix BAR size overflow)
  - Resolves: bz#1210503
    (vfio improve PCI ROM loading error handling)
  - Resolves: bz#1210504
    (vfio: Fix overrun after readlink() fills buffer completely)
  - Resolves: bz#1210505
    (vfio: use correct runstate)
  - Resolves: bz#1210508
    (vfio: Use vfio type1 v2 IOMMU interface)
  - Resolves: bz#1210509
    (vfio-pci: Enable device request notification support)
  - Resolves: bz#1210510
    (Sync MTRRs with KVM and disable on reset)
  - Resolves: bz#1217850
    (qemu-kvm: ExcludeArch: aarch64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-89.el7
changelog:
  - kvm-CVE-2015-1779-incrementally-decode-websocket-frames.patch [bz#1206497]
  - kvm-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch [bz#1206497]
  - kvm-qemu-iotests-Test-unaligned-4k-zero-write.patch [bz#1200295]
  - kvm-block-Fix-NULL-deference-for-unaligned-write-if-qiov.patch [bz#1200295]
  - kvm-qemu-iotests-Test-unaligned-sub-block-zero-write.patch [bz#1200295]
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219270]
  - Resolves: bz#1200295
    (QEMU segfault when doing unaligned zero write to non-512 disk)
  - Resolves: bz#1206497
    (CVE-2015-1779 qemu-kvm: qemu: vnc: insufficient resource limiting in VNC websockets decoder [rhel-7.2])
  - Resolves: bz#1219270
    (CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-90.el7
changelog:
  - kvm-qcow2-Pass-discard-type-to-qcow2_discard_clusters.patch [bz#1208808]
  - kvm-qcow2-Discard-VM-state-in-active-L1-after-creating-s.patch [bz#1208808]
  - kvm-configure-Require-libfdt-for-arm-ppc-microblaze-soft.patch [bz#1217850]
  - kvm-configure-Add-handling-code-for-AArch64-targets.patch [bz#1217850]
  - kvm-configure-permit-compilation-on-arm-aarch64.patch [bz#1217850]
  - kvm-spec-Allow-build-on-aarch64.patch [bz#1217850]
  - kvm-Remove-redhat-extensions-from-qmp-events.txt.patch [bz#1222833]
  - kvm-spec-Add-misssing-QMP-documentation-files.patch [bz#1222833]
  - Resolves: bz#1208808
    (creating second and further snapshot takes ages)
  - Resolves: bz#1217850
    (qemu-kvm: Enable build on aarch64)
  - Resolves: bz#1222833
    (We ship incomplete QMP documentation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-91.el7
changelog:
  - kvm-vmdk-Fix-overflow-if-l1_size-is-0x20000000.patch [bz#1217351]
  - kvm-block-ssh-Drop-superfluous-libssh2_session_last_errn.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-through-check_host_key.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-through-authenticate.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-through-connect_to_ssh.patch [bz#1226683]
  - kvm-block-ssh-Propagate-errors-to-open-and-create-method.patch [bz#1226683]
  - kvm-ssh-Don-t-crash-if-either-host-or-path-is-not-specif.patch [bz#1226683]
  - kvm-curl-Replaced-old-error-handling-with-error-reportin.patch [bz#1226684]
  - kvm-curl-Fix-long-line.patch [bz#1226684]
  - kvm-curl-Remove-unnecessary-use-of-goto.patch [bz#1226684]
  - kvm-curl-Fix-return-from-curl_read_cb-with-invalid-state.patch [bz#1226684]
  - kvm-curl-Remove-erroneous-sleep-waiting-for-curl-complet.patch [bz#1226684]
  - kvm-curl-Whitespace-only-changes.patch [bz#1226684]
  - kvm-block-curl-Implement-the-libcurl-timer-callback-inte.patch [bz#1226684]
  - kvm-curl-Remove-unnecessary-explicit-calls-to-internal-e.patch [bz#1226684]
  - kvm-curl-Eliminate-unnecessary-use-of-curl_multi_socket_.patch [bz#1226684]
  - kvm-curl-Ensure-all-informationals-are-checked-for-compl.patch [bz#1226684]
  - kvm-curl-Fix-hang-reading-from-slow-connections.patch [bz#1226684]
  - kvm-curl-Fix-build-when-curl_multi_socket_action-isn-t-a.patch [bz#1226684]
  - kvm-curl-Remove-broken-parsing-of-options-from-url.patch [bz#1226684]
  - kvm-curl-refuse-to-open-URL-from-HTTP-server-without-ran.patch [bz#1226684]
  - kvm-curl-Add-sslverify-option.patch [bz#1226684]
  - kvm-block-Drop-superfluous-conditionals-around-g_free.patch [bz#1226684]
  - kvm-curl-Handle-failure-for-potentially-large-allocation.patch [bz#1226684]
  - kvm-block.curl-adding-timeout-option.patch [bz#1226684]
  - kvm-curl-Allow-a-cookie-or-cookies-to-be-sent-with-http-.patch [bz#1226684]
  - kvm-curl-The-macro-that-you-have-to-uncomment-to-get-deb.patch [bz#1226684]
  - kvm-block-curl-Improve-type-safety-of-s-timeout.patch [bz#1226684]
  - kvm-Enable-ssh-driver-read-only.patch [bz#1226683]
  - kvm-Enable-curl-driver-read-only.patch [bz#1226684]
  - Resolves: bz#1217351
    (Overflow in malloc size calculation in VMDK driver)
  - Resolves: bz#1226683
    ([virt-v2v] Backport upstream ssh driver to qemu-kvm)
  - Resolves: bz#1226684
    ([virt-v2v] Enable curl driver + upstream features + fixes in qemu-kvm and enable https)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-92.el7
changelog:
  - kvm-seccomp-add-timerfd_create-and-timerfd_settime-to-th.patch [bz#1185737]
  - kvm-qdict-Add-qdict_join.patch [bz#1226697]
  - kvm-block-Allow-JSON-filenames.patch [bz#1226697]
  - kvm-spice-display-fix-segfault-in-qemu_spice_create_upda.patch [bz#1230808]
  - Resolves: bz#1185737
    (qemu-kvm hang when boot with usb-host and sandbox was enabled)
  - Resolves: bz#1226697
    ([virt-v2v] Allow json: filenames in qemu-img)
  - Resolves: bz#1230808
    ([abrt] qemu-system-x86: __memcmp_sse4_1(): qemu-system-x86_64 killed by SIGSEGV)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-93.el7
changelog:
  - kvm-atomics-add-explicit-compiler-fence-in-__atomic-memo.patch [bz#1142857 bz#1142857 (aka bz#8*bz#10^bz#6/bz#7)]
  - Resolves: bz#1142857
    ([abrt] qemu-kvm: bdrv_error_action(): qemu-kvm killed by SIGABRT)
  - Resolves: bz#8*10^6/7)
    (XFree86 apparently sets xhost to ill inital values)
  - Resolves: bz#(aka
    ()


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-94.el7
changelog:
  - kvm-qcow2-Put-cache-reference-in-error-case.patch [bz#1129893]
  - kvm-qcow2-Catch-bdrv_getlength-error.patch [bz#1129893]
  - kvm-block-Introduce-qemu_try_blockalign.patch [bz#1129893]
  - kvm-qcow2-Catch-host_offset-for-data-allocation.patch [bz#1129893]
  - kvm-iotests-Add-test-for-image-header-overlap.patch [bz#1129893]
  - kvm-block-Catch-bs-drv-in-bdrv_check.patch [bz#1129893]
  - kvm-qapi-block-Add-fatal-to-BLOCK_IMAGE_CORRUPTED.patch [bz#1129893]
  - kvm-qcow2-Add-qcow2_signal_corruption.patch [bz#1129893]
  - kvm-qcow2-Use-qcow2_signal_corruption-for-overlaps.patch [bz#1129893]
  - kvm-qcow2-Check-L1-L2-reftable-entries-for-alignment.patch [bz#1129893]
  - kvm-iotests-Add-more-tests-for-qcow2-corruption.patch [bz#1129893]
  - kvm-qcow2-fix-leak-of-Qcow2DiscardRegion-in-update_refco.patch [bz#1129893]
  - kvm-qcow2-Do-not-overflow-when-writing-an-L1-sector.patch [bz#1129893]
  - kvm-iotests-Add-test-for-qcow2-L1-table-update.patch [bz#1129893]
  - kvm-block-Add-qemu_-try_-blockalign0.patch [bz#1129893]
  - kvm-qcow2-Calculate-refcount-block-entry-count.patch [bz#1129893]
  - kvm-qcow2-Fix-leaks-in-dirty-images.patch [bz#1129893]
  - kvm-qcow2-Split-qcow2_check_refcounts.patch [bz#1129893]
  - kvm-qcow2-Use-sizeof-refcount_table.patch [bz#1129893]
  - kvm-qcow2-Pull-check_refblocks-up.patch [bz#1129893]
  - kvm-qcow2-Use-int64_t-for-in-memory-reftable-size.patch [bz#1129893]
  - kvm-qcow2-Split-fail-code-in-L1-and-L2-checks.patch [bz#1129893]
  - kvm-qcow2-Let-inc_refcounts-return-errno.patch [bz#1129893]
  - kvm-qcow2-Let-inc_refcounts-resize-the-reftable.patch [bz#1129893]
  - kvm-qcow2-Reuse-refcount-table-in-calculate_refcounts.patch [bz#1129893]
  - kvm-qcow2-Fix-refcount-blocks-beyond-image-end.patch [bz#1129893]
  - kvm-qcow2-Do-not-perform-potentially-damaging-repairs.patch [bz#1129893]
  - kvm-qcow2-Rebuild-refcount-structure-during-check.patch [bz#1129893]
  - kvm-qcow2-Clean-up-after-refcount-rebuild.patch [bz#1129893]
  - kvm-iotests-Fix-test-outputs.patch [bz#1129893]
  - kvm-iotests-Add-test-for-potentially-damaging-repairs.patch [bz#1129893]
  - kvm-qcow2-Drop-REFCOUNT_SHIFT.patch [bz#1129893]
  - kvm-block-Respect-underlying-file-s-EOF.patch [bz#1129893]
  - kvm-qcow2-Fix-header-extension-size-check.patch [bz#1129893]
  - kvm-qcow2.py-Add-required-padding-for-header-extensions.patch [bz#1129893]
  - kvm-block-Don-t-probe-for-unknown-backing-file-format.patch [bz#1129893]
  - kvm-qcow2-Add-two-more-unalignment-checks.patch [bz#1129893]
  - kvm-iotests-Add-tests-for-more-corruption-cases.patch [bz#1129893]
  - kvm-qcow2-Respect-new_block-in-alloc_refcount_block.patch [bz#1129893]
  - kvm-iotests-Add-tests-for-refcount-table-growth.patch [bz#1129893]
  - kvm-qcow2-Fix-header-update-with-overridden-backing-file.patch [bz#1129893]
  - kvm-qcow2-Flush-pending-discards-before-allocating-clust.patch [bz#1129893]
  - Resolves: bz#1129893
    (Backport additional qcow2 corruption prevention and image repair patches)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-95.el7
changelog:
  - kvm-i8254-fix-out-of-bounds-memory-access-in-pit_ioport_.patch [bz#1229646]
  - kvm-target-i386-fix-cpuid-leaf-0x0d.patch [bz#1233350]
  - kvm-target-i386-Intel-MPX.patch [bz#1233350]
  - kvm-always-update-the-MPX-model-specific-register.patch [bz#1233350]
  - kvm-target-i386-bugfix-of-Intel-MPX.patch [bz#1233350]
  - kvm-target-i386-fix-set-of-registers-zeroed-on-reset.patch [bz#1233350]
  - kvm-target-i386-Add-mpx-CPU-feature-name.patch [bz#1233350]
  - kvm-target-i386-Avoid-shifting-left-into-sign-bit.patch [bz#1233350]
  - kvm-target-i386-add-Intel-AVX-512-support.patch [bz#1233350]
  - kvm-configure-Add-support-for-tcmalloc.patch [bz#1213881]
  - Resolves: bz#1213881
    (enable using tcmalloc for memory allocation in qemu-kvm)
  - Resolves: bz#1229646
    (CVE-2015-3214 qemu-kvm: qemu: i8254: out-of-bounds memory access in pit_ioport_read function [rhel-7.2])
  - Resolves: bz#1233350
    ([Intel 7.2 FEAT] Expose MPX feature to guest - qemu-kvm)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-96.el7
changelog:
  - kvm-ahci.c-mask-unused-flags-when-reading-size-PRDT-DBC.patch [bz#1205100]
  - kvm-ide-Correct-handling-of-malformed-short-PRDTs.patch [bz#1205100]
  - Resolves: bz#1205100
    (qemu-kvm: Qemu: PRDT overflow from guest to host [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-97.el7
changelog:
  - kvm-ide-Check-array-bounds-before-writing-to-io_buffer-C.patch [bz#1243690]
  - kvm-ide-atapi-Fix-START-STOP-UNIT-command-completion.patch [bz#1243690]
  - kvm-ide-Clear-DRQ-after-handling-all-expected-accesses.patch [bz#1243690]
  - Resolves: bz#1243690
    (EMBARGOED CVE-2015-5154 qemu-kvm: qemu: ide: atapi: heap overflow during I/O buffer memory access [rhel-7.2])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-98.el7
changelog:
  - kvm-block-curl-Don-t-lose-original-error-when-a-connecti.patch [bz#1235812]
  - kvm-vfio-pci-Add-pba_offset-PCI-quirk-for-Chelsio-T5-dev.patch [bz#1244347]
  - kvm-block-Print-its-file-name-if-backing-file-opening-fa.patch [bz#1238639]
  - kvm-block-Propagate-error-in-bdrv_img_create.patch [bz#1238639]
  - kvm-iotests-Add-test-for-non-existing-backing-file.patch [bz#1238639]
  - Resolves: bz#1235812
    (block/curl: Fix generic "Input/output error" on failure)
  - Resolves: bz#1238639
    (qemu-img shows error message for backing file twice)
  - Resolves: bz#1244347
    (Quirk for Chelsio T5 MSI-X PBA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-99.el7
changelog:
  - kvm-usb-ccid-add-missing-wakeup-calls.patch [bz#1243731]
  - kvm-vpc-Handle-failure-for-potentially-large-allocations.patch [bz#1217349]
  - kvm-block-vpc-prevent-overflow-if-max_table_entries-0x40.patch [bz#1217349]
  - kvm-block-qemu-iotests-add-check-for-multiplication-over.patch [bz#1217349]
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249718]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249718]
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248766]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248766]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248766]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248766]
  - Resolves: bz#1217349
    (qemu-img vpc driver segfault)
  - Resolves: bz#1243731
    (smart card emulation doesn't work with USB3 (nec-xhci) controller)
  - Resolves: bz#1248766
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-7.2])
  - Resolves: bz#1249718
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-100.el7
changelog:
  - kvm-block-update-test-070-for-vhdx.patch [bz#1171576]
  - kvm-block-coverity-fix-check-return-value-for-fcntl-in-g.patch [bz#1219217]
  - Resolves: bz#1171576
    (test case 064 and 070 of qemu-iotests fail for vhdx with qemu-kvm-1.5.3-83.el7)
  - Resolves: bz#1219217
    (Coverity-detected defect: call to fcntl without checking return value)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-101.el7
changelog:
  - kvm-serial-reset-state-at-startup.patch [bz#922014]
  - kvm-ide-Check-validity-of-logical-block-size.patch [bz#1134670]
  - Resolves: bz#1134670
    (fail to specify the physical_block_size/logical_block_size value not 512 for IDE disk)
  - Resolves: bz#922014
    (RFE: support hotplugging chardev & serial ports (Windows guests))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-102.el7
changelog:
  - kvm-mc146818rtc-add-rtc-reset-reinjection-QMP-command.patch [bz#1191226]
  - Resolves: bz#1191226
    (libvirt requires rtc-reset-reinjection command, backport it to RHEL7.1)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-103.el7
changelog:
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1218919]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1218919]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1218919]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1218919]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1218919]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1218919]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1218919]
  - Resolves: bz#1218919
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-104.el7
changelog:
  - kvm-qemu-iotests-Filter-qemu-io-output-in-025.patch [bz#1170974]
  - Resolves: bz#1170974
    (test case 025 of qemu-iotests fail for raw with qemu-kvm-1.5.3-83.el7.x86_64)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-105.el7
changelog:
  - kvm-qtest-ide-test-disable-flush-test.patch [bz#1270341]
  - Resolves: bz#1270341
    (qemu-kvm build failure race condition in tests/ide-test)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-106.el7
changelog:
  - kvm-ehci-clear-suspend-bit-on-detach.patch [bz#1268879]
  - kvm-rbd-make-qemu-s-cache-setting-override-any-ceph-sett.patch [bz#1277248]
  - kvm-rbd-fix-ceph-settings-precedence.patch [bz#1277248]
  - kvm-target-i386-get-put-MSR_TSC_AUX-across-reset-and-mig.patch [bz#1265427]
  - kvm-rtl8139-Fix-receive-buffer-overflow-check.patch [bz#1252757]
  - kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in.patch [bz#1252757]
  - Resolves: bz#1252757
    ([RHEL-7.2-qmu-kvm] Package is 100% lost when ping from host to Win2012r2 guest with 64000 size)
  - Resolves: bz#1265427
    (contents of MSR_TSC_AUX are not migrated)
  - Resolves: bz#1268879
    (Camera stops work after remote-viewer re-connection [qemu-kvm])
  - Resolves: bz#1277248
    (ceph.conf properties override qemu's command-line properties)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-107.el7
changelog:
  - kvm-raw-posix-Fix-.bdrv_co_get_block_status-for-unaligne.patch [bz#1283116]
  - Resolves: bz#1283116
    ([abrt] qemu-img: get_block_status(): qemu-img killed by SIGABRT)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-108.el7
changelog:
  - kvm-net-Make-qmp_query_rx_filter-with-name-argument-more.patch [bz#1269738]
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298048]
  - Resolves: bz#1269738
    (Vlan table display repeat four times in qmp when queues=4)
  - Resolves: bz#1298048
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-109.el7
changelog:
  - kvm-e1000-eliminate-infinite-loops-on-out-of-bounds-tran.patch [bz#1296044]
  - kvm-nbd-Always-call-close_fn-in-nbd_client_new.patch [bz#1285453]
  - kvm-nbd-server-Coroutine-based-negotiation.patch [bz#1285453]
  - kvm-nbd-client_close-on-error-in-nbd_co_client_start.patch [bz#1285453]
  - kvm-Remove-libcacard-build.patch [bz#1314153]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)
  - Resolves: bz#1296044
    (qemu-kvm: insufficient loop termination conditions in start_xmit() and e1000_receive() [rhel-7.3])
  - Resolves: bz#1314153
    (Disable building of libcacard)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-110.el7
changelog:
  - kvm-qemu-io-Remove-unused-args_command.patch [bz#1272523]
  - kvm-cutils-Support-P-and-E-suffixes-in-strtosz.patch [bz#1272523]
  - kvm-qemu-io-Make-cvtnum-a-wrapper-around-strtosz_suffix.patch [bz#1272523]
  - kvm-qemu-io-Handle-cvtnum-errors-in-alloc.patch [bz#1272523]
  - kvm-qemu-io-Don-t-use-global-bs-in-command-implementatio.patch [bz#1272523]
  - kvm-qemu-io-Split-off-commands-to-qemu-io-cmds.c.patch [bz#1272523]
  - kvm-qemu-io-Factor-out-qemuio_command.patch [bz#1272523]
  - kvm-qemu-io-Move-help-function.patch [bz#1272523]
  - kvm-qemu-io-Move-quit-function.patch [bz#1272523]
  - kvm-qemu-io-Move-qemu_strsep-to-cutils.c.patch [bz#1272523]
  - kvm-qemu-io-Move-functions-for-registering-and-running-c.patch [bz#1272523]
  - kvm-qemu-io-Move-command_loop-and-friends.patch [bz#1272523]
  - kvm-qemu-io-Move-remaining-helpers-from-cmd.c.patch [bz#1272523]
  - kvm-qemu-io-Interface-cleanup.patch [bz#1272523]
  - kvm-qemu-io-Use-the-qemu-version-for-V.patch [bz#1272523]
  - kvm-Make-qemu-io-commands-available-in-HMP.patch [bz#1272523]
  - kvm-blkdebug-Add-BLKDBG_FLUSH_TO_OS-DISK-events.patch [bz#1272523]
  - kvm-qemu-io-fix-cvtnum-lval-types.patch [bz#1272523]
  - kvm-qemu-io-Check-for-trailing-chars.patch [bz#1272523]
  - kvm-qemu-io-Correct-error-messages.patch [bz#1272523]
  - kvm-ide-test-fix-failure-for-test_flush.patch [bz#1272523]
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331413]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-xxxx.patch [bz#1331413]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331413]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331413]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331413]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331413]
  - Resolves: bz#1272523
    (qemu-kvm build failure race condition in tests/ide-test)
  - Resolves: bz#1331413
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-111.el7
changelog:
  - kvm-vmdk-Leave-bdi-intact-if-ENOTSUP-in-vmdk_get_info.patch [bz#1299250]
  - kvm-vmdk-Use-g_random_int-to-generate-CID.patch [bz#1299250]
  - kvm-vmdk-Fix-comment-to-match-code-of-extent-lines.patch [bz#1299250]
  - kvm-vmdk-Clean-up-descriptor-file-reading.patch [bz#1299250]
  - kvm-vmdk-Check-descriptor-file-length-when-reading-it.patch [bz#1299250]
  - kvm-vmdk-Remove-unnecessary-initialization.patch [bz#1299250]
  - kvm-vmdk-Set-errp-on-failures-in-vmdk_open_vmdk4.patch [bz#1299250]
  - kvm-block-vmdk-make-ret-variable-usage-clear.patch [bz#1299250]
  - kvm-block-vmdk-move-string-allocations-from-stack-to-the.patch [bz#1299250]
  - kvm-block-vmdk-fixed-sizeof-error.patch [bz#1299250]
  - kvm-vmdk-Widen-before-shifting-32-bit-header-field.patch [bz#1299250]
  - kvm-vmdk-Fix-next_cluster_sector-for-compressed-write.patch [bz#1299250]
  - kvm-vmdk-Fix-index_in_cluster-calculation-in-vmdk_co_get.patch [bz#1299250]
  - kvm-vmdk-Use-vmdk_find_index_in_cluster-everywhere.patch [bz#1299250]
  - kvm-vmdk-Fix-next_cluster_sector-for-compressed-write2.patch [bz#1299250]
  - kvm-vmdk-Create-streamOptimized-as-version-3.patch [bz#1299116]
  - kvm-vmdk-Fix-converting-to-streamOptimized.patch [bz#1299116]
  - kvm-vmdk-Fix-calculation-of-block-status-s-offset.patch [bz#1299116]
  - Resolves: bz#1299116
    (qemu-img created VMDK images lead to "Not a supported disk format (sparse VMDK version too old)")
  - Resolves: bz#1299250
    (qemu-img created VMDK images are unbootable)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-112.el7
changelog:
  - kvm-virtio-scsi-Prevent-assertion-on-missed-events.patch [bz#1312289]
  - kvm-seccomp-adding-sysinfo-system-call-to-whitelist.patch [bz#1177318]
  - kvm-acpi-strip-compiler-info-in-built-in-DSDT.patch [bz#1330969]
  - kvm-acpi-fix-endian-ness-for-table-ids.patch [bz#1330969]
  - kvm-acpi-support-specified-oem-table-id-for-build_header.patch [bz#1330969]
  - kvm-acpi-take-oem_id-in-build_header-optionally.patch [bz#1330969]
  - kvm-acpi-expose-oem_id-and-oem_table_id-in-build_rsdt.patch [bz#1330969]
  - kvm-acpi-add-function-to-extract-oem_id-and-oem_table_id.patch [bz#1330969]
  - kvm-pc-set-the-OEM-fields-in-the-RSDT-and-the-FADT-from-.patch [bz#1330969]
  - kvm-block-jobs-qemu-kvm-rhel-differentiation.patch [bz#1156635]
  - Resolves: bz#1156635
    (Libvirt is confused that qemu-kvm exposes 'block-job-cancel' but not 'block-stream')
  - Resolves: bz#1177318
    (Guest using rbd based image as disk failed to start when sandbox was enabled)
  - Resolves: bz#1312289
    ("qemu-kvm: /builddir/build/BUILD/qemu-1.5.3/hw/scsi/virtio-scsi.c:533: virtio_scsi_push_event: Assertion `event == 0' failed" after hotplug 20 virtio-scsi disks then hotunplug them)
  - Resolves: bz#1330969
    (match the OEM ID and OEM Table ID fields of the FADT and the RSDT to those of the SLIC)


author: Jeff E. Nelson <jen@redhat.com> - 1.5.3-113.el7
changelog:
  - kvm-qxl-allow-to-specify-head-limit-to-qxl-driver.patch [bz#1283198]
  - kvm-qxl-Fix-new-function-name-for-spice-server-library.patch [bz#1283198]
  - kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-.patch [bz#1268345]
  - Resolves: bz#1268345
    (posix_fallocate emulation on NFS fails with Bad file descriptor if fd is opened O_WRONLY)
  - Resolves: bz#1283198
    (RFE: backport max monitor limitation from Qemu upstream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-114.el7
changelog:
  - kvm-hw-input-hid.c-Fix-capslock-hid-code.patch [bz#1256741]
  - kvm-target-i386-fix-pcmpxstrx-equal-ordered-strstr-mode.patch [bz#1340971]
  - kvm-spec-Update-rules-before-triggering-for-kvm-device.patch [bz#1333159]
  - Resolves: bz#1256741
    ("CapsLock" will work as "\" when boot a guest with usb-kbd)
  - Resolves: bz#1333159
    (qemu-kvm doesn't reload udev rules before triggering for kvm device)
  - Resolves: bz#1340971
    (qemu: accel=tcg does not implement SSE 4 properly)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-115.el7
changelog:
  - kvm-spice-do-not-require-TCP-ports.patch [bz#1336491]
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1346982]
  - Resolves: bz#1336491
    (Ship FD connection patches qemu-kvm part)
  - Resolves: bz#1346982
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-116.el7
changelog:
  - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1340929]
  - Resolves: bz#1340929
    (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-117.el7
changelog:
  - kvm-target-i386-add-feature-flags-for-CPUID-EAX-0xd-ECX-.patch [bz#1327599]
  - kvm-target-i386-add-Skylake-Client-cpu-model.patch [bz#1327599]
  - Resolves: bz#1327599
    (Add Skylake CPU model)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-118.el7
changelog:
  - kvm-util-introduce-MIN_NON_ZERO.patch [bz#1318199]
  - kvm-BlockLimits-introduce-max_transfer_length.patch [bz#1318199]
  - kvm-block-backend-expose-bs-bl.max_transfer_length.patch [bz#1318199]
  - kvm-scsi-generic-Merge-block-max-xfer-len-in-INQUIRY-res.patch [bz#1318199]
  - kvm-raw-posix-Fetch-max-sectors-for-host-block-device.patch [bz#1318199]
  - kvm-scsi-Advertise-limits-by-blocksize-not-512.patch [bz#1318199]
  - kvm-util-Fix-MIN_NON_ZERO.patch [bz#1318199]
  - Resolves: bz#1318199
    (expose host BLKSECTGET limit in scsi-block (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-119.el7
changelog:
  - kvm-qxl-factor-out-qxl_get_check_slot_offset.patch [bz#1355730]
  - kvm-qxl-store-memory-region-and-offset-instead-of-pointe.patch [bz#1355730]
  - kvm-qxl-fix-surface-migration.patch [bz#1355730]
  - kvm-qxl-fix-qxl_set_dirty-call-in-qxl_dirty_one_surface.patch [bz#1355730]
  - Resolves: bz#1355730
    (spice-gtk shows outdated screen state after migration [qemu-kvm])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-120.el7
changelog:
  - kvm-Add-install-dependency-to-newer-libusbx-version.patch [bz#1351106]
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359729]
  - Resolves: bz#1351106
    (symbol lookup error: /usr/libexec/qemu-kvm: undefined symbol: libusb_get_port_numbers)
  - Resolves: bz#1359729
    (CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-7.3])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-121.el7
changelog:
  - kvm-json-parser-drop-superfluous-assignment-for-token-va.patch [bz#1276036]
  - kvm-qjson-Apply-nesting-limit-more-sanely.patch [bz#1276036]
  - kvm-qjson-Don-t-crash-when-input-exceeds-nesting-limit.patch [bz#1276036]
  - kvm-check-qjson-Add-test-for-JSON-nesting-depth-limit.patch [bz#1276036]
  - kvm-qjson-Spell-out-some-silent-assumptions.patch [bz#1276036]
  - kvm-qjson-Give-each-of-the-six-structural-chars-its-own-.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_keyword-and-simplify.patch [bz#1276036]
  - kvm-qjson-Inline-token_is_escape-and-simplify.patch [bz#1276036]
  - kvm-qjson-replace-QString-in-JSONLexer-with-GString.patch [bz#1276036]
  - kvm-qjson-Convert-to-parser-to-recursive-descent.patch [bz#1276036]
  - kvm-qjson-store-tokens-in-a-GQueue.patch [bz#1276036]
  - kvm-qjson-surprise-allocating-6-QObjects-per-token-is-ex.patch [bz#1276036]
  - kvm-qjson-Limit-number-of-tokens-in-addition-to-total-si.patch [bz#1276036]
  - kvm-json-streamer-Don-t-leak-tokens-on-incomplete-parse.patch [bz#1276036]
  - kvm-json-streamer-fix-double-free-on-exiting-during-a-pa.patch [bz#1276036]
  - kvm-trace-remove-malloc-tracing.patch [bz#1360137]
  - Resolves: bz#1276036
    (Crash on QMP input exceeding limits)
  - Resolves: bz#1360137
    (GLib-WARNING **: gmem.c:482: custom memory allocation vtable not supported)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-122.el7
changelog:
  - kvm-virtio-validate-the-existence-of-handle_output-befor.patch [bz#1367040]
  - Resolves: bz#1367040
    (QEMU crash when guest notifies non-existent virtqueue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-123.el7
changelog:
  - kvm-Fix-backport-of-target-i386-add-feature-flags-for-CP.patch [bz#1371619]
  - kvm-Add-skip_dump-flag-to-ignore-memory-region-during-du.patch [bz#1373088]
  - Resolves: bz#1371619
    (Flags xsaveopt xsavec xgetbv1 are missing on qemu-kvm)
  - Resolves: bz#1373088
    ([FJ7.3 Bug]: virsh dump with both --memory-only and --format option fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-124.el7
changelog:
  - kvm-target-i386-Add-support-for-FEAT_7_0_ECX.patch [bz#1372459]
  - kvm-target-i386-Add-more-Intel-AVX-512-instructions-supp.patch [bz#1372459]
  - Resolves: bz#1372459
    ([Intel 7.3 Bug] SKL-SP Guest cpu doesn't support avx512 instruction sets(avx512bw, avx512dq and avx512vl) (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-125.el7
changelog:
  - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453]
  - Resolves: bz#1285453
    (An NBD client can cause QEMU main loop to block when connecting to built-in NBD server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7
changelog:
  - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542]
  - Resolves: bz#1376542
    (RHSA-2016-1756 breaks migration of instances)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-73
changelog:
  - portblock: fix tickle_tcp bug
  - nfsserver: use rpcpipefs_dir variable
  - mysql: use replication_port variable
  - oracle: inform user that monprofile must start with C## for
    container databases

    Resolves: rhbz#1337109
    Resolves: rhbz#1337615
    Resolves: rhbz#1337124
    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-78
changelog:
  - nfsserver: fix monitor issues causing NFS to start on
    "debug-monitor" and "resource cleanup"
  - nfsserver: remove "up to 10 tries" on start to avoid issues with
    some services taking longer to start
  - nfsserver: stop rpc-gssd to allow unmounting of "rpcpipefs_dir"

    Resolves: rhbz#1356866
    Resolves: rhbz#1126073
    Resolves: rhbz#1346733


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-81
changelog:
  - oracle: fix issue with C## in monprofile and inform user that
    monuser must start with C## as well for container databases

    Resolves: rhbz#1328386


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-82
changelog:
  - portblock: create tickle_dir if it doesn't exist
  - tomcat: use systemd if available

    Resolves: rhbz#1303037
    Resolves: rhbz#1249430


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.0-14
changelog:
  - Merge Pacemaker cluster resource agents:
    * Add Source1.
    * Drop noarch. We have real binaries now.
    * Update BuildRequires.
    * Update all relevant prep/build/install/files/description sections.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.0-16
changelog:
  - Create an ldirectord package
  - Update Pacameker agents to upstream version: 2198dc90bec4
    + Build: Import ldirectord.
    + Ensure HA_VARRUNDIR has a value to substitute
    + High: Add findif tool (mandatory for IPaddr/IPaddr2)
    + High: IPv6addr: new nic and cidr_netmask parameters
    + High: postfix: new resource agent
    + Include license information
    + Low (LF 2159): Squid: make the regexp match more precisely output of netstat
    + Low: configure: Fix package name.
    + Low: ldirectord: add dependency on $remote_fs.
    + Low: ldirectord: add mandatory required header to init script.
    + Medium (LF 2165): IPaddr2: remove all colons from the mac address before passing it to send_arp
    + Medium: VirtualDomain: destroy domain shortly before timeout expiry
    + Medium: shellfuncs: Make the mktemp wrappers work.
    + Remove references to Echo function
    + Remove references to heartbeat shellfuncs.
    + Remove useless path lookups
    + findif: actually include the right header. Simplify configure.
    + ldirectord: Remove superfluous configure artifact.
    + ocf-tester: Fix package reference and path to DTD.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.3-3
changelog:
  - Update Pacameker agents to upstream version: 099c0e5d80db
    + Add the ha_parameter function back into .ocf-shellfuncs.
    + Bug bnc#534803 - Provide a default for MAILCMD
    + Fix use of undefined macro @HA_NOARCHDATAHBDIR@
    + High (LF 2138): IPsrcaddr: replace 0/0 with proper ip prefix (thanks to Michael Ricordeau and Michael Schwartzkopff)
    + Import shellfuncs from heartbeat as badly written RAs use it
    + Medium (LF 2173): nfsserver: exit properly in nfsserver_validate
    + Medium: RA: Filesystem: implement monitor operation
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable (addendum)
    + Medium: RA: iSCSILogicalUnit: use a 16-byte default SCSI ID
    + Medium: RA: iSCSITarget: be more persistent deleting targets on stop
    + Medium: RA: portblock: add per-IP filtering capability
    + Medium: mysql-proxy: log_level and keepalive parameters
    + Medium: oracle: drop spurious output from sqlplus
    + RA: Filesystem: allow configuring smbfs mounts as clones


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.4-2
changelog:
  - Update Pacameker agents to upstream version: e2338892f59f
    + High: send_arp - turn on unsolicited mode for compatibilty with the libnet version's exit codes
    + High: Trap sigterm for compatibility with the libnet version of send_arp
    + Medium: Bug - lf#2147: IPaddr2: behave if the interface is down
    + Medium: IPv6addr: recognize network masks properly
    + Medium: RA: VirtualDomain: avoid needlessly invoking "virsh define"


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.5-2
changelog:
  - Update Pacameker agents to upstream version: bc00c0b065d9
    + High: RA: introduce OCF_FUNCTIONS_DIR, allow it to be overridden (LF2239)
    + High: doc: add man pages for all RAs (LF2237)
    + High: syslog-ng: new RA
    + High: vmware: make meta-data work and several cleanups (LF 2212)
    + Medium: .ocf-shellfuncs: add ocf_is_probe function
    + Medium: Dev: make RAs executable (LF2239)
    + Medium: IPv6addr: ifdef out the ip offset hack for libnet v1.1.4 (LF 2034)
    + Medium: add mercurial repository version information to .ocf-shellfuncs
    + Medium: build: add perl-MailTools runtime dependency to ldirectord package (LF 1469)
    + Medium: iSCSITarget, iSCSILogicalUnit: support LIO
    + Medium: nfsserver: use check_binary properly in validate (LF 2211)
    + Medium: nfsserver: validate should not check if nfs_shared_infodir exists (thanks to eelco@procolix.com) (LF 2219)
    + Medium: oracle/oralsnr: export variables properly
    + Medium: pgsql: remove the previous backup_label if it exists
    + Medium: postfix: fix double stop (thanks to Dinh N. Quoc)
    + RA: LVM: Make monitor operation quiet in logs (bnc#546353)
    + RA: Xen: Remove instance_attribute "allow_migrate" (bnc#539968)
    + ldirectord: OCF agent: overhaul


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.6-1
changelog:
  - New rgmanager resource agents upstream release
  - spec file update:
    * use global instead of define
    * use new Source0 url
    * use resource-agents macro more aggressively


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.6-2
changelog:
  - Update Pacameker agents to upstream version: c76b4a6eb576
    + High: RA: VirtualDomain: fix forceful stop (LF 2283)
    + High: apache: monitor operation of depth 10 for web applications (LF 2234)
    + Medium: IPaddr2: CLUSTERIP/iptables rule not always inserted on failed monitor (LF 2281)
    + Medium: RA: Route: improve validate (LF 2232)
    + Medium: mark obsolete RAs as deprecated (LF 2244)
    + Medium: mysql: escalate stop to KILL if regular shutdown doesn't work


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.8-1
changelog:
  - New rgmanager resource agents upstream release
    Resolves: rhbz#548133, rhbz#565907, rhbz#545602, rhbz#555901
    Resolves: rhbz#564471, rhbz#515717, rhbz#557128, rhbz#536157
    Resolves: rhbz#455300, rhbz#561416, rhbz#562237, rhbz#537201
    Resolves: rhbz#536962, rhbz#553383, rhbz#556961, rhbz#555363
    Resolves: rhbz#557128, rhbz#455300, rhbz#557167, rhbz#459630
    Resolves: rhbz#532808, rhbz#556603, rhbz#554968, rhbz#555047
    Resolves: rhbz#554968, rhbz#555047
  - spec file update:
    * update spec file copyright date
    * use bz2 tarball


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.9-1
changelog:
  - New rgmanager resource agents upstream release
    Resolves: rhbz#455300, rhbz#568446, rhbz#561862, rhbz#536902
    Resolves: rhbz#512171, rhbz#519491


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.9-2
changelog:
  - Resolves: rhbz#572993 - Patched build process to correctly generate ldirectord man page
  - Resolves: rhbz#574732 - Add libnet-devel as a dependancy to ensure IPaddrv6 is built


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.10-1
changelog:
  - New rgmanager resource agents upstream release
    Resolves: rhbz#519491, rhbz#570525, rhbz#571806, rhbz#574027
    Resolves: rhbz#574215, rhbz#574886, rhbz#576322, rhbz#576335
    Resolves: rhbz#575103, rhbz#577856, rhbz#577874, rhbz#578249
    Resolves: rhbz#578625, rhbz#578626, rhbz#578628, rhbz#578626
    Resolves: rhbz#579621, rhbz#579623, rhbz#579625, rhbz#579626
    Resolves: rhbz#579059


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.10-2
changelog:
  - New pacemaker agents upstream release
    + High: RA: vmware: fix set_environment() invocation (LF 2342)
    + High: RA: vmware: update to version 0.2
    + Medium: Filesystem: prefer /proc/mounts to /etc/mtab for non-bind mounts (lf#2388)
    + Medium: IPaddr2: don't bring the interface down on stop (thanks to Lars Ellenberg)
    + Medium: IPsrcaddr: modify the interface route (lf#2367)
    + Medium: ldirectord: Allow multiple email addresses (LF 2168)
    + Medium: ldirectord: fix setting defaults for configfile and ldirectord (lf#2328)
    + Medium: meta-data: improve timeouts in most resource agents
    + Medium: nfsserver: use default values (lf#2321)
    + Medium: ocf-shellfuncs: don't log but print to stderr if connected to a terminal
    + Medium: ocf-shellfuncs: don't output to stderr if using syslog
    + Medium: oracle/oralsnr: improve exit codes if the environment isn't valid
    + Medium: RA: iSCSILogicalUnit: fix monitor for STGT
    + Medium: RA: make sure that OCF_RESKEY_CRM_meta_interval is always defined (LF 2284)
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: VirtualDomain: bail out early if config file can't be read during probe (Novell 593988)
    + Medium: RA: VirtualDomain: fix incorrect use of __OCF_ACTION
    + Medium: RA: VirtualDomain: improve error messages
    + Medium: RA: VirtualDomain: spin on define until we definitely have a domain name
    + Medium: Route: add route table parameter (lf#2335)
    + Medium: sfex: don't use pid file (lf#2363,bnc#585416)
    + Medium: sfex: exit with success on stop if sfex has never been started (bnc#585416)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.11-1
changelog:
  - new upstream release
    Resolves: rhbz#583945, rhbz#581047, rhbz#576330, rhbz#583017
    Resolves: rhbz#583019, rhbz#583948, rhbz#584003, rhbz#582017
    Resolves: rhbz#555901, rhbz#582754, rhbz#582573, rhbz#581533
  - Switch to file based Requires.
    Also address several other problems related to missing runtime
    components in different agents.
    With the current Requires: set, we guarantee all basic functionalities
    out of the box for lvm/fs/clusterfs/netfs/networking.
    Resolves: rhbz#570008


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.12-1
changelog:
  - New pacemaker agents upstream release: a7c0f35916bf
    + High: pgsql: properly implement pghost parameter
    + High: RA: mysql: fix syntax error
    + High: SAPInstance RA: do not rely on op target rc when monitoring clones (lf#2371)
    + High: set the HA_RSCTMP directory to /var/run/resource-agents (lf#2378)
    + Medium: IPaddr/IPaddr2: add a description of the assumption in meta-data
    + Medium: IPaddr: return the correct code if interface delete failed
    + Medium: nfsserver: rpc.statd as the notify cmd does not work with -v (thanks to Carl Lewis)
    + Medium: oracle: reduce output from sqlplus to the last line for queries (bnc#567815)
    + Medium: pgsql: implement "config" parameter
    + Medium: RA: iSCSITarget: follow changed IET access policy


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-1
changelog:
  - new upstream release
    Resolves: rhbz#585217, rhbz#586100, rhbz#581533, rhbz#582753
    Resolves: rhbz#582754, rhbz#585083, rhbz#587079, rhbz#588890
    Resolves: rhbz#588925, rhbz#583789, rhbz#589131, rhbz#588010
    Resolves: rhbz#576871, rhbz#576871, rhbz#590000, rhbz#589823


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.13-1
changelog:
  - new upstream release
    Resolves: rhbz#592103, rhbz#593108, rhbz#578617, rhbz#594626
    Resolves: rhbz#594511, rhbz#596046, rhbz#594111, rhbz#597002
    Resolves: rhbz#599643


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.14-1
changelog:
  - new upstream release
    Resolves: rhbz#553383, rhbz#557563, rhbz#578625, rhbz#591003
    Resolves: rhbz#593721, rhbz#593726, rhbz#595455, rhbz#595547
    Resolves: rhbz#596918, rhbz#601315, rhbz#604298, rhbz#606368
    Resolves: rhbz#606470, rhbz#606480, rhbz#606754, rhbz#606989
    Resolves: rhbz#607321, rhbz#608154, rhbz#608887, rhbz#609181
    Resolves: rhbz#609866, rhbz#609978, rhbz#612097, rhbz#612110
    Resolves: rhbz#612165, rhbz#612941, rhbz#614127, rhbz#614356
    Resolves: rhbz#614421, rhbz#614457, rhbz#614961, rhbz#615202
    Resolves: rhbz#615203, rhbz#615255, rhbz#617163, rhbz#617566
    Resolves: rhbz#618534, rhbz#618703, rhbz#618806, rhbz#618814


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.16-1
changelog:
  - new upstream release
    Resolves: rhbz#619096, rhbz#614046, rhbz#620679, rhbz#619680
    Resolves: rhbz#621562, rhbz#621694, rhbz#608887, rhbz#622844
    Resolves: rhbz#623810, rhbz#617306, rhbz#623816, rhbz#624691
    Resolves: rhbz#622576


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.17-1
changelog:
  - new upstream release
    Resolves: rhbz#632595, rhbz#633856, rhbz#632385, rhbz#628013
    Resolves: rhbz#621313, rhbz#595383, rhbz#580492, rhbz#605733
    Resolves: rhbz#636243, rhbz#591003, rhbz#637913, rhbz#634718
    Resolves: rhbz#617247, rhbz#617247, rhbz#617234, rhbz#631943
    Resolves: rhbz#639018


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.1.0-1
changelog:
  - new upstream release
  - spec file update:
    Update upstream URL
    Update source URL
    use standard configure macro
    use standard make invokation


author: Chris Feist <cfeist@redhat.com> - 3.9.2-3.8
changelog:
  - Remove cluster-glue-libs-devel
  - Disable IPv6addr & sfex to fix deps on libplumgpl & libplum (due to
    disappearance of cluster-glue in F18)


author: David Vossel <dvossel@redhat.com> - 3.9.5-5
changelog:
  - Merges redhat provider into heartbeat provider. Remove
    rgmanager's redhat provider.

    Resolves: rhbz#917681
    Resolves: rhbz#928890
    Resolves: rhbz#952716
    Resolves: rhbz#960555


author: David Vossel <dvossel@redhat.com> - 3.9.5-7
changelog:
  - Detect duplicate resources with the same volgrpname
    name when using exclusive activation with tags

    Resolves: # rhbz984054


author: David Vossel <dvossel@redhat.com> - 3.9.5-8
changelog:
  - Add runtime dependencies section for Heartbeat agents.
  - Fix multi-lib inconsistencies found during rpm diff testing.
  - Add dist field back to rpm release name.


author: David Vossel <dvossel@redhat.com> - 3.9.5-10
changelog:
  - Removes ldirectord package
  - Puts sap agents and connector script in subpackage
  - exclude unsupported packages
  - symlink ipaddr to ipaddr2 so only a single agent is supported


author: David Vossel <dvossel@redhat.com> - 3.9.5-14
changelog:
  - Add ability for apache agent to perform simple monitoring
    of server request/response without requiring server-status
    to be enabled.
  - Fixes invalid return statement in LVM agent.
  - Oracle TNS_ADMIN option 

    Resolves: rhbz#917806
    Resolves: rhbz#917681
    Resolves: rhbz#799065


author: David Vossel <dvossel@redhat.com> - 3.9.5-15
changelog:
  - Update VirtualDomain heartbeat agent for heartbeat merger.
  - Includes upstream fixes for pacemaker_remote lxc test case.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-16
changelog:
  - Fixes issue with mysql agent not being able to set transient
    attributes on local node correctly.
  - Fixes bash syntax error in VirtualDomain during 'stop'
  - Fixes VirtualDomain default hypervisor usage.
  - Fixes VirtualDomain 'start' of pre-defined domain

    Resolves: rhbz#917681
    Resolves: rhbz#1014641
    Resolves: rhbz#1016140


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Split send_ua utility out of IPv6addr.c source so it can be
    re-used in IPaddr2 without requiring cluster-glue.
  - Fixes issue with pgsql and SAPInstance not setting transient
    attributes correctly when local corosync node name is not
    equal to 'uname -n'
  - High: ocft: Fedora supported test cases

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-18
changelog:
  - Remove support for (nginx, mysql-proxy, rsyslog). nginx and
    mysql-proxy are not a supported projects. Rsyslog is not an
    agent we will be supporting in an HA environment.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-20
changelog:
  - tomcat agent updates for pacemaker support
  - slapd agent updates for pacemaker support
  - Fixes missing etab file required for nfsserver

    Resolves: rhbz#1033016
    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-24
changelog:
  - Addition of the clvmd resource-agent
  - Support monitoring qemu based VirtualDomain resources without
    requiring libvirtd to be running.

    Resolves: rhbz#1064512
    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-25
changelog:
  - Rename clvmd agent to clvm to avoid problems associated
    with having a resource-agent named the same exact name
    as the binary the agent manages.

    Resolves: rhbz#1064512


author: David Vossel <dvossel@redhat.com> - 3.9.5-26
changelog:
  - Handle monitor qemu based VirtualDomain resources without
    requiring libvirtd even if configuration file does not
    contain an 'emulator' value pointing to the emulator binary.

    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-28
changelog:
  - Updates to nfs server related agent.
  - Introduces nfsnotify for sending NFSv3 NSM state change
    notifications allowing NFSv3 clients to reclaim locks.

    Resolves: rhbz#1091101


author: David Vossel <dvossel@redhat.com> - 3.9.5-29
changelog:
  - Support the check_user and check_passwd galera resource-agent
    options.
  - Minor NFS agent updates.

    Resolves: rhbz#1116166
    Resolves: rhbz#1091101


author: David Vossel <dvossel@redhat.com> - 3.9.5-30
changelog:
  - Support monitor of lxc without requiring libvirt.
  - Wait for filesystem modules to load during start.
  - Warn users managing clustered LVM when lvmetad is in use.
  - Restore VirtualDomain default start stop timeout values.
  - Support exit reason string
  - Auto set lvm locking type to clustered when clvmd is in use.

  Resolves: rhbz# 1083041
  Resolves: rhbz# 1083231
  Resolves: rhbz# 1097593
  Resolves: rhbz# 1105655
  Resolves: rhbz# 1128933
  Resolves: rhbz# 773395


author: David Vossel <dvossel@redhat.com> - 3.9.5-31
changelog:
  - Man page updates give pcs config examples
  - add iscsi agent support
  - add infiniband support to ethmonitor
  - add resource-agent support of exit reason string
  - add safe umount option to Filesystem resource agent

    Resolves: rhbz#1058102
    Resolves: rhbz#1118029
    Resolves: rhbz#1122285
    Resolves: rhbz#1128933
    Resolves: rhbz#1095944


author: David Vossel <dvossel@redhat.com> - 3.9.5-32
changelog:
  - Fixes iSCSILogicalUnit syntax error
  - Fixes mysql stop operation when db storage is unavailable

    Resolves: rhbz#1118029
    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-33
changelog:
  - Merges latest upstream patches for galera agent
  - Merges latest upstream patchs for exit reason string

    Resolves: rhbz#1116166
    Resolves: rhbz#1128933


author: David Vossel <dvossel@redhat.com> - 3.9.5-34
changelog:
  - Fixes mysql agents behavior when monitoring resource instance
    when environment validation fails.

    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-35
changelog:
  - Introduces docker resource-agent for managing docker containers.
    The docker agent is being released as tech preview.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-36
changelog:
  - Fixes cleaning up stale docker containers during stop if
    container instance failed.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-37
changelog:
  - Rename docker agent's 'container' arg to 'name' to avoid confusion
    with pacemaker's metadata 'container' argument.
  - Introduce monitor_cmd into docker agent.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-42
changelog:
  - Improve galera resource-agent to not require use of read-only
    mode to retrieve last known write sequence number.

    Resolves: rhbz#1170376


author: David Vossel <dvossel@redhat.com> - 3.9.5-44
changelog:
  - For IPsrcaddr, properly handle misconfiguration in a way that
    doesn't result in fencing.
  - Return exit reason for invalid netmask in IPaddr2

    Resolves: rhbz#1200756
    Resolves: rhbz#773399


author: David Vossel <dvossel@redhat.com> - 3.9.5-45
changelog:
  - Fix clvmd usage of daemon_options
  - Use better default nfsserver start timeouts
  - Make nfsserver preserve options in /etc/sysconfig/nfs
  - Add link_status_only option to ethmonitor agent
  - Add support for nginx agent
  - Add support for db2 agent
  - CTDB agent updates

    Resolves: rhbz#1171162
    Resolves: rhbz#1173193
    Resolves: rhbz#1182787
    Resolves: rhbz#1213971
    Resolves: rhbz#1183136
    Resolves: rhbz#1059988
    Resolves: rhbz#1077888


author: David Vossel <dvossel@redhat.com> - 3.9.5-46
changelog:
  - iface-vlan agent
  - Allow partial activation when physical volumes are missing.
  - Properly handle 'includes' during apache config parsing
  - Support for NovaCompute resource-agent

    Resolves: rhbz#1160365
    Resolves: rhbz#1214781
    Resolves: rhbz#1223615
    Resolves: rhbz#1214360


author: David Vossel <dvossel@redhat.com> - 3.9.5-47
changelog:
  - NovaCompute and NovaEvacuate updates
  - dhcpd chroot fix
  - redis 0byte error fix

    Resolves: rhbz#1214360
    Resolves: rhbz#1227293
    Resolves: rhbz#1231032


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-55
changelog:
  - NovaCompute/NovaEvacuate: Fix 'evacute' typo
  - NovaEvacuate invoke off action

    Resolves: rhbz#1282723
    Resolves: rhbz#1287303


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-57
changelog:
  - Replace NovaCompute with nova-compute-wait which lets systemd
    manage the nova-compute process

    Resolves: rhbz#1304011


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-60
changelog:
  - rabbitmq-cluster: fix to forget stopped cluster nodes
  - nfsserver: fix systemd status detection

    Resolves: rhbz#1247303
    Resolves: rhbz#1126073


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-62
changelog:
  - tomcat: fix for SELinux enforced mode
  - send_arp: fix buffer overflow on infiniband devices
  - mysql: fix tmpfile leak
  - VirtualDomain: add migrate_options parameter
  - VirtualDomain: fix issue where config file might get removed
  - VirtualDomain: fix locale in stop and status functions()

    Resolves: rhbz#1249430
    Resolves: rhbz#1250728
    Resolves: rhbz#1263348
    Resolves: rhbz#1242181
    Resolves: rhbz#1242558
    Resolves: rhbz#1301189


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-63
changelog:
  - IPaddr2: use IPv6 DAD for collision detection
  - nagios: new resource agent

    Resolves: rhbz#1276699
    Resolves: rhbz#1212632


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-67
changelog:
  - sap_redhat_cluster_connector: add support for hostnames with "-"
  - NovaEvacuate: simplify nova check
  - portblock: new resource agent

    Resolves: rhbz#1265527
    Resolves: rhbz#1287314
    Resolves: rhbz#1303037


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-69
changelog:
  - SAP HANA: add Multiple Components One System (MCOS) support
  - VirtualDomain: add migration_speed and migration_downtime options
  - VirtualDomain: fix unnecessary error when probing nonexistent domain
  - oralsnr: fix status check fail when username is more than 8 characters long
  - oracle: fix unable to start because of ORA-01081

    Resolves: rhbz#1289107
    Resolves: rhbz#1296406
    Resolves: rhbz#1307160
    Resolves: rhbz#1317578
    Resolves: rhbz#1318985


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-70
changelog:
  - nfsserver: fix nfs-idmapd fails to start due to
    var-lib-nfs-rpc_pipefs.mount being active

    Resolves: rhbz#1325453


author: John H Terpstra <jht@samba.anu.edu.au>
changelog:
  - Many optimisations (some suggested by Manoj Kasichainula <manojk@io.com>
  - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
  - Compounded make line
  - Updated smb.init restart mechanism
  - Use compound mkdir -p line instead of individual calls to mkdir
  - Fixed smb.conf file path for log files
  - Fixed smb.conf file path for incoming smb print spool directory
  - Added a number of options to smb.conf file
  - Added smbadduser command (missed from all previous RPMs) - Doooh!
  - Added smbuser file and smb.conf file updates for username map


author: Erik Troan <ewt@redhat.com>
changelog:
  - made the %postun script a tad less agressive; no reason to remove
    the logs or lock file (after all, if the lock file is still there,
    samba is still running)
  - the %postun and %preun should only exectute if this is the final
    removal
  - migrated %triggerpostun from Red Hat's samba package to work around
    packaging problems in some Red Hat samba releases


author: Bill Nottingham <notting@redhat.com>
changelog:
  - add a mount.smb to make smb mounting a little easier.
  - smb filesystems apparently don't work on alpha. Oops.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.0.5
  - fix mount.smb - smbmount options changed again.........
  - fix postun. oops.
  - update some stuff from the samba team's spec file.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - use cp rather than mv to preserve /etc/services perms (#4938 et al).
  - use mktemp to generate /etc/tmp.XXXXXX file name.
  - add prereqs on sed/mktemp/killall (need to move killall to /bin).
  - fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix yp_get_default_domain in autoconf
  - only link against readline for smbclient
  - fix log rotation (#9909)


author: Than Ngo <than@redhat.de>
changelog:
  - add initdir macro to handle the initscript directory
  - add a new macro to handle /etc/pam.d/system-auth


author: Bill Nottingham <notting@redhat.com>
changelog:
  - move initscript back
  - remove 'Using Samba' book from %doc 
  - move stuff to /etc/samba (#13708)
  - default configuration tweaks (#13704)
  - some logrotate tweaks


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix swat only_from line (#18726, others)
  - fix attempt to write outside buildroot on install (#17943)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - set a default CA certificate path in smb.conf (#19010)
  - require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file


author: Bill Nottingham <notting@redhat.com>
changelog:
  - i18n-ize initscript
  - add a sysconfig file for daemon options (#23550)
  - clarify smbpasswd man page (#23370)
  - build with LFS support (#22388)
  - avoid extraneous pam error messages (#10666)
  - add Urban Widmark's bug fixes for smbmount (#19623)
  - fix setgid directory modes (#11911)
  - split swat into subpackage (#19706)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak the PAM code some more to try to do a setcred() after initgroups()
  - pull in all of the optflags on i386 and sparc
  - don't explicitly enable Kerberos support -- it's only used for password
    checking, and if PAM is enabled it's a no-op anyway


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to samba 2.2.0
  - moved codepages to %{_datadir}/samba/codepages
  - use all available CPUs for building rpm packages
  - use %{_xxx} defines at most places in spec-file
  - "License:" replaces "Copyright:"
  - dropped excludearch sparc
  - de-activated japanese patches 100 and 200 for now 
    (they need to be fixed and tested wth 2.2.0)
  - separated swat.desktop file from spec-file and added
    german translations
  - moved /etc/sysconfig/samba to a separate source-file
  - use htmlview instead of direct call to netscape in 
    swat.desktop-file


author: Helge Deller <hdeller@redhat.de>
changelog:
  - build as 2.2.0-1 release
  - skip the documentation-directories docbook, manpages and yodldocs
  - don't include *.sgml documentation in package
  - moved codepage-directory to /usr/share/samba/codepages
  - make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - (these changes are from the non-head version)
  - Don't include /usr/sbin/samba, it's the same as the initscript
  - unset TMPDIR, as samba can't write into a TMPDIR owned
    by root (#41193)
  - Add pidfile: lines for smbd and nmbd and a config: line
    in the initscript  (#15343)
  - don't use make -j
  - explicitly include /usr/share/samba, not just the files in it


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Use /var/cache/samba instead of /var/lock/samba 
  - Remove "domain controller" keyword from smb.conf, it's 
    deprecated (from #13704)
  - Sync some examples with smb.conf.default
  - Fix password synchronization (#16987)


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Don't include smbpasswd in samba, it's in samba-common (#51598)
  - Add a disabled "obey pam restrictions" statement - it's not
    active, as we use encrypted passwords, but if the admin turns
    encrypted passwords off the choice is available. (#31351)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-3
changelog:
  - Add "--with-utmp" to configure options (#55372)
  - Include winbind, pam_smbpass.so, rpcclient and smbcacls
  - start using /var/cache/samba, we need to keep state and there is
    more than just locks involved


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-5
changelog:
  - Teach smbadduser about "getent passwd" 
  - Fix more pid-file references
  - Add (conditional) winbindd startup to the initscript, configured in
    /etc/sysconfig/samba


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-6
changelog:
  - Move winbind files to samba-common. Add separate initscript for
    winbind 
  - Fixes for winbind - protect global variables with mutex, use
    more secure getenv


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.3a-3
changelog:
  - include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
    (patch posted to samba-list by Ilia Chipitsine)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.5-7
changelog:
  - Enable VFS support and compile the "recycling" module (#69796)
  - more selective includes of the examples dir


author: Jay Fenlason <fenlason@redhat.com> 2.2.7a-3
changelog:
  - edited spec file to put .so files in the correct directories
    on 64-bit platforms that have 32-bit compatability issues
    (sparc64, x86_64, etc).  This fixes bugzilla #83782.
  - Added samba-2.2.7a-error.patch from twaugh.  This fixes
    bugzilla #82454.


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.7a-4
changelog:
  - relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
    link with libnsl, avoiding unresolved symbol errors on functions in libnsl


author: Jay Fenlason <fenlason@redhat.com> 2.2.8-0
changelog:
  - Upgrade to 2.2.8
  - removed commented out patches.
  - removed old patches and .md5 files from the repository.
  - remove duplicate /sbin/chkconfig --del winbind which causes
    warnings when removing samba.
  - Fixed minor bug in smbprint that causes it to fail when called with
    more than 10 parameters: the accounting file (and spool directory
    derived from it) were being set wrong due to missing {}.  This closes
    bug #86473.
  - updated smb.conf patch, includes new defaults to close bug #84822.


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-1
changelog:
  - upgrade to 2.2.8a
  - remove old .md5 files
  - add "pid directory = /var/run" to the smb.conf file.  Fixes #88495
  - Patch from jra@dp.samba.org to fix a delete-on-close regression


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-2
changelog:
  - add libsmbclient.so for gnome-vfs-extras
  - Edit specfile to specify /var/run for pid files
  - Move /tmp/.winbindd/socket to /var/run/winbindd/socket


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-3beta3
changelog:
  - Merge from 3.0.0-2beta3.3E
  - (Correct log file names (#100981).)
  - (Fix pidfile directory in samab.log)
  - (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
  - (Move libsmbclient to the -common package (#99449))


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-15
changelog:
  - New 3.0.0 final release
  - merge nmbd-netbiosname and testparm patches from 3E branch
  - updated the -logfiles patch to work against 3.0.0
  - updated the pie patch
  - update the VERSION file during build
  - use make -j if avaliable
  - merge the winbindd_privileged change from 3E
  - merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
    platforms despite the broken Makefile


author: Felipe Alfaro Solana <felipe_alfaro@linuxmail.org> 3.0.1-1
changelog:
  - Update to 3.0.1
  - Removed testparm patch as it's already merged
  - Removed Samba.7* man pages
  - Fixed .buildroot patch
  - Fixed .pie patch
  - Added new /usr/bin/tdbdump file


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-3rc2
changelog:
  - add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
  - Upgrade to new upstream version
  - build mount.cifs for the new cifs filesystem in the 2.6 kernel.


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-5
changelog:
  - New upstream version: 3.0.2 final includes security fix for #114995
    (CAN-2004-0082)
  - Edit postun script for the -common package to restart winbind when
    appropriate.  Fixes bugzilla #114051.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Change all requires lines to list an explicit epoch.  Closes #102715
  - Add an explicit Epoch so that %{epoch} is defined.


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-1.pre1
changelog:
  - New upstream version.
  - Updated -pie and -logfiles patches for 3.0.3pre1
  - add krb5-devel to buildrequires, fixes #116560
  - Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
    "service smb status".  This fixes #116559


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-2.pre2
changelog:
  - New upstream version  
  - Updated configure line to remove --with-fhs and to explicitly set all
    the directories that --with-fhs was setting.  We were overriding most of
    them anyway.  This closes #118598


author: jay Fenlason <fenlason@redhat.com> 3.0.3-3.rc1
changelog:
  - New upstream version
  - updated spec file to make libsmbclient.so executable.  This closes
    bugzilla #121356


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.3-60
changelog:
  - Update to 3.5.3
  - Make sure nmb and smb initscripts return LSB compliant return codes
  - Fix winbind over ipv6


author: Andreas Schneider <asn@redhat.com> - 2:3.6.5-88
changelog:
  - Move tmpfiles.d config to common package as it is needed for smbd and
    winbind.
  - Make sure tmpfiles get created after installation.


author: Ville Skyttä <ville.skytta@iki.fi> - 2:3.6.6-92
changelog:
  - Call ldconfig at libwbclient and -winbind-clients post(un)install time.
  - Fix empty localization files, use %find_lang to find and %lang-mark them.
  - Escape macros in %changelog.
  - Fix source tarball URL.


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.0-154.rc3
changelog:
  - Update to 4.0.0rc3.
  - resolves: #805562 - Unable to share print queues.
  - resolves: #863388 - Unable to reload smbd configuration with systemctl.


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.0-160.rc3
changelog:
  - resolves: #867893 - Move /var/log/samba to samba-common package for
                        winbind which requires it.


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.2-1
changelog:
  - Update to Samba 4.0.2.
  - Fixes CVE-2013-0213.
  - Fixes CVE-2013-0214.
  - resolves: #906002
  - resolves: #905700
  - resolves: #905704
  - Fix conn->share_access which is reset between user switches.
  - resolves: #903806
  - Add missing example and make sure we don't introduce perl dependencies.
  - resolves: #639470


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.3-1
changelog:
  - Update to Samba 4.0.3.
  - resolves: #907544 - Add unowned directory /usr/lib64/samba.
  - resolves: #906517 - Fix pidl code generation with gcc 4.8.
  - resolves: #908353 - Fix passdb backend ldapsam as module.


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.4-3
changelog:
  - resolves: #919405 - Fix and improve large_readx handling for broken clients.
  - resolves: #924525 - Don't use waf caching.


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.5-1
changelog:
  - Update to Samba 4.0.5.
  - Add UPN enumeration to passdb internal API (bso #9779).
  - resolves: #928947 - samba-doc is obsolete now.
  - resolves: #948606 - LogRotate should be optional, and not a hard "Requires".


author: - Andreas Schneider <asn@redhat.com> - 2:4.0.7-2
changelog:
  - resolves: #972692 - Build with PIE and full RELRO.
  - resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
  - resolves: #981033 - Local user's krb5cc deleted by winbind.
  - resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong
                        directory.


author: - Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.2
changelog:
  - resolves: #985985 - Fix file conflict between samba and wine.
  - resolves: #985107 - Add support for new default location for Kerberos
                        credential caches.


author: - Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.7
changelog:
  - related: #985609 - Update to Samba 4.1.0rc3.
  - resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd.


author: - Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.8
changelog:
  - related: #985609 - Update to Samba 4.1.0rc4.
  - resolves: #1014656 - Split out a samba-winbind-modules package.


author: - Andreas Schneider <asn@redhat.com> - 4.1.0-4
changelog:
  - related: #884169 - Add direct dependency to samba-libs in the
                       glusterfs package.
  - resolves: #996567 - Fix userPrincipalName composition.
  - related: #884169 - Fix memset call with zero length in in ntdb.


author: - Andreas Schneider <asn@redhat.com> - 4.1.1-4
changelog:
  - resolves: #1034048 - Fix group name substitution in template homedir.
  - resolves: #1018041 - Fix CVE-2013-4408.
  - related: #884169 - Fix several covscan warnings.


author: - Andreas Schneider <asn@redhat.com> - 4.1.1-9
changelog:
  - resolves: #1033122 - Fix dropbox regression.
  - resolves: #1040464 - Fix %G substituion for config parameters.


author: - Andreas Schneider <asn@redhat.com> - 4.1.1-12
changelog:
  - resolves: #1050886 - Fix full CPU utilization in winbindd.
  - resolves: #1051400 - Fix segfault in smbd.
  - resolves: #1051402 - Fix SMB2 server panic when a smb2 brlock times out.


author: - Andreas Schneider <asn@redhat.com> - 4.1.1-17
changelog:
  - resolves: #1067606 - Fix wbinfo with one-way trust.
  - resolves: #1069569 - Fix memory leak reading the printer list.


author: - Alexander Bokovoy <abokovoy@redhat.com> - 4.1.1-30
changelog:
  - resolves: #1083859  - Force KRB5CCNAME in Samba systemd units.
  - related: #1082598 - Fully enables systemd integration.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.1.1-34
changelog:
  - resolves: #1105505 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108845 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105574 - CVE-2014-0178: Uninitialized memory exposure.


author: - Andreas Schneider <asn@redhat.com> - 4.1.1-37
changelog:
  - resolves: #1072352 - Make pidl a noarch subpackage.
  - resolves: #1133516 - Create a samba-test-libs package.
  - resolves: #1132873 - Add support to rebuild without clustering.


author: - Andreas Schneider <asn@redhat.com> - 4.1.12-2
changelog:
  - resolves: #1138554 - Fix consuming a lot of CPU when re-reading printcap info.
  - resolves: #1134323 - Fix running Samba on little endian Power8 (ppc64le).
  - resolves: #1113064 - Fix case sensitivity options with SMB2 protocols.
  - resolves: #1088924 - Fix applying ACL masks when setting ACLs.
  - resolves: #1135723 - Fix 'force user' regression.
  - resolves: #1117770 - Fix empty full_name field with samlogon.
  - resolves: #1101210 - Fix telling systemd that nmbd is waiting for interfaces.
  - resolves: #1127931 - Fix getgroups() with idmap_ad returning non-mapped groups.
  - resolves: #1144963 - Fix idmap_ad with SFU against trusted domains.
  - resolves: #1140568 - Fix a segfault in the smbclient echo command.
  - resolves: #1089940 - Improve service principal guessing in 'net ads'.
  - resolves: #955561 - Fix overwriting of SPNs in AD during 'net ads join'.
  - resolves: #955562 - Add precreated SPNS from AD during keytab initialization.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.1.12-3
changelog:
  - resolves: #878351 - Fix usage of AES keys by default.
  - resolves: #861366 - Fix KRB5 locator to use same KDC for joining and DNS update.


author: - Andreas Schneider <asn@redhat.com> - 4.1.12-9
changelog:
  - resolves: #1162552 - Fix net ads join segfault on big endian systems.
  - resolves: #1164203 - Fix net ads join segfault with existing keytab.


author: - Andreas Schneider <asn@redhat.com> - 4.1.12-11
changelog:
  - resolves: #1163748 - Fix smbclient -L fails against new Windows versions
                         over TCP.
  - resolves: #1167849 - Fix smbstatus --profile always returning EXIT_FAILURE.


author: - Andreas Schneider <asn@redhat.com> - 4.1.12-13
changelog:
  - resolves: #1172089 - Fix 'net rpc join' with schannel changes.
  - resolves: #1170883 - Fix 'net time system' segfault.


author: Andreas Schneider <asn@redhat.com> - 4.2.2-1
changelog:
  - resolves: #1196140 - Rebase Samba to version 4.2.2
  - resolves: #1186403 - Split patches to fix multiarch conflicts
  - resolves: #1167325 - Retrieve printer GUID from AD if it is not in the
                         registry
  - resolves: #1220174 - Fix issues with winbind library dependencies
  - resolves: #1211658 - Fix stale cache entries on printer rename
  - resolves: #1228809 - Fix reconnect on session exparation


author: Andreas Schneider <asn@redhat.com> - 4.2.2-2
changelog:
  - related: #1196140 - Add missing build dependency for libarchive
  - related: #1196140 - Make sure we do a hardened build


author: Andreas Schneider <asn@redhat.com> - 4.2.3-1
changelog:
  - related: #1196140 - Rebase to version 4.2.3
  - resolves: #1237036 - Fix DCERPC PDU calculation
  - resolves: #1237039 - Fix winbind request cancellation
  - resolves: #1223981 - Fix possible segfault with smbX protocol setting


author: Andreas Schneider <asn@redhat.com> - 4.2.3-2
changelog:
  - resolves: #1238194 - Fix the 'dfree command'
  - resolves: #1216062 - Document netbios name length limitation


author: Andreas Schneider <asn@redhat.com> - 4.2.3-6
changelog:
  - resolves: #1255322 - Fix 'map to guest = Bad uid' option
  - resolves: #1255326 - Fix segfault with 'mangling method = hash'


author: Andreas Schneider <asn@redhat.com> - 4.2.3-9
changelog:
  - resolves: #1273912 - Fix dependencies to samba-common
  - resolves: #1273393 - Fix user after free in smb name resolution


author: Guenther Deschner <gdeschner@redhat.com> - 4.2.3-11
changelog:
  - resolves: #1290711
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-7
changelog:
  - Fix regressions introduced with security tightening as part of Badlock release
  - resolves: #1330199


author: Andreas Schneider <asn@redhat.com> - 4.4.4-1
changelog:
  - resolves: #1303076 - Rebase Samba to version 4.4.4
  - resolves: #1314673 - Fix CVE-2015-7560
  - resolves: #1263322 - Add '--no-dns-updates' option to 'net ads join'
  - resolves: #1264433 - Fix segfault in pam_winbind.so with invalid config
                         options
  - resolves: #1193504 - Fix smbget to retrieve files recursively
  - resolves: #1193502 - Fix smbget to use command line credentials
  - resolves: #1193493 - Fix smbget url credentials parsing
  - resolves: #1273999 - Support printing with Kerberos credentials on newer
                         CUPS versions
  - resolves: #1296821 - Define /etc/pam.d/samba as a non replaceable config
  - resolves: #1261107 - Fix memory leak because of missing talloc stackframe
  - resolves: #1333562 - Fix memory leak after smbc_free_context()
  - resolves: #1315422 - Fix regression from CVE-2015-5252
  - resolves: #1316899 - Fixed idmap_hash module issues when used with others
  - resolves: #1322691 - Fix badlock related bugs
  - Fix CVE-2015-5370
  - Fix CVE-2016-2110
  - Fix CVE-2016-2111
  - Fix CVE-2016-2112
  - Fix CVE-2016-2113
  - Fix CVE-2016-2114
  - Fix CVE-2016-2115
  - Fix CVE-2016-2118
  - resolves: #1327951 - Fix regression with anonymous connections from OS X
  - resolves: #1327845 - Fix pcap_cache_reload() with spoolssd
  - resolves: #1289640 - Fix ctdb selinux issue with read only tracking dbs
  - resolves: #1341208 - Fix enumerating groups over NSS with idmap_ad
  - resolves: #1345827 - Fix resolving trusted domain users on domain member
  - resolves: #1346334 - Fix typo in smb.conf.example
  - resolves: #1335292 - Fix site-aware 'net ads join -k'
  - resolves: #1260214 - Accept empty realm for ad domains with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.4.4-3
changelog:
  - related: #1260214 - Correctly warn about missing realm for ad domains
                        with 'security=domain'


author: Andreas Schneider <asn@redhat.com> - 4.4.4-4
changelog:
  - resolves: #1351655 - Fix winbind meomory leak with each cached credentials
                         login
  - resolves: #1351961 - Fix CVE-2016-2119


author: Andreas Schneider <asn@redhat.com> - 4.4.4-5
changelog:
  - resolves: #1359091 - Package /usr/lib/samba/ldb in the common-libs package
  - resolves: #1360788 - Fix multilib issue with ctdb-tests package
  - resolves: #1362385 - Fix Samba ignoring supplementary groups
  - resolves: #1364051 - Fix smbd panic with stale ctdb entries


author: Andreas Schneider <asn@redhat.com> - 4.4.4-6
changelog:
  - resolves: #1367316 - Increase required Kerbersion version number
  - resolves: #1366477 - Fix using the right krb5 ccache in libads
  - resolves: #1356501 - Fix high CPU usage with smbclient connection to
                         non-reachable IP


author: Andreas Schneider <asn@redhat.com> - 4.4.4-10
changelog:
  - resolves: #1393050 - Fix linking nss_wins with libreplace
  - resolves: #1393051 - Fix nss_wins function definitions for gethostbyname*
  - resolves: #1393048 - Fix %G substitution in AD case
  - resolves: #1393052 - Fix regression of smbclient unable to connect to
                         Apple and Azure


author: Justin M. Forbes <jforbes@redhat.com> 0.5.1-2
changelog:
  - Ugly hacks to make package noarch and available for arch that cannot build it.
  - Disable useless debuginfo


author: Cole Robinson <crobinso@redhat.com> - 1.7.0-1
changelog:
  - Rebased to version 1.7.0
  - Support for virtio-scsi
  - Improved USB drive support
  - Several USB controller bug fixes and improvements


author: Cole Robinson <crobinso@redhat.com> - 1.7.1-1
changelog:
  - Rebased to version 1.7.1
  - Initial support for booting from USB attached scsi (USB UAS) drives
  - USB EHCI 64bit controller support
  - USB MSC multi-LUN device support
  - Support for booting from LSI SCSI controllers on emulators
  - Support for booting from AMD PCscsi controllers on emulators


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-2
changelog:
  - Disable options not used / not supported by RHEL-7 (rhbz 927582)
  - Add pvpanic device driver (rhbz 967777)
  - Obsolete vgabios (rhbz 976340)


author: Miroslav Rezanina <mrezanin@redhat.com> - seabios-1.7.2.2-3.el7
changelog:
  - seabios-floppy-Introduce-struct-floppy_pio_s-for-floppy-PIO-.patch [bz#920140]
  - seabios-floppy-Cleanup-floppy-irq-wait-handling.patch [bz#920140]
  - seabios-floppy-Implement-media-format-sensing.patch [bz#920140]
  - seabios-Place-rpm-version-info-into-version-banner.patch [bz#894979]
  - seabios-ahci-add-missing-check-for-allocation-failure.patch [bz#1005747]
  - Resolves: bz#1005747
    (fail to boot rhel7 guest with >126(21 ahci controller) ahci disks)
  - Resolves: bz#894979
    (place rpm version info into version banner)
  - Resolves: bz#920140
    (qemu-kvm emulation of 2.88M floppy fails)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-4.el7
changelog:
  - seabios-Introduce-and-convert-pmm-code-to-use-standard-list-.patch [bz#947051]
  - seabios-Fix-error-in-hlist_for_each_entry_safe-macro.patch [bz#947051]
  - seabios-Another-fix-for-hlist_for_each_entry_safe.patch [bz#947051]
  - seabios-uas-add-temporary-superspeed-stopgap.patch [bz#947051]
  - seabios-usb-add-usb_update_pipe.patch [bz#947051]
  - seabios-usb-add-xhci-support.patch [bz#947051]
  - seabios-xhci-adaptions-for-old-rhel7-seabios-codebase.patch [bz#947051]
  - seabios-allow-1TB-of-RAM.patch [bz#1016974]
  - Resolves: bz#1016974
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)
  - Resolves: bz#947051
    ([RFE] implement xhci support in seabios)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-5.el7
changelog:
  - seabios-build-explicitly-set-ROM-size.patch [bz#1038604]
  - Resolves: bz#1038604
    (make seabios 256k for rhel7 machine types)


author: Michal Novotny <minovotn@redhat.com> - seabios-1.7.2.2-6.el7
changelog:
  - seabios-biostables-support-looking-up-RSDP.patch [bz#1034877]
  - seabios-romfile_loader-utility-to-patch-in-memory-ROM-files.patch [bz#1034877]
  - seabios-acpi-load-and-link-tables-through-romfile-loader.patch [bz#1034877]
  - Resolves: bz#1034877
    (export acpi tables to guests (seabios))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-8.el7
changelog:
  - seabios-vgabios-Fix-cirrus-memory-clear-on-mode-switch.patch [bz#979898]
  - Resolves: bz#979898
    ([qemu-kvm]The win2k3-32 guest display is abnormal when using -vga cirrus)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-10.el7
changelog:
  - Fixed seavgabios-bin obsoletes/provides [bz#1035452]
  - Resolves: bz#1035452
    ( seavgabios-bin has bad obsoletes/provides for "vgabios")


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-11.el7
changelog:
  - seabios-init_virtio_scsi-reset-the-HBA-before-freeing-its-vi.patch [bz#1013418]
  - seabios-smbios-catch-zero-length-strings.patch [bz#1052837]
  - seabios-resume-restore-piix-pm-config-registers-after-resume.patch [bz#1049860]
  - seabios-pci-align-64bit-pci-regions-to-1G.patch [bz#1055832]
  - seabios-pci-log-pci-windows.patch [bz#1055832]
  - seabios-pci-improve-io-address-space-allocation.patch [bz#1055832]
  - Resolves: bz#1013418
    (qemu-kvm with a virtio-scsi controler without devices attached quits after stop/cont in HMP/QMP)
  - Resolves: bz#1049860
    (Guest agent command hang there after restore the guest from the save file)
  - Resolves: bz#1052837
    (The wrong DMI structures could not be decoded while booting vm with -smbios params)
  - Resolves: bz#1055832
    (can not see seabios GUI when boot with 155 virtio-blk-pci disks via pci-bridge)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-2.el7
changelog:
  - seabios-Build-seabios-as-noarch.patch [bz#1118380]
  - Resolves: bz#1118380
    (Seabios build required for ppc64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-4.el7
changelog:
  - seabios-smbios-set-bios-vendor-version-fields-to-Seabios-0.5.patch [bz#1123299]
  - Resolves: bz#1123299
    (smbios table 0 vendor string should be Seabios (for rhel6 compatibility) [7.1+7.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-5.el7
changelog:
  - seabios-Workaround-for-a-win8.1-32-S4-resume-bug.patch [bz#1050775]
  - seabios-boot-Fix-boot-order-for-SCSI-target-lun-9.patch [bz#1096560]
  - Resolves: bz#1096560
    (fail to assign correct order for the boot device in seabios as we specified the bootindex in qemu-kvm cli(under the same virtio-scsi-pci))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-6.el7
changelog:
  - seabios-Extend-ExclusiveArch-to-power64-architectures.patch [bz#1163924]
  - Resolves: bz#1163924
    (seabios is needed for ppc64 and ppc64le but marked ExclusiveArch aarch64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-8.el7
changelog:
  - seabios-turn-off-stack-switching-for-vgabios.patch [bz#1182634]
  - Resolves: bz#1182634
    (Remove CONFIG_VGA_ALLOCATE_EXTRA_STACK)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-9.el7_1
changelog:
  - seabios-boot.c-delay-exiting-boot-if-menu-key-is-ESC.patch [bz#841638]
  - seabios-boot-switch-default-menu-key-to-ESC.patch [bz#841638]
  - Resolves: bz#841638
    (Provide a platform agnostic approach to invoking the BIOS, boot menu, or other BIOS functions)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-10.el7
changelog:
  - seabios-fw-pci-scan-all-buses-if-extraroots-romfile-is-prese.patch [bz#1235381]
  - seabios-fw-pci-map-memory-and-IO-regions-for-multiple-pci-ro.patch [bz#1235381]
  - Resolves: bz#1235381
    (RFE: configure guest NUMA node locality for guest PCI devices)


author: Yash Mankad <ymankad@redhat.com> - 1.7.5-11.el7
changelog:
  - seabios-bootorder-Update-extra-pci-root-buses-bootorder-form.patch [bz#1242968]
  - Resolves: bz#1242968
    (pci: support booting of devices behind PXB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-2.el7
changelog:
  - seabios-fw-pci-add-Q35-S3-support.patch [bz#1185721]
  - Resolves: bz#1185721
    (win7 guest (boot with q35) show dark screen after do S3)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-3.el7
changelog:
  - seabios-redhat-reserve-more-memory-on-fseg.patch [bz#1327060]
  - seabios-redhat-turn-off-some-config-options.patch [bz#1327060]
  - Resolves: bz#1327060
    ([Seabios]Limited boot number supported for SCSI/SATA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-4.el7
changelog:
  - seabios-Build-vgabios-virtio.bin.patch [bz#1327001]
  - Resolves: bz#1327001
    (vgabios-virtio.bin should be included  in seavgabios-bin package)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7
changelog:
  - seabios-pci-don-t-map-virtio-1.0-storage-devices-above-4G.patch [bz#1373154]
  - Resolves: bz#1373154
    (Guest fails boot up with ivshmem-plain and virtio-pci device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.1
changelog:
  - seabios-vgabios-Reorder-video-modes-to-work-around-a-Windows.patch [bz#1392028]
  - Resolves: bz#1392028
    ([virtio-win][svvp][ws2016] cannot generate dump file when using nmi on ws2016 and win10-32/64)


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Dan Walsh <dwalsh@redhat.com> 3.8.1-2
changelog:
  - Fix label on /var/lib/dokwiki
  - Change permissive domains to enforcing
  - Fix libvirt policy to allow it to run on mls


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-7
changelog:
  - Update boinc policy
  - Fix sysstat policy to allow sys_admin
  - Change failsafe_context to unconfined_r:unconfined_t:s0


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-18
changelog:
  - Allow clamscan to read proc_t
  - Allow mount_t to write to debufs_t dir
  - Dontaudit mount_t trying to write to security_t dir


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-20
changelog:
  - Allow cron to look at user_cron_spool links
  - Lots of fixes for mozilla_plugin_t
  - Add sysv file system
  - Turn unconfined domains to permissive to find additional avcs


author: Dan Walsh <dwalsh@redhat.com> 3.9.1-2
changelog:
  - Dominic Grift Cleanup
  - Miroslav Grepl policy for jabberd
  - Various fixes for mount/livecd and prelink


author: Dan Walsh <dwalsh@redhat.com> 3.9.2-1
changelog:
  - Merge upstream fix of mmap_zero
  - Allow mount to write files in debugfs_t
  - Allow corosync to communicate with clvmd via tmpfs
  - Allow certmaster to read usr_t files
  - Allow dbus system services to search cgroup_t
  - Define rlogind_t as a login pgm


author: Dan Walsh <dwalsh@redhat.com> 3.9.3-1
changelog:
  Allow iptables to read shorewall tmp files
  Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr
  intd
  label vlc as an execmem_exec_t 
  Lots of fixes for mozilla_plugin to run google vidio chat
  Allow telepath_msn to execute ldconfig and its own tmp files
  Fix labels on hugepages
  Allow mdadm to read files on /dev
  Remove permissive domains and change back to unconfined
  Allow freshclam to execute shell and bin_t
  Allow devicekit_power to transition to dhcpc
  Add boolean to allow icecast to connect to any port


author: Dan Walsh <dwalsh@redhat.com> 3.9.3-2
changelog:
  - Handle /var/db/sudo
  - Allow pulseaudio to read alsa config
  - Allow init to send initrc_t dbus messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.4-2
changelog:
  - Allow all domains that can use cgroups to search tmpfs_t directory
  - Allow init to send audit messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.4-3
changelog:
  - Add the ability to send audit messages to confined admin policies
  - Remove permissive domain from cmirrord and dontaudit sys_tty_config
  - Split out unconfined_domain() calls from other unconfined_ calls so we can d
  - virt needs to be able to read processes to clearance for MLS


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-4
changelog:
  - Cleanup policy via dgrift
  - Allow dovecot_deliver to append to inherited log files
  - Lots of fixes for consolehelper


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-5
changelog:
  - Pull in cleanups from dgrift
  - Allow mozilla_plugin_t to execute mozilla_home_t
  - Allow rpc.quota to do quotamod


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-6
changelog:
  - Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home
  - Allow clamd to send signals to itself
  - Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.
  - Allow haze to connect to yahoo chat and messenger port tcp:5050.
  Bz #637339
  - Allow guest to run ps command on its processes by allowing it to read /proc
  - Allow firewallgui to sys_rawio which seems to be required to setup masqerading
  - Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.
  - Add label for /var/log/slim.log


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-7
changelog:
  - Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
  - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
  - Allow confined users to read xdm_etc_t files
  - Allow xdm_t to transition to xauth_t for lxdm program


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-9
changelog:
  - Turn off default transition to mozilla_plugin and telepathy domains from unconfined user 
  - Turn off iptables from unconfined user 
  - Allow sudo to send signals to any domains the user could have transitioned to.
  - Passwd in single user mode needs to talk to console_device_t
  - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
  - locate tried to read a symbolic link, will dontaudit
  - New labels for telepathy-sunshine content in homedir
  - Google is storing other binaries under /opt/google/talkplugin
  - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
  - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
  - modemmanger and bluetooth send dbus messages to devicekit_power
  - Samba needs to getquota on filesystems labeld samba_share_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-10
changelog:
  - Start adding support for use_fusefs_home_dirs
  - Add /var/lib/syslog directory file context
  - Add /etc/localtime as locale file context


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-11
changelog:
  - Fix fusefs handling
  - Do not allow sandbox to manage nsplugin_rw_t
  - Allow mozilla_plugin_t to connecto its parent
  - Allow init_t to connect to plymouthd running as kernel_t
  - Add mediawiki policy
  - dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.
  - Disable transition from dbus_session_domain to telepathy for F14
  - Allow boinc_project to use shm
  - Allow certmonger to search through directories that contain certs
  - Allow fail2ban the DAC Override so it can read log files owned by non root users


author: Dan Walsh <dwalsh@redhat.com> 3.9.6-2
changelog:
  - Lots of fixes for systemd
  - systemd now executes readahead and tmpwatch type scripts
  - Needs to manage random seed


author: Dan Walsh <dwalsh@redhat.com> 3.9.6-3
changelog:
  -Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access
  - dovecot-auth_t needs ipc_lock
  - gpm needs to use the user terminal
  - Allow system_mail_t to append ~/dead.letter
  - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf
  - Add pid file to vnstatd
  - Allow mount to communicate with gfs_controld
  - Dontaudit hal leaks in setfiles


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-4
changelog:
  - Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.
  - Allow devicekit_power to domtrans to mount
  - Allow dhcp to bind to udp ports > 1024 to do named stuff
  - Allow ssh_t to exec ssh_exec_t
  - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used
  - Fix clamav_append_log() intefaces
  - Fix 'psad_rw_fifo_file' interface


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-5
changelog:
  - Allow chome to create netlink_route_socket
  - Add additional MATHLAB file context
  - Define nsplugin as an application_domain
  - Dontaudit sending signals from sandboxed domains to other domains
  - systemd requires init to build /tmp /var/auth and /var/lock dirs
  - mount wants to read devicekit_power /proc/ entries
  - mpd wants to connect to soundd port
  - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit
  - Treat lib_t and textrel_shlib_t directories the same
  - Allow mount read access on virtual images


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-7
changelog:
  - Dontaudit sandbox sending sigkill to all user domains
  - Add policy for rssh_chroot_helper
  - Add missing flask definitions
  - Allow udev to relabelto removable_t
  - Fix label on /var/log/wicd.log
  - Transition to initrc_t from init when executing bin_t
  - Add audit_access permissions to file
  - Make removable_t a device_node 
  - Fix label on /lib/systemd/*


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-8
changelog:
  - Allow NetworkManager to read openvpn_etc_t
  - Dontaudit hplip to write of /usr dirs
  - Allow system_mail_t to create /root/dead.letter as mail_home_t
  - Add vdagent policy for spice agent daemon


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-9
changelog:
  - Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it
  - Udev needs to stream connect to init and kernel
  - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-10
changelog:
  - Fix sandbox to work on nfs homedirs
  - Allow cdrecord to setrlimit
  - Allow mozilla_plugin to read xauth
  - Change label on systemd-logger to syslogd_exec_t
  - Install dirsrv policy from dirsrv package


author: Dan Walsh <dwalsh@redhat.com> 3.9.8-3
changelog:
  - Fix up corecommands.fc to match upstream
  - Make sure /lib/systemd/* is labeled init_exec_t
  - mount wants to setattr on all mountpoints
  - dovecot auth wants to read dovecot etc files
  - nscd daemon looks at the exe file of the comunicating daemon
  - openvpn wants to read utmp file
  - postfix apps now set sys_nice and lower limits
  - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly
  - Also resolves nsswitch
  - Fix labels on /etc/hosts.*
  - Cleanup to make upsteam patch work
  - allow abrt to read etc_runtime_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-4
changelog:
  - Allow groupd transition to fenced domain when executes fence_node
  - Fixes for rchs policy
  - Allow mpd to be able to read samba/nfs files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-5
changelog:
  - Turn on mediawiki policy
  - kdump leaks kdump_etc_t to ifconfig, add dontaudit
  - uux needs to transition to uucpd_t
  - More init fixes relabels man,faillog
  - Remove maxima defs in libraries.fc
  - insmod needs to be able to create tmpfs_t files
  - ping needs setcap


author: Dan Walsh <dwalsh@redhat.com> 3.9.8-6
changelog:
  - Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t
  - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp
  - Fix xserver interface
  - Fix definition of /var/run/lxdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-7
changelog:
  - Allow nagios plugins to read usr files
  - Allow mysqld-safe to send system log messages
  - Fixes fpr ddclient policy
  - Fix sasl_admin interface
  - Allow apache to search zarafa config
  - Allow munin plugins to search /var/lib directory
  - Allow gpsd to read sysfs_t
  - Fix labels on /etc/mcelog/triggers to bin_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-1
changelog:
  - Update to upstream
  - Dontaudit leaked sockets from userdomains to user domains
  - Fixes for mcelog to handle scripts
  - Apply patch from Ruben Kerkhof
  - Allow syslog to search spool dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-2
changelog:
  - Turn on allow_postfix_local_write_mail_spool
  - Allow initrc_t to transition to shutdown_t
  - Allow logwatch and cron to mls_read_to_clearance for MLS boxes
  - Allow wm to send signull to all applications and receive them from users
  - lircd patch from field
  - Login programs have to read /etc/samba
  - New programs under /lib/systemd
  - Abrt needs to read config files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-4
changelog:
  - Allow ddclient to fix file mode bits of ddclient conf file
  - init leaks file descriptors to daemons
  - Add labels for /etc/lirc/ and
  - Allow amavis_t to exec shell
  - Add label for gssd_tmp_t for /var/tmp/nfs_0


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-3
changelog:
  - fixes to allow /var/run and /var/lock as tmpfs
  - Allow chrome sandbox to connect to web ports
  - Allow dovecot to listem on lmtp and sieve ports
  - Allov ddclient to search sysctl_net_t
  - Transition back to original domain if you execute the shell


author: Dan Walsh <dwalsh@redhat.com> 3.9.10-4
changelog:
  - Fix up handling of dnsmasq_t creating /var/run/libvirt/network
  - Turn on sshd_forward_ports boolean by default
  - Allow sysadmin to dbus chat with rpm
  - Add interface for rw_tpm_dev
  - Allow cron to execute bin
  - fsadm needs to write sysfs
  - Dontaudit consoletype reading /var/run/pm-utils
  - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin
  - certmonger needs to manage dirsrv data
  - /var/run/pm-utils should be labeled as devicekit_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-5
changelog:
  - Fix cron to run ranged when started by init
  - Fix devicekit to use log files
  - Dontaudit use of devicekit_var_run_t for fstools
  - Allow init to setattr on logfile directories
  - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-6
changelog:
  - Fix gnome_manage_data interface
  - Dontaudit sys_ptrace capability for iscsid
  - Fixes for nagios plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-7
changelog:
  - Fix the label for wicd log
  - plymouthd creates force-display-on-active-vt file
  - Allow avahi to request the kernel to load a module
  - Dontaudit hal leaks
  - Fix gnome_manage_data interface
  - Add new interface corenet_packet to define a type as being an packet_type.
  - Removed general access to packet_type from icecast and squid.
  - Allow mpd to read alsa config
  - Fix the label for wicd log
  - Add systemd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-10
changelog:
  - Fixes for clamscan and boinc policy
  - Add boinc_project_t setpgid
  - Allow alsa to create tmp files in /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-11
changelog:
  - Turn on systemd policy
  - mozilla_plugin needs to read certs in the homedir.
  - Dontaudit leaked file descriptors from devicekit
  - Fix ircssi to use auth_use_nsswitch
  - Change to use interface without param in corenet to disable unlabelednet packets
  - Allow init to relabel sockets and fifo files in /dev
  - certmonger needs dac* capabilities to manage cert files not owned by root
  - dovecot needs fsetid to change group membership on mail
  - plymouthd removes /var/log/boot.log
  - systemd is creating symlinks in /dev
  - Change label on /etc/httpd/alias to be all cert_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.10-12
changelog:
  - Allow domains that transition to ping or traceroute, kill them
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-13
changelog:
  - Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs
  - remove per sandbox domains devpts types
  - Allow dkim-milter sending signal to itself


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-1
changelog:
  - Update to upstream
  - Fixes for systemd policy
  - Fixes for passenger policy
  - Allow staff users to run mysqld in the staff_t domain, akonadi needs this
  - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py
  - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data
  - Dontaudit (xdm_t) gok attempting to list contents of /var/account
  - Telepathy domains need to read urand
  - Need interface to getattr all file classes in a mock library for setroubleshoot


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-2
changelog:
  - New labels for ghc http content
  - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev
  - pm-suspend now creates log file for append access so we remove devicekit_wri
  - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap
  - Fixes for greylist_milter policy


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-3
changelog:
  - Allow xdm and syslog to use /var/log/boot.log
  - Allow users to communicate with mozilla_plugin and kill it
  - Add labeling for ipv6 and dhcp


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-4
changelog:
  - Gnome apps list config_home_t
  - mpd creates lnk files in homedir
  - apache leaks write to mail apps on tmp files
  - /var/stockmaniac/templates_cache contains log files
  - Abrt list the connects of mount_tmp_t dirs
  - passwd agent reads files under /dev and reads utmp file
  - squid apache script connects to the squid port
  - fix name of plymouth log file
  - teamviewer is a wine app
  - allow dmesg to read system state
  - Stop labeling files under /var/lib/mock so restorecon will not go into this 
  - nsplugin needs to read network state for google talk


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-5
changelog:
  - Add initial policy for system-setup-keyboard which is now daemon
  - Label /var/lock/subsys/shorewall as shorewall_lock_t
  - Allow users to communicate with the gpg_agent_t
  - Dontaudit mozilla_plugin_t using the inherited terminal
  - Allow sambagui to read files in /usr
  - webalizer manages squid log files
  - Allow unconfined domains to bind ports to raw_ip_sockets
  - Allow abrt to manage rpm logs when running yum
  - Need labels for /var/run/bittlebee
  - Label .ssh under amanda
  - Remove unused genrequires for virt_domain_template
  - Allow virt_domain to use fd inherited from virtd_t
  - Allow iptables to read shorewall config


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-6
changelog:
  - Add firewalld policy
  - Allow vmware_host to read samba config
  - Kernel wants to read /proc Fix duplicate grub def in cobbler
  - Chrony sends mail, executes shell, uses fifo_file and reads /proc
  - devicekitdisk getattr all file systems
  - sambd daemon writes wtmp file
  - libvirt transitions to dmidecode


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-7
changelog:
  - gnomeclock executes a shell
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir
  - Fixes for namespace policy and other fixes related to polyinstantiation
  - Add namespace policy
  - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts
  - Fixes for init, psad policy which relate with confined users
  - Do not audit bootloader attempts to read devicekit pid files
  - Allow nagios service plugins to read /proc


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-8
changelog:
  - Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on
  - Add puppetmaster_use_db boolean
  - Fixes for zarafa policy
  - Fixes for gnomeclock poliy
  - Fix systemd-tmpfiles to use auth_use_nsswitch


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-3
changelog:
  - NetworkManager wants to read consolekit_var_run_t
  - Allow readahead to create /dev/.systemd/readahead
  - Remove permissive domains
  - Allow newrole to run namespace_init


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-4
changelog:
  - nslcd needs setsched and to read /usr/tmp
  - Invalid call in likewise policy ends up creating a bogus role
  - Cannon puts content into /var/lib/bjlib that cups needs to be able to write
  - Allow screen to create screen_home_t in /root
  - dirsrv sends syslog messages
  - pinentry reads stuff in .kde directory
  - Add labels for .kde directory in homedir
  - Treat irpinit, iprupdate, iprdump services with raid policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-5
changelog:
  - Allow nagios plugin to read /proc/meminfo
  - Fix for mozilla_plugin
  - Allow samba_net_t to create /etc/keytab
  - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t
  - nslcd can read user credentials
  - Allow nsplugin to delete mozilla_plugin_tmpfs_t
  - abrt tries to create dir in rpm_var_lib_t
  - virt relabels fifo_files
  - sshd needs to manage content in fusefs homedir
  - mock manages link files in cache dir


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-6
changelog:
  - Fix xserver_dontaudit_read_xdm_pid
  - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite
  - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. 
  	* These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t
  - Allow readahead to manage readahead pid dirs
  - Allow readahead to read all mcs levels
  - Allow mozilla_plugin_t to use nfs or samba homedirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-7
changelog:
  - ricci_modclusterd_t needs to bind to rpc ports 500-1023
  - Allow dbus to use setrlimit to increase resoueces
  - Mozilla_plugin is leaking to sandbox
  - Allow confined users  to connect to lircd over unix domain stream socket which allow to use remote control
  - Allow awstats to read squid logs
  - seunshare needs to manage tmp_t
  - apcupsd cgi scripts have a new directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-9
changelog:
  - syslog_t needs syslog capability
  - dirsrv needs to be able to create /var/lib/snmp
  - Fix labeling for dirsrv
  - Fix for dirsrv policy missing manage_dirs_pattern
  - corosync needs to delete clvm_tmpfs_t files
  - qdiskd needs to list hugetlbfs
  - Move setsched to sandbox_x_domain, so firefox can run without network access
  - Allow hddtemp to read removable devices
  - Adding syslog and read_policy permissions to policy
  	* syslog
  		Allow unconfined, sysadm_t, secadm_t, logadm_t
  	* read_policy
  		allow unconfined, sysadm_t, secadm_t, staff_t on Targeted
  		allow sysadm_t (optionally), secadm_t on MLS
  - mdadm application will write into /sys/.../uevent whenever arrays are
  assembled or disassembled.


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-10
changelog:
  - New labeling for postfmulti #675654
  - dontaudit xdm_t listing noxattr file systems
  - dovecot-auth needs to be able to connect to mysqld via the network as well as locally
  - shutdown is passed stdout to a xdm_log_t file
  - smartd creates a fixed disk device
  - dovecot_etc_t contains a lnk_file that domains need to read
  - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot


author: Dan Walsh <dwalsh@redhat.com> 3.9.14-1
changelog:
  - Update to ref policy
  - cgred needs chown capability
  - Add /dev/crash crash_dev_t
  - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.15-2
changelog:
  - Allow usbhid-ups to read hardware state information
  - systemd-tmpfiles has moved
  - Allo cgroup to sys_tty_config
  - For some reason prelink is attempting to read gconf settings
  - Add allow_daemons_use_tcp_wrapper boolean
  - Add label for ~/.cache/wocky to make telepathy work in enforcing mode
  - Add label for char devices /dev/dasd*
  - Fix for apache_role
  - Allow amavis to talk to nslcd
  - allow all sandbox to read selinux poilcy config files
  - Allow cluster domains to use the system bus and send each other dbus messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.15-5
changelog:
  - gpg_t needs to talk to gnome-keyring
  - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd
  - enforce MCS labeling on nodes
  - Allow arpwatch to read meminfo
  - Allow gnomeclock to send itself signals
  - init relabels /dev/.udev files on boot
  - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t
  - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t
  - dnsmasq can run as a dbus service, needs acquire service
  - mysql_admin should  be allowed to connect to mysql service
  - virt creates monitor sockets in the users home dir


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-1
changelog:
  - Update to upstream
  - Fixes for telepathy
  - Add port defition for ssdp port
  - add policy for /bin/systemd-notify from Dan
  - Mount command requires users read mount_var_run_t
  - colord needs to read konject_uevent_socket
  - User domains connect to the gkeyring socket
  - Add colord policy and allow user_t and staff_t to dbus chat with it
  - Add lvm_exec_t label for kpartx
  - Dontaudit reading the mail_spool_t link from sandbox -X
  - systemd is creating sockets in avahi_var_run and system_dbusd_var_run


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-2
changelog:
  - Add policykit fixes from Tim Waugh
  - dontaudit sandbox domains sandbox_file_t:dir mounton
  - Add new dontaudit rules for sysadm_dbusd_t
  - Change label for /var/run/faillock
  	* other fixes which relate with this change


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-3
changelog:
  - mozilla_plugin_tmp_t needs to be treated as user tmp files
  - More dontaudits of writes from readahead
  - Dontaudit readahead_t file_type:dir write, to cover up kernel bug
  - systemd_tmpfiles needs to relabel faillog directory as well as the file
  - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-4
changelog:
  - Initial policy for matahari
  - Add dev_read_watchdog
  - Allow clamd to connect clamd port
  - Add support for kcmdatetimehelper
  - Allow shutdown to setrlimit and sys_nice
  - Allow systemd_passwd to talk to /dev/log before udev or syslog is running
  - Purge chr_file and blk files on /tmp
  - Fixes for pads
  - Fixes for piranha-pulse
  - gpg_t needs to be able to encyprt anything owned by the user


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-5
changelog:
  - Fix multiple specification for boot.log
  - devicekit leaks file descriptors to setfiles_t
  - Change all all_nodes to generic_node and all_if to generic_if
  - Should not use deprecated interface
  - Switch from using all_nodes to generic_node and from all_if to generic_if
  - Add support for xfce4-notifyd
  - Fix file context to show several labels as SystemHigh
  - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs
  - Add etc_runtime_t label for /etc/securetty
  - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly
  - login.krb needs to be able to write user_tmp_t
  - dirsrv needs to bind to port 7390 for dogtag
  - Fix a bug in gpg policy
  - gpg sends audit messages
  - Allow qpid to manage matahari files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-7
changelog:
  - Allow $1_sudo_t and $1_su_t open access to user terminals
  - Allow initrc_t to use generic terminals
  - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs
  -systemd is going to be useing /run and /run/lock for early bootup files.
  - Fix some comments in rlogin.if
  - Add policy for KDE backlighthelper
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - setroubleshoot reads executables to see if they have TEXTREL
  - Add /var/spool/audit support for new version of audit
  - Remove kerberos_connect_524() interface calling
  - Combine kerberos_master_port_t and kerberos_port_t
  - systemd has setup /dev/kmsg as stderr for apps it executes
  - Need these access so that init can impersonate sockets on unix_dgram_socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-10
changelog:
  - Add file_contexts.subs to handle /run and /run/lock
  - Add other fixes relating to /run changes from F15 policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-12
changelog:
  - Add /var/run/lock /var/lock definition to file_contexts.subs
  - nslcd_t is looking for kerberos cc files
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Allow sysadm_t to set attributes on fixed disks
  - allow user domains to execute lsof and look at application sockets
  - prelink_cron job calls telinit -u if init is rewritten
  - Fixes to run qemu_t from staff_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-14
changelog:
  - Add Dan's patch to remove 64 bit variants
  - Allow colord to use unix_dgram_socket 
  - Allow apps that search pids to read /var/run if it is a lnk_file 
  - iscsid_t creates its own directory 
  - Allow init to list var_lock_t dir 
  - apm needs to verify user accounts auth_use_nsswitch
  - Add labeling for systemd unit files
  - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added
  - Add label for matahari-broker.pid file
  - We want to remove untrustedmcsprocess from ability to read /proc/pid
  - Fixes for matahari policy
  - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir
  - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-15
changelog:
  - xdm_t needs getsession for switch user 
  - Every app that used to exec init is now execing systemdctl 
  - Allow squid to manage krb5_host_rcache_t files 
  - Allow foghorn to connect to agentx port - Fixes for colord policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-16
changelog:
  - Fixes for zarafa policy
  - Add support for AEOLUS project
  - Change labeling of fping6
  - Allow plymountd to send signals to init
  - Allow initrc_t domain to manage abrt pid files
  - Virt_admin should be allowed to manage images and processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-17
changelog:
  - Add support for ABRT retrace server
  - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners
  - Allow telepath_msn_t to read /proc/PARENT/cmdline
  - ftpd needs kill capability
  - Allow telepath_msn_t to connect to sip port
  - keyring daemon does not work on nfs homedirs
  - Allow $1_sudo_t to read default SELinux context
  - Add label for tgtd sock file in /var/run/
  - Add apache_exec_rotatelogs interface
  - allow all zaraha domains to signal themselves, server writes to /tmp
  - Allow syslog to read the process state
  - Add label for /usr/lib/chromium-browser/chrome
  - Remove the telepathy transition from unconfined_t
  - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts
  - Allow initrc_t domain to manage abrt pid files
  - Add support for AEOLUS project
  - Virt_admin should be allowed to manage images and processes
  - Allow plymountd to send signals to init
  - Change labeling of fping6


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-18
changelog:
  - Allow init_t getcap and setcap
  - Allow namespace_init_t to use nsswitch
  - aisexec will execute corosync
  - colord tries to read files off noxattr file systems
  - Allow init_t getcap and setcap


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-19
changelog:
  - Forard port changes from F15 for telepathy
  - NetworkManager should be allowed to use /dev/rfkill
  - Fix dontaudit messages to say Domain to not audit
  - Allow telepathy domains to read/write gnome_cache files
  - Allow telepathy domains to call getpw
  - Fixes for colord and vnstatd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-20
changelog:
  - Fix label for /usr/share/munin/plugins/munin_* plugins
  - Add support for zarafa-indexer
  - Fix boolean description
  - Allow colord to getattr on /proc/scsi/scsi
  - Add label for /lib/upstart/init
  - Colord needs to list /mnt


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-21
changelog:
  - Dontaudit sys_module for ifconfig
  - Make telepathy and gkeyringd daemon working with confined users
  - colord wants to read files in users homedir
  - Remote login should be creating user_tmp_t not its own tmp files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-22
changelog:
  - Allow logrotate to execute systemctl
  - Allow nsplugin_t to getattr on gpmctl
  - Fix dev_getattr_all_chr_files() interface
  - Allow shorewall to use inherited terms
  - Allow userhelper to getattr all chr_file devices
  - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t
  - Fix labeling for ABRT Retrace Server


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-25
changelog:
  - Fixes for sanlock policy
  - Fixes for colord policy
  - Other fixes
  	* http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-26
changelog:
  - Add mailscanner policy from dgrift
  - Allow chrome to optionally be transitioned to
  - Zabbix needs these rules when starting the zabbix_server_mysql
  - Implement a type for freedesktop openicc standard (~/.local/share/icc)
  - Allow system_dbusd_t to read inherited icc_data_home_t files.
  - Allow colord_t to read icc_data_home_t content. #706975
  - Label stuff under /usr/lib/debug as if it was labeled under /


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-27
changelog:
  - Fixes for zabbix
  - init script needs to be able to manage sanlock_var_run_...
  - Allow sandlock and wdmd to create /var/run directories... 
  - mixclip.so has been compiled correctly
  - Fix passenger policy module name


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-29
changelog:
  - Add dspam policy
  - Add lldpad policy
  - dovecot auth wants to search statfs #713555
  - Allow systemd passwd apps to read init fifo_file
  - Allow prelink to use inherited terminals
  - Run cherokee in the httpd_t domain
  - Allow mcs constraints on node connections
  - Implement pyicqt policy
  - Fixes for zarafa policy
  - Allow cobblerd to send syslog messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-2
changelog:
  - Change usbmuxd_t to dontaudit attempts to read chr_file
  - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains
  - Allow pppd to search /var/lock dir
  - Add rhsmcertd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-3
changelog:
  - A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit
  - Allow colord to interact with the users through the tmpfs file system
  - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files
  - Add label for /var/log/mcelog
  - Allow asterisk to read /dev/random if it uses TLS
  - Allow colord to read ini files which are labeled as bin_t
  - Allow dirsrvadmin sys_resource and setrlimit to use ulimit
  - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first.  
  - Also lists /var and /var/spool directories
  - Add openl2tpd to l2tpd policy
  - qpidd is reading the sysfs file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-4
changelog:
  - Allow setsched for virsh
  - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories
  - iptables: the various /sbin/ip6?tables.* are now symlinks for
  /sbin/xtables-multi


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-5
changelog:
  - Initial systemd_logind policy
  - Add policy for systemd_logger and additional proivs for systemd_logind
  - More fixes for systemd policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-6
changelog:
  - Add initial policy for abrt_dump_oops_t
  - xtables-multi wants to getattr of the proc fs
  - Smoltclient is connecting to abrt
  - Dontaudit leaked file descriptors to postdrop
  - Allow abrt_dump_oops to look at kernel sysctls
  - Abrt_dump_oops_t reads kernel ring buffer
  - Allow mysqld to request the kernel to load modules
  - systemd-login needs fowner
  - Allow postfix_cleanup_t to searh maildrop


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-8
changelog:
  - Fix oracledb_port definition
  - Allow mount to mounton the selinux file system
  - Allow users to list /var directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-9
changelog:
  - Allow systemd_logind to send dbus messages with users
  - allow accountsd to read wtmp file
  - Allow dhcpd to get and set capabilities


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-10
changelog:
  - Allow rcsmcertd to perform DNS name resolution
  - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts
  - Allow tmux to run as screen
  - New policy for collectd
  - Allow gkeyring_t to interact with all user apps
  - Add rules to allow firstboot to run on machines with the unconfined.pp module removed


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-13
changelog:
  - Add abrt_domain attribute
  - Allow corosync to manage cluster lib files
  - Allow corosync to connect to the system DBUS


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-16
changelog:
  - fetchmail can use kerberos
  - ksmtuned reads in shell programs
  - gnome_systemctl_t reads the process state of ntp
  - dnsmasq_t asks the kernel to load multiple kernel modules
  - Add rules for domains executing systemctl
  - Bogus text within fc file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-18
changelog:
  - Turn on allow_domain_fd_use boolean on F16
  - Allow syslog to manage all log files
  - Add use_fusefs_home_dirs boolean for chrome
  - Make vdagent working with confined users
  - Add abrt_handle_event_t domain for ABRT event scripts
  - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change
  - Allow httpd_git_script_t to read passwd data
  - Allow openvpn to set its process priority when the nice parameter is used


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-19
changelog:
  - Add policy for sa-update being run out of cron jobs
  - Add create perms to postgresql_manage_db
  - ntpd using a gps has to be able to read/write generic tty_device_t
  - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev
  - fix spec file
  - Remove qemu_domtrans_unconfined() interface
  - Make passenger working together with puppet
  - Add init_dontaudit_rw_stream_socket interface
  - Fixes for wordpress


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-20
changelog:
  - Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-21
changelog:
  - Allow insmod_t to use fds leaked from devicekit
  - dontaudit getattr between insmod_t and init_t unix_stream_sockets
  - Change sysctl unit file interfaces to use systemctl
  - Add support for chronyd unit file
  - Allow mozilla_plugin to read gnome_usr_config
  - Add policy for new gpsd
  - Allow cups to create kerberos rhost cache files
  - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-22
changelog:
  - Allow Postfix to deliver to Dovecot LMTP socket
  - Ignore bogus sys_module for lldpad
  - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock
  - systemd_logind_t sets the attributes on usb devices
  - Allow hddtemp_t to read etc_t files
  - Add permissivedomains module
  - Move all permissive domains calls to permissivedomain.te
  - Allow pegasis to send kill signals to other UIDs


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-23
changelog:
  - Add glance policy
  - Allow mdadm setsched
  - /var/run/initramfs should not be relabeled with a restorecon run
  - memcache can be setup to override sys_resource
  - Allow httpd_t to read tetex data
  - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-24
changelog:
  - pki needs another port
  - Add more labels for cluster scripts
  - Fix label on nfs-utils scripts directories
  - Fixes for cluster
  - Allow gatherd to read /dev/rand and /dev/urand
  - abrt leaks fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-25
changelog:
  - Add exim_exec_t label for /usr/sbin/exim_tidydb
  - Call init_dontaudit_rw_stream_socket() interface in mta policy
  - sssd need to search /var/cache/krb5rcache directory
  - Allow corosync to relabel own tmp files
  - Allow zarafa domains to send system log messages
  - Allow ssh to do tunneling
  - Allow initrc scripts to sendto init_t unix_stream_socket
  - Changes to make sure dmsmasq and virt directories are labeled correctly
  - Changes needed to allow sysadm_t to manage systemd unit files
  - init is passing file descriptors to dbus and on to system daemons
  - Allow sulogin additional access Reported by dgrift and Jeremy Miller
  - Steve Grubb believes that wireshark does not need this access
  - Fix /var/run/initramfs to stop restorecon from looking at
  - pki needs another port
  - Add more labels for cluster scripts
  - Allow apps that manage cgroup_files to manage cgroup link files
  - Fix label on nfs-utils scripts directories
  - Allow gatherd to read /dev/rand and /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-26
changelog:
  - removing unconfined_notrans_t no longer necessary
  - Clean up handling of secure_mode_insmod and secure_mode_policyload
  - Remove unconfined_mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-27
changelog:
  -  Allow collectd to read hardware state information
  - Add loop_control_device_t
  - Allow mdadm to request kernel to load module
  - Allow domains that start other domains via systemctl to search unit dir
  - systemd_tmpfilses, needs to list any file systems mounted on /tmp
  - No one can explain why radius is listing the contents of /tmp, so we will dontaudit
  - If I can manage etc_runtime files, I should be able to read the links
  - Dontaudit hostname writing to mock library chr_files
  - Have gdm_t setup labeling correctly in users home dir
  - Label content unde /var/run/user/NAME/dconf as config_home_t
  - Allow sa-update to execute shell
  - Make ssh-keygen working with fips_enabled
  - Make mock work for staff_t user
  - Tighten security on mock_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-28
changelog:
  - Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files
  - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-29
changelog:
  - Allow sanlock to manage virt lib files
  - Add virt_use_sanlock booelan
  - ksmtuned is trying to resolve uids
  - Make sure .gvfs is labeled user_home_t in the users home directory
  - Sanlock sends kill signals and needs the kill capability
  - Allow mockbuild to work on nfs homedirs
  - Fix kerberos_manage_host_rcache() interface
  - Allow exim to read system state


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-33
changelog:
  - Change screen to use screen_domain attribute and allow screen_domains to read all process domain state
  - Add SELinux support for ssh pre-auth net process in F17
  - Add logging_syslogd_can_sendmail boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-34
changelog:
  - Make mta_role() active
  - Allow asterisk to connect to jabber client port
  - Allow procmail to read utmp
  - Add NIS support for systemd_logind_t
  - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t
  - Fix systemd_manage_unit_dirs() interface
  - Allow ssh_t to manage directories passed into it
  - init needs to be able to create and delete unit file directories
  - Fix typo in apache_exec_sys_script
  - Add ability for logrotate to transition to awstat domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-34.3
changelog:
  - Add support for Clustered Samba commands
  - Allow ricci_modrpm_t to send log msgs
  - move permissive virt_qmf_t from virt.te to permissivedomains.te
  - Allow ssh_t to use kernel keyrings
  - Add policy for libvirt-qmf and more fixes for linux containers
  - Initial Polipo
  - Sanlock needs to run ranged in order to kill svirt processes
  - Allow smbcontrol to stream connect to ctdbd


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-34.4
changelog:
  - Fixes caused by the labeling of /etc/passwd
  - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-36
changelog:
  - Allow logrotate setuid and setgid since logrotate is supposed to do it
  - Fixes for thumb policy by grift
  - Add new nfsd ports
  - Added fix to allow confined apps to execmod on chrome
  - Add labeling for additional vdsm directories
  - Allow Exim and Dovecot SASL
  - Add label for /var/run/nmbd
  - Add fixes to make virsh and xen working together
  - Colord executes ls
  - /var/spool/cron  is now labeled as user_cron_spool_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-37
changelog:
  - Allow nmbd to manage sock file in /var/run/nmbd
  - ricci_modservice send syslog msgs
  - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly
  - Allow systemd_logind_t to manage /run/USER/dconf/user


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-38
changelog:
  - Allow virsh to read xenstored pid file
  - Backport corenetwork fixes from upstream
  - Do not audit attempts by thumb to search config_home_t dirs (~/.config)
  - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t
  - allow thumb to read generic data home files (mime.type)


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-39
changelog:
  - Fixes for bootloader policy
  - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore
  - Allow nsplugin to read /usr/share/config
  - Allow sa-update to update rules
  - Add use_fusefs_home_dirs for chroot ssh option
  - Fixes for grub2
  - Update systemd_exec_systemctl() interface
  - Allow gpg to read the mail spool
  - More fixes for sa-update running out of cron job
  - Allow ipsec_mgmt_t to read hardware state information
  - Allow pptp_t to connect to unreserved_port_t
  - Dontaudit getattr on initctl in /dev from chfn
  - Dontaudit getattr on kernel_core from chfn
  - Add systemd_list_unit_dirs to systemd_exec_systemctl call
  - Fixes for collectd policy
  - CHange sysadm_t to create content as user_tmp_t under /tmp


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-39.1
changelog:
  - Remove allow_ptrace and replace it with deny_ptrace, which will remove all 
  ptrace from the system
  - Remove 2000 dontaudit rules between confined domains on transition
  and replace with single
  dontaudit domain domain:process { noatsecure siginh rlimitinh } ;


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-39.3
changelog:
  - Move dontaudit sys_ptrace line from permissive.te to domain.te
  - Remove policy for hal, it no longer exists


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-40
changelog:
  - Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK)
  - Make corosync to be able to relabelto cluster lib fies
  - Allow samba domains to search /var/run/nmbd
  - Allow dirsrv to use pam
  - Allow thumb to call getuid
  - chrome less likely to get mmap_zero bug so removing dontaudit
  - gimp help-browser has built in javascript
  - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t
  - Re-write glance policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-41
changelog:
  - Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain
  - Allow init process to setrlimit on itself
  - Take away transition rules for users executing ssh-keygen
  - Allow setroubleshoot_fixit_t to read /dev/urand
  - Allow sshd to relbale tunnel sockets
  - Allow fail2ban domtrans to shorewall in the same way as with iptables
  - Add support for lnk files in the /var/lib/sssd directory
  - Allow system mail to connect to courier-authdaemon over an unix stream socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-47
changelog:
  - Fixes for cloudform policies which need to connect to random ports
  - Make sure if an admin creates modules content it creates them with the correct label
  - Add port 8953 as a dns port used by unbound
  - Fix file name transition for alsa and confined users


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-48
changelog:
  - Allow named to connect to dirsrv by default
  - add ldapmap1_0 as a krb5_host_rcache_t file
  - Google chrome developers asked me to add bootstrap policy for nacl stuff
  - Allow rhev_agentd_t to getattr on mountpoints
  - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-49
changelog:
  - Change bootstrap name to nacl
  - Chrome still needs execmem
  - Missing role for chrome_sandbox_bootstrap
  - Add boolean to remove execmem and execstack from virtual machines
  - Dontaudit xdm_t doing an access_check on etc_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-50
changelog:
  - Allow policykit to talk to the systemd via dbus
  - Move chrome_sandbox_nacl_t to permissive domains
  - Additional rules for chrome_sandbox_nacl


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-51
changelog:
  -  Begin removing qemu_t domain, we really no longer need this domain.  
  - systemd_passwd needs dac_overide to communicate with users TTY's
  - Allow svirt_lxc domains to send kill signals within their container


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-53
changelog:
  - Make nvidia* to be labeled correctly
  - Fix abrt_manage_cache() interface
  - Make filetrans rules optional so base policy will build
  - Dontaudit chkpwd_t access to inherited TTYS
  - Make sure postfix content gets created with the correct label
  - Allow gnomeclock to read cgroup
  - Fixes for cloudform policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-55
changelog:
  - Add more MCS fixes to make sandbox working
  - Make faillog MLS trusted to make sudo_$1_t working
  - Allow sandbox_web_client_t to read passwd_file_t
  - Add .mailrc file context
  - Remove execheap from openoffice domain
  - Allow chrome_sandbox_nacl_t to read cpu_info
  - Allow virtd to relabel generic usb which is need if USB device
  - Fixes for virt.if interfaces to consider chr_file as image file type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-58
changelog:
  - Add ssh_dontaudit_search_home_dir
  - Changes to allow namespace_init_t to work
  - Add interface to allow exec of mongod, add port definition for mongod port, 27017
  - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t
  - Allow spamd and clamd to steam connect to each other
  - Add policy label for passwd.OLD
  - More fixes for postfix and postfix maildro
  - Add ftp support for mozilla plugins
  - Useradd now needs to manage policy since it calls libsemanage
  - Fix devicekit_manage_log_files() interface
  - Allow colord to execute ifconfig
  - Allow accountsd to read /sys
  - Allow mysqld-safe to execute shell
  - Allow openct to stream connect to pcscd
  - Add label for /var/run/nm-dns-dnsmasq\.conf
  - Allow networkmanager to chat with virtd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-59
changelog:
  - Allow mcelog_t to create dir and file in /var/run and label it correctly
  - Allow dbus to manage fusefs
  - Mount needs to read process state when mounting gluster file systems
  - Allow collectd-web to read collectd lib files
  - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr
  - Allow colord to get the attributes of tmpfs filesystem
  - Add sanlock_use_nfs and sanlock_use_samba booleans
  - Add bin_t label for /usr/lib/virtualbox/VBoxManage


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-63
changelog:
  - Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it
  - Allow all postfix domains to use the fifo_file
  - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t
  - Allow apmd_t to read grub.cfg
  - Let firewallgui read the selinux config
  - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp
  - Fix devicekit_manage_pid_files() interface
  - Allow squid to check the network state
  - Dontaudit colord getattr on file systems
  - Allow ping domains to read zabbix_tmp_t files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-64
changelog:
  - Use fs_use_xattr for squashf
  -  Fix procs_type interface
  - Dovecot has a new fifo_file /var/run/dovecot/stats-mail
  - Dovecot has a new fifo_file /var/run/stats-mail
  - Colord does not need to connect to network
  - Allow system_cronjob to dbus chat with NetworkManager
  - Puppet manages content, want to make sure it labels everything correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-65
changelog:
  - Fixes related to  /bin, /sbin
  - Allow abrt to getattr on blk files
  - Add type for rhev-agent log file
  - Fix labeling for /dev/dmfm
  - Dontaudit wicd leaking
  - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it
  - Label /etc/locale.conf correctly
  - Allow user_mail_t to read /dev/random
  - Allow postfix-smtpd to read MIMEDefang
  - Add label for /var/log/suphp.log
  - Allow swat_t to connect and read/write nmbd_t sock_file
  - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf
  - Allow systemd-tmpfiles to change user identity in object contexts
  - More fixes for rhev_agentd_t consolehelper policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-67
changelog:
  - Allow mozilla_plugin_t to manage mozilla_home_t
  - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
  - Add label for tumblerd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-68
changelog:
  - Allow abrt  to request the kernel to load a module
  - Make sure mozilla content is labeled correctly
  - Allow tgtd to read system state
  - More fixes for boinc
    * allow to resolve dns name
    * re-write boinc policy to use boinc_domain attribute
  - Allow munin services plugins to use NSCD services


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-69
changelog:
  - Add label for /var/lib/iscan/interpreter
  - Dont audit writes to leaked file descriptors or redirected output for nacl
  - NetworkManager needs to write to /sys/class/net/ib*/mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-70
changelog:
  - Add httpd_can_connect_ldap() interface
  - apcupsd_t needs to use seriel ports connected to usb devices
  - Kde puts procmail mail directory under ~/.local/share
  - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now
  - Add labeling for /sbin/iscsiuio


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-71
changelog:
  - default trans rules for Rawhide policy
  -  Make sure sound_devices controlC* are labeled correctly on creation
  - sssd now needs sys_admin
  - Allow snmp to read all proc_type
  - Allow to setup users homedir with quota.group


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-72
changelog:
  - New fix for seunshare, requires seunshare_domains to be able to mounton /
  - Allow systemctl running as logrotate_t to connect to private systemd socket
  - Allow tmpwatch to read meminfo
  - Allow rpc.svcgssd to read supported_krb5_enctype
  - Allow zarafa domains to read /dev/random and /dev/urandom
  - Allow snmpd to read dev_snmp6
  - Allow procmail to talk with cyrus
  - Add fixes for check_disk and check_nagios plugins


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-73
changelog:
  - Fixed destined form libvirt-sandbox
  - Allow apps that list sysfs to also read sympolicy links in this filesystem
  - Add ubac_constrained rules for chrome_sandbox
  - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra
  - Allow postgresql to be executed by the caller
  - Standardize interfaces of daemons 
  - Add new labeling for mm-handler
  - Allow all matahari domains to read network state and etc_runtime_t files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-74
changelog:
  - Add labeling for /var/run/systemd/journal/syslog
  - libvirt sends signals to ifconfig
  - Allow domains that read logind session files to list them


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-75
changelog:
  - Merge systemd patch
  - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online
  - Allow deltacloudd dac_override, setuid, setgid  caps
  - Allow aisexec to execute shell
  - Add use_nfs_home_dirs boolean for ssh-keygen


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-76
changelog:
  - Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there
  - bluetooth says they do not use /tmp and want to remove the type
  - Allow init to transition to colord
  - Mongod needs to read /proc/sys/vm/zone_reclaim_mode
  - Allow postfix_smtpd_t to connect to spamd
  - Add boolean to allow ftp to connect to all ports > 1023
  - Allow sendmain to write to inherited dovecot tmp files
  - setroubleshoot needs to be able to execute rpm to see what version of packages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-77
changelog:
  - Treat Bip with bitlbee policy
        * Bip is an IRC proxy
  - Add port definition for interwise port
  - Add support for ipa_memcached socket
  - systemd_jounald needs to getattr on all processes
  - mdadmin fixes
       * uses getpw
  - amavisd calls getpwnam()
  - denyhosts calls getpwall()


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-79
changelog:
  - Turn on deny_ptrace boolean for the Rawhide run, so we can test this out
  - Cups exchanges dbus messages with init
  - udisk2 needs to send syslog messages
  - certwatch needs to read /etc/passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-80
changelog:
  - Add zabbix_can_network boolean
  - Add httpd_can_connect_zabbix boolean
  - Prepare file context labeling for usrmove functions
  - Allow system cronjobs to read kernel network state
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow corosync to read and write to qpidd shared mem
  -  mozilla_plugin is trying to run pulseaudio 
  - Fixes for new sshd patch for running priv sep domains as the users context
  - Turn off dontaudit rules when turning on allow_ypbind
  - udev now reads /etc/modules.d directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-82
changelog:
  - Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory
  - lxdm startup scripts should be labeled bin_t, so confined users will work
  - mcstransd now creates a pid, needs back port to F16
  - qpidd should be allowed to connect to the amqp port
  - Label devices 010-029 as usb devices
  - ypserv packager says ypserv does not use tmp_t so removing selinux policy types
  - Remove all ptrace commands that I believe are caused by the kernel/ps avcs
  - Add initial Obex policy
  - Add logging_syslogd_use_tty boolean
  - Add polipo_connect_all_unreserved bolean
  - Allow zabbix to connect to ftp port
  - Allow systemd-logind to be able to switch VTs
  - Allow apache to communicate with memcached through a sock_file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-83
changelog:
  - Add new sysadm_secadm.pp module
  	* contains secadm definition for sysadm_t
  - Move user_mail_domain access out of the interface into the te file
  - Allow httpd_t to create httpd_var_lib_t directories as well as files
  - Allow snmpd to connect to the ricci_modcluster stream
  - Allow firewalld to read /etc/passwd
  - Add auth_use_nsswitch for colord
  - Allow smartd to read network state
  - smartdnotify needs to read /etc/group


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-85
changelog:
  - sshd fixes seem to be causing unconfined domains to dyntrans to themselves
  - fuse file system is now being mounted in /run/user
  - systemd_logind is sending signals to processes that are dbus messaging with it
  - Add support for winshadow port and allow iscsid to connect to this port
  - httpd should be allowed to bind to the http_port_t udp socket
  - zarafa_var_lib_t can be a lnk_file
  - A couple of new .xsession-errors files
  - Seems like user space and login programs need to read logind_sessions_files
  - Devicekit disk seems to be being launched by systemd
  - Cleanup handling of setfiles so most of rules in te file
  - Correct port number for dnssec
  - logcheck has the home dir set to its cache


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-86
changelog:
  - make consoletype_exec optional, so we can remove consoletype policy
  - remove unconfined_permisive.patch
  - Allow openvpn_t to inherit user home content and tmp content
  - Fix dnssec-trigger labeling
  - Turn on obex policy for staff_t
  - Pem files should not be secret
  - Add lots of rules to fix AVC's when playing with containers
  - Fix policy for dnssec
  - Label ask-passwd directories correctly for systemd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-87
changelog:
  - Allow firewalld to read urand
  - Alias java, execmem_mono to bin_t to allow third parties
  - Add label for kmod
  - /etc/redhat-lsb contains binaries
  - Add boolean to allow gitosis to send mail
  - Add filename transition also for "event20"
  - Allow systemd_tmpfiles_t to delete all file types
  - Allow collectd to ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-88
changelog:
  - Need to add sys_ptrace back in since reading any content in /proc can cause these accesses
  - Add additional systemd interfaces which are needed fro *_admin interfaces
  - Fix bind_admin() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-89
changelog:
  - Allow boinc project to getattr on fs
  - Allow init to execute initrc_state_t
  - rhev-agent package was rename to ovirt-guest-agent
  - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly
  - sytemd writes content to /run/initramfs and executes it on shutdown
  - kdump_t needs to read /etc/mtab, should be back ported to F16
  - udev needs to load kernel modules in early system boot


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-90
changelog:
  - Add proxy class and read access for gssd_proxy
  - Separate out the sharing public content booleans
  - Allow certmonger to execute a script and send signals to  apache and dirsrv to reload the certificate
  -  Add label transition for gstream-0.10 and 12
  - Add booleans to allow rsync to share nfs and cifs file sytems
  - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it
  - Fix filename transitions for cups files
  - Allow denyhosts to read "unix"
  - Add file name transition for locale.conf.new
  - Allow boinc projects to gconf config files
  - sssd needs to be able to increase the socket limit under certain loads
  - sge_execd needs to read /etc/passwd
  - Allow denyhost to check network state
  - NetworkManager needs to read sessions data
  - Allow denyhost to check network state
  - Allow xen to search virt images directories
  - Add label for /dev/megaraid_sas_ioctl_node
  - Add autogenerated man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-93
changelog:
  - Add user_fonts_t alias xfs_tmp_t
  - Since depmod now runs as insmod_t we need to write to kernel_object_t
  - Allow firewalld to dbus chat with networkmanager
  - Allow qpidd to connect to matahari ports
  - policykit needs to read /proc for uses not owned by it
  - Allow systemctl apps to connecto the init stream


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-94
changelog:
  - Allow ksysguardproces to send system log msgs
  - Allow  boinc setpgid and signull
  - Allow xdm_t to sys_ptrace to run pidof command
  - Allow smtpd_t to manage spool files/directories and symbolic links
  - Add labeling for jetty
  - Needed changes to get unbound/dnssec to work with openswan


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-95
changelog:
  - Allow sysadm_u to reach system_r by default #784011
  - Allow nagios plugins to use inherited user terminals
  - Razor labeling is not used no longer
  - Add systemd support for matahari
  - Add port_types to man page, move booleans to the top, fix some english
  - Add support for matahari-sysconfig-console
  - Clean up matahari.fc
  - Fix matahari_admin() interfac
  - Add labels for/etc/ssh/ssh_host_*.pub keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-96
changelog:
  - Add labeling for /var/spool/postfix/dev/log
  - NM reads sysctl.conf
  - Iscsi log file context specification fix
  -  Allow mozilla plugins to send dbus messages to user domains that transition to it
  - Allow mysql to read the passwd file
  - Allow mozilla_plugin_t to create mozilla home dirs in user homedir
  - Allow deltacloud to read kernel sysctl
  - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself
  - Allow postgresql_t to connectto itself
  - Add login_userdomain attribute for users which can log in using terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-97
changelog:
  - Fix man pages fro domains
  - Add man pages for SELinux users and roles
  - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon
  - Add policy for matahari-rpcd
  - nfsd executes mount command on restart
  - Matahari domains execute renice and setsched
  - Dontaudit leaked tty in mozilla_plugin_config
  - mailman is changing to a per instance naming
  - Add 7600 and 4447 as jboss_management ports
  - Add fixes for nagios event handlers
  - Label httpd.event as httpd_exec_t, it is an apache daemon


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-98
changelog:
  - Add policy for nove-cert
  - Add labeling for nova-openstack  systemd unit files
  - Add policy for keystoke


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-99
changelog:
  - Back port some of the access that was allowed in nsplugin_t
  - Add definitiona for couchdb ports
  - Allow nagios to use inherited users ttys
  - Add git support for mock
  - Allow inetd to use rdate port
  - Add own type for rdate port
  - Allow samba to act as a portmapper
  - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev
  - New fixes needed for samba4
  - Allow apps that use lib_t to read lib_t symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-100
changelog:
  - Add additional fixes for icmp nagios plugin
  - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin
  - Add certmonger_unconfined_exec_t
  - Make sure tap22 device is created with the correct label
  - Allow staff users to read systemd unit files
  - Merge in previously built policy
  - Arpwatch needs to be able to start netlink sockets in order to start
  - Allow cgred_t to sys_ptrace to look at other DAC Processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-102
changelog:
  - More fixes for boinc policy
  - Allow polipo domain to create its own cache dir and pid file
  - Add systemctl support to httpd domain
  - Add systemctl support to polipo, allow NetworkManager to manage the service
  - Add policy for jockey-backend
  - Add support for motion daemon which is now covered by zoneminder policy
  - Allow colord to read/write motion tmpfs
  - Allow vnstat to search through var_lib_t directories
  - Stop transitioning to quota_t, from init an sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-103
changelog:
  - Add a new type for /etc/firewalld and allow firewalld to write to this directory
  - Add definition for ~/Maildir, and allow mail deliver domains to write there
  - Allow polipo to run from a cron job
  - Allow rtkit to schedule wine processes
  - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label
  - Allow users domains to send signals to consolehelper domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-105
changelog:
  - Allow chronyd to read unix
  - Allow hpfax to read /etc/passwd
  - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them
  - Allow rpcd to read quota_db_t
  - Update to man pages to match latest policy
  - Fix bug in jockey interface for sepolgen-ifgen
  - Add initial svirt_prot_exec_t policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-106
changelog:
  - Allow auditctl getcap
  - Allow vdagent to use libsystemd-login
  - Allow abrt-dump-oops to search /etc/abrt
  - Got these avc's while trying to print a boarding pass from firefox
  - Devicekit is now putting the media directory under /run/media
  - Allow thumbnailers to create content in ~/.thumbails directory
  - Add support for proL2TPd by Dominick Grift
  - Allow all domains to call getcap
  - wdmd seems to get a random chown capability check that it does not need
  - Allow vhostmd to read kernel sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-107
changelog:
  - Add numad policy and numad man page
  - Add fixes for interface bugs discovered by SEWatch
  - Add /tmp support for squid
  - Add fix for #799102
       * change default labeling for /var/run/slapd.* sockets
  - Make thumb_t as userdom_home_reader
  - label /var/lib/sss/mc same as pubconf, so getpw domains can read it
  - Allow smbspool running as cups_t to stream connect to nmbd
  - accounts needs to be able to execute passwd on behalf of users
  - Allow systemd_tmpfiles_t to delete boot flags
  - Allow dnssec_trigger to connect to apache ports
  - Allow gnome keyring to create sock_files in ~/.cache
  - google_authenticator is using .google_authenticator
  - sandbox running from within firefox is exposing more leaks
  - Dontaudit thumb to read/write /dev/card0
  - Dontaudit getattr on init_exec_t for gnomeclock_t
  - Allow certmonger to do a transition to certmonger_unconfined_t
  - Allow dhcpc setsched which is caused by nmcli
  - Add rpm_exec_t for /usr/sbin/bcfg2
  - system cronjobs are sending dbus messages to systemd_logind
  - Thumnailers read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-108
changelog:
  - Add new policy and man page for bcfg2
  - cgconfig needs to use getpw calls
  - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt
  - gnome-keyring wants to create a directory in cache_home_t
  - sanlock calls getpw


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-109
changelog:
  - Ensure lastlog is labeled correctly
  - Allow accountsd to read /proc data about gdm
  - Add fixes for tuned
  - Add bcfg2 fixes which were discovered during RHEL6 testing
  - More fixes for gnome-keyring socket being moved
  - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown
  - Fix description for files_dontaudit_read_security_files() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-110
changelog:
  - /var/run/postmaster.* labeling is no longer needed
  - Alllow drbdadmin to read /dev/urandom
  - l2tpd_t seems to use ptmx
  - group+ and passwd+ should be labeled as /etc/passwd
  - Zarafa-indexer is a socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-111
changelog:
  - Rename rdate port to time port, and allow gnomeclock to connect to it
  - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda
  - /etc/auto.* should be labeled bin_t
  - Add httpd_use_fusefs boolean
  - Add fixes for heartbeat
  - Allow sshd_t to signal processes that it transitions to
  - Add condor policy
  - Allow svirt to create monitors in ~/.libvirt
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Lot of fixes for cfengine


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-112
changelog:
  - upowered needs to setsched on the kernel
  - Allow mpd_t to manage log files
  - Allow xdm_t to create /var/run/systemd/multi-session-x
  - Add rules for missedfont.log to be used by thumb.fc
  - Additional access required for virt_qmf_t
  - Allow dhclient to dbus chat with the firewalld
  - Add label for lvmetad
  - Allow systemd_logind_t to remove userdomain sock_files
  - Allow cups to execute usr_t files
  - Fix labeling on nvidia shared libraries
  - wdmd_t needs access to sssd and /etc/passwd
  - Add boolean to allow ftp servers to run in passive mode
  - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with
  - Fix using httpd_use_fusefs
  - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-113
changelog:
  - Allow svirt_t to create content in the users homedir under ~/.libvirt
  - Fix label on /var/lib/heartbeat
  - Allow systemd_logind_t to send kill signals to all processes started by a user
  - Fuse now supports Xattr Support


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-114
changelog:
  - Add support for clamd+systemd
  - Allow fresclam to execute systemctl to handle clamd
  - Change labeling for /usr/sbin/rpc.ypasswd.env
  	- Allow yppaswd_t to execute yppaswd_exec_t
  	- Allow yppaswd_t to read /etc/passwd
  - Gnomekeyring socket has been moved to /run/user/USER/
  - Allow samba-net to connect to ldap port
  - Allow signal for vhostmd
  - allow mozilla_plugin_t to read user_home_t socket
  - New access required for secure Linux Containers
  - zfs now supports xattrs
  - Allow quantum to execute sudo and list sysfs
  - Allow init to dbus chat with the firewalld
  - Allow zebra to read /etc/passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-115
changelog:
  - Allow condor domains to connect to ephemeral ports
  - More fixes for condor policy
  - Allow keystone to stream connect to mysqld
  - Allow mozilla_plugin_t to read generic USB device to support GPS devices
  - Allow thum to file name transition gstreamer home content
  - Allow thum to read all non security files
  - Allow glance_api_t to connect to ephemeral ports
  - Allow nagios plugins to read /dev/urandom
  - Allow syslogd to search postfix spool to support postfix chroot env
  - Fix labeling for /var/spool/postfix/dev
  - Allow wdmd chown
  - Label .esd_auth as pulseaudio_home_t
  - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-116
changelog:
  - More access required for virt_qmf_t
  - Additional assess required for systemd-logind to support multi-seat
  - Allow mozilla_plugin to setrlimit
  - Revert changes to fuse file system to stop deadlock


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-117
changelog:
  - Add policy for abrt-watch-log
  - Add definitions for jboss_messaging ports
  - Allow systemd_tmpfiles to manage printer devices
  - Allow oddjob to use nsswitch
  - Fix labeling of log files for postgresql
  - Allow mozilla_plugin_t to execmem and execstack by default
  - Allow firewalld to execute shell
  - Fix /etc/wicd content files to get created with the correct label
  - Allow mcelog to exec shell
  - Add ~/.orc as a gstreamer_home_t
  - /var/spool/postfix/lib64 should be labeled lib_t
  - mpreaper should be able to list all file system labeled directories
  - Add support for apache to use openstack
  - Add labeling for /etc/zipl.conf and zipl binary
  - Turn on allow_execstack and turn off telepathy transition for final release


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-118
changelog:
  - Add unconfined_execmem_exec_t as an alias to bin_t
  - Allow fenced to read snmp var lib files, also allow it to read usr_t
  - ontaudit access checks on all executables from mozilla_plugin
  - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode
  - Allow systemd_tmpfiles_t to getattr all pipes and sockets
  - Allow glance-registry to send system log messages
  - semanage needs to manage mock lib files/dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-119
changelog:
  - Allow logrotate to getattr on systemd unit files
  - Add support for tor systemd unit file
  - Allow apmd to create /var/run/pm-utils with the correct label
  - Allow l2tpd to send sigkill to pppd
  - Allow pppd to stream connect to l2tpd
  - Add label for scripts in /etc/gdm/
  - Allow systemd_logind_t to ignore mcs constraints on sigkill
  - Fix files_filetrans_system_conf_named_files() interface
  - Add labels for /usr/share/wordpress/wp-includes/*.php
  - Allow cobbler to get SELinux mode and booleans


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-120
changelog:
  - Add clamscan_can_scan_system boolean
  - Allow mysqld to read kernel network state
  - Allow sshd to read/write condor lib files
  - Allow sshd to read/write condor-startd tcp socket
  - Fix description on httpd_graceful_shutdown
  - Allow glance_registry to communicate with mysql
  - dbus_system_domain is using systemd to lauch applications
  - add interfaces to allow domains to send kill signals to user mail agents
  - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t
  - Lots of new access required for secure containers
  - Corosync needs sys_admin capability
  - ALlow colord to create shm
  - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific
  - Add boolean to control whether or not mozilla plugins can create random content in the users homedir
  -  Add new interface to allow domains to list msyql_db directories, needed for libra
  - shutdown has to be allowed to delete etc_runtime_t
  - Fail2ban needs to read /etc/passwd
  -  Allow ldconfig to create /var/cache/ldconfig
  - Allow tgtd to read hardware state information
  - Allow collectd to create packet socket
  - Allow chronyd to send signal to itself
  - Allow collectd to read /dev/random
  - Allow collectd to send signal to itself
  - firewalld needs to execute restorecon
  - Allow restorecon and other login domains to execute restorecon


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-121
changelog:
  - Add labeling for /usr/share/jetty/bin/jetty.sh
  - Add jetty policy which contains file type definitios
  - Allow jockey to use its own fifo_file and make this the default for all domains
  - Allow mozilla_plugins to use spice (vnc_port/couchdb)
  - asterisk wants to read the network state
  - Blueman now uses /var/lib/blueman- Add label for nodejs_debug
  - Allow mozilla_plugin_t to create ~/.pki directory and content


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-122
changelog:
  - Allow jetty running as httpd_t to read hugetlbfs files
  - Allow sys_nice and setsched for rhsmcertd
  - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports
  - Allow setfiles to append to xdm_tmp_t
  - Add labeling for /export as a usr_t directory
  - Add labels for .grl files created by gstreamer


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-123
changelog:
  - Fix zarafa labeling
  - Allow guest_t to fix labeling
  - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - add lxc_contexts
  - Allow accountsd to read /proc
  - Allow restorecond to getattr on all file sytems
  - tmpwatch now calls getpw
  - Allow apache daemon to transition to pwauth domain
  - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t
  - The obex socket seems to be a stream socket
  - dd label for /var/run/nologin


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-125
changelog:
  - Fix pulseaudio port definition
  - Add labeling for condor_starter
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Allow prelink_cron_system_t to getpw calls
  - Allow sudo domains to manage kerberos rcache files
  - Allow user_mail_domains to work with courie
  - Port definitions necessary for running jboss apps within openshift
  -  Add support for openstack-nova-metadata-api
  - Add support for nova-console*
  - Add support for openstack-nova-xvpvncproxy
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd
  - Fix auth_role() interface
  - Allow numad to read sysfs
  - Allow matahari-rpcd to execute shell
  - Add label for ~/.spicec
  - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it
  - Devicekit_disk wants to read the logind sessions file when writing a cd
  - Add fixes for condor to make condor jobs working correctly
  - Change label of /var/log/rpmpkgs to cron_log_t
  - Access requires to allow systemd-tmpfiles --create to work.
  - Fix obex to be a user application started by the session bus.
  - Add additional filename trans rules for kerberos
  - Fix /var/run/heartbeat labeling
  - Allow apps that are managing rcache to file trans correctly
  - Allow openvpn to authenticate against ldap server
  - Containers need to listen to network starting and stopping events


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-126
changelog:
  - Dontaudit lpr_t to read/write leaked mozilla tmp files
  - Add file name transition for .grl-podcasts directory
  - Allow corosync to read user tmp files
  - Allow fenced to create snmp lib dirs/files
  - More fixes for sge policy
  - Allow mozilla_plugin_t to execute any application
  - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain
  - Allow mongod to read system state information
  -  Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t
  - Allow polipo to manage polipo_cache dirs
  - Add jabbar_client port to mozilla_plugin_t
  - Cleanup procmail policy
  - system bus will pass around open file descriptors on files that do not have labels on them
  - Allow l2tpd_t to read system state
  - Allow tuned to run ls /dev
  - Allow sudo domains to read usr_t files
  - Add label to machine-id 
  - Fix corecmd_read_bin_symlinks cut and paste error


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-127
changelog:
  - Add policy for subversion daemon
  - Allow boinc to read passwd
  - Allow pads to read kernel network state
  - Fix man2html interface for sepolgen-ifgen
  - Remove extra /usr/lib/systemd/system/smb
  - Remove all /lib/systemd and replace with /usr/lib/systemd
  - Add policy for man2html
  - Fix the label of kerberos_home_t to krb5_home_t
  - Allow mozilla plugins to use Citrix
  - Allow tuned to read /proc/sys/kernel/nmi_watchdog
  - Allow tune /sys options via systemd's tmpfiles.d "w" type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-128
changelog:
  - Fix description of authlogin_nsswitch_use_ldap
  - Fix transition rule for rhsmcertd_t needed for RHEL7
  - Allow useradd to list nfs state data
  - Allow openvpn to manage its log file and directory
  - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly
  - Allow thumb to use nvidia devices
  -  Allow local_login to create user_tmp_t files for kerberos
  - Pulseaudio needs to read systemd_login /var/run content
  - virt should only transition named system_conf_t config files
  - Allow  munin to execute its plugins
  - Allow nagios system plugin to read /etc/passwd
  - Allow plugin to connect to soundd port
  - Fix httpd_passwd to be able to ask passwords
  - Radius servers can use ldap for backing store
  - Seems to need to mount on /var/lib for xguest polyinstatiation to work.
  - Allow systemd_logind to list the contents of gnome keyring
  - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL
  - Add policy for isns-utils


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-1
changelog:
  - Mass merge with upstream
    * new policy topology to include contrib policy modules
    * we have now two base policy patches


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-3
changelog:
  - PolicyKit path has changed
  - Allow httpd connect to dirsrv socket
  - Allow tuned to write generic kernel sysctls
  - Dontaudit logwatch to gettr on /dev/dm-2
  - Allow policykit-auth to manage kerberos files
  - Make condor_startd and rgmanager as initrc domain
  - Allow virsh to read /etc/passwd
  - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs
  - xdm now needs to execute xsession_exec_t
  - Need labels for /var/lib/gdm
  - Fix files_filetrans_named_content() interface
  - Add new attribute - initrc_domain
  - Allow systemd_logind_t to signal, signull, sigkill all processes
  - Add filetrans rules for etc_runtime files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-4
changelog:
  - Add support for ecryptfs
    * ecryptfs does not support xattr
    * we need labeling for HOMEDIR
  - Add policy for (u)mount.ecryptfs*
  - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache
  - Allow dovecot to manage Maildir content, fix transitions to Maildir
  - Allow postfix_local to transition to dovecot_deliver
  - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code
  - Cleanup interface definitions
  - Allow apmd to change with the logind daemon
  - Changes required for sanlock in rhel6
  - Label /run/user/apache as httpd_tmp_t
  - Allow thumb to use lib_t as execmod if boolean turned on
  - Allow squid to create the squid directory in /var with the correct labe
  - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com)
  - Allow virtd to exec xend_exec_t without transition
  - Allow virtd_lxc_t to unmount all file systems


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-5
changelog:
  - apcupsd needs to read /etc/passwd
  - Sanlock allso sends sigkill
  - Allow glance_registry to connect to the mysqld port
  - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl
  - Allow firefox plugins/flash to connect to port 1234
  - Allow mozilla plugins to delete user_tmp_t files
  - Add transition name rule for printers.conf.O
  - Allow virt_lxc_t to read urand
  - Allow systemd_loigind to list gstreamer_home_dirs
  - Fix labeling for /usr/bin
  - Fixes for cloudform services
    * support FIPS
  - Allow polipo to work as web caching
  - Allow chfn to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-6
changelog:
  - Add tomcat policy
  - Remove pyzor/razor policy
  - rhsmcertd reads the rpm database
  - Dontaudit  thumb to setattr on xdm_tmp dir
  - Allow wicd to execute ldconfig in the networkmanager_t domain
  - Add /var/run/cherokee\.pid labeling
  - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too
  - Allow postfix-master to r/w pipes other postfix domains
  - Allow snort to create netlink_socket
  - Add kdumpctl policy
  - Allow firstboot to create tmp_t files/directories
  - /usr/bin/paster should not be labeled as piranha_exec_t
  - remove initrc_domain from tomcat
  - Allow ddclient to read /etc/passwd
  - Allow useradd to delete all file types stored in the users homedir
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those
  - Transition xauth files within firstboot_tmp_t
  - Fix labeling of /run/media to match /media
  - Label all lxdm.log as xserver_log_t
  - Add port definition for mxi port
  - Allow local_login_t to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-7
changelog:
  - add ptrace_child access to process
  - remove files_read_etc_files() calling from all policies which have auth_use_nsswith()
  - Allow boinc domains to manage boinc_lib_t lnk_files
  - Add support for boinc-client.service unit file
  - Add support for boinc.log
  - Allow mozilla_plugin execmod on mozilla home files if allow_ex
  - Allow dovecot_deliver_t to read dovecot_var_run_t
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Move thin policy out from cloudform.pp and add a new thin poli
  - pacemaker needs to communicate with corosync streams
  - abrt is now started on demand by dbus
  - Allow certmonger to talk directly to Dogtag servers
  - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c
  - Allow mozila_plugin to execute gstreamer home files
  - Allow useradd to delete all file types stored in the users hom
  - rhsmcertd reads the rpm database
  - Add support for lightdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-8
changelog:
  - initrc is calling exportfs which is not confined so it attempts to read nfsd_files
  - Fixes for passenger running within openshift.
  - Add labeling for all tomcat6 dirs
  - Add support for tomcat6
  - Allow cobblerd to read /etc/passwd
  - Allow jockey to read sysfs and and execute binaries with bin_t
  - Allow thum to use user terminals
  - Allow cgclear to read cgconfig config files
  - Fix bcf2g.fc
  - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains
  - Allow dbomatic to execute ruby
  - abrt_watch_log should be abrt_domain
  - Allow mozilla_plugin to connect to gatekeeper port


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-9
changelog:
  - Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t
  - Add init_access_check() interface
  - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t
  - Allow tcpdump to create a netlink_socket
  - Label newusers like useradd
  - Change xdm log files to be labeled xdm_log_t
  - Allow sshd_t with privsep to work in MLS
  - Allow freshclam to update databases thru HTTP proxy
  - Allow s-m-config to access check on systemd
  - Allow abrt to read public files by default
  - Fix amavis_create_pid_files() interface
  - Add labeling and filename transition for dbomatic.log
  - Allow system_dbusd_t to stream connect to bluetooth, and use its socket
  - Allow amavisd to execute fsav
  - Allow tuned to use sys_admin and sys_nice capabilities
  - Add php-fpm policy from Bryan
  - Add labeling for aeolus-configserver-thinwrapper
  - Allow thin domains to execute shell
  - Fix gnome_role_gkeyringd() interface description
  - Lot of interface fixes
  - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files
  - Allow OpenMPI job to use kerberos
  - Make deltacloudd_t as nsswitch_domain
  - Allow xend_t to run lsscsi
  - Allow qemu-dm running as xend_t to create tun_socket
  - Add labeling for /opt/brother/Printers(.*/)?inf
  - Allow jockey-backend to read pyconfig-64.h labeled as usr_t
  - Fix clamscan_can_scan_system boolean
  - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-10
changelog:
  - Add realmd and stapserver policies
  - Allow useradd to manage stap-server lib files
  - Tighten up capabilities for confined users
  - Label /etc/security/opasswd as shadow_t
  - Add label for /dev/ecryptfs
  - Allow condor_startd_t to start sshd with the ranged
  - Allow lpstat.cups to read fips_enabled file
  - Allow pyzor running as spamc_t to create /root/.pyzor directory
  - Add labelinf for amavisd-snmp init script
  - Add support for amavisd-snmp
  - Allow fprintd sigkill self
  - Allow xend (w/o libvirt) to start virtual machines
  - Allow aiccu to read /etc/passwd
  - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes
  - Add condor_startd_ranged_domtrans_to() interface
  - Add ssd_conf_t for /etc/sssd
  - accountsd needs to fchown some files/directories
  - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content
  - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit
  - Allow xend_t to read the /etc/passwd file


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-12
changelog:
  - Add interface to dontaudit getattr access on sysctls
  - Allow sshd to execute /bin/login
  - Looks like xdm is recreating the xdm directory in ~/.cache/ on login
  - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald
  -  Fix semanage to work with unconfined domain disabled on F18
  - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls
  - Virt seems to be using lock files
  - Dovecot seems to be searching directories of every mountpoint
  - Allow jockey to read random/urandom, execute shell and install third-party drivers
  - Add aditional params to allow cachedfiles to manage its content
  - gpg agent needs to read /dev/random
  - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write
  - Add a bunch of dontaudit rules to quiet svirt_lxc domains
  - Additional perms needed to run svirt_lxc domains
  - Allow cgclear to read cgconfig
  - Allow sys_ptrace capability for snmp
  - Allow freshclam to read /proc
  - Allow procmail to manage /home/user/Maildir content
  - Allow NM to execute wpa_cli
  - Allow amavis to read clamd system state
  - Regenerate man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-13
changelog:
  - Add systemd_logind_inhibit_var_run_t attribute
  - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type
  - Add interface for mysqld to dontaudit signull to all processes
  - Label new /var/run/journal directory correctly
  - Allow users to inhibit suspend via systemd
  - Add new type for the /var/run/inhibit directory
  - Add interface to send signull to systemd_login so avahi can send them
  - Allow systemd_passwd to send syslog messages
  - Remove corenet_all_recvfrom_unlabeled() calling fro policy files
  - Allow       editparams.cgi running as httpd_bugzilla_script_t to read /etc/group
  - Allow smbd to read cluster config
  - Add additional labeling for passenger
  - Allow dbus to inhibit suspend via systemd
  - Allow avahi to send signull to systemd_login


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-1
changelog:
  - Fix saslauthd when it tries to read /etc/shadow
  - Label gnome-boxes as a virt homedir
  - Need to allow svirt_t ability to getattr on nfs_t file systems
  - Update sanlock policy to solve all AVC's
  - Change confined users can optionally manage virt content
  - Handle new directories under ~/.cache
  - Add block suspend to appropriate domains
  - More rules required for containers
  - Allow login programs to read /run/ data created by systemd_logind
  - Allow staff users to run svirt_t processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-2
changelog:
  - Add new type selinux_login_config_t for /etc/selinux/<type>/logins/
  - Additional fixes for seutil_manage_module_store()
  - dbus_system_domain() should be used with optional_policy
  - Fix svirt to be allowed to use fusefs file system
  - Allow login programs to read /run/ data created by systemd_login
  - sssd wants to write /etc/selinux/<policy>/logins/ for SELinux PAM module
  - Fix svirt to be allowed to use fusefs file system
  - Allow piranha domain to use nsswitch
  - Sanlock needs to send Kill Signals to non root processes
  - Pulseaudio wants to execute /run/user/PID/.orc


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-4
changelog:
  - Fix ecryptfs interfaces
  - Bootloader seems to be trolling around /dev/shm and /dev
  - init wants to create /etc/systemd/system-update.target.wants
  - Fix systemd_filetrans call to move it out of tunable
  - Fix up policy to work with systemd userspace manager
  - Add secure_firmware capability and remove bogus epolwakeup
  - Call seutil_*_login_config interfaces where should be needed
  - Allow rhsmcertd to send signal to itself
  - Allow thin domains to send signal to itself
  - Allow Chrome_ChildIO to read dosfs_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-5
changelog:
  - Put placeholder back in place for proper numbering of capabilities
  - Systemd also configures init scripts


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-6
changelog:
  - Fix Boolean settings
  - Add new libjavascriptcoregtk as textrel_shlib_t
  - Allow xdm_t to create xdm_home_t directories
  - Additional access required for systemd
  - Dontaudit mozilla_plugin attempts to ipc_lock
  - Allow tmpreaper to delete unlabeled files
  - Eliminate screen_tmp_t and allow it to manage user_tmp_t
  - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors
  - Allow web plugins to connect to the asterisk ports
  - Condor will recreate the lock directory if it does not exist
  - Oddjob mkhomedir needs to connectto user processes
  - Make oddjob_mkhomedir_t a userdom home manager


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-7
changelog:
  - Fix bogus regex found by eparis
  - Fix manage run interface since lvm needs more access
  - syslogd is searching cgroups directory
  - Fixes to allow virt-sandbox-service to manage lxc var run content


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-8
changelog:
  - Fix labeling of content in /run created by virsh_t
  - Allow condor domains to read kernel sysctls
  - Allow condor_master to connect to amqp
  - Allow thumb drives to create shared memory and semaphores
  - Allow abrt to read mozilla_plugin config files
  - Add labels for lightsquid
  - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow
  - dovecot_auth_t uses ldap for user auth
  - Allow domains that can read dhcp_etc_t to read lnk_files
  - Add more then one watchdog device
  - Allow useradd_t to manage etc_t files so it can rename it and edit them
  - Fix invalid class dir should be fifo_file
  - Move /run/blkid to fsadm and make sure labeling is correct


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-9
changelog:
  - Allow postfix, sssd, rpcd to block_suspend
  - udev seems to need secure_firmware capability
  - Allow virtd to send dbus messages to firewalld so it can configure the firewall


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-10
changelog:
  - Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working
  - Allow dlm_controld to execute dlm_stonith labeled as bin_t
  - Allow GFS2 working on F17
  - Abrt needs to execute dmesg
  - Allow jockey to list the contents of modeprobe.d
  - Add policy for lightsquid as squid_cron_t
  - Mailscanner is creating files and directories in /tmp
  - dmesg is now reading /dev/kmsg
  - Allow xserver to communicate with secure_firmware
  - Allow fsadm tools (fsck) to read /run/mount contnet
  - Allow sysadm types to read /dev/kmsg
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-11
changelog:
  - Allow svirt domains to manage the network since this is containerized
  - Allow svirt_lxc_net_t to send audit messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-12
changelog:
  - Add file name transitions for ttyACM0
  - spice-vdagent(d)'s are going to log over to syslog
  - Add sensord policy
  - Add more fixes for passenger policy related to puppet
  - Allow wdmd to create wdmd_tmpfs_t
  - Fix labeling for /var/run/cachefilesd\.pid
  - Add thumb_tmpfs_t files type


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-14
changelog:
  - Allow realmd to read resolv.conf
  - Add pegasus_cache_t type
  - Label /usr/sbin/fence_virtd as virsh_exec_t
  - Add policy for pkcsslotd
  - Add support for cpglockd
  - Allow polkit-agent-helper to read system-auth-ac
  - telepathy-idle wants to read gschemas.compiled
  - Allow plymouthd to getattr on fs_t
  - Add slpd policy
  - Allow ksysguardproces to read/write config_usr_t


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-15
changelog:
  - Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs
  - Allow domains that can read etc_t to read etc_runtime_t 
  - Allow all domains to use inherited tmpfiles


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-16
changelog:
  - nmbd wants to create /var/nmbd
  -  Stop transitioning out of anaconda and firstboot, just causes AVC messages
  - Allow clamscan to read /etc files
  - Allow bcfg2 to bind cyphesis port
  - heartbeat should be run as rgmanager_t instead of corosync_t
  - Add labeling for /etc/openldap/certs
  - Add labeling for /opt/sartest directory
  - Make crontab_t as userdom home reader
  - Allow tmpreaper to list admin_home dir
  - Add defition for imap_0 replay cache file
  - Add support for gitolite3
  - Allow virsh_t to send syslog messages
  - allow domains that can read samba content to be able to list the directories also
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd
  - Separate out sandbox from sandboxX policy so we can disable it by default
  - Run dmeventd as lvm_t
  - Mounting on any directory requires setattr and write permissions
  - Fix use_nfs_home_dirs() boolean
  - New labels for pam_krb5
  - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-17
changelog:
  - Merge openshift policy
  - Allow xauth to read /dev/urandom
  - systemd needs to relabel content in /run/systemd directories
  - Files unconfined should be able to perform all services on all files
  - Puppet tmp file can be leaked to all domains
  - Dontaudit rhsmcertd-worker to search /root/.local
  - Allow chown capability for zarafa domains
  -  Allow system cronjobs to runcon into openshift domains
  - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-18
changelog:
  - Allow postalias to read postfix config files
  - Allow man2html to read man pages
  - Allow rhev-agentd to search all mountpoints
  - Allow rhsmcertd to read /dev/random
  - Add tgtd_stream_connect() interface
  - Add cyrus_write_data() interface
  - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t
  - Add port definition for tcp/81 as http_port_t
  - Fix /dev/twa labeling
  - Allow systemd to read modules config


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-20
changelog:
  -  Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd
  - Remove pam_selinux.8 which conflicts with man page owned by the pam package
  - Allow glance-api to talk to mysql
  - ABRT wants to read Xorg.0.log if if it detects problem with Xorg
  - Fix gstreamer filename trans. interface


