# changelog

author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-27
changelog:
  - Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.
  - Allow samba-net to access /var/lib/ctdbd dirs/files.
  - Allow glusterd to send a signal to smbd.
  - Make ctdbd as home manager to access also FUSE.
  - Allow glusterd to use geo-replication gluster tool.
  - Allow glusterd to execute ssh-keygen.
  - Allow glusterd to interact with cluster services.
  - Allow glusterd to connect to the system DBUS for service (acquire_svc).
  - Label /dev/log correctly.
  Resolves:#1230932


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-28
changelog:
  - Allow glusterd to send generic signals to systemd_passwd_agent processes.
  - Allow glusterd to access init scripts/units without defined policy
  - Allow glusterd to run init scripts.
  - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-29
changelog:
  - We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.
  - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.
  - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. 
  - Label gluster python hooks also as bin_t.
  - Allow glusterd to interact with gluster tools running in a user domain
  - Add glusterd_manage_lib_files() interface.
  - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. 
  - Allow samba_t net_admin capability to make CIFS mount working.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-30
changelog:
  - Allow iptables to read ctdbd lib files.
  Resolves:#1224879
  - Add systemd_networkd_t to nsswitch domains.
  - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. 
  Resolves:#1130675
  - Allow NetworkManager write to sysfs. 
  - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
  - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
  - Allow NetworkManager write to sysfs. 
  - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. 
  - Dontaudit apache to manage snmpd_var_lib_t files/dirs. 
  - Add interface snmp_dontaudit_manage_snmp_var_lib_files().
  - Dontaudit mozilla_plugin_t cap. sys_ptrace. 
  - Rename xodbc-connect port to xodbc_connect
  - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. 
  - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. 
  - Dontaudit chrome to read passwd file. 
  - nrpe needs kill capability to make gluster moniterd nodes working. 
  Resolves:#1235587


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-31
changelog:
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins
  Resolves:#1233550
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
  - Add support for oddjob based helper in FreeIPA.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add nagios_domtrans_unconfined_plugins() interface.
  - Update mta_filetrans_named_content() interface to cover more db files. 
  Resolves:#1167468
  - Add back ftpd_use_passive_mode boolean with fixed description.
  - Allow pmcd daemon stream connect to mysqld.
  - Allow pcp domains to connect to own process using unix_stream_socket. 
  Resolves:#1213709
  - Allow  abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add support for oddjob based helper in FreeIPA.
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-32
changelog:
  - Allow gluster to connect to all ports. It is required by random services executed by gluster.
  - Add interfaces winbind_signull(), samba_unconfined_net_signull().
  - Dontaudit smbd_t block_suspend capability. This is kernel bug.
  - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
      checking if processes exists.
  - Add tmpreaper booleans to use nfs_t and samba_share_t.
  - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server
  - Allow connect ypserv to portmap_port_t
  - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
  - Add support for openstack-nova-* packages
  - Allow NetworkManager_t send signull to dnssec_trigger_t.
  - Allow glusterd to execute showmount in the showmount domain.
  - Label swift-container-reconciler binary as swift_t.
  - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.
  - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?"
  Resolves:#1213540
  - Merge all nova_* labels under one nova_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-33
changelog:
  - Allow networkmanager read rfcomm port.
  Resolves:#1212498
  - Remove non exists label.
  - Fix *_admin intefaces where body is not consistent with header.
  - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config
  - Remove non exits nfsd_ro_t label.
  - Make all interfaces related to openshift_cache_t as deprecated.
  - Add rpm_var_run_t label to rpm_admin header
  - Add jabberd_lock_t label to jabberd_admin header.
  - Add samba_unconfined_script_exec_t to samba_admin header.
  - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
  - Fix ctdb policy
  - Add samba_signull_winbind()
  - Add samba_signull_unconfined_net()
  - Allow ctdbd_t send signull to samba_unconfined_net_t.
  - Allow openshift_initrc_t to communicate with firewalld over dbus 
  Resolves:#1221326


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-34
changelog:
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow networkmanager to  communicate via dbus with systemd_hostanmed. 
  Resolves: #1234954
  - Allow stream connect logrotate to prosody.
  - Add prosody_stream_connect() interface.
  -  httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.
  - Allow prosody to create own tmp files/dirs.
  Resolves:#1212498


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-35
changelog:
  - gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te
  - Allow pcp_pmcd daemon to read postfix config files.
  - Allow pcp_pmcd daemon to search postfix spool dirs.
  Resolves: #1213740
  - Added Booleans: pcp_read_generic_logs.
  Resolves: #1213740
  - Allow drbd to read configuration options used when loading modules.
  Resolves: #1134883
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow glusterd to communicate with cluster domains over stream socket.
  - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-36
changelog:
  - Allow drbd to get attributes from filesystems.
  - Allow redis to read kernel parameters.
  Resolves: #1209518
  - Allow virt_qemu_ga_t domtrans to passwd_t
  - Allow audisp_remote_t to start power unit files domain to allow halt system.
  Resolves: #1186780
  - Allow audisp_remote_t to read/write user domain pty.
  Resolves: #1186780
  - Label /usr/sbin/chpasswd as passwd_exec_t.
  - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).
  Resolves:#1221121


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-37
changelog:
  - Allow httpd_suexec_t to read and write Apache stream sockets 
  Resolves: #1243569
  - Allow qpid to create lnk_files in qpid_var_lib_t
  Resolves: #1247279


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-38
changelog:
  - Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files).
    Resolves: #1243902
  - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
    Resolves: #1238079
  - Allow lsm_plugin_t to rw raw_fixed_disk.
    Resolves:#1238079
  - Allow rhsmcertd to send signull to unconfined_service.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-39
changelog:
  - Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
  Resolves:#1073314
  - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS.
  - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users.
  - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
  - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
  Resolves:#1183503
  - Add support for /etc/sanlock which is writable by sanlock daemon.
  Resolves:#1231377
  - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
  Resolves:#1243775 
  - Allow snapperd to pass data (one way only) via pipe negotiated over dbus
  Resolves:#1250550
  - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-40
changelog:
  - Add interface to read/write watchdog device
  - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
  Resolves:#1210237
  - Allow apcupsd_t to read /sys/devices 
  Resolves:#1189185
  - Allow logrotate to reload services.
  Resolves: #1242453
  - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
  Resolves: #1244260
  - Allow openhpid liboa_soap plugin to read generic certs.
  Resolves: #1244248
  - Allow openhpid liboa_soap plugin to read resolv.conf file.
  Resolves: #1244248
  - Label /usr/libexec/chrony-helper as chronyd_exec_t
  - Allow chronyd_t to read dhcpc state.
  - Allow chronyd to execute mkdir command.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-41
changelog:
  - Allow pcp_domain to manage pcp_var_lib_t lnk_files.
  Resolves: #1252341
  - Label /var/run/xtables.* as iptables_var_run_t
  Resolves: #1243403


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-42
changelog:
  - Fix label on /var/tmp/kiprop_0
  Resolves:#1220763
  - Allow lldpad_t to getattr tmpfs_t.
  Resolves: #1246220
  - Label /dev/shm/lldpad.* as lldapd_tmpfs_t
  Resolves: #1246220
  - Allow audisp client to read system state.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-43
changelog:
  - Allow openhpid_t to read system state.
  Resolves: #1244248
  - Added labels for files provided by rh-nginx18 collection
  Resolves: #1249945
  - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
  Resolves: #1252968
  - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
  Resolves: #1243431
  - Allow abrt_dump_oops_t to read proc_security_t files.
  - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains
  - Add interface abrt_dump_oops_domtrans()
  - Add mountpoint dontaudit access check in rhsmcertd policy.
  Resolves: #1243431
  - Allow samba_net_t to manage samba_var_t sock files.
  Resolves: #1252937
  - Allow chrome setcap to itself.
  Resolves: #1251996
  - Allow httpd daemon to manage httpd_var_lib_t lnk_files.
  Resolves: #1253706
  - Allow chronyd exec systemctl
  Resolves: #1243764
  - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.
  Resolves: #1243764
  - Added interface fs_dontaudit_write_configfs_dirs
  - Add label for kernel module dep files in /usr/lib/modules
  Resolves:#916635
  - Allow kernel_t domtrans to abrt_dump_oops_t
  - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.
  - Allow systemd-networkd to send logs to systemd-journald.
  Resolves: #1236616


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-44
changelog:
  - Allow exec pidof under hypervkvp domain.
  Resolves: #1254870
  - Allow hypervkvp daemon create connection to the system DBUS
  Resolves: #1254870


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-45
changelog:
  - Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.
  Resolves: #1252442


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-46
changelog:
  - Allow watchdog execute fenced python script. Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764
  - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-47
changelog:
  - Fix regexp in chronyd.fc file
  Resolves: #1243764
  - Allow passenger to getattr filesystem xattr
  Resolves: #1196555
  - Label mdadm.conf.anackbak as mdadm_conf_t file.
  Resolves: #1088904
  - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc."
  - Allow watchdog execute fenced python script.
  Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t.
  Resolves: #1230877


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-48
changelog:
  - Fix labeling for fence_scsi_check script
  Resolves: #1255020
  - Allow openhpid to read system state Allow openhpid to connect to tcp http port.
   Resolves: #1244248
  - Allow openhpid to read snmp var lib files.
   Resolves: #1243902
  - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
  - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
  Resolves: #1243403
  - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl 
  Resolves: #1255020


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-49
changelog:
  - Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. 
  Resolves:#1250456


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-50
changelog:
  - Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager 
  Resolves: #1192338
  - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
   Resolves: #1238079
  - Allow rhsmcertd_t send signull to unconfined_service_t domains. 
  Resolves: #1176078
  - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.
  - Allow openhpid_t daemon to manage snmp files and dirs. 
  Resolves: #1243902
  - Allow mdadm_t domain read/write to general ptys and unallocated ttys. 
  Resolves: #1073314
  - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
   Resolves: #1176078


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-51
changelog:
  - Label /etc/ipa/nssdb dir as cert_t
  Resolves:#1262718
  - Do not provide docker policy files which is shipped by docker-selinux.rpm
  Resolves:#1262812


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-52
changelog:
  - Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.
  Resolves: #1230300
  - Allow qpid daemon to connect on amqp tcp port.
  Resolves: #1261805


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-53
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. 
  Resolves: #1256459


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-54
changelog:
  - Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
  Resolves:#1261938
  - Allow abrt_t domain to write to kernel msg device.
  Resolves: #1257828
  - Allow rpcbind_t domain to change file owner and group
  Resolves: #1265266


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-55
changelog:
  - We need to require sandbox_web_type attribute in sandbox_x_domain_template(). 
  Resolves: #1261938
  - ipsec: The NM helper needs to read the SAs
  Resolves: #1259786
  - ipsec: Allow ipsec management to create ptys
  Resolves: #1259786


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-56
changelog:
  - Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.
  - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.
  Resolves:#1266928


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-57
changelog:
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs
  Resolves: #1254188
  - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
  Resolves:#1261938


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-58
changelog:
  - Allow search dirs in sysfs types in kernel_read_security_state.
  Resolves: #1254188
  - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.
  Resolves: #1254188


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-60
changelog:
  Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.
  Resolves:#1247880


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-61
changelog:
  - Allow smbcontrol domain to send sigchld to ctdbd domain.
  Resolves: #1293784
  - Allow openvswitch read/write hugetlb filesystem.
  Resolves: #1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-62
changelog:
  - Allow openvswitch to manage hugetlfs files and dirs.
  Resolves: rhbz#1278495
  - Add fs_manage_hugetlbfs_files() interface.
  Resolves: rhbz#1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-64
changelog:
  - Add new SELinux policy fo targetd daemon.
  Resolves: rhbz#1063714
  - Add new SELinux policy fo ipmievd daemon.
  Resolves: rhbz#1083031
  - Add new SELinux policy fo hsqldb daemon.
  Resolves: rhbz#1083171
  - Add new SELinux policy for blkmapd daemon.
  Resolves: rhbz#1072997
  - Allow p11-child to connect to apache ports.
  - Label /usr/sbin/lvmlockd binary file as lvm_exec_t.
  Resolves: rhbz#1278028
  - Add interface "lvm_manage_lock" to lvm policy.
  Resolves: rhbz#1063714


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-65
changelog:
  - Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902
  - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.
  Resolves:  rhbz#1242506
  - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
  Resolves: rhbz#1284972
  - Add support for systemd-hwdb daemon.
   Resolves: rhbz#1257940
  - Add interface fs_setattr_cifs_dirs().
   Resolves: rhbz#1284972


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-67
changelog:
  - Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
  Resolves: rhbz#1263770
  - Fix context of "/usr/share/nginx/html".
  Resolves: rhbz#1261857
  - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
  Resolves: rhbz#1270344
  - Allow pmlogger to create pmlogger.primary.socket link file.
   Resolves: rhbz#1270344
  - Label nagios scripts as httpd_sys_script_exec_t.
  Resolves: rhbz#1260306
  - Add dontaudit interface for kdumpctl_tmp_t
  Resolves: rhbz#1156442
  - Allow mdadm read files in EFI partition.
  Resolves: rhbz#1291801
  - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
  Resolves: rhbz#1293140
  - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs
  Resolves: rhbz#1293140
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  Resolves: rhbz#1265102
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp.
  Resolves: rhbz#1213409
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  Resolves: rhbz#1206525
  - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
  Resolves: rhbz#1275246
  - cockpit has grown content in /var/run directory
  Resolves: rhbz#1279429
  - Allow collectd setgid capability
  Resolves:#1310898
  - Remove declaration of empty booleans in virt policy.
  Resolves: rhbz#1103153
  - Fix typo in drbd policy
  - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.
  Resolves: rhbz#1134883
  - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
  Resolves: rhbz#1293788
  - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
  Resolves: rhbz#1254188
  - Allow abrt_t to read sysctl_net_t files.
  Resolves: rhbz#1254188
  - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
  - Allow abrt-hook-ccpp to getattr on all executables.
  - Allow setuid/setgid capabilities for abrt-hook-ccpp.
   Resolves: rhbz#1254188
  - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling.
   Resolves: rhbz#1254188
  - Allow abrt-hook-ccpp to change SELinux user identity for created objects.
   Resolves: rhbz#1254188
  - Dontaudit write access to inherited kdumpctl tmp files.
   Resolves: rbhz#1156442
  - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
   Resolves: rhbz#1291801
  - Label 8952 tcp port as nsd_control.
   Resolves: rhbz#1293140
  - Allow ipsec to use pam.
   Resolves: rhbz#1315700
  - Allow to log out to gdm after screen was resized in session via vdagent.
  Resolves: rhbz#1249020
  - Allow setrans daemon to read /proc/meminfo.
   Resolves: rhbz#1316804
  - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
  Resolves: rhbz#1298151
  - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
  Resolves: rhbz#1236579
  - Add new selinux policy for systemd-resolved dawmon.
  Resolves: rhbz#1236579
  - Add interface ssh_getattr_server_keys() interface.
  Resolves: rhbz#1306197
  - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
  Resolves: rhbz#1306197
  - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used.
  Resolves: rhbz#1309417
  - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.
  Resolves: rhbz#1293788


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-68
changelog:
  - Create new permissivedomains CIL module and make it active.
  Resolves: rhbz#1320451
  - Add support for new mock location - /usr/libexec/mock/mock.
  Resolves: rhbz#1271209
  - Allow bitlee to create bitlee_var_t dirs.
  Resolves: rhbz#1268651
  - Allow CIM provider to read sssd public files.
  Resolves: rhbz#1263339
  - Fix some broken interfaces in distro policy.
  Resolves: rhbz#1121171
  - Allow power button to shutdown the laptop.
  Resolves: rhbz#995898
  - Allow lsm plugins to create named fixed disks.
  Resolves: rhbz#1238066
  - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777
  - Allow hyperv domains to rw hyperv devices.
  Resolves: rhbz#1309361
  - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1297323
  - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.
  - Add support for /dev/mptctl device used to check RAID status.
   Resolves: rhbz#1258029
  - Create hyperv* devices and create rw interfaces for this devices.
  Resolves: rhbz#1309361
  - Add fixes for selinux userspace moving the policy store to /var/lib/selinux.
  - Remove optional else block for dhcp ping


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-69
changelog:
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1319442
  - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.
  Resolves: rhbz#1296640
  - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
  Resolves: rhbz#1097775
  - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.
  Resolves: rhbz#1262483
  - Allow nsd daemon to create log file in /var/log as nsd_log_t
  Resolves: rhbz#1293140
  - Sanlock policy update.   - New sub-domain for sanlk-reset daemon
  Resolves: rhbz#1212324
  - Label all run tgtd files, not just socket files
  Resolves: rhbz#1280280
  - Label all run tgtd files, not just socket files.
  Resolves: rhbz#1280280
  - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
  Resolves: rhbz#1321049
  - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.
  Resolves: rhbz#1318224
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow targetd to read/write to /dev/mapper/control device.
  Resolves: rhbz#1063714
  - Allow KDM to get status about power services. This change allow kdm to be able do shutdown.
  Resolves: rhbz#1316724
  - Allow systemd-resolved daemon creating netlink_route sockets.
  Resolves:rhbz#1236579
  - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used
  Resolves: rhbz#1065362
  - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t
  Resolves: rhbz#1321943
  - Label all nvidia binaries as xserver_exec_t
  Resolves: rhbz#1322283


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-70
changelog:
  - Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
   Resolves: rhbz#1312809
   Resolves: rhbz#1323947
  - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144
  - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.
  Resolves: rhbz#1324144
  - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.
  Resolves: rhbz#1324144
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.
  Resolves: rhbz#1309454


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-71
changelog:
  - Add interface glusterd_dontaudit_read_lib_dirs()
  Resolves: rhbz#1295680
  - Dontaudit Occasionally observing AVC's while running geo-rep automation
  Resolves: rhbz#1295680
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1331561
  - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content 
  Resolves: rhbz#1246522
  - Allow stunnel create log files. 
  Resolves: rhbz#1296851
  - Label tcp port 8181 as intermapper_port_t.
  Resolves: rhbz#1334783
  - Label tcp/udp port 2024 as xinuexpansion4_port_t
  Resolves: rhbz#1334783
  - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t
  Resolves: rhbz#1334783
  - Dontaudit ldconfig read gluster lib files.
  Resolves: rhbz#1295680
  - Add interface auth_use_nsswitch() to systemd_domain_template.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-72
changelog:
  - We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.
  Resolves: rhbz#1333952


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-73
changelog:
  - Allow logwatch to domtrans to postqueue
  Resolves: rhbz#1331542
  - Label /var/log/ganesha.log as gluster_log_t
  - Allow glusterd_t domain to create glusterd_log_t files.
  - Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow zabbix to connect to postgresql port
  Resolves: rhbz#1330479
  - Add userdom_destroy_unpriv_user_shared_mem() interface.
  Related: rhbz#1306403
  - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
  Resolves: rhbz#1306403


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-74
changelog:
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-75
changelog:
  - dnsmasq: allow NetworkManager to control dnsmasq via D-Bus
  Resolves: rhbz#1336722
  - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
  Resolves: rhbz#1333198
  - sftpd_* booleans are functionless these days.
  Resolves: rhbz#1335656
  - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737
  - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.
  Resolves: rhbz#1264390
  - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
  Resolves: rhbz#1337061
  - Revert "Allow all domains some process flags."
  Resolves: rhbz#1303644
  - Revert "Remove setrlimit to all domains."
  Resolves: rhbz#1303644
  - Label /usr/sbin/xrdp* files as bin_t
  Resolves: rhbz#1276777
  - Add mls support for some db classes
  Resolves: rhbz#1303651
  - Allow systemd_resolved_t to check if ipv6 is disabled.
  Resolves: rhbz#1236579
  - Allow systemd_resolved to read systemd_networkd run files.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-76
changelog:
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - New interfaces needed for systemd-machinectl
  Resolves: rhbz#1236580
  - New interfaces needed by systemd-machine
  Resolves: rhbz#1236580
  - Add interface allowing sending and receiving messages from virt over dbus.
  Resolves: rhbz#1236580
  - Backport docker policy from Fedora.
  Related: #1303123
  Resolves: #1341257
  - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.
  Resolves: rhbz#1236580
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added interfaces needed by new docker policy.
  Related: rhbz#1303123
  - Add support for systemd-machined daemon
  Resolves: rhbz#1236580
  - Allow rpm-ostree domain transition to install_t domain from init_t.
  Resolves: rhbz#1340542


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-77
changelog:
  - Allow tmpreaper_t to read/setattr all non_security_file_type dirs
  Resolves: rhbz#1115987
  - Allow firewalld to create firewalld_var_run_t directory.
  Resolves: rhbz#1304723
  - Add interface firewalld_read_pid_files()
  Resolves: rhbz#1304723
  - Label /usr/libexec/rpm-ostreed as rpm_exec_t.
  Resolves: rhbz#1340542
  - Allow sanlock service to read/write cephfs_t files.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - Add interface files_setattr_non_security_dirs()
  Resolves: rhbz#1115987
  - Add support for onloadfs
  - Allow iptables to read firewalld pid files.
  Resolves: rhbz#1304723
  - Add SELinux support for ceph filesystem.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  Resolves: rhbz#1236580


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-78
changelog:
  - Allow glusterd domain read krb5_keytab_t files.
  Resolves: rhbz#1343929
  - Fix typo in files_setattr_non_security_dirs.
  Resolves: rhbz#1115987


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-80
changelog:
  - Allow conman to kill conman_unconfined_script.
  Resolves: rhbz#1297323
  - Make conman_unconfined_script_t as init_system_domain.
  Resolves:rhbz#1297323
  - Allow init dbus chat with apmd.
  Resolves:rhbz#995898
  - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
  Resolves: rhbz#1233252
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Add mediawiki rules to proper scope
  Resolves: rhbz#1301186
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Allow mysqld_safe to inherit rlimit information from mysqld
  Resolves: rhbz#1323673
  - Allow collectd_t to stream connect to postgresql.
  Resolves: rhbz#1344056
  - Allow mediawiki-script to read /etc/passwd file.
  Resolves: rhbz#1301186
  - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
  Resolves: rhbz#1344505
  - Add labels for mediawiki123
  Resolves: rhbz#1293872
  - Fix label for all fence_scsi_check scripts
  - Allow ip netns to mounton root fs and unmount proc_t fs.
  Resolves: rhbz#1343776
  Resolves: rhbz#1286851
  - Allow sysadm_t to run newaliases command.
  Resolves: rhbz#1344828
  - Add interface sysnet_filetrans_named_net_conf()
  Resolves: rhbz#1344505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-81
changelog:
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Allow mongod log to syslog.
  Resolves: rhbz#1306995
  - Allow rhsmcertd connect to port tcp 9090
  Resolves: rhbz#1337319
  - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. 
  Resolves: rhbz#1262483
  Resolves: rhbz#1277506
  - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
  Resolves: rhbz#1301516
  - Add new boolean spamd_update_can_network.
  Resolves: rhbz#1305469
  - Allow rhsmcertd connect to tcp netport_port_t
  Resolves: rhbz#1329475
  - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
  Resolves: rhbz#1328234
  - Allow prosody to bind to fac_restore tcp port.
  Resolves: rhbz#1321787
  - Allow ninfod to read raw packets
  Resolves: rhbz#1317964
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1260835
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1271159
  - Allow tuned to use policykit. This change is required by cockpit.
  Resolves: rhbz#1346464
  - Allow conman_t to read dir with conman_unconfined_script_t binary files.
  Resolves: rhbz#1297323
  - Allow pegasus to read /proc/sysinfo.
  Resolves: rhbz#1265883
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255
  - Label tcp ports:16379, 26379 as redis_port_t
  Resolves: rhbz#1348471
  - Allow systemd to relabel /var and /var/lib directories during boot.
  - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
  - Add files_relabelto_var_lib_dirs() interface.
  - Label tcp port 2004 as mailbox_port_t.
  Resolves: rhbz#1332843
  - Label tcp and udp port 5582 as fac_restore_port_t
  Resolves: rhbz#1321787
  - Allow sysadm_t user to run postgresql-setup.
  Resolves: rhbz#1282543
  - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
  Resolves: rhbz#1297480
  - Update netlink socket classes.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-82
changelog:
  - Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
  Resolves:rhbz#1331315
  - Label named-pkcs11 binary as named_exec_t.
  Resolves: rhbz#1331315
  - Allow glusterd daemon to get systemd status
  Resolves: rhbz#1321785
  - Allow logrotate dbus-chat with system_logind daemon
  Resolves: rhbz#1283134
  - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
  Resolves: rhbz#1336211
  - Add interface cron_read_pid_files()
  Resolves: rhbz#1336211
  - Allow pcp_pmlogger to create unix dgram sockets
  Resolves: rhbz#1336211
  - Add hwloc-dump-hwdata SELinux policy
  Resolves: rhbz#1344054
  - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
  Resolves: rhbz#1121171
  - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
  Resolves: rhbz#1259764
  - Create label for openhpid log files. 
  esolves: rhbz#1259764
  - Label /var/lib/ganglia as httpd_var_lib_t
  Resolves: rhbz#1260536
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Include patch from distgit repo: policy-RHEL-7.1-flask.patch.
  Resolves: rhbz#1329560
  - Update refpolicy to handle hwloc
  Resolves: rhbz#1344054
  - Label /etc/dhcp/scripts dir as bin_t
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-83
changelog:
  - Allow krb5kdc_t to communicate with sssd
  Resolves: rhbz#1319933
  - Allow prosody to bind on prosody ports
  Resolves: rhbz#1304664
  - Add dac_override caps for fail2ban-client
  Resolves: rhbz#1316678
  - dontaudit read access for svirt_t on the file /var/db/nscd/group
  Resolves: rhbz#1301637
  - Allow inetd child process to communicate via dbus with systemd-logind
  Resolves: rhbz#1333726
  - Add label for brltty log file
  Resolves: rhbz#1328818
  - Allow dspam to read the passwd file
  Resolves: rhbz#1286020
  - Allow snort_t to communicate with sssd
  Resolves: rhbz#1284908
  - svirt_sandbox_domains need to be able to execmod for badly built libraries.
  Resolves: rhbz#1206339
  - Add policy for lttng-tools package.
  Resolves: rhbz#1256374
  - Make mirrormanager as application domain.
  Resolves: rhbz#1328234
  - Add support for the default lttng-sessiond port - tcp/5345.  This port is used by LTTng 2.x central tracing registry session daemon.
  - Add prosody ports
  Resolves: rhbz#1304664
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-84
changelog:
  - Fix typo in brltty SELinux module
  - Add new SELinux module sbd
  Resolves: rhbz#1322725
  - Allow pcp dmcache metrics collection
  Resolves: rhbz#1309883
  - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
  Resolves: rhbz#1350782
  - Allow openvpn to create sock files labeled as openvpn_var_run_t
  Resolves: rhbz#1328246
  - Allow hypervkvp daemon to getattr on  all filesystem types.
  Resolves: rhbz#1349356
  - Allow firewalld to create net_conf_t files
  Resolves: rhbz#1304723
  - Allow mock to use lvm
  Resolves: rhbz#1271209
  - Allow keepalived to create netlink generic sockets.
  Resolves: rhbz#1349809
  - Allow mirromanager creating log files in /tmp
  Resolves:rhbz#1328818
  - Rename few modules to make it consistent with source files
  Resolves: rhbz#1351445
  - Allow vmtools_t to transition to rpm_script domain
  Resolves: rhbz#1342119
  - Allow nsd daemon to manage nsd_conf_t dirs and files
  Resolves: rhbz#1349791
  - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
  Resolves: rhbz#1346900
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535
  - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
  Resolves: rhbz#1086240
  - Add interface lvm_getattr_exec_files()
  Resolves: rhbz#1271209
  - Fix typo Compliling vs. Compiling
  Resolves: rhbz#1351445


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-85
changelog:
  - Allow virtual machines to rw infiniband devices.
  Resolves: rhbz#1210263
  - Allow opensm daemon to rw infiniband_mgmt_device_t
  Resolves: rhbz#1210263
  - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.
  Resolves: rhbz#1350756
  - Make label for new infiniband_mgmt deivices
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-86
changelog:
  - Allow udev to manage systemd-hwdb files
  - Add interface systemd_hwdb_manage_config()
  Resolves: rhbz#1350756
  - Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-87
changelog:
  - Allow lttng tools to block suspending
  Resolves: rhbz#1256374
  - Allow creation of vpnaas in openstack
  Resolves: rhbz#1352710
  - virt: add strict policy for virtlogd daemon
  Resolves:rhbz#1311606
  - Update makefile to support snapperd_contexts file
  Resolves: rhbz#1352681


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-88
changelog:
  - Allow rhsmcertd to copy certs into /etc/docker/cert.d
  - Add interface docker_rw_config()
  Resolves: rhbz#1344500
  - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t
  Resolves: rhbz#1355632
  - Allow rhsmcertd to read network sysctls
  Resolves: rhbz#1329475
  - Label /var/log/graphite-web dir as httpd_log_t
  Resolves: rhbz#1310898
  - Allow mock to use generic ptys
  Resolves: rhbz#1271209
  - Allow adcli running as sssd_t to write krb5.keytab file.
  Resolves: rhbz#1356082
  - Allow openvswitch connect to openvswitch_port_t type.
  Resolves: rhbz#1335024
  - Add SELinux policy for opendnssec service.
  Resolves: rhbz#1350957
  - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd
  Resolves: rhbz#1350957
  - label /dev/ndctl0 device as nvram_device_t
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-89
changelog:
  - Allow firewalld to manage net_conf_t files.
  Resolves:rhbz#1304723
  - Allow logrotate read logs inside containers.
  Resolves: rhbz#1303514
  - Allow sssd to getattr on fs_t
  Resolves: rhbz#1356082
  - Allow opendnssec domain to manage bind chace files
  Resolves: rhbz#1350957
  - Fix typo in rhsmcertd  policy module
  Resolves: rhbz#1329475
  - Allow systemd to get status of systemd-logind daemon
  Resolves: rhbz#1356141
  - Label more ndctl devices not just ndctl0
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-90
changelog:
  - Allow ipa-dnskey read system state.
  Reasolves: rhbz#1350957
  - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
  Resolves: rhbz#1350957


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-92
changelog:
  - Dontaudit mock_build_t can list all ptys.
  Resolves: rhbz#1271209
  - Allow ftpd_t to mamange userhome data without any boolean.
  Resolves: rhbz#1097775
  - Add logrotate permissions for creating netlink selinux sockets.
  Resolves: rhbz#1283134
  - Allow lsmd_plugin_t to exec ldconfig.
  Resolves: rhbz#1238066
  - Allow vnstatd domain to read /sys/class/net/ files
  Resolves: rhbz#1358243
  - Remove duplicate allow rules in spamassassin SELinux module
  Resolves:rhbz#1358175
  - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
  Resolves:rhbz#1358175
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857
  - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
  Resolves: rhbz#1330464
  - Allow gnome-keyring also manage user_tmp_t sockets.
  Resolves: rhbz#1257057
  - corecmd: Remove fcontext for /etc/sysconfig/libvirtd
  Resolves:rhbz#1351382


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-93
changelog:
  - Dontaudit mock to write to generic certs.
  Resolves: rhbz#1271209
  - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
  Resolves: rhbz#1347514
  - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain"
  - Allow modemmanager to write to systemd inhibit pipes
  Resolves: rhbz#1365214
  - Label corosync-qnetd and corosync-qdevice as corosync_t domain
  Resolves: rhbz#1347514
  - Allow ipa_helper to read network state
  Resolves: rhbz#1361636
  - Label oddjob_reqiest as oddjob_exec_t
  Resolves: rhbz#1361636
  - Add interface oddjob_run()
  Resolves: rhbz#1361636
  - Allow modemmanager chat with systemd_logind via dbus
  Resolves: rhbz#1362273
  - Allow NetworkManager chat with puppetagent via dbus
  Resolves: rhbz#1363989
  - Allow NetworkManager chat with kdumpctl via dbus
  Resolves: rhbz#1363977
  - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
  Resolves: rhbz#1322725
  - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
  Resolves: rhbz#1349058
  - Allow rasdaemon to use tracefs filesystem.
  Resolves: rhbz#1364380
  - Fix typo bug in dirsrv policy
  - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
  Resolves: rhbz#1283134
  - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
  Resolves: rhbz#1362688
  - Allow dirsrv to read dirsrv_share_t content
  Resolves: rhbz#1363662
  - Allow virtlogd_t to append svirt_image_t files.
  Resolves: rhbz#1358140
  - Allow hypervkvp domain to read hugetlbfs dir/files.
  Resolves: rhbz#1349356
  - Allow mdadm daemon to read nvme_device_t blk files
  Resolves: rhbz#1362564
  - Allow selinuxusers and unconfineduser to run oddjob_request
  Resolves: rhbz#1361636
  - Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
  Resolves: rhbz#1362539
  - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*.
  Resolves: rhbz#1363769
  - Fix typo in device interfaces
  Resolves: rhbz#1349058
  - Add interfaces for managing ipmi devices
  Resolves: rhbz#1349058
  - Add interfaces to allow mounting/umounting tracefs filesystem
  Resolves: rhbz#1364380
  - Add interfaces to allow rw tracefs filesystem
  Resolves: rhbz#1364380
  - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
  Resolves: rhbz#1362564
  - Label /sys/kernel/debug/tracing filesystem
  Resolves: rhbz#1364380
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-94
changelog:
  - Allow ipmievd domain to create lock files in /var/lock/subsys/
  Resolves:rhbz#1349058
  - Update policy for ipmievd daemon.
  Resolves:rhbz#1349058
  - Dontaudit hyperkvp to getattr on non security files.
  Resolves: rhbz#1349356
  - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
  Resolves: rhbz#1347514
  - Fixed lsm SELinux module
  - Add sys_admin capability to sbd domain
  Resolves: rhbz#1322725
  - Allow vdagent to comunnicate with systemd-logind via dbus
  Resolves: rhbz#1366731
  - Allow lsmd_plugin_t domain to create fixed_disk device.
  Resolves: rhbz#1238066
  - Allow opendnssec domain to create and manage own tmp dirs/files
  Resolves: rhbz#1366649
  - Allow opendnssec domain to read system state
  Resolves: rhbz#1366649
  - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
  Resolves: rhbz#1366649
  - Allow rasdaemon to mount/unmount tracefs filesystem.
  Resolves: rhbz#1364380
  - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/
  Resolves: rhbz#1367520
  - Modify interface den_read_nvme() to allow also read nvme_device_t block files.
  Resolves: rhbz#1362564
  - Label /var/run/storaged as lvm_var_run_t.
  Resolves: rhbz#1264390
  - Allow unconfineduser to run ipa_helper_t.
  Resolves: rhbz#1361636


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-95
changelog:
  - Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
  Resolves:rhbz#1366915
  - Allow certmonger to manage all systemd unit files
  Resolves:rhbz#1366915
  - Grant certmonger "chown" capability
  Resolves:rhbz#1366915
  - Allow ipa_helper_t stream connect to dirsrv_t domain
  Resolves: rhbz#1368418
  - Update oracleasm SELinux module
  Resolves: rhbz#1331383
  - label /var/lib/kubelet as svirt_sandbox_file_t
  Resolves: rhbz#1369159
  - Add few interfaces to cloudform.if file
  Resolves: rhbz#1367834
  - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
  Resolves: rhbz#1347514
  - Allow krb5kdc_t to read krb4kdc_conf_t dirs.
  Resolves: rhbz#1368492
  - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
  Resolves: rhbz#1365653
  - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.
  Resolves: rhbz#1365653
  - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type
  Resolves: rhbz#1331383
  - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
  Resolves: rhbz#1367834
  - Allow iptables to creating netlink generic sockets.
  Resolves: rhbz#1364359


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-96
changelog:
  - Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Move label for /var/lib/docker/vfs/ to proper SELinux module
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - Allow systemd-machined to communicate to lxc container using dbus
  - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
  - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
  - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-97
changelog:
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  Resolves: rhbz#1331383
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  Resolves: rhbz#1206525
  - Allow mdadm_t to getattr all device nodes
  Resolves: rhbz#1365171
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  Resolves:rhbz#1052880
  - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy.
  Resolves: rhbz#1372705
  - Allow guest-set-user-passwd to set users password.
  Resolves: rhbz#1369693
  - Allow samdbox domains to use msg class
  Resolves: rhbz#1372677
  - Allow domains using kerberos to read also kerberos config dirs
  Resolves: rhbz#1368492
  - Allow svirt_sandbox_domains to r/w onload sockets
  Resolves: rhbz#1342930
  - Add interface fs_manage_oracleasm()
  Resolves: rhbz#1331383
  - Label /dev/kfd as hsa_device_t
  Resolves: rhbz#1373488
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
  Resolves: rhbz#1368097
  - Add interface to write to nsfs inodes
  Resolves: rhbz#1372705
  - Allow systemd services to use PrivateNetwork feature
  Resolves: rhbz#1372705
  - Add a type and genfscon for nsfs.
  Resolves: rhbz#1372705
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
  Resolves: rhbz#1290400


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-98
changelog:
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  Resolves: rhbz#1331383
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  Resolves: rhbz#1206525


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-99
changelog:
  - Allow iscsid create netlink iscsid sockets.
  Resolves: rhbz#1358266
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  Resolves: rhbz#1375462


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-100
changelog:
  - Allow ftp daemon to manage apache_user_content
  Resolves: rhbz#1097775
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  Resolves: rhbz#1331383
  - Allow oracleasm to rw inherited fixed disk device
  Resolves: rhbz#1331383
  - Allow collectd to connect on unix_stream_socket
  Resolves: rhbz#1377259


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-101
changelog:
  - Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
  Resolves: rhbz#1309883


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-103
changelog:
  - Allow sssd_selinux_manager_t to manage also dir class.
  Resolves: rhbz#1368097
  - Add interface seutil_manage_default_contexts_dirs()
  Resolves: rhbz#1368097


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-104
changelog:
  - Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros
  - Add selinux-policy-migrate-local-changes service
  Resolves: rhbz#1381588


author: Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-105
changelog:
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  Resolves: rhbz#1384488
  - Allow glusterd to get attributes on /sys/kernel/config directory.
  Resolves: rhbz#1384483


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-106
changelog:
  - Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
  Resolves: rhbz#1392010


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-108
changelog:
  - Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients
  Resolves: rhbz#1393505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-109
changelog:
  - Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
  Resolves: rhbz#1399250


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-112
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Allow systemd to stop glusterd_t domains.
  Resolves: rhbz#1400493


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-113
changelog:
  - Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes.
  Resolves: rhbz#1403254


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-115
changelog:
  - Allow glusterd_t to bind on med_tlp port.
  Resolves: rhbz#1404152
  - Update ctdbd_t policy to reflect all changes.
  Resolves: rhbz#1402451
  - Label tcp port 24009 as med_tlp_port_t
  Resolves: rhbz#1404152
  -  Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-116
changelog:
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1404152
  - Revert: Allow glusterd_t to bind on med_tlp port.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-117
changelog:
  - Allow systemd container to read/write usermodehelperstate
  Resolves: rhbz#1403254
  - Label udp ports in range 24007-24027 as gluster_port_t
  Resolves: rhbz#1404152


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-118
changelog:
  - Allow firewalld to getattr open search read modules_object_t:dir
  Resolves: rhbz#1418391
  - Fix label for nagios plugins in nagios file conxtext file
  Resolves: rhbz#1277718
  - Add sys_ptrace capability to pegasus domain
  Resolves: rhbz#1381238
  - Allow sssd_t domain setpgid
  Resolves:rhbz#1416780
  - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk.
  Resolves: rhbz#1350927
  - Allow kdumpgui domain to read nvme device
  Resolves: rhbz#1415084
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization.
  Resolves: rhbz#1146987
  - Add user namespace capability object classes.
  Resolves: rhbz#1368057
  - Add module_load permission to class system
  Resolves:rhbz#1368057
  - Add the validate_trans access vector to the security class 
  Resolves: rhbz#1368057
  - Add "binder" security class and access vectors
  Resolves: rhbz#1368057
  - Allow ifconfig_t domain read nsfs_t
  Resolves: rhbz#1349814
  - Allow ping_t domain to load kernel modules.
  Resolves: rhbz#1388363


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-119
changelog:
  - Add interface init_stream_connectto()
  Resolves:rhbz#1365947
  - Allow rhsmcertd domain signull kernel.
  Resolves: rhbz#1379781
  - Allow kdumpgui domain to read nvme device
  - Allow insmod_t to load kernel modules
  Resolves: rhbz#1421598
  - Add interface files_load_kernel_modules()
  Resolves: rhbz#1421598
  - Add SELinux support for systemd-initctl daemon
  Resolves:rhbz#1365947
  - Add SELinux support for systemd-bootchart
  Resolves: rhbz#1365953


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-120
changelog:
  - Allow initrc_t domain to run rhel-autorelabel script properly during boot process
  Resolves: rhbz#1379722
  - Allow systemd_initctl_t to create and connect unix_dgram sockets
  Resolves: rhbz#1365947
  - Allow ifconfig_t to mount/unmount nsfs_t filesystem
  Resolves: rhbz#1349814
  - Add interfaces allowing mount/unmount nsfs_t filesystem
  Resolves: rhbz#1349814


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-122
changelog:
  - Allow nfsd_t domain rw sysctl_rpc_t dirs
  Resolves: rhbz#1405304
  - Allow cgdcbxd_t to manage cgroup files.
  Resolves: rhbz#1358493
  - Allow cmirrord_t domain to create netlink_connector sockets
  Resolves: rhbz#1412670
  - Allow fcoemon to create netlink scsitransport sockets
  Resolves: rhbz#1362496
  - Allow quota_nld_t create netlink_generic sockets
  Resolves: rhbz#1358679
  - Allow cgred_t create netlink_connector sockets
  Resolves: rhbz#1376357
  - Add dhcpd_t domain fowner capability
  Resolves: rhbz#1358485
  - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
  Resolves: rhbz#1358478
  - Rename docker module to container module
  Resolves: rhbz#1386916
  - Allow setflies to mount tracefs
  Resolves: rhbz#1376357
  - Allow iptables to read nsfs files.
  Resolves: rhbz#1411316
  - Allow systemd_bootchart_t domain create dgram sockets.
  Resolves: rhbz#1365953
  - Rename docker interfaces to container
  Resolves: rhbz#1386916


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-123
changelog:
  - Allow nfsd_t domain to create sysctls_rpc_t files
  Resolves: rhbz#1405304
  - Allow openvswitch to create netlink generic sockets.
  Resolves: rhbz#1397974
  - Create kernel_create_rpc_sysctls() interface
  Resolves: rhbz#1405304


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-124
changelog:
  - Allow rhsmcertd_t dbus chat with system_cronjob_t
  Resolves: rhbz#1405341
  - Allow openvswitch exec hostname and readinitrc_t files
  Resolves: rhbz#1405479
  - Improve SELinux context for mysql_db_t objects.
  Resolves: rhbz#1391521
  - Allow postfix_postdrop to communicate with postfix_master via pipe.
  Resolves: rhbz#1379736
  - Add radius_use_jit boolean
  Resolves: rhbz#1426205
  - Label /var/lock/subsys/iptables as iptables_lock_t
  Resolves: rhbz#1405441
  - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t
  Resolves: rhbz#1332803
  - Allow can_load_kernmodule to load kernel modules.
  Resolves: rhbz#1423427
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-125
changelog:
  - Update ganesha policy
  Resolves: rhbz#1426554
  Resolves: rhbz#1383784
  - Allow chronyd to read adjtime
  Resolves: rhbz#1416015
  - Fixes for chrony version 2.2
  Resolves: rhbz#1416015
  - Add interface virt_rw_stream_sockets_svirt()
  Resolves: rhbz#1415841
  - Label /dev/ss0 as gpfs_device_t
  Resolves: rhbz#1383784
  - Allow staff to rw svirt unix stream sockets.
  Resolves: rhbz#1415841
  - Label /rhev/data-center/mnt as mnt_t
  Resolves: rhbz#1408275
  - Associate sysctl_rpc_t with proc filesystems
  Resolves: rhbz#1350927
  - Add new boolean: domain_can_write_kmsg
  Resolves: rhbz#1415715


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-128
changelog:
  - Add handling booleans via selinux-policy macros in custom policy spec files.
  Resolves: rhbz#1380854


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-130
changelog:
  - Allow gssproxy to get attributes on all filesystem object types.
  Resolves: rhbz#1430295
  - Allow ganesha to chat with unconfined domains via dbus
  Resolves: rhbz#1426554
  - add the policy required for nextcloud
  Resolves: rhbz#1425530
  - Add nmbd_t capability2 block_suspend
  Resolves: rhbz#1425357
  - Label /var/run/chrony as chronyd_var_run_t
  Resolves: rhbz#1416015
  - Add domain transition from sosreport_t to iptables_t
  Resolves: rhbz#1359789
  - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd
  Resolves: rhbz:#1332803


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-131
changelog:
  - Remove tomcat_t domain from unconfined domains
  Resolves: rhbz#1432083
  - Create new boolean: sanlock_enable_home_dirs()
  Resolves: rhbz#1432783
  - Allow mdadm_t domain to read/write nvme_device_t
  Resolves: rhbz#1431617
  - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
  Resolves: rhbz#1383621
  - Dontaudit domain to create any file in /proc. This is kernel bug.
  Resolves: rhbz#1412679
  - Add interface dev_rw_nvme
  Resolves: rhbz#1431617


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-132
changelog:
  - Add haproxy_t domain fowner capability
  Resolves: rhbz#1386233
  - Allow domain transition from ntpd_t to hwclock_t domains
  Resolves: rhbz#1375624
  - Allow cockpit_session_t setrlimit and sys_resource
  Resolves: rhbz#1402316
  - Dontaudit svirt_t read state of libvirtd domain
  Resolves: rhbz#1426106
  - Update httpd and gssproxy modules to reflects latest changes in freeipa
  Resolves: rhbz#1432115
  - Allow iptables read modules_conf_t
  Resolves: rhbz#1367520


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-133
changelog:
  - Allow drbd load modules
  Resolves: rhbz#1134883
  - Revert "Add sys_module capability for drbd
  Resolves: rhbz#1134883"
  - Allow stapserver list kernel modules
  Resolves: rhbz#1325976
  - Update targetd policy
  Resolves: rhbz#1373860
  - Add sys_admin capability to amanda
  Resolves: rhbz#1371561
  - Allow hypervvssd_t to read all dirs.
  Resolves: rhbz#1331309
  - Label /run/haproxy.sock socket as haproxy_var_run_t
  Resolves: rhbz#1386233
  - Allow oddjob_mkhomedir_t to mamange autofs_t dirs.
  Resolves: rhbz#1408819
  - Allow tomcat to connect on http_cache_port_t
  Resolves: rhbz#1432083
  - Allow geoclue to send msgs to syslog.
  Resolves: rhbz#1434286
  - Allow condor_master_t domain capability chown.
  Resolves: rhbz#1277506
  - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t.
  Resolves: rhbz#1167468
  - Allow nova domain search for httpd configuration.
  Resolves: rhbz#1190761
  - Add sys_module capability for drbd
  Resolves: rhbz#1134883
  - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files
  Resolves: rhbz#1286474
  - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus
  Resolves: rhbz#1278010


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-134
changelog:
  - Allow named_t domain bind on several udp ports
  Resolves: rhbz#1312972
  - Update nscd_use() interface
  Resolves: rhbz#1281716
  - Allow radius_t domain ptrace
  Resolves: rhbz#1426641
  - Update nagios to allos exec systemctl
  Resolves: rhbz#1247635
  - Update pcp SELinux module to reflect all pcp changes
  Resolves: rhbz#1271998
  - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t
  Resolves: rhbz#1325527
  - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-136
changelog:
  - geoclue wants to dbus chat with avahi
  Resolves: rhbz#1434286
  - Allow iptables get list of kernel modules
  Resolves: rhbz#1367520
  - Allow unconfined_domain_type to enable/disable transient unit
  Resolves: rhbz#1337041
  - Add interfaces init_enable_transient_unit() and init_disable_transient_unit
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  Resolves: rhbz#1435264
  - Label sysroot dir under ostree as root_t
  Resolves: rhbz#1428112


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-137
changelog:
  - Dontaudit firewalld wants write to /root
  Resolves: rhbz#1438708
  - Dontaudit firewalld to create dirs in /root/
  Resolves: rhbz#1438708
  - Allow sendmail to search network sysctls
  Resolves: rhbz#1369376
  - Add interface gssd_noatsecure()
  Resolves: rhbz#1438036
  - Add interface gssproxy_noatsecure()
  Resolves: rhbz#1438036
  - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals
  Resolves: rhbz#1379371
  - Allow chronyd_t net_admin capability to allow support HW timestamping.
  Resolves: rhbz#1416015
  - Update tomcat policy
  Resolves: rhbz#1436689
  Resolves: rhbz#1436383
  - Allow certmonger to start haproxy service
  Resolves: rhbz#1349394
  - Allow init noatsecure for gssd and gssproxy
  Resolves: rhbz#1438036


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-139
changelog:
  - Fix all AVC denials during pkispawn of CA
  Resolves: rhbz#1436383
  - Update pki interfaces and tomcat module
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-140
changelog:
  - Allow pcp_pmcd_t net_admin capability.
  - Allow pcp_pmcd_t read net sysctls
  - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t
  Resolves: rhbz#1336211


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-142
changelog:
  - Allow sbd_t to read/write fixed disk devices
  Resolves: rhbz#1440165
  - Add sys_ptrace capability to radiusd_t domain
  Resolves: rhbz#1426641
  - Allow cockpit_session_t domain connects to ssh tcp ports.
  Resolves: rhbz#1413509


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-143
changelog:
  - Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed.
  Resolves: rhbz#1431859
  - Fix policy to reflect all changes in new IPA release
  Resolves: rhbz#1432115
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-145
changelog:
  - Update tomcat policy to adjust for removing unconfined_domain attr.
  Resolves: rhbz#1432083
  - Allow httpd_t domain read also httpd_user_content_type lnk_files.
  Resolves: rhbz#1383621
  - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
  Resolves: rhbz#1436689
  - Dontaudit <user>_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
  Resolves: rhbz#1425530
  - Add interface ipa_filetrans_named_content()
  Resolves: rhbz#1432115
  - Allow tomcat use nsswitch
  Resolves: rhbz#1436689
  - Allow certmonger_t start/status generic services
  Resolves: rhbz#1436689
  - Allow dirsrv read cgroup files.
  Resolves: rhbz#1436689
  - Allow ganesha_t domain read/write infiniband devices.
  Resolves: rhbz#1383784
  - Allow sendmail_t domain sysctl_net_t files
  Resolves: rhbz#1369376
  - Allow targetd_t domain read network state and getattr on loop_control_device_t
  Resolves: rhbz#1373860
  - Allow condor_schedd_t domain send mails.
  Resolves: rhbz#1277506
  - Alow certmonger to create own systemd unit files.
  Resolves: rhbz#1436689
  - Allow staff to systemctl virt server when staff_use_svirt=1
  Resolves: rhbz#1415841
  - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
  Resolves: rhbz#1432115
  - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t
  Resolves: rhbz#1428112


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-146
changelog:
  - Allow pki_tomcat_t domain read /etc/passwd.
  Resolves: rhbz#1436689
  - Allow tomcat_t domain read ipa_tmp_t files
  Resolves: rhbz#1436689
  - Label new path for ipa-otpd
  Resolves: rhbz#1446353
  - Allow radiusd_t domain stream connect to postgresql_t
  Resolves: rhbz#1446145
  - Allow rhsmcertd_t to execute hostname_exec_t binaries.
  Resolves: rhbz#1445494
  - Allow virtlogd to append nfs_t files when virt_use_nfs=1
  Resolves: rhbz#1402561


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-147
changelog:
  - Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-148
changelog:
  - Allow hypervkvp_t domain execute hostname
  Resolves: rhbz#1449064
  - Dontaudit sssd_selinux_manager_t use of net_admin capability
  Resolves: rhbz#1444955
  - Allow tomcat_t stream connect to pki_common_t
  Resolves: rhbz#1447436
  - Dontaudit xguest_t's attempts to listen to its tcp_socket
  - Allow sssd_selinux_manager_t to ioctl init_t sockets
  Resolves: rhbz#1436689
  - Allow <role>_su_t to create netlink_selinux_socket
  Resolves rhbz#1146987
  - Allow unconfined_t to module_load any file
  Resolves rhbz#1442994


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-149
changelog:
  - Update targetd policy to accommodate changes in the service
  Resolves: rhbz#1424621
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  Resolves: rhbz#1450819
  - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
  Resolves: rhbz#1415841
  - Allow radius domain stream connec to postgresql
  Resolves: rhbz#1446145
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  Resolves: rhbz#1449977
  - Allow glusterd_t domain start ganesha service
  Resolves: rhbz#1448090
  - Made few cosmetic changes in sssd SELinux module
  Resolves: rhbz#1448060
  - sssd-kcm should not run as unconfined_service_t BZ(1447411)
  Resolves: rhbz#1448060
  - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct
  Resolves: rhbz#1448056
  - Allow keepalived_t domain read usermodehelper_t
  Resolves: rhbz#1449769
  - Allow tomcat_t domain read pki_common_t files
  Resolves: rhbz#1447436
  - Add interface pki_read_common_files()
  Resolves: rhbz#1447436


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-150
changelog:
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  Resolves: rhbz#1451318
  - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
  Resolves: rhbz#1448056 Resolves: rhbz#1448060
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  Resolves: rhbz#1450819
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  Resolves: rhbz#1373321
  - Allow netutils setpcap capability
  Resolves:1444438


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-151
changelog:
  - nmbd_t needs net_admin capability like smbd
  Resolves: rhbz#1431859
  - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
  Resolves: rhbz#1431859
  - Allow rngd domain read sysfs_t
  Resolves: rhbz#1451735
  - Add interface pki_manage_common_files()
  Resolves: rhbz#1447436
  - Allow tomcat_t domain to manage pki_common_t files and dirs
  Resolves: rhbz#1447436
  - Use stricter fc rules for sssd sockets in /var/run
  Resolves: rhbz#1448060
  - Allow certmonger reads httpd_config_t files
  Resolves: rhbz#1436689
  - Allow keepalived_t domain creating netlink_netfilter_socket.
  Resolves: rhbz#1451684
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  Resolves: rhbz#1451318
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  Resolves: rhbz#1373321


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-152
changelog:
  - Allow httpd_t reading kerberos kdc config files
  Resolves: rhbz#1452215
  - Allow tomcat_t domain connect to ibm_dt_2 tcp port.
  Resolves: rhbz#1447436
  - Allow stream connect to initrc_t domains
  Resolves: rhbz#1447436
  - Allow  dnsmasq_t domain to read systemd-resolved pid files.
  Resolves: rhbz#1453114
  - Allow tomcat domain name_bind on tcp bctp_port_t
  Resolves: rhbz#1451757
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1447669
  - Allow condor_master_t write to sysctl_net_t
  Resolves: rhbz#1277506
  - Allow nagios check disk plugin read /sys/kernel/config/
  Resolves: rhbz#1277718
  - Allow pcp_pmie_t domain execute systemctl binary
  Resolves: rhbz#1271998
  - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
  Resolves: rhbz#1247635
  - Label tcp/udp port 1792 as ibm_dt_2_port_t
  Resolves: rhbz#1447436
  - Add interface fs_read_configfs_dirs()
  - Add interface fs_read_configfs_files()
  - Fix systemd_resolved_read_pid interface
  - Add interface systemd_resolved_read_pid()
  Resolves: rhbz#1453114
  - Allow sshd_net_t domain read/write into crypto devices
  Resolves: rhbz#1452759
  - Label 8999 tcp/udp as bctp_port_t
  Resolves: rhbz#1451757


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-154
changelog:
  - Add few allow rules to ganesha module
  Resolves: rhbz#1448090
  - Allow condor_master_t to read sysctls.
  Resolves: rhbz#1277506
  - Add dac_override cap to ctdbd_t domain
  Resolves: rhbz#1435708
  - Label 8750 tcp/udp port as dey_keyneg_port_t
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-155
changelog:
  - Create new interface: glusterd_read_lib_files()
  - Allow ganesha read glusterd lib files.
  - Allow ganesha read network sysctls
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-156
changelog:
  - Add new boolean virt_use_glusterd
  Resolves: rhbz#1455994
  - Add capability sys_boot for sbd_t domain
  - Allow sbd_t domain to create rpc sysctls.
  Resolves: rhbz#1455631
  - Allow ganesha_t domain to manage glusterd_var_run_t pid files.
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-157
changelog:
  - Allow tomcat to connect on all unreserved ports
  - Allow ganesha to connect to all rpc ports
  Resolves: rhbz#1448090
  - Update ganesha with another fixes.
  Resolves: rhbz#1448090
  - Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
  Resolves: rhbz#1448090
  - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files
  Resolves: rhbz#1448090
  - Hide broken symptoms when machine is configured with network bounding.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-158
changelog:
  - Allow iscsi domain load kernel module.
  Resolves: rhbz#1457874
  - Allow keepalived domain connect to squid tcp port
  Resolves: rhbz#1457455
  - Allow krb5kdc_t domain read realmd lib files.
  Resolves: rhbz#1436689
  - xdm_t should view kernel keys
  Resolves: rhbz#1432645


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-160
changelog:
  - Allow named_t to bind on udp 4321 port
  Resolves: rhbz#1312972
  - Allow systemd-sysctl cap. sys_ptrace
  Resolves: rhbz#1458999


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-163
changelog:
  - Allow sssd_t to read realmd lib files.
  Resolves: rhbz#1436689
  - Add permission open to files_read_inherited_tmp_files() interface
  Resolves: rhbz#1290633
  Resolves: rhbz#1457106


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Gerd Hoffmann <kraxel@redhat.com> - 0.5.2-2
changelog:
  - Fix license: LGPL.
  - Cleanup specfile, drop bits not needed any more with
    recent rpm versions (F13+).
  - Use optflags as-is.
  -


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-2
changelog:
  - Various bugfixes from upstream git:
    - Make spicec work together with the Firefox XPI for RHEV-M
    - Make sure the spicec window gets properly raised when first shown


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-3
changelog:
  - Log to ~/.spicec/cegui.log rather then to CEGUI.log in the cwd, this
    fixes spicec from aborting when run in a non writable dir (#650253)


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-4
changelog:
  - Fix the info layer not showing when used through the XPI
  - Do not let the connection gui flash by when a hostname has been specified
    on the cmdline
  - Fix spice client locking up when dealing with XIM input (#654265)
  - Fix modifier keys getting stuck (#655048)
  - Fix spice client crashing when dealing with XIM ibus input (#655836)
  - Fix spice client only showing a white screen in full screen mode


author: Hans de Goede <hdegoede@redhat.com> - 0.8.0-2
changelog:
  - Fix being unable to send ctrl+alt+key when release mouse is bound to
    ctrl+alt (which can happen when used from RHEV-M)


author: Alon Levy <alevy@redhat.com>
changelog:
  - Fix mjpeg memory leak and bad behavior.
  - Add usbredir to list of channels for security purposes. (#819484)


author: Soren Sandmann <ssp@redhat.com> - 0.11.3-1
changelog:
  - Add capability patches
  - Add capability patches to the included copy of spice-protocol

      Please see the comment above Patch6 and Patch7
      regarding this situation.


author: Yonit Halperin <yhalperi@redhat.com> 0.12.4-1
changelog:
  - New upstream release 0.12.4
  - Require libjpeg-turbo-devel instead of libjpeg-devel
  - Remove "BuildRequires: spice-protocol" from spice-server
  - Add "Requires: spice-protocol" to spice-server-devel.


author: Hans de Goede <hdegoede@redhat.com> - 0.12.4-1
changelog:
  - Add patches from upstream git to fix sound-channel-free crash (rhbz#986407)
  - Add Obsoletes for dropped spice-client sub-package


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-5
changelog:
  - Fix qemu crash during migration with reboot
    Resolves: rhbz#1016795
  - Monitor whether the client is alive
    Resolves: rhbz#1016790


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-7
changelog:
  - Fix assert in mjpeg_encoder_adjust_params_to_bit_rate()
    Resolves: rhbz#1086823
  - Fix "Spice-ERROR **: reds.c:1464:reds_send_link_ack: assertion
    `link->link_mess->channel_type == SPICE_CHANNEL_MAIN' failed" assertion
    Resolves: rhbz#1058625
  - Lower a monitor-config warning to debug level
    Resolves: rhbz#1119220
  - mjpeg: Don't warn on unsupported image formats
    Resolves: rhbz#1070028


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-8
changelog:
  - Fix defects reported by Coverity
    Resolves: rhbz#885717
  - Validate surface bounding box sent from QXL driver
    Resolves: rhbz#1052856
  - Fix assertion sometimes happening during migration while a client is
    connected
    Resolves: rhbz#1035184
  - Fix crash when restarting VM with old client
    Resolves: rhbz#1145919


author: Fabiano Fidêncio <fidencio@redhat.com> 0.12.4-10
changelog:
  - Fix qemu segmentation fault (core dumped) when boot KVM guest with
    spice in FIPS enabled mode.
    Resolves: rhbz#1071176


author: Fabiano Fidêncio <fidencio@redhat.com> 0.12.4-11
changelog:
  - Don't assert on invalid client message
    Resolves: rhbz#1227410
  - Don't truncate large 'now' values in _spice_timer_set
    Resolves: rhbz#1227408
  - Avoid race conditions reading monitor configs from guest
    Resolves: rhbz#1239128
  - Lock the pixmap image cache for the entire fill_bits call
    Resolves: rhbz#1235443


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-16
changelog:
  - Use autosetup
    Related: CVE-2016-0749
  - Fix heap-based memory corruption within smartcard handling
    Resolves: CVE-2016-0749
  - Fix host memory access from guest with invalid primary surface parameters
    Resolves: CVE-2016-2150


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-17
changelog:
  - Fix crash when the client sends a wrong header (for example when using spice-html5)
    Resolves: rhbz#1281442
  - Fix crash when guest provides wrong address
    Resolves: rhbz#1264356
  - Fix thread-safety issue causing a crash when playing a Youtube video spanning
    multiple monitors
    Resolves: rhbz#1253375
  - Add patches reducing QEMU wake-ups
    Related: rhbz#912763, rhbz#1186146
  - Fix use-after-free after resetting a VM
    Resolves: rhbz#1281455
  - Send KeepAlive probes every 10 minutes
    Resolves: rhbz#1298590
  - Add client to guest volume synchronization
    Resolves: rhbz#1264107


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-18
changelog:
  - Fix crash when connecting to VM using smartcard passthrough
    Resolves: rhbz#1340899
  - Fix hang after unredirecting a USB device
    Resolves: rhbz#1338752
  - Backport spice_qxl_set_max_monitors()
    Resolves: rhbz#1283202


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-1
changelog:
  - Rebase to spice-server 0.12.8
    Resolves: rhbz#1388947
    Resolves: rhbz#1377551
    Resolves: rhbz#1283202


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-5.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-2
changelog:
  - Apply several important fixes from upstream 1.10 branch
  - Related: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-3
changelog:
  - Resolves: #983580 - Netgroups should ignore the 'use_fully_qualified_names'
                        setting


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-4
changelog:
  - Resolves: #983587 - sss_debuglevel did not increase verbosity in
                        sssd_pac.log


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.1beta2
changelog:
  - New upstream release 1.11 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
  - Related: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-1
changelog:
  - New upstream release 1.11.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-1
changelog:
  - New upstream release 1.11.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
  - Resolves: rhbz#991065 - Rebase SSSD to 1.11.0


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-2
changelog:
  - Resolves: rhbz#1019882 - RHEL7 ipa ad trusted user lookups failed with
                             sssd_be crash
  - Resolves: rhbz#1002597 - ad: unable to resolve membership when user is
                             from different domain than group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-2
changelog:
  - Skip netgroups that don't provide well-formed triplets
  - Related: rhbz#991549 -  sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-3
changelog:
  - Resolves: rhbz#991549 - sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-4
changelog:
  - Resolves: rhbz#1031562 - Incorrect mention of access_filter in sssd-ad
                             manpage


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-5
changelog:
  - Resolves: rhbz#1033084 - sssd_be segfaults if empty grop is resolved
                             using ad_matching_rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-6
changelog:
  - Resolves: rhbz#1028057 - Improve detection of the right domain when
                             processing group with members from several domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-7
changelog:
  - Resolves: rhbz#1036157 - sssd can't retrieve auto.master when using the
                             "default_domain_suffix" option in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-9
changelog:
  - Resolves: rhbz#1036758 - SSSD: Allow for custom attributes in RDN when
                             using id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-10
changelog:
  - Resolves: rhbz#1029631 - sssd_be crashes on manually adding a cleartext
                             password to ldap_default_authtok


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-11
changelog:
  - Resolves: rhbz#1038637 - If SSSD starts offline, subdomains list is
                             never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-13
changelog:
  - Resolves: rhbz#1023409 - Valgrind sssd "Syscall param
                             socketcall.sendto(msg) points to uninitialised
                             byte(s)"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-14
changelog:
  - Resolves: rhbz#1040969 - sssd_nss grows memory footprint when netgroups
                             are requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-15
changelog:
  - Resolves: rhbz#1033096 - tokenGroups do not work reliable with Global
                             Catalog
  - Resolves: rhbz#1030483 - Individual group search returned multiple
                             results in GC lookups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-16
changelog:
  - The AD provider is able to resolve group memberships for groups with
    Global and Universal scope
  - Related: rhbz#1033096 - tokenGroups do not work reliable with Global
                            Catalog


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-17
changelog:
  - Re-initialize subdomains after provider startup
  - Related: rhbz#1038637 - If SSSD starts offline, subdomains list is
                            never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-21
changelog:
  - Resolves: rhbz#1048184 - Group lookup does not return member with multiple
                             names after user lookup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-22
changelog:
  - Resolves: rhbz#1032983 - sssd_be crashes when ad_access_filter uses
                             FOREST keyword.
  - Fix two memory leaks in the PAC responder (Related: rhbz#991065)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-23
changelog:
  - Resolves: rhbz#1033133 - "System Error" when invalid ad_access_filter
                              is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-25
changelog:
  - Resolves: rhbz#1053106 - sssd ad trusted sub domain do not inherit
                             fallbacks and overrides settings


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-26
changelog:
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-28
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain
  - Fix return value when searching for AD domain flat names
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-29
changelog:
  - Resolves: rhbz#1051360 - [FJ7.0 Bug]: [REG] sssd_be crashes when
                             ldap_search_base cannot be parsed.
  - Fix a typo in the man page
  - Related: rhbz#1034920 - RHEL7 sssd not setting IPA AD trusted user homedir


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-30
changelog:
  - Resolves: rhbz#1037653 - Enabling ldap_id_mapping doesn't exclude
                             uidNumber in filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-31
changelog:
  - Resolves: rhbz#1054899 - explicitly suggest krb5_auth_timeout in a loud
                             DEBUG message in case Kerberos authentication
                             times out


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-32
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-34
changelog:
  - Resolves: rhbz#877438 - sudoNotBefore/sudoNotAfter not supported by sssd
                            sudoers plugin


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-35
changelog:
  - Resolves: rhbz#1028039 - AD Enumeration reads data from LDAP while
                             regular lookups connect to GC


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-36
changelog:
  - Resolves: rhbz#1059253 - Man page states default_shell option supersedes
                             other shell options but in fact override_shell does.
  - Use the right domain for AD site resolution
  - Related: rhbz#743503 -  [RFE] sssd should support DNS sites


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-38
changelog:
  - Resolves: rhbz#1059753 - Warn with a user-friendly error message when
                             permissions on sssd.conf are incorrect


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-39
changelog:
  - Resolves: rhbz#872177 - [RFE] subdomain homedir template should be
                            configurable/use flatname by default


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-40
changelog:
  - Resolves: rhbz#1033081 - Implement heuristics to detect if POSIX attributes
                             have been replicated to the Global Catalog or not


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-41
changelog:
  - Resolves: rhbz#1064582 - sss_cache does not reset the SYSDB_INITGR_EXPIRE
                             attribute when expiring users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-43
changelog:
  - Resolves: rhbz#1068640 - 'IPA: Don't call tevent_req_post outside _send'
                             should be added to RHEL7


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-44
changelog:
  - Resolves: rhbz#1033069 - Configuring two different provider types might
                             start two parallel enumeration tasks


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-45
changelog:
  - Resolves: rhbz#1067476 - SSSD pam module accepts usernames with leading
                             spaces


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-48
changelog:
  - Resolves: rhbz#1064908 - MAN: Remove misleading memberof example from
                             ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-49
changelog:
  - Resolves: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                             manually, if ID mapping configuration changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-50
changelog:
  - Pull some follow up man page fixes from upstream
  - Related: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                            manually, if ID mapping configuration changes
  - Related: rhbz#1064908 - MAN: Remove misleading memberof example from
                            ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-51
changelog:
  - Fix idmap documentation
  - Bump idmap version info
  - Related: rhbz#1067361 - Check IPA idranges before saving them to the cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-52
changelog:
  - Resolves: rhbz#1068725 - Evaluate usage of sudo LDAP provider together
                             with the AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-53
changelog:
  - Resolves: rhbz#1071903 - ipa-server-mode: Use lower-case user name
                             component in home dir path


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-54
changelog:
  - Resolves: rhbz#1072067 - SSSD Does not cache SELinux map from FreeIPA
                             correctly


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-55
changelog:
  - Resolves: rhbz#1073631 - sssd fails to handle expired passwords
                             when OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-56
changelog:
  - Related: rhbz#1072995 -  AD group inconsistency when using AD provider
                             in sssd-1.11-40


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-57
changelog:
  - Related: rhbz#1066096 - not retrieving homedirs of AD users with
                            posix attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-58
changelog:
  - Related: rhbz#1073635 - IPA SELinux code looks for the host in the wrong
                            sysdb subdir when a trusted user logs in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-59
changelog:
  - Related: rhbz#1075621 - Add another Kerberos error code to trigger IPA
                            password migration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-60
changelog:
  - Resolves: rhbz#1075663 - SSSD should create the SELinux mapping file
                             with format expected by pam_selinux


author: Sumit Bose <sbose@redhat.com> - 1.11.2-63
changelog:
  - Resolves: rhbz#1078877 - Valgrind: Invalid read of int while processing
                             netgroup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-64
changelog:
  - Resolves: rhbz#1077328 - other subdomains are unavailable when joined
                             to a subdomain in the ad forest


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-65
changelog:
  - Resolves: rhbz#1082191 - RHEL7 IPA selinuxusermap hbac rule not always
                             matching


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-66
changelog:
  - Resolves: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-67
changelog:
  - Fix a DEBUG message, backport two related fixes
  - Related: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-68
changelog:
  - Resolves: rhbz#1097286 - Expanding home directory fails when the request
                             comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-69
changelog:
  - Backport a patch to allow krb5-utils-test to run as root
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-70
changelog:
  - Squash in upstream review comments about the PAC patch
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-2
changelog:
  - Use libsemanage for SELinux label changes
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-3
changelog:
  - Add the low-level server changes for running as unprivileged user
  - Package the libsss_semange library needed for SELinux label changes
  - Related: rhbz#1113783 - sssd should run under unprivileged user 
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-4
changelog:
  - Fix regressions caused by views patches when SSSD is connected to a
    pre-4.0 IPA server
  - Related: rhbz#1109756 - Rebase SSSD to 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-5
changelog:
  - Amend the sssd-ldap man page with info about lockout setup
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137014 - Shell fallback mechanism in SSSD 
  - Resolves: rhbz#790854 - 4 functions with reference leaks within sssd (src/python/pyhbac.c)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-6
changelog:
  - Include the responder and packaging patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1153518 - service lookups returned in lowercase with
                             case_sensitive=preserving
  - Resolves: rhbz#1158809 - Enumeration shows only a single group multiple
                             times


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-8
changelog:
  - Support overriding SSH public keys with views
  - Support extended attributes via the extop plugin
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137010 - disable midpoint refresh for netgroups if ptask
                             refresh is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-9
changelog:
  - Include the ldap_child and selinux_child patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-10
changelog:
  - Fix two regressions in the new selinux_child process
  - Related: rhbz#1113783 - sssd should run under unprivileged user
  - Resolves: rhbz#1132365 - Remove password from the PAM stack if OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-12
changelog:
  - Move adding the user from pretrans to pre, copy adding the user to
    sssd-krb5-common and sssd-ipa as well in order to work around yum
    ordering issue
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-15
changelog:
  - Resolves: rhbz#1153603 - Proxy Provider: Fails to lookup case sensitive
                             users and groups with case_sensitive=preserving


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-16
changelog:
  - Use upstreamed patches for the rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-17
changelog:
  - Update man page to clarify TGs should be disabled with a custom search base
  - Related: rhbz#1161741 - TokenGroups for LDAP provider breaks in corner cases


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-18
changelog:
  - Support views for IPA users
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-19
changelog:
  - Resolves: rhbz#1153593 - Manpage description of case_sensitive=preserving
                            is incomplete


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-20
changelog:
  - Resolves: rhbz#1163742 - "debug_timestamps = false" and "debug_microseconds
                             = true" do not work after enabling journald
                             with sssd.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-22
changelog:
  - Handle IPA group names returned from the extop plugin
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-23
changelog:
  - Add an option that describes where to put generated krb5 files to
  - Related: rhbz#1135043 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-24
changelog:
  - Resolves: rhbz#1165794 - sssd does not work with custom value of option
                             re_expression


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-25
changelog:
  - Use alternatives for libwbclient
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-26
changelog:
  - Handle migrating clients between views
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-27
changelog:
  - Resolves: rhbz#1166727 - pam_sss domains option: Untrusted users from
                             the same domain are allowed to auth.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-28
changelog:
  - Fix typo in libwbclient-devel alternatives invocation
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-30
changelog:
  - krb5_child and ldap_child do not call Kerberos calls as root
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-31
changelog:
  - Resolves: rhbz#1169739 - selinuxusermap rule does not apply to trusted
                             AD users
  - Enable running unit tests without cmocka
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-32
changelog:
  - Resolves: rhbz#1124320 - [FJ7.0 Bug]: getgrent returns error because sss
                             is written in nsswitch.conf as default.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-34
changelog:
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Remove Coverity warnings in krb5_child code
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Rebuild to add several forgotten Patch entries
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Sumit Bose <sbose@redhat.com> - 1.12.2-37
changelog:
  - Resolves: rhbz#1169459 - sssd-ad: The man page description to enable GPO HBAC
                             Policies are unclear
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Sumit Bose <sbose@redhat.com> - 1.12.2-38
changelog:
  - Resolves: rhbz#1171215 - Crash in function get_object_from_cache
  - Resolves: rhbz#1171383 - getent fails for posix group with AD users after
                             login
  - Resolves: rhbz#1171382 - getent of AD universal group fails after group users
                             login
  - Resolves: rhbz#1170300 - Access is not rejected for disabled domain
  - Resolves: rhbz#1162486 - Error processing external groups with
                             getgrnam/getgrgid in the server mode
  - Resolves: rhbz#1168904 - gid is overridden by uid in default trust view


author: Sumit Bose <sbose@redhat.com> - 1.12.2-39
changelog:
  - Resolves: rhbz#1175408 - SSSD should not fail authentication when only allow
                             rules are used
  - Resolves: rhbz#1175705 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-40
changelog:
  - Resolves: rhbz#1177140 - gpo_child fails if "log level" is enabled in smb.conf
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-43
changelog:
  - Resolves: rhbz#1182183 - pam_sss(sshd:auth): authentication failure with
                             user from AD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-44
changelog:
  - Resolves: rhbz#1184140 - Users saved throug extop don't have the
                             originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-45
changelog:
  - Open socket to the PAC responder in krb5_child before dropping root
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-46
changelog:
  - Handle GID override in MPG domains
  - Handle views with mixed-case domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-48
changelog:
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-49
changelog:
  - Process ghost members only once
  - Fix processing of universal groups with members from different domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-50
changelog:
  - Add a patch dependency
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-51
changelog:
  - Bump the release number
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-53
changelog:
  - Resolves: rhbz#1187192 - IPA initgroups don't work correctly in
                             non-default view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-55
changelog:
  - Fix endianess bug in fill_id()
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-57
changelog:
  - Run the restart in sssd-common posttrans
  - Explicitly require libwbclient
  - Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.2
changelog:
  - Resolves: rhbz#1199143 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.3
changelog:
  - Set a pointer in ldap_child to NULL to avoid warnings
  - Related: rhbz#1198759 - ccname_file_dummy is not unlinked on error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.4
changelog:
  - Handle case where there is no default and no rules
  - Resolves: rhbz#1192314 - With empty ipaselinuxusermapdefault security
                             context on client is staff_u


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.5
changelog:
  - Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-58.6
changelog:
  - Initialize variable in the views code in one success and one failure path
  - Resolves: rhbz#1202170 - sssd_be segfault on IPA(when auth with AD
                             trusted domain) client at
                             src/providers/ipa/ipa_s2n_exop.c:1605


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-59
changelog:
  - Resolves: rhbz#1201840 - SSSD downloads too much information when fetching
                             information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-60
changelog:
  - Filter out domain-local groups during AD initgroups operation
  - Related: rhbz#1201840 - SSSD downloads too much information when fetching
                            information about groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0.1alpha
changelog:
  - Resolves: rhbz#1205554 - Rebase SSSD to 1.13.x
  - Relax the libldb requirement
  - Resolves: rhbz#1221992 - sssd_be segfault at 0 ip sp error 6 in
                             libtevent.so.0.9.21
  - Resolves: rhbz#1221839 - SSSD group enumeration inconsistent due to
                             binary SIDs
  - Resolves: rhbz#1219285 - Unable to resolve group memberships for AD
                             users when using sssd-1.12.2-58.el7_1.6.x86_64
                             client in combination with
                             ipa-server-3.0.0-42.el6.x86_64 with AD Trust
  - Resolves: rhbz#1217559 - [RFE] Support GPOs from different domain controllers
  - Resolves: rhbz#1217350 - ignore_group_members doesn't work for subdomains
  - Resolves: rhbz#1217127 - Override for IPA users with login does not list
                             user all groups
  - Resolves: rhbz#1216285 - autofs provider fails when default_domain_suffix
                             and use_fully_qualified_names set
  - Resolves: rhbz#1214719 - Group resolution is inconsistent with group
                             overrides
  - Resolves: rhbz#1214718 - Overridde with --login fails trusted adusers
                             group membership resolution
  - Resolves: rhbz#1214716 - idoverridegroup for ipa group with --group-name
                             does not work
  - Resolves: rhbz#1214337 - Overrides with --login work in second attempt
  - Resolves: rhbz#1212489 - Disable the cleanup task by default
  - Resolves: rhbz#1211830 - external users do not resolve with
                             "default_domain_suffix" set in IPA server sssd.conf
  - Resolves: rhbz#1210854 - Only set the selinux context if the context
                             differs from the local one
  - Resolves: rhbz#1209483 - When using id_provider=proxy with
                             auth_provider=ldap, it does not work as expected
  - Resolves: rhbz#1209374 - Man sssd-ad(5) lists Group Policy Management
                             Editor naming for some policies but not for all
  - Resolves: rhbz#1208507 - sysdb sudo search doesn't escape special characters
  - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface
  - Resolves: rhbz#1206566 - SSSD does not update Dynamic DNS records if
                             the IPA domain differs from machine hostname's
                             domain
  - Resolves: rhbz#1206189 - [bug] sssd always appends default_domain_suffix
                             when checking for host keys
  - Resolves: rhbz#1204203 - sssd crashes intermittently
  - Resolves: rhbz#1203945 - [FJ7.0 Bug]: getgrent returns error because
                             sss is written in nsswitch.conf as default
  - Resolves: rhbz#1203642 - GPO access control looks for computer object
                             in user's domain only
  - Resolves: rhbz#1202245 - SSSD's HBAC processing is not permissive enough
                             with broken replication entries
  - Resolves: rhbz#1201271 - sssd_nss segfaults if initgroups request is by
                             UPN and doesn't find anything
  - Resolves: rhbz#1200873 - [RFE] Allow smart multi step prompting when
                             user logs in with password and token code from IPA
  - Resolves: rhbz#1199541 - Read and use the TTL value when resolving a
                             SRV query
  - Resolves: rhbz#1199533 - [RFE] Implement background refresh for users,
                             groups or other cache objects
  - Resolves: rhbz#1199445 - Does sssd-ad use the most suitable attribute
                             for group name?
  - Resolves: rhbz#1198477 - ccname_file_dummy is not unlinked on error
  - Resolves: rhbz#1187103 - [RFE] User's home directories are not taken
                             from AD when there is an IPA trust with AD
  - Resolves: rhbz#1185536 - In ipa-ad trust, with 'default_domain_suffix' set
                             to AD domain, IPA user are not able to log unless
                             use_fully_qualified_names is set
  - Resolves: rhbz#1175760 - [RFE] Have OpenLDAP lock out ssh keys when
                             account naturally expires
  - Resolves: rhbz#1163806 - [RFE]ad provider dns_discovery_domain option:
                             kerberos discovery is not using this option
  - Resolves: rhbz#1205160 - Complain loudly if backend doesn't start due
                             to missing or invalid keytab


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-1
changelog:
  - Rebase to 1.13.0 upstream
  - Related: rhbz#1205554 - Rebase SSSD to 1.13.x
  - Resolves: rhbz#910187 - [RFE] authenticate against cache in SSSD
  - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-3
changelog:
  - Add support for InfoPipe wildcard requests
  - Resolves: rhbz#1206571 - [RFE] Expose D-BUS interface


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1206565 - [RFE] Add dualstack and multihomed support
  - Resolves: rhbz#1187146 - If v4 address exists, will not create nonexistant
                             v6 in ipa domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-8
changelog:
  - Remove OTP from PAM stack correctly
  - Related: rhbz#1200873 - [RFE] Allow smart multi step prompting when
                            user logs in with password and token code from IPA
  - Handle sssd-owned keytabs when sssd runs as root
  - Related: rhbz#1205144 - RFE: Support one-way trusts for IPA


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-9
changelog:
  - Fix memory cache integration tests
  - Resolves: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups
  - Resolves: rhbz#854396 - [RFE] Support for smart cards


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-10
changelog:
  - Resolves: rhbz#1244949 - getgrgid for user's UID on a trust client
                             prevents getpw*


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-11
changelog:
  - Remove binary blob from SC patches as patch(1) can't handle those
  - Related: rhbz#854396 - [RFE] Support for smart cards


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-12
changelog:
  - More memory cache related fixes
  - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-13
changelog:
  - Fix missing dependency of sssd-tools
  - Resolves: rhbz#1246489 - sss_obfuscate fails with "ImportError: No module
                             named pysss"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-14
changelog:
  - Bump release number
  - Related: rhbz#1246489 - sss_obfuscate fails with "ImportError: No module
                            named pysss"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-15
changelog:
  - Resolves: rhbz#1249015 - KDC proxy not working with SSSD krb5_use_kdcinfo
                             enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-16
changelog:
  - Fix race condition in invalidating the memory cache
  - Related: rhbz#1206575 - [RFE] The fast memory cache should cache initgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-19
changelog:
  - Resolves: rhbz#1202724 - [RFE] Add a way to lookup users based on CAC
                             identity certificates


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-20
changelog:
  - Related: rhbz#1250135 - Detect re-established trusts in the IPA
                            subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-22
changelog:
  - Resolves: rhbz#1244950 - Add index for 'objectSIDString' and maybe to
                             other cache attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-23
changelog:
  - Support import/export for local overrides
  - Support FQDNs for local overrides
  - Resolves: rhbz#1254184 - sss_override does not work correctly when
                             'use_fully_qualified_names = True'


author: Martin Kosek <mkosek@redhat.com> - 1.13.0-25
changelog:
  - Resolves: rhbz#1254189 - sss_override contains an extra parameter --debug
                             but is not listed in the man page or in
                             the arguments help


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-26
changelog:
  - Resolves: rhbz#1256398 - sssd cannot resolve user names containing
                             backslash with ldap provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-29
changelog:
  - Resolves: rhbz#1263587 - sss_override --name doesn't work with RFC2307
                             and ghost users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-30
changelog:
  - Patches required for better handling of failover with one-way trusts
  - Related: rhbz#1250135 - Detect re-established trusts in the IPA subdomain
                            code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-31
changelog:
  - Remove -d from sss_override manpage
  - Related: rhbz#1259512 - sss_override : The local override user is not found


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-33
changelog:
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-34
changelog:
  - Fix a Coverity warning in dyndns code
  - Resolves: rhbz#1261155 - nsupdate exits on first GSSAPI error instead
                             of processing other commands


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-35
changelog:
  - Resolves: rhbz#1250135 - Detect re-established trusts in the IPA
                             subdomain code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-36
changelog:
  - Resolves: rhbz#1266107 - AD: Conditional jump or move depends on
                             uninitialised value


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-40
changelog:
  - Resolves: rhbz#1270827 - local overrides: don't contact server with
                             overridden name/id


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-42
changelog:
  - Resolves: rhbz#1300740 - [RFE] IPA: resolve external group memberships
                             of IPA groups during getgrnam and getgrgid


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-44
changelog:
  - Resolves: rhbz#1308913 - sssd be memory leak in sssd's memberof plugin
  - More patches from upstream related to the memory leak


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-45
changelog:
  - Resolves: rhbz#1334159 - IPA provider crashes if a netgroup from a
                             trusted domain is requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-46
changelog:
  - Resolves: rhbz#1296902 - In IPA-AD trust environment access is granted
                             to AD user even if the user is disabled on AD.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-47
changelog:
  - Resolves: rhbz#1336706 - sssd_nss memory usage keeps growing when trying
                             to retrieve non-existing netgroups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-48
changelog:
  - Resolves: rhbz#1290853 - [sssd] Trusted (AD) user's info stays in sssd
                             cache for much more than expected.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-49
changelog:
  - Resolves: rhbz#1336688 - sssd tries to resolve global catalog servers
                             from AD forest sub-domains in AD-IPA trust setup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.0-50
changelog:
  - Build the PAC plugin with krb5-1.14
  - Related: rhbz#1336688 - sssd tries to resolve global catalog servers
                            from AD forest sub-domains in AD-IPA trust setup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0alpha-1
changelog:
  - Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
  - The rebase includes fixes for the following bugzillas:
  - Resolves: rhbz#789477 - [RFE] SUDO: Support the IPA schema
  - Resolves: rhbz#1059972 - RFE: SSSD: Automatically assign new slices for
                             any AD domain
  - Resolves: rhbz#1233200 - man sssd.conf should clarify details about
                             subdomain_inherit option.
  - Resolves: rhbz#1238144 - Need better libhbac debuging added to sssd
  - Resolves: rhbz#1265366 - sss_override segfaults when accidentally adding
                             --help flag to some commands
  - Resolves: rhbz#1269512 - sss_override: memory violation
  - Resolves: rhbz#1278566 - crash in sssd when non-Englsh locale is used
                             and pam_strerror prints non-ASCII characters
  - Resolves: rhbz#1283686 - groups get deleted from the cache
  - Resolves: rhbz#1290378 - Smart Cards: Certificate in the ID View
  - Resolves: rhbz#1292238 - extreme memory usage in libnfsidmap sss.so
                             plug-in when resolving groups with many members
  - Resolves: rhbz#1292456 - sssd_be AD segfaults on missing A record
  - Resolves: rhbz#1294670 - Local users with local sudo rules causes
                             LDAP queries
  - Resolves: rhbz#1296618 - Properly remove OriginalMemberOf attribute in
                             SSSD cache if user has no secondary groups anymore
  - Resolves: rhbz#1299553 - Cannot retrieve users after upgrade from 1.12
                             to 1.13
  - Resolves: rhbz#1302821 - Cannot start sssd after switching to non-root
  - Resolves: rhbz#1310877 - [RFE] Support Automatic Renewing of Kerberos
                             Host Keytabs
  - Resolves: rhbz#1313014 - sssd is not closing sockets properly
  - Resolves: rhbz#1318996 - SSSD does not fail over to next GC
  - Resolves: rhbz#1327270 - local overrides: issues with sub-domain users
                             and mixed case names
  - Resolves: rhbz#1342547 - sssd-libwbclient: wbcSidsToUnixIds should not
                             fail on lookup errors


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0beta1-2
changelog:
  - Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
  - Resolves: rhbz#790113 - [RFE] "include" directive in sssd.conf
  - Resolves: rhbz#874985 - [RFE] AD provider support for automount lookups
  - Resolves: rhbz#879333 - [RFE] SSSD admin tool request - status overview
  - Resolves: rhbz#1140022 - [RFE]Allow sssd to add a new option that would
                             specify which server to update DNS with
  - Resolves: rhbz#1290380 - RFE: Improve SSSD performance in large
                             environments
  - Resolves: rhbz#883886 - sssd: incorrect checks on length values during
                            packet decoding
  - Resolves: rhbz#988207 - sssd does not detail which line in configuration
                            is invalid
  - Resolves: rhbz#1007969 - sssd_cache does not remove have an option to
                             remove the sssd database
  - Resolves: rhbz#1103249 - PAC responder needs much time to process large
                             group lists
  - Resolves: rhbz#1118257 - Users in ipa groups, added to netgroups are
                             not resovable
  - Resolves: rhbz#1269018 - Too much logging from sssd_be
  - Resolves: rhbz#1293695 - sssd mixup nested group from AD trusted domains
  - Resolves: rhbz#1308935 - After removing certificate from user in IPA
                             and even after sss_cache, FindByCertificate
                             still finds the user
  - Resolves: rhbz#1315766 - SSSD PAM module does not support multiple
                             password prompts (e.g. Password + Token) with sudo
  - Resolves: rhbz#1316164 - SSSD fails to process GPO from Active Directory
  - Resolves: rhbz#1322458 - sssd_be[11010]: segfault at 0 ip 00007ff889ff61bb
                             sp 00007ffc7d66a3b0 error 4 in
                             libsss_ipa.so[7ff889fcf000+5d000]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-1
changelog:
  - New upstream release 1.14.0
  - Resolves: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3
  - Resolves: rhbz#835492 - [RFE] SSSD admin tool request - force reload
  - Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)
  - Resolves: rhbz#1278691 - Please fix rfc2307 autofs schema defaults
  - Resolves: rhbz#1287209 - default_domain_suffix Appended to User Name
  - Resolves: rhbz#1300663 - Improve sudo protocol to support configurations
                             with default_domain_suffix
  - Resolves: rhbz#1312275 - Support authentication indicators from IPA


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-2
changelog:
  - Explicitly BuildRequire newer ding-libs
  - Resolves: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-3
changelog:
  - Sync a few minor patches from upstream
  - Fix a failover issue
  - Resolves: rhbz#1334749 - sssd fails to mark a connection as bad on
                             searches that time out


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-5
changelog:
  - Sync a few minor patches from upstream
  - Fix sssctl manpage
  - Fix nss-tests unit test on big-endian machines
  - Fix several issues in the config schema
  - Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-6
changelog:
  - Resolves: rhbz#1349882 - sssd does not work under non-root user
  - Also cherry-pick a few patches from upstream to fix config schema
  - Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-7
changelog:
  - Resolves: rhbz#1350520 - [abrt] sssd-common: ipa_dyndns_update_send():
                             sssd_be killed by SIGSEGV


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-9
changelog:
  - Resolves: rhbz#1354414 - New or modified ID-View User overrides are not
                             visible unless rm -f /var/lib/sss/db/*cache*


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-11
changelog:
  - fix capaths output
  - Resolves: rhbz#1344940 - GSSAPI error causes failures for child domain
                             user logins across IPA - AD trust
  - also fix Coverity issues in the secrets responder and suppress noisy
    debug messages when setting the timestamp cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-12
changelog:
  - handle unresolvable sites more gracefully
  - Resolves: rhbz#1346011 - sssd is looking at a server in the GC of a
                             subdomain, not the root domain.
  - fix compilation warnings in unit tests


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-13
changelog:
  - Resolves: rhbz#1304992 - Handle overriden name of members in the
                             memberUid attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-15
changelog:
  - Resolves: rhbz#1364118 - [abrt] [faf] sssd: unknown function():
                             /usr/libexec/sssd/sssd_nss killed by 11
  - Resolves: rhbz#1361563 - Wrong pam error code returned for password
                             change in offline mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-16
changelog:
  - Cherry-pick patches from upstream that fix several regressions
  - Avoid checking local users in all cases
  - Resolves: rhbz#1353951 - sssd_pam leaks file descriptors


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-17
changelog:
  - Fix regressions in the simple access provider
  - Resolves: rhbz#1360806 - sssd does not start if sub-domain user is used
                             with simple access provider
  - Apply a number of specfile patches to better match the upstream spefile
  - Related: rhbz#1290381 - Rebase SSSD to 1.14.x in RHEL-7.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-18
changelog:
  - Resolves: rhbz#1349900 - gpo search errors out and gpo_cache file is
                             never created


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-19
changelog:
  - Add several small fixes related to the config API
  - Related: rhbz#1072458 - [RFE] SSSD configuration file test tool (sssd_check)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-20
changelog:
  - Resolves: rhbz#1290500 - [feat] command to manually list
                             fo_add_server_to_list information


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-21
changelog:
  - Resolves: rhbz#1271280 - sssd stores and returns incorrect information
                             about empty netgroup (ldap-server: 389-ds)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-22
changelog:
  - Resolves: rhbz#1268874 - Add an option to disable checking for trusted
                             domains in the subdomains provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-24
changelog:
  - Add socket-activation plumbing for the sssd-secrets responder
  - Related: rhbz#1311056 - Add a Secrets as a Service component


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-25
changelog:
  - Fix RPM scriptlet plumbing for the sssd-secrets responder
  - Related: rhbz#1311056 - Add a Secrets as a Service component


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-26
changelog:
  - Resolves: rhbz#1368324 - libsss_autofs.so is packaged in two packages
                             sssd-common and libsss_autofs


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-27
changelog:
  - Resolves: rhbz#1362023 - SSSD fails to start when ldap_user_extra_attrs
                             contains mail


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-28
changelog:
  - Resolves: rhbz#1364033 - sssd exits if clock is adjusted backwards
                             after boot


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-31
changelog:
  - Apply forgotten patch
  - Resolves: rhbz#1368496 - sssd is not able to authenticate with alias
  - Resolves: rhbz#1366470 - sssd: throw away the timestamp cache if
                             re-initializing the persistent cache
  - Fix deleting non-existent secret
  - Related: rhbz#1311056 - Add a Secrets as a Service component


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-32
changelog:
  - Resolves: rhbz#1371152 - SSSD qualifies principal twice in IPA-AD trust
                             if the principal attribute doesn't exist on the
                             AD side


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-35
changelog:
  - Fix permissions for the private pipe directory
  - Resolves: rhbz#1362716 - selinux avc denial for vsftp login as ipa user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-37
changelog:
  - Resolves: rhbz#1373444 - unable to create group in sssd cache
  - Resolves: rhbz#1373577 - unable to add local user in sssd to a group in sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-38
changelog:
  - Resolves: rhbz#1372753 - Access denied for user when access_provider =
                             krb5 is set in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-39
changelog:
  - Resolves: rhbz#1375182 - SSSD goes offline when the LDAP server returns
                             sizelimit exceeded


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-40
changelog:
  - Resolves: rhbz#1375299 - sss_groupshow <user> fails with error "No such
                             group in local domain. Printing groups only
                             allowed in local domain"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-42
changelog:
  - Resolves: rhbz#1371631 - login using gdm calls for gdm-smartcard when
                             smartcard authentication is not enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-44
changelog:
  - Resolves: rhbz#1372075 - AD provider: SSSD does not retrieve a domain-local
                             group with the AD provider when following AGGUDLP
                             group structure across domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.14.0-45
changelog:
  - Resolves: rhbz#1378911 - No supplementary groups are resolved for users
                             in nested OUs when domain stanza differs from AD
                             domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-1
changelog:
  - Update to upstream 1.15.0
  - Resolves: rhbz#1393824 - Rebase SSSD to version 1.15
  - Resolves: rhbz#1407960 - wbcLookupSid() fails in pdomain is NULL
  - Resolves: rhbz#1406437 - sssctl netgroup-show Cannot allocate memory
  - Resolves: rhbz#1400422 - Use-after free in resolver in case the fd is
                             writeable and readable at the same time
  - Resolves: rhbz#1393085 - bz - ldap group names don't resolve after
                             upgrading sssd to 1.14.0 if ldap_nesting_level is set to 0
  - Resolves: rhbz#1392444 - sssd_be keeps crashing
  - Resolves: rhbz#1392441 - sssd fails to start after upgrading to RHEL 7.3
  - Resolves: rhbz#1382602 - autofs map resolution doesn't work offline
  - Resolves: rhbz#1380436 - sudo: ignore case on case insensitive domains
  - Resolves: rhbz#1378251 - Typo In SSSD-AD Man Page
  - Resolves: rhbz#1373427 - Clock skew makes SSSD return System Error
  - Resolves: rhbz#1306707 - Need better handling of "Server not found in
                             Kerberos database"
  - Resolves: rhbz#1297462 - Don't include 'enable_only=sssd' in the localauth
                             plugin config


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-2
changelog:
  - Fix several packaging issues, notably the p11_child is no longer setuid
    and the libwbclient used a wrong version number in the symlink


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream 1.15.1
  - https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html
  - Resolves: rhbz#1327085 - Don't prompt for password if there is already
                             one on the stack
  - Resolves: rhbz#1378722 - [RFE] Make GETSIDBYNAME and GETORIGBYNAME
                             request aware of UPNs and aliases
  - Resolves: rhbz#1405075 - [RFE] Add PKINIT support to SSSD Kerberos provider
  - Resolves: rhbz#1416526 - Need correction in sssd-krb5 man page
  - Resolves: rhbz#1418752 - pam_sss crashes in do_pam_conversation if no
                             conversation function is provided by the
                             client app
  - Resolves: rhbz#1419356 - Fails to accept any sudo rules if there are
                             two user entries in an ldap role with the same
                             sudo user
  - Resolves: rhbz#1421622 - SSSD - Users/Groups are cached as mixed-case
                             resulting in users unable to sign in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-1
changelog:
  - Update to upstream 1.15.2
  - https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_2.html
  - Resolves: rhbz#1418728 - IPA - sudo does not handle associated conflict
                             entries
  - Resolves: rhbz#1386748 - sssd doesn't update PTR records if A/PTR zones
                             are configured as non-secure and secure
  - Resolves: rhbz#1214491 - [RFE] Make it possible to configure AD subdomain
                             in the SSSD server mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-2
changelog:
  - Resolves: rhbz#1340711 - [RFE] Use one smartcard and certificate for
                             authentication to distinct logon accounts


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-4
changelog:
  - Resolves: rhbz#1330196 - [RFE] Short name input format with SSSD for
                             users from all domains when domain autodiscovery
                             is used or when IPA client resolves trusted AD
                             domain users
  - Also backport some buildtime fixes for the KCM responder
  - Related: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-5
changelog:
  - Resolves: rhbz#1434991 - Issue processing ssh keys from certificates in
                             ssh respoder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-6
changelog:
  - Resolves: rhbz#1425891 - Support delivering non-POSIX users and groups
                             through the IFP and PAM interfaces


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-7
changelog:
  - Fix off-by-one error in the KCM responder
  - Related: rhbz#1396012 - [RFE] KCM ccache daemon in SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-9
changelog:
  - Resolves: rhbz#1414023 - Create troubleshooting tool to determine if a
                             failure is in SSSD or not when using layered
                             products like RH-SSO/CFME etc


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-10
changelog:
  - Resolves: rhbz#1427195 - sssd_nss consumes more memory until restarted
                             or machine swaps


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-11
changelog:
  - Resolves: rhbz#1438374 - [abrt] [faf] sssd: vfprintf():
                             /usr/libexec/sssd/sssd_be killed by 11


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-12
changelog:
  - Resolves: rhbz#1432112 - sssctl config-check does not give any error
                             when default configuration file is not present


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-13
changelog:
  - Resolves: rhbz#1438388 - [abrt] [faf] sssd: unknown function():
                             /usr/libexec/sssd/sssd_pam killed by 6


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-14
changelog:
  - Resolves: rhbz#1415167 - pam_acct_mgmt with pam_sss.so fails in
                             unprivileged container unless
                             selinux_provider = none is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-15
changelog:
  - Resolves: rhbz#1431858 - Wrong principal found with ad provider and long
                             host name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-16
changelog:
  - Resolves: rhbz#1402532 - D-Bus interface of sssd is giving inappropriate
                             group information for trusted AD users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-17
changelog:
  - Allow completely server-side unqualified name resolution if the domain order is set,
    do not require any client-side changes
  - Related: rhbz#1330196 - [RFE] Short name input format with SSSD for users from
                            all domains when domain autodiscovery is used or when
                            IPA client resolves trusted AD domain users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-18
changelog:
  - Remove an unused variable from the sssd-secrets responder
  - Related: rhbz#1398701 - [sssd-secrets] https proxy talks plain http
  - Improve two DEBUG messages in the client trust code to aid troubleshooting
  - Fix standalone application domains
  - Related: rhbz#1425891 - Support delivering non-POSIX users and groups
                            through the IFP and PAM interfaces


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-19
changelog:
  - Resolves: rhbz#1428866 - Using ad_enabled_domains configuration option
                             in sssd.conf causes nameservice lookups to fail.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-20
changelog:
  - Resolves: rhbz#1441545 - With multiple subdomain sections id command
                             output for user is not displayed for both domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-21
changelog:
  - Resolves: rhbz#1446139 - Infopipe method ListByCertificate does not
                             return the users with overrides


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-22
changelog:
  - Resolves: rhbz#1427749 - SSSD in server mode iterates over all domains
                             for group-by-GID requests, causing unnecessary
                             searches


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.2-23
changelog:
  - Resolves: rhbz#1430494 - expect sss_ssh_authorizedkeys and
                             sss_ssh_knownhostsproxy manuals to be packaged
                             into sssd-common package


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-24
changelog:
  - Resolves: rhbz#1434992 - Wrong pam return code for user from subdomain
                             with ad_access_filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-25
changelog:
  - Resolves: rhbz#1445445 - Smart card login fails if same cert mapped to
                             IdM user and AD user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-28
changelog:
  - Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
                             properly in v 1.15
  - Also apply an additional patch for rhbz#1441545


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-29
changelog:
  - Reapply patch by Lukas Slebodnik to fix upgrade issues with libwbclient
  - Resolves: rhbz#1439457 - SSSD does not start after upgrade from 7.3 to 7.4 
  - Resolves: rhbz#1449107 - error: %pre(sssd-common-1.15.2-26.el7.x86_64)
                             scriptlet failed, exit status 3


author: Sumit Bose <sbose@redhat.com> - 1.15.2-30
changelog:
  - Resolves: rhbz#1449726 - sss_nss_getlistbycert() does not return results from
                             multiple domains
  - Resolves: rhbz#1447098 - sssd unable to search dbus for ipa user by
                             certificate
  - Additional patch for rhbz#1440132


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-31
changelog:
  - Resolves: rhbz#1446535 - Group resolution does not work in subdomain
                             without ad_server option


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-32
changelog:
  - Resolves: rhbz#1306707 - Need better debug message when krb5_child
                             returns an unhandled error, leading to a
                             System Error PAM code


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-34
changelog:
  - Resolves: rhbz#1446302 - crash in sssd-kcm due to a race-condition
                             between two concurrent requests


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-36
changelog:
  - Resolves: rhbz#1389796 - Smartcard authentication with UPN as logon name
                             might fail
  - Fix Coverity issues in patches for rhbz#1445445


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-37
changelog:
  - Resolves: rhbz#1428906 - sssd intermittently failing to resolve groups
                             for an AD user in IPA-AD trust environment.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-38
changelog:
  - Resolves: rhbz#1457644 - Segfault in access_provider = krb5 is set in
                             sssd.conf due to an off-by-one error when
                             constructing the child send buffer
  - Resolves: rhbz#1456531 - Option name typos are not detected with validator
                             function of sssctl config-check command in domain
                             sections


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-39
changelog:
  - Resolves: rhbz#1450094 - Properly support IPA's promptusername config
                             option


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-40
changelog:
  - Resolves: rhbz#1449729 - org.freedesktop.sssd.infopipe.GetUserGroups
                             does not resolve groups into names with AD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-43
changelog:
  - Resolves: rhbz#1440132 - fiter_users and filter_groups stop working
                             properly in v 1.15


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-44
changelog:
  - Resolves: rhbz#1457927 - getent failed to fetch netgroup information
                             after changing default_domain_suffix to
                             ADdomin in /etc/sssd/sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-47
changelog:
  - Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
                             most of the entries once the cleanup task kicks in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-48
changelog:
  - Resolves: rhbz#1459846 - krb5: properly handle 'password expired'
                             information retured by the KDC during
                             PKINIT/Smartcard authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-49
changelog:
  - Resolves: rhbz#1450107 - SSSD doesn't handle conflicts between users
                             from trusted domains with the same name when
                             shortname user resolution is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50
changelog:
  - Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
                             connected to AD child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.1
changelog:
  - Resolves: rhbz#1478250 - Idle nss file descriptors should be closed
                             [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.2
changelog:
  - Resolves: rhbz#1478252 - Querying the AD domain for external domain's
                             ID can mark the AD domain offline [rhel-7.4.z]


author: Jeff Johnson <jbj@redhat.com> 0.15-3687.0
changelog:
  - first build from adapted spec file, only client and libraries for now.
  - internal apr/apr-utils/neon until incompatibilities sort themselves out.
  - avoid libdir issues on x86_64 for the moment.


author: Joe Orton <jorton@redhat.com> 0.22.2-1
changelog:
  - update to 0.22.2; add mod_dav_svn subpackage
  - include Python bindings
  - neon: force use of expat, enable SSL
  - drop check for specific apr version added in -3


author: Jeff Johnson <jbj@redhat.com> 0.22.2-2
changelog:
  - use external neon-0.23.9-2 (i.e. with neon-config), drop internal neon.
  - use db-4.1.25, not db-4.0.14.
  - do "make check" (but ignore failure for now).
  - s390x knows not of httpd >= 2.0.45.


author: Joe Orton <jorton@redhat.com> 1.0.0-2
changelog:
  - add fix for lack of apr_dir_read ordering guarantee (Philip Martin)
  - enable compression in ra_dav by default (Tobias Ringström)


author: Joe Orton <jorton@redhat.com> 1.0.2-2
changelog:
  - add perl MODULE_COMPAT requirement for -perl subpackage
  - move perl man pages into -perl subpackage
  - clean up -perl installation and dependencies (Ville Skyttä, #123045)


author: Joe Orton <jorton@redhat.com> 1.1.3-7
changelog:
  - restore swig bindings support (from upstream via Max Bowsher, #141343)
  - tweak SELinux commentary in default subversion.conf


author: Joe Orton <jorton@redhat.com> 1.1.3-8
changelog:
  - further swig bindings fix (upstream via Max Bowsher, #151798)
  - fix perl File::Path dependency in filter-requires.sh


author: Joe Orton <jorton@redhat.com> 1.2.0-3
changelog:
  - update to 1.2.1
  - fix BuildRequires for ruby and apr-util (#163126)
  - drop static library archives


author: Joe Orton <jorton@redhat.com> 1.2.3-3
changelog:
  - update to 1.2.3
  - update to psvn.el r16070 from Stefan Reichoer
  - merge subversion.conf changes from RHEL4
  - merge filter-requires.sh changes from FC4 updates


author: Joe Orton <jorton@redhat.com> 1.3.2-2
changelog:
  - update to 1.3.2
  - fix Ruby sitelibdir (Garrick Staples, #191611)
  - own /etc/subversion (#189071)
  - update to psvn.el r19857


author: Joe Orton <jorton@redhat.com> 1.4.3-3
changelog:
  - update to 1.4.3 (#228691)
  - remove trailing dot from Summary
  - use current preferred standard BuildRoot
  - add post/postun ldconfig scriptlets for -ruby and -javahl


author: Joe Orton <jorton@redhat.com> 1.4.4-2
changelog:
  - update to 1.4.4
  - add Provides: svn (#245087)
  - fix without-java build (Lennert Buytenhek, #245467)


author: Joe Orton <jorton@redhat.com> 1.4.4-3
changelog:
  - fix build with new glibc open()-as-macro
  - build all swig code in %build, not %install
  - BuildRequire perl(Test::More), perl(ExtUtils::MakeMaker)


author: Joe Orton <jorton@redhat.com> 1.4.4-4
changelog:
  - trim dependencies from .la files
  - detabify spec file
  - test suite disabled to ease stress on builders


author: Joe Orton <jorton@redhat.com> 1.5.6-3
changelog:
  - update to 1.5.6
  - autoload psvn (#238491, Tom Tromey)
  - regenerate swig bindings (#480503)
  - fix build with libtool 2.2 (#469524)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.5-3
changelog:
  - Apply svn2cl upstream patch to fix newline issues with libxml2 2.7.4+,
    see http://bugs.debian.org/546990 for details.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.7.0-2
changelog:
  - Fix apr Conflicts syntax in -libs.
  - Fix obsolete chown syntax in subversion.conf.
  - Fix use of spaces vs tabs in specfile.


author: Joe Orton <jorton@redhat.com> - 1.7.3-2
changelog:
  - add upstream test suite fixes for APR hash change (r1293602, r1293811)
  - use ruby vendorlib directory (#798203)
  - convert svnserve to systemd (#754074)


author: Vít Ondruch <vondruch@redhat.com> - 1.7.8-6
changelog:
  - Rebuild for https://fedoraproject.org/wiki/Features/Ruby_2.0.0
  - Drop Ruby version checks from configuration script.
  - Fix and enable Ruby test suite.


author: Joe Orton <jorton@redhat.com> - 1.7.9-2
changelog:
  - try harder to avoid svnserve bind failures in ruby binding tests
  - enable verbose output for ruby binding tests


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
  - remove absolute path names from the PAM configuration, ensuring that the
    right modules get used for whichever arch we're built for
  - don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
  - Enhance sesh.c to fork/exec children itself, to avoid
    having sudo reap all domains.
  - Only reinstall default signal handlers immediately before
    exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
  - new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
  - Remove selinux patch.  It has been decided that the SELinux patch for sudo is
  - no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
  - We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
  - fix #198755 - make login processes (sudo -i) initialise session keyring
    (thanks for PAM config files to David Howells)
  - add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
  - adjust audit patch, do not scream when kernel is
    compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
  - fixed building with new libtool
  - fix for incorrect handling of groups in Runas_User
  - added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
  - moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
  - epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
  - new upstream version 1.7.2p2-1
  - commented out unused aliases in sudoers to make visudo happy (#550239)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
changelog:
  - Add /etc/sudoers.d dir and use it in default config (#551470).
  - Drop *.pod man page duplicates from docs.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
changelog:
  - audit related Makefile.in and configure.in corrections
  - added --with-audit configure option
  - removed call to libtoolize


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
changelog:
  - update to new upstream version
  - merged .audit and .libaudit patch
  - added sudoers.ldap.5* to files


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
changelog:
  - update to new upstream version
  - new command available: sudoreplay
  - use native audit support
  - corrected license field value: BSD -> ISC


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
changelog:
  - anybody in the wheel group has now root access (using password) (rhbz#656873)
  - sync configuration paths with the nss_ldap package (rhbz#652687)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
changelog:
  - rebase to 1.8.1p2
  - removed .sudoi patch
  - fixed typo: RELPRO -> RELRO
  - added -devel subpackage for the sudo_plugin.h header file
  - use default ldap configuration files again


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
changelog:
  - added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
  - re-enabled SSSD support
  - removed libsss_sudo dependency


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
changelog:
  - added upstream patch for a regression
  - don't include arch specific files in the -devel subpackage
  - ship only one sample plugin in the -devel subpackage


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
changelog:
  - update to 1.8.6p7
  - fixes CVE-2013-1775 and CVE-2013-1776
  - fixed several packaging issues (thanks to ville.skytta@iki.fi)
    - build with system zlib.
    - let rpmbuild strip libexecdir/*.so.
    - own the %{_docdir}/sudo-* dir.
    - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
    - fix bogus %changelog dates.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-3
changelog:
  - synced sudoers, configure options & configuration files with
    expected RHEL configuration
    Resolves: rhbz#969373
    Resolves: rhbz#971009
    Resolves: rhbz#965124
    Resolves: rhbz#971013
    Resolves: rhbz#839705


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-5
changelog:
  - added standalone manpage for sudo.conf and sudo-ldap.conf
  - spec file cleanup
    Resolves: rhbz#881258


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-6
changelog:
  - fixed alias cycle detection code
  - added debug messages for tracing of netgroup matching
  - fixed aborting on realloc when displaying allowed commands
  - sssd: filter netgroups in the sudoUser attribute
  - parse uids/gids more strictly
  - added debug messages to trace netgroup matching
    Resolves: rhbz#1026904
    Resolves: rhbz#1026890
    Resolves: rhbz#1007014
    Resolves: rhbz#1026894
    Resolves: rhbz#1000389
    Resolves: rhbz#994566


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-11
changelog:
  - Fixed incorrect login shell path construction in sesh
    (thanks fkrska@redhat.com for the patch)
    Resolves: rhbz#1065418


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-12
changelog:
  - RHEL 7.1 erratum
    - don't retry authentication when ctrl-c pressed
    - fix double-quote processing in Defaults options
    - handle the "(none)" hostname correctly
    - SSSD: fix sudoUser netgroup specification filtering
    - SSSD: list correct user when -U <user> -l specified
    - SSSD: show rule names on long listing (-ll)
    - fix infinite loop when duplicate entries are specified on the
      sudoers nsswitch.conf line
    Resolves: rhbz#1084488
    Resolves: rhbz#1088464
    Resolves: rhbz#1088825
    Resolves: rhbz#1092499
    Resolves: rhbz#1093099
    Resolves: rhbz#1096813
    Resolves: rhbz#1147497
    Resolves: rhbz#1147557


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-14
changelog:
  - RHEL 7.2 erratum
    - backported command digest specification
    - fixed CVE-2014-9680 sudo: unsafe handling of TZ environment variable
    - fixed typos in sudoers.ldap man page
    - fixed handling of double-quoted sudoOption values in ldap, sssd sources
    - fixed numeric uid specification support in ldap source
    - fixed authentication flag logic in ldap source
    - added the systemctl command to the SERVICES alias in the default sudoers file
    Resolves: rhbz#1144446
    Resolves: rhbz#1235570
    Resolves: rhbz#1138259
    Resolves: rhbz#1183818
    Resolves: rhbz#1233607
    Resolves: rhbz#1144419
    Resolves: rhbz#1135539
    Resolves: rhbz#1215400


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-15
changelog:
  - RHEL 7.2 erratum
    - fixed compilation of testing binaries during make check
    - added legacy group processing patch
    - replaced buggy base64 decoder with a public domain implementation
    Resolves: rhbz#1254621
    Resolves: rhbz#1183818
    Resolves: rhbz#1247591


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-18
changelog:
  - RHEL 7.3 erratum
    - removed requiretty flag from the default sudoers policy
    - backported pam_service and pam_login_service defaults options
    - implemented netgroup_tuple defaults option for changing netgroup
      processing semantics
    - fixed user matching logic in the LDAP nss backend
    - don't allow visudo to accept an invalid sudoers file
    - fixed a bug causing that non-root users can list privileges of
      other users
    - modified digest check documentation to mention the raciness of
      the checking mechanism
    Resolves: rhbz#1196451
    Resolves: rhbz#1247230
    Resolves: rhbz#1334331
    Resolves: rhbz#1334360
    Resolves: rhbz#1261998
    Resolves: rhbz#1313364
    Resolves: rhbz#1312486
    Resolves: rhbz#1268958
    Resolves: rhbz#1335039
    Resolves: rhbz#1335042
    Resolves: rhbz#1335045
    Resolves: rhbz#1273243
    Resolves: rhbz#1299883


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-19
changelog:
  - RHEL 7.3 erratum
    - removed INPUTRC from env_keep to prevent a potential info leak
    Resolves: rhbz#1340700


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
changelog:
  - RHEL 7.4 erratum
    - Resolves: rhbz#1360687 - rebase to 1.8.19p2
    - Resolves: rhbz#1123526 - performance improvement
    - Resolves: rhbz#1308789 - add MAIL and NOMAIL tags
    - Resolves: rhbz#1348504 - sudo now parses sudoers with sudoers locale
    - Resolves: rhbz#1374417 - "sudo -l command" indicated that the command 
      was runnable even if denied by sudoers when using LDAP or SSSD backend.
    - Resolves: rhbz#1387303 - add ignore_iolog_errors option
    - Resolves: rhbz#1389360 - wrong log file group ownership
    - Resolves: rhbz#1389735 - add iolog_group, iolog_mode, iolog_user options
    - Resolves: rhbz#1397169 - maxseq and ignore_iolog_errors options
    - Resolves: rhbz#1403051 - add support for querying netgroups directly via LDAP
    - Resolves: rhbz#1410086 - race condition while creating /var/log/sudo-io dir
    - Resolves: rhbz#1413160 - add ignore_unknown_defaults flag
    - Resolves: rhbz#1254772 - ability to export sudoers in json format
    - Resolves: rhbz#1417187 - wrong reference to config file in systax error message
    - Resolves: rhbz#1424575 - visudo was not printing severity of error/warning message


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
  - RHEL 7.4 erratum
  - Fixes coverity scan issues created by our patches: 
    - fixed resource leaks and a compiler warning in digest backport patch
    - removed needless code from cmnd_no_wait patch causing clang warning
    - format of the last changelog message causes problems to rhpkg push,
      so don't use that as a commit message 
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
  - RHEL 7.4 eratum
  - Fixes semicolon typo in digest backport patch from the previous build
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
  - RHEL 7.4 erratum
  - fixed cmnd_no_wait patch
  - backported iolog_flush sudoers default
    Resolves: rhbz#1369856
    Resolves: rhbz#1425853


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Lennart Poettering <lpoetter@redhat.com> - 0-0.7.20100629git4176e5
changelog:
  - New snapshot
  - Split off -units package where other packages can depend on without pulling in the whole of systemd


author: Lennart Poettering <lpoetter@redhat.com> - 8-3
changelog:
  - Reexecute after installation, take ownership of /var/run/user
  - https://bugzilla.redhat.com/show_bug.cgi?id=627457
  - https://bugzilla.redhat.com/show_bug.cgi?id=627634


author: Lennart Poettering <lpoetter@redhat.com> - 10-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=630401
  - https://bugzilla.redhat.com/show_bug.cgi?id=630225
  - https://bugzilla.redhat.com/show_bug.cgi?id=626966
  - https://bugzilla.redhat.com/show_bug.cgi?id=623456


author: Lennart Poettering <lpoetter@redhat.com> - 14-1
changelog:
  - Upstream update
  - Enable hwclock-load by default
  - Obsolete readahead
  - Enable /var/run and /var/lock on tmpfs


author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694079
  - https://bugzilla.redhat.com/show_bug.cgi?id=693289
  - https://bugzilla.redhat.com/show_bug.cgi?id=693274
  - https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694788
  - https://bugzilla.redhat.com/show_bug.cgi?id=694321
  - https://bugzilla.redhat.com/show_bug.cgi?id=690253
  - https://bugzilla.redhat.com/show_bug.cgi?id=688661
  - https://bugzilla.redhat.com/show_bug.cgi?id=682662
  - https://bugzilla.redhat.com/show_bug.cgi?id=678555
  - https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=699394
  - https://bugzilla.redhat.com/show_bug.cgi?id=698198
  - https://bugzilla.redhat.com/show_bug.cgi?id=698674
  - https://bugzilla.redhat.com/show_bug.cgi?id=699114
  - https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
  - Bugfix release
  - https://bugzilla.redhat.com/show_bug.cgi?id=707507
  - https://bugzilla.redhat.com/show_bug.cgi?id=707483
  - https://bugzilla.redhat.com/show_bug.cgi?id=705427
  - https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
  - Apply patches from current upstream
  - https://bugzilla.redhat.com/show_bug.cgi?id=709909
  - https://bugzilla.redhat.com/show_bug.cgi?id=710839
  - https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
  - Apply patches from current upstream.
  - Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
  - New upstream release
  - Update post scripts
  - Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
  - A couple of fixes from upstream:
  - Fix a regression in bash-completion reported in Bodhi.
  - Fix a crash in isolating.
  - Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
  - Build against libgee06. Reenable gtk tools.
  - Delete unused patches.
  - Add easy building of git snapshots.
  - Remove legacy spec file elements.
  - Don't mention implicit BuildRequires.
  - Configure with --disable-static.
  - Merge -units into the main package.
  - Move section 3 manpages to -devel.
  - Fix unowned directory.
  - Run ldconfig in scriptlets.
  - Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
  - New upstream release
  - Save a bit of entropy during system installation (#789407)
  - Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
  - don't conflict with fedora-release systemd never actually provided
  - /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
  - apply patch from upstream so we can build systemd on arm and ppc
  - and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
  - Add triggers from Bill Nottingham to correct the damage done by
  the obsoleted systemd-units's preun scriptlet (#807457).


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
  - Update to current git snapshot
  - Add systemd-readahead-analyze
  - Drop upstream patch
  - Split systemd-libs
  - Drop duplicate doc files
  - Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
  - New upstream release
  - Enable gdm and avahi by default via the preset file
  - Convert /etc/sysconfig/desktop to display-manager.service symlink
  - Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
  - Remount file systems MS_PRIVATE before switching roots
  - https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
  - more scriptlet fixes
  (move dm migration logic to %posttrans so the service
  files it's looking for are available at the time
  the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
  - Update preset policy
  - Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
  - New upstream release
  - Take possession of /etc/localtime, and remove /etc/sysconfig/clock
  - https://bugzilla.redhat.com/show_bug.cgi?id=858780
  - https://bugzilla.redhat.com/show_bug.cgi?id=858787
  - https://bugzilla.redhat.com/show_bug.cgi?id=858771
  - https://bugzilla.redhat.com/show_bug.cgi?id=858754
  - https://bugzilla.redhat.com/show_bug.cgi?id=858746
  - https://bugzilla.redhat.com/show_bug.cgi?id=858266
  - https://bugzilla.redhat.com/show_bug.cgi?id=858224
  - https://bugzilla.redhat.com/show_bug.cgi?id=857670
  - https://bugzilla.redhat.com/show_bug.cgi?id=856975
  - https://bugzilla.redhat.com/show_bug.cgi?id=855863
  - https://bugzilla.redhat.com/show_bug.cgi?id=851970
  - https://bugzilla.redhat.com/show_bug.cgi?id=851275
  - https://bugzilla.redhat.com/show_bug.cgi?id=851131
  - https://bugzilla.redhat.com/show_bug.cgi?id=847472
  - https://bugzilla.redhat.com/show_bug.cgi?id=847207
  - https://bugzilla.redhat.com/show_bug.cgi?id=846483
  - https://bugzilla.redhat.com/show_bug.cgi?id=846085
  - https://bugzilla.redhat.com/show_bug.cgi?id=845973
  - https://bugzilla.redhat.com/show_bug.cgi?id=845194
  - https://bugzilla.redhat.com/show_bug.cgi?id=845028
  - https://bugzilla.redhat.com/show_bug.cgi?id=844630
  - https://bugzilla.redhat.com/show_bug.cgi?id=839736
  - https://bugzilla.redhat.com/show_bug.cgi?id=835848
  - https://bugzilla.redhat.com/show_bug.cgi?id=831740
  - https://bugzilla.redhat.com/show_bug.cgi?id=823485
  - https://bugzilla.redhat.com/show_bug.cgi?id=821813
  - https://bugzilla.redhat.com/show_bug.cgi?id=807886
  - https://bugzilla.redhat.com/show_bug.cgi?id=802198
  - https://bugzilla.redhat.com/show_bug.cgi?id=767795
  - https://bugzilla.redhat.com/show_bug.cgi?id=767561
  - https://bugzilla.redhat.com/show_bug.cgi?id=752774
  - https://bugzilla.redhat.com/show_bug.cgi?id=732874
  - https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=859614
  - https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=831665
  - https://bugzilla.redhat.com/show_bug.cgi?id=847720
  - https://bugzilla.redhat.com/show_bug.cgi?id=858693
  - https://bugzilla.redhat.com/show_bug.cgi?id=863481
  - https://bugzilla.redhat.com/show_bug.cgi?id=864629
  - https://bugzilla.redhat.com/show_bug.cgi?id=864672
  - https://bugzilla.redhat.com/show_bug.cgi?id=864674
  - https://bugzilla.redhat.com/show_bug.cgi?id=865128
  - https://bugzilla.redhat.com/show_bug.cgi?id=866346
  - https://bugzilla.redhat.com/show_bug.cgi?id=867407
  - https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
  - add dmraid-activation.service to the default preset
  - add yum protected.d fragment
  - https://bugzilla.redhat.com/show_bug.cgi?id=869619
  - https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
  - Fix cyclical dep between systemd and systemd-libs.
  - Avoid broken build of test-journal-syslog.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873387
  - https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
  - Revert udev killing cgroup patch for F18 Beta.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=873459
  - https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
  - added spice-vdagentd.service to presets (Lennart, #876237)
  - BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
  (requested by Milan Brož).
  - verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
  - Disable hardening on s390(x) because PIE is broken there and produces
  text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
  - Added qemu-guest-agent.service to presets (Lennart, #885406).
  - Add missing pygobject3-base to systemd-analyze deps (Lennart).
  - Do not require hwdata, it is all in the hwdb now (Kay).
  - Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
  - Automatically discover whether to run autoreconf and add autotools and git
  BuildRequires based on the presence of patches to be applied.
  - Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
  - nspawn create empty /etc/resolv.conf if necessary
  - python wrapper: add sd_journal_add_conjunction()
  - fix s390 booting
  - Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
  - fix ENOENT for getaddrinfo
  - Resolves: rhbz#954012 rhbz#956035
  - crypt-setup-generator: correctly check return of strdup
  - logind-dbus: initialize result variable
  - prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
  - Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 206-3
changelog:
  - add dependency on kmod >= 14
  - remove /var/log/journal to make journal non-persistant (#989750)
  - add hypervkvpd.service to presets (#924321)


author: Harald Hoyer <harald@redhat.com> 206-4
changelog:
  - journal: handle multiline syslog messages
  - man: Fix copy&paste error
  - core: synchronously block when logging
  - journal: immediately sync to disk as soon as we receieve an EMERG/ALERT/CRIT message
  - initctl: use irreversible jobs when switching runlevels
  - udev: log error if chmod/chown of static dev nodes fails
  - udev: static_node - don't touch permissions uneccessarily
  - tmpfiles: support passing --prefix multiple times
  - tmpfiles: introduce --exclude-prefix
  - tmpfiles-setup: exclude /dev prefixes files
  - logind: update state file after generating the session fifo, not before
  - journalctl: use _COMM= match for scripts
  - man: systemd.unit: fix volatile path
  - man: link up scope+slice units from systemd.unit(5)
  - man: there is no session mode, only user mode
  - journal: fix hashmap leak in mmap-cache
  - systemd-delta: Only print colors when on a tty
  - systemd: fix segv in snapshot creation
  - udev: hwdb - try reading modalias for usb before falling back to the composed one
  - udevd: respect the log-level set in /etc/udev/udev.conf
  - fstab-generator: respect noauto/nofail when adding sysroot mount


author: Harald Hoyer <harald@redhat.com> 206-5
changelog:
  - obsolete upstart
  Resolves: rhbz#978014
  - obsolete hal
  Resolves: rhbz#975589
  - service: always unwatch PIDs before forgetting old ones
  Resolves: rhbz#995197
  - units: disable kmod-static-nodes.service in containers
  - use CAP_MKNOD ConditionCapability
  - fstab-generator: read rd.fstab=on/off switch correctly
  - backlight: add minimal tool to save/restore screen brightness
  - backlight: instead of syspath use sysname for identifying
  - sysctl: allow overwriting of values specified in "later"
  - systemd-python: fix initialization of _Reader objects
  - udevd: simplify sigterm check
  - libudev: fix hwdb validation to look for the *new* file
  - units: make fsck units remain after exit
  - udev: replace CAP_MKNOD by writable /sys condition
  - libudev-enumerate.c:udev_enumerate_get_list_entry() fixed
  - journal: fix parsing of facility in syslog messages


author: Harald Hoyer <harald@redhat.com> 206-8
changelog:
  - support "debug" kernel command line parameter
  - journald: fix fd leak in journal_file_empty
  - journald: fix vacuuming of archived journals
  - libudev: enumerate - do not try to match against an empty subsystem
  - cgtop: fixup the online help
  - libudev: fix memleak when enumerating childs


author: Lukas Nykryn <lnykryn@redhat.com> - 207-2
changelog:
  - Advertise hibernation only if there's enough free swap
  - swap: create .wants symlink to 'auto' swap devices
  - Verify validity of session name when received from outside
  - polkit: Avoid race condition in scraping /proc
  Resolves: rhbz#1005142


author: Lukas Nykryn <lnykryn@redhat.com> - 207-5
changelog:
  - create /etc/rc.d/rc.local (#968401)
  - cgroup: always enable memory.use_hierarchy= for all cgroups (#1011575)
  - remove user@.service (#1019738)
  - drop some out-of-date references to cgroup settings (#1000004)
  - explain NAME in systemctl man page (#978954)


author: Harald Hoyer <harald@redhat.com> 207-6
changelog:
  - changed systemd-journal-gateway login shell to /sbin/nologin
  - backported a lot of bugfixes
  - udev: path_id - fix by-path link generation for scm devices
  Resolves: rhbz#888707


author: Lukas Nykryn <lnykryn@redhat.com> - 207-9
changelog:
  - treat reload failure as failure (#1036848)
  - improve journal performance (#1029604)
  - backport bugfixes (#1043525)
  - fix handling of trailing whitespace in split_quoted (#984832)
  - localed: match converted keymaps before legacy (#903776)
  - improve the description of parameter X in tmpfiles.d page (#1029604)
  - obsolete ConsoleKit (#1039761)
  - make rc.local more backward comaptible (#1039465)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 207-12
changelog:
  - shell-completion: remove load and dump from systemctl (#1048066)
  - delta: ensure that d_type will be set on every fs (#1050795)
  - tmpfiles: don't allow label_fix to print ENOENT when we want to ignore it (#1044871)
  - udev/net_id: Introduce predictable network names for Linux on System z (#870859)
  - coredumpctl: in case of error free pattern after print (#1052786)


author: Michal Sekletar <msekleta@redhat.com> - 208-1
changelog:
  - rebase to systemd-208 (#1063332)
  - do not create symlink /etc/systemd/system/syslog.service (#1055421)


author: Michal Sekletar <msekleta@redhat.com> - 208-2
changelog:
  - require redhat-release package
  - call systemd-tmpfiles after package installation (#1059345)
  - move preset policy out of systemd package (#903690)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-7
changelog:
  - setup tty permissions and group for /dev/sclp_line0 (#1070310)
  - cdrom_id: use the old MMC fallback (#1038015)
  - mount: don't send out PropertiesChanged message if actually nothing got changed (#1069718)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-8
changelog:
  - rules: mark loop device as SYSTEMD_READY=0 if no file is attached (#1067422)
  - utmp: make sure we don't write the utmp reboot record twice on each boot (#1053600)
  - rework session shutdown logic (#1047614)
  - introduce new stop protocol for unit scopes (#1064976)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-9
changelog:
  - fixes crashes in logind and systemd (#1073994)
  - run fsck before mouting root in initramfs (#1056661)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 208-11
changelog:
  - logind-session: save stopping flag (#1082692)
  - unit: add waiting jobs to run queue in unit_coldplug (#1083159)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-12
changelog:
  - units/serial-getty@.service: add [Install] section (#1083936)
  - units: order network-online.target after network.target (#1072431)
  - util: consider both fuse.glusterfs and glusterfs network file systems (#1080229)
  - core: make StopWhenUnneeded work in conjunction with units that fail during their start job (#986949)
  - cgroups-agent: down-grade log level (#1044386)
  - random-seed: raise POOL_SIZE_MIN constant to 1024 (#1066517)
  - delta: do not use unicode chars in C locale (#1088419)
  - core: print debug instead of error message (#1105608)
  - journald: always add syslog facility for messages coming from kmsg (#1113215)
  - fsck,fstab-generator: be lenient about missing fsck.<type> (#1098310)
  - rules/60-persistent-storage: add nvme pcie ssd scsi_id ENV (#1042990)
  - cgls: fix running with -M option (#1085455)
  - getty: Start getty on 3270 terminals available on Linux on System z (#1075729)
  - core: Added support for ERRNO NOTIFY_SOCKET  message parsing (#1106457)
  - socket: add SocketUser= and SocketGroup= for chown()ing sockets in the file system (#1111761)
  - tmpfiles: add --root option to operate on an alternate fs tree (#1111199)
  - units: make ExecStopPost action part of ExecStart (#1036276)
  - machine-id: only look into KVM uuid when we are not running in a container (#1123452)
  - util: reset signals when we fork off agents (#1134818)
  - udev: do not skip the execution of RUN when renaming a network device fails (#1102135)
  - man: mention System Administrator's Guide in systemctl manpage (#978948)
  - vconsole: also copy character maps (not just fonts) from vt1 to vt2, vt3, ... (#1002450)
  - localed: consider an unset model as a wildcard (#903776)
  - systemd-detect-virt: detect s390 virtualization (#1139149)
  - socket: introduce SELinuxContextFromNet option (#1113790)
  - sysctl: make --prefix allow all kinds of sysctl paths (#1138591)
  - man: mention localectl in locale.conf (#1049286)
  - rules: automatically online hot-added CPUs (#968811)
  - rules: add rule for naming Dell iDRAC USB Virtual NIC as 'idrac' (#1054477)
  - bash-completion: add verb set-property (#1064487)
  - man: update journald rate limit defaults (#1145352)
  - core: don't try to connect to d-bus after switchroot (#1083300)
  - localed: check for partially matching converted keymaps (#1109145)
  - fileio: make parse_env_file() return number of parsed items (#1069420)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-13
changelog:
  - tmpfiles: minor modernizations (#1147524)
  - install: when looking for a unit file for enabling, search for templates only after traversing all search directories (#1147524)
  - install: remove unused variable (#1147524)
  - bootctl: typo fix in help message (#1147524)
  - logind: ignore failing close() on session-devices (#1147524)
  - sysfs-show.c: return negative error (#1147524)
  - core: only send SIGHUP when doing first kill, not when doing final sigkill (#1147524)
  - cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested (#1147524)
  - core: don't send duplicate SIGCONT when killing units (#1147524)
  - efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled (#1147524)
  - macro: better make IN_SET() macro use const arrays (#1147524)
  - macro: make sure we can use IN_SET() also with complex function calls as first argument (#1147524)
  - core: fix property changes in transient units (#1147524)
  - load-modules: properly return a failing error code if some module fails to load (#1147524)
  - core/unit: fix unit_add_target_dependencies() for units with no dependencies (#1147524)
  - man: there is no ExecStopPre= for service units (#1147524)
  - man: document that per-interface sysctl variables are applied as network interfaces show up (#1147524)
  - journal: downgrade vaccuum message to debug level (#1147524)
  - logs-show: fix corrupt output with empty messages (#1147524)
  - journalctl: refuse extra arguments with --verify and similar (#1147524)
  - journal: assume that next entry is after previous entry (#1147524)
  - journal: forget file after encountering an error (#1147524)
  - man: update link to LSB (#1147524)
  - man: systemd-bootchart - fix spacing in command (#1147524)
  - man: add missing comma (#1147524)
  - units: Do not unescape instance name in systemd-backlight@.service (#1147524)
  - manager: flush memory stream before using the buffer (#1147524)
  - man: multiple sleep modes are to be separated by whitespace, not commas (#1147524)
  - man: fix description of systemctl --after/--before (#1147524)
  - udev: properly detect reference to unexisting part of PROGRAM's result (#1147524)
  - gpt-auto-generator: don't return OOM on parentless devices (#1147524)
  - man: improve wording of systemctl's --after/--before (#1147524)
  - cgroup: it's not OK to invoke alloca() in loops (#1147524)
  - core: don't try to relabel mounts before we loaded the policy (#1147524)
  - systemctl: --kill-mode is long long gone, don't mention it in the man page (#1147524)
  - ask-password: when the user types a overly long password, beep and refuse (#1147524)
  - logind: don't print error if devices vanish during ACL-init (#1147524)
  - tty-ask-password-agent: return negative errno (#1147524)
  - journal: cleanup up error handling in update_catalog() (#1147524)
  - bash completion: fix __get_startable_units (#1147524)
  - core: check the right variable for failed open() (#1147524)
  - man: sd_journal_send does nothing when journald is not available (#1147524)
  - man: clarify that the ExecReload= command should be synchronous (#1147524)
  - conf-parser: never consider it an error if we cannot load a drop-in file because it is missing (#1147524)
  - socket: properly handle if our service vanished during runtime (#1147524)
  - Do not unescape unit names in [Install] section (#1147524)
  - util: ignore_file should not allow files ending with '~' (#1147524)
  - core: fix invalid free() in killall() (#1147524)
  - install: fix invalid free() in unit_file_mask() (#1147524)
  - unit-name: fix detection of unit templates/instances (#1147524)
  - journald: make MaxFileSec really default to 1month (#1147524)
  - bootchart: it's not OK to return -1 from a main program (#1147524)
  - journald: Fix off-by-one error in "Missed X kernel messages" warning (#1147524)
  - man: drop references to removed and obsolete 'systemctl load' command (#1147524)
  - units: fix BindsTo= logic when applied relative to services with Type=oneshot (#1147524)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-15
changelog:
  - core: do not segfault if /proc/swaps cannot be opened (#1151239)
  - man: we don't have 'Wanted' dependency (#1152487)
  - environment: append unit_id to error messages regarding EnvironmentFile (#1147691)
  - udevd: add --event-timeout commandline option (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-16
changelog:
  - logind: use correct "who" enum values with KillUnit. (#1155502)
  - logind: always kill session when termination is requested (#1155502)
  - udev: net_id - correctly name netdevs based on dev_port when set (#1155996)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-17
changelog:
  - udev: net_id dev_port is base 10 (#1155996)
  - udev: Fix parsing of udev.event-timeout kernel parameter (#1154778)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 217-0.2
changelog:
  - spec fixes
  - core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies


author: Lukáš Nykrýn <lnykryn@redhat.com> - 218-0.3
changelog:
  - rebase to 218
  - remove networkd tmpfiles snipets due to packaging issues
  - add resolved subpackage
  - backport some nspawn features from upstream


author: Lukas Nykryn <lnykryn@redhat.com> - 219-2
changelog:
  - udev: restore udevadm settle timeout (#1210981)
  - udev: settle should return immediately when timeout is 0 (#1210981)
  - udev: Fix ping timeout when settle timeout is 0 (#1210981)
  - detect-virt: use /proc/device-tree (#1207773)
  - ARM: detect-virt: detect Xen (#1207773)
  - ARM: detect-virt: detect QEMU/KVM (#1207773)
  - Persistent by_path links for ata devices (#1045498)
  - man: document forwarding to syslog better (#1177336)
  - man: fix typos in previous comimt (#1177336)
  - LSB: always add network-online.target to services with priority over 10 (#1189253)
  - rules: enable memory hotplug (#1105020)
  - rules: reload sysctl settings when the bridge module is loaded (#1182105)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-3
changelog:
  - console-getty.service: don't start when /dev/console is missing (#1222517)
  - resolved: Do not add .busname dependencies, when compiling without kdbus. (#1222517)
  - man: add journal-remote.conf(5) (#1222517)
  - mount: don't run quotaon only for network filesystems (#1222517)
  - mount: fix up wording in the comment (#1222517)
  - udev: net_id - fix copy-paste error (#1222517)
  - man: don't mention "journalctl /dev/sda" (#1222517)
  - units: move After=systemd-hwdb-update.service dependency from udev to udev-trigger (#1222517)
  - units: explicitly order systemd-user-sessions.service after nss-user-lookup.target (#1222517)
  - zsh-completion: update loginctl (#1222517)
  - zsh-completion: add missing -M completion for journalctl (#1222517)
  - zsh-completion: update hostnamectl (#1222517)
  - shell-completion: systemctl switch-root verb (#1222517)
  - core/automount: beef up error message (#1222517)
  - man: remove 'fs' from 'rootfsflags' (#1222517)
  - shared: fix memleak (#1222517)
  - udevd: fix synchronization with settle when handling inotify events (#1222517)
  - python-systemd: fix is_socket_inet to cope with ports (#1222517)
  - man: fix examples indentation in tmpfiles.d(5) (#1222517)
  - systemctl: avoid bumping NOFILE rlimit unless needed (#1222517)
  - exit-status: Fix "NOTINSSTALLED" typo (#1222517)
  - tmpfiles: there's no systemd-forbid-user-logins.service service (#1222517)
  - kmod-setup: load ip_tables kmod at boot (#1222517)
  - util: Fix assertion in split() on missing ' (#1222517)
  - units: set KillMode=mixed for our daemons that fork worker processes (#1222517)
  - unit: don't add automatic dependencies on device units if they aren't supported (#1222517)
  - update-done: ignore nanosecond file timestamp components, they are not reliable (#1222517)
  - sd-daemon: simplify sd_pid_notify_with_fds (#1222517)
  - fstab-generator: add x-systemd.requires and x-systemd.requires-mounts-for (#1164334)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-4
changelog:
  - core: Fix assertion with empty Exec*= paths (#1222517)
  - rules: load sg module (#1186462)
  - util: add shell_maybe_quote() call for preparing a string for shell cmdline inclusion (#1016680)
  - bus-util: be more verbose if dbus job fails (#1016680)
  - notify: fix badly backported help message (#1199644)
  - cryptsetup: craft a unique ID with the source device (#1226333)
  - systemctl: introduce --now for enable, disable and mask (#1233081)
  - udev: also create old sas paths (#957112)
  - journald: do not strip leading whitespace from messages (#1227396)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-5
changelog:
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1199644)
  - bus-creds: always set SD_BUS_CREDS_PID when we set pid in the mask (#1230190)
  - sd-bus: do not use per-datagram auxiliary information (#1230190)
  - sd-bus: store selinux context at connection time (#1230190)
  - journald: simplify context handling (#1230190)
  - bash-completion: add verb set-property (#1235635)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-6
changelog:
  - sd-bus: don't inherit connection creds into message creds when we have a direct connection (#1230190)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-8
changelog:
  - sysv-generator test: Fix assertion (#1222517)
  - man: avoid line break in url (#1222517)
  - Add VARIANT as a standard value for /etc/os-release (#1222517)
  - Fix permissions on /run/systemd/nspawn/locks (#1222517)
  - generators: rename add_{root,usr}_mount to add_{sysroot,sysroot_usr}_mount (#1222517)
  - Generate systemd-fsck-root.service in the initramfs (#1222517)
  - units: fix typo in systemd-resolved.service (#1222517)
  - core: don't consider umask for SocketMode= (#1222517)
  - timedate: fix memory leak in timedated (#1222517)
  - coredump: make sure we vacuum by default (#1222517)
  - tmpfiles: don't fail if we cannot create a subvolume because a file system is read-only but a dir already exists anyway (#1222517)
  - resolved: fix crash when shutting down (#1222517)
  - resolved: allow DnsAnswer objects with no space for RRs (#1222517)
  - id128: add new sd_id128_is_null() call (#1222517)
  - journalctl: Improve boot ID lookup (#1222517)
  - test-hashmap: fix an assert (#1222517)
  - units: make sure systemd-nspawn@.slice instances are actually located in machine.slice (#1222517)
  - Revert "journald-audit: exit gracefully in the case we can't join audit multicast group" (#1222517)
  - journald: handle more gracefully when bind() fails on audit sockets (#1222517)
  - udev: link-config - fix corruption (#1222517)
  - udev/net_id: Only read the first 64 bytes of PCI config space (#1222517)
  - shared: generator - correct path to systemd-fsck (#1222517)
  - logind: Save the user’s state when a session enters SESSION_ACTIVE (#1222517)
  - small fix ru translation (#1222517)
  - kmod-setup: don't warn when ipv6 can't be loaded (#1222517)
  - Partially revert "ma-setup: simplify" (#1222517)
  - ima-setup: write policy one line at a time (#1222517)
  - ata_id: unbotch format specifier (#1222517)
  - install: explicitly return 0 on success (#1222517)
  - systemd.service.xml: document that systemd removes the PIDFile (#1222517)
  - core: handle --log-target=null when calling systemd-shutdown (#1222517)
  - man: ProtectHome= protects /root as well (#1222517)
  - timedatectl: trim non-local RTC warning to 80 chars wide (#1222517)
  - escape: fix exit code (#1222517)
  - man: information about available properties (#1222517)
  - journal: in persistent mode create /var/log/journal, with all parents. (#1222517)
  - sysv-generator: fix wrong "Overwriting existing symlink" warnings (#1222517)
  - mount: don't claim a device is gone from /proc/self/mountinfo before it is gone from *all* lines (#1222517)
  - mount: properly check for mounts currently in /proc/self/mountinfo (#1222517)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-9
changelog:
  - units: add [Install] section to tmp.mount
  - bus-util: add articles to explanation messages (#1016680)
  - bus-util: print correct warnings for units that fail but for which we have a NULL result only (#1016680)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-11
changelog:
  - journald-server: don't read audit events (#1252409)
  - everything: remove traces of --user (#1071363)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-12
changelog:
  - selinux: fix check for transient units (#1255129)
  - socket: fix setsockopt call. SOL_SOCKET changed to SOL_TCP. (#1135599)
  - selinux: fix missing SELinux unit access check (#1185120)
  - selinux: always use *_raw API from libselinux (#1256888)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-14
changelog:
  - Revert "sysctl.d: default to fq_codel, fight bufferbloat" (#1263158)
  - loginctl: print nontrivial properties in logictl show-* (#1260465)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-15
changelog:
  - login: fix label on /run/nologin (#1264073)
  - udev-rules: prandom character device node permissions (#1264112)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-16
changelog:
  - login: fix gcc warning, include missing header file (#1264073)
  - shutdown: make sure /run/nologin has correct label (#1264073)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-17
changelog:
  - sd-event: fix prepare priority queue comparison function (#1266479)
  - units: run ldconfig also when cache is unpopulated (#1265539)
  - selinux: fix regression of systemctl subcommands when absolute unit file paths are specified (#1185120)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-19
changelog:
  - udev: make naming for virtio devices opt-in (#1269216)
  - tmpfiles.d: don't clean SAP sockets either (#1186044)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-20
changelog:
  - run: synchronously wait until the scope unit we create is started (#1272368)
  - device: rework how we enter tentative state (#1283579)
  - core: Do not bind a mount unit to a device, if it was from mountinfo (#1283579)
  - logind: set RemoveIPC=no by default (#1284588)
  - sysv-generator: follow symlinks in /etc/rc.d/init.d (#1285492)
  - sysv-generator test: always log to console (#1279034)
  - man: RemoveIPC is set to no on rhel (#1284588)
  - Avoid /tmp being mounted as tmpfs without the user's will (#1298109)
  - test sysv-generator: Check for network-online.target. (#1279034)
  - arm/aarch64: detect-virt: check dmi (#1278165)
  - detect-virt: dmi: look for KVM (#1278165)
  - Revert "journald: turn ForwardToSyslog= off by default" (#1285642)
  - terminal-util: when resetting terminals, don't wait for carrier (#1266745)
  - basic/terminal-util: introduce SYSTEMD_COLORS environment variable (#1247963)
  - ask-password: don't abort when message is missing (#1261136)
  - sysv-generator: do not join dependencies on one line, split them (#1288600)
  - udev: fibre channel: fix NPIV support (#1266934)
  - ata_id: unreverse WWN identifier (#1273306)
  - Fixup WWN bytes for big-endian systems (#1273306)
  - sd-journal: introduce has_runtime_files and has_persistent_files (#1082179)
  - journalctl: improve error messages when the specified boot is not found (#1082179)
  - journalctl: show friendly info when using -b on runtime journal only (#1082179)
  - journalctl: make "journalctl /dev/sda" work (#947636)
  - journalctl: add match for the current boot when called with devpath (#947636)
  - man: clarify what happens when journalctl is called with devpath (#947636)
  - core: downgrade warning about duplicate device names (#1296249)
  - udev: downgrade a few warnings to debug messages (#1289461)
  - man: LEVEL in systemd-analyze set-log level is not optional (#1268336)
  - Revert "udev: fibre channel: fix NPIV support" (#1266934)
  - udev: path-id: fibre channel NPIV - use fc_vport's port_name (#1266934)
  - systemctl: is-active/failed should return 0 if at least one unit is in given state (#1254650)
  - rules: set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event (#1312011)
  - s390: add personality support (#1300344)
  - socket_address_listen - do not rely on errno (#1316452)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-21
changelog:
  - path_id: reintroduce by-path links for virtio block devices (#952567)
  - journal: fix error handling when compressing journal objects (#1292447)
  - journal: irrelevant coding style fixes (#1292447)
  - install: follow unit file symlinks in /usr, but not /etc when looking for [Install] data (#1159308)
  - core: look for instance when processing template name (#1159308)
  - core: improve error message when starting template without instance (#1142369)
  - man/tmpfiles.d: add note about permissions and ownership of symlinks (#1296288)
  - tmpfiles: don't follow symlinks when adjusting ACLs, fille attributes, access modes or ownership (#1296288)
  - udev: filter out non-sensically high onboard indexes reported by the kernel (#1230210)
  - test-execute: add tests for RuntimeDirectory (#1324826)
  - core: fix group ownership when Group is set (#1324826)
  - fstab-generator: cescape device name in root-fsck service (#1306126)
  - core: add new RandomSec= setting for time units (#1305279)
  - core: rename Random* to RandomizedDelay* (#1305279)
  - journal-remote: change owner of /var/log/journal/remote and create /var/lib/systemd/journal-upload (#1327303)
  - Add Seal option in the configuration file for journald-remote (#1329233)
  - tests: fix make check failure (#1159308)
  - device: make sure to not ignore re-plugged device (#1332606)
  - device: Ensure we have sysfs path before comparing. (#1332606)
  - core: fix memory leak on set-default, enable, disable etc (#1331667)
  - nspawn: fix minor memory leak (#1331667)
  - basic: fix error/memleak in socket-util (#1331667)
  - core: fix memory leak in manager_run_generators() (#1331667)
  - modules-load: fix memory leak (#1331667)
  - core: fix memory leak on failed preset-all (#1331667)
  - sd-bus: fix memory leak in test-bus-chat (#1331667)
  - core: fix memory leak in transient units (#1331667)
  - bus: fix leak in error path (#1331667)
  - shared/logs-show: fix memleak in add_matches_for_unit (#1331667)
  - logind: introduce LockedHint and SetLockedHint (#3238) (#1335499)
  - import: use the old curl api (#1284974)
  - importd: drop dkr support (#1284974)
  - import: add support for gpg2 for verifying imported images (#1284974)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-22
changelog:
  - nspawn: when connected to pipes for stdin/stdout, pass them as-is to PID 1 (#1307080)
  - mount: remove obsolete -n (#1339721)
  - core: don't log job status message in case job was effectively NOP (#3199) (#1280014)
  - core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification (#1305608)
  - logind: process session/inhibitor fds at higher priority (#1305608)
  - Teach bus_append_unit_property_assignment() about 'Delegate' property (#1337922)
  - sd-netlink: fix deep recursion in message destruction (#1330593)
  - add REMOTE_ADDR and REMOTE_PORT for Accept=yes (#1341154)
  - core: don't dispatch load queue when setting Slice= for transient units (#1343904)
  - run: make --slice= work in conjunction with --scope (#1343904)
  - myhostname: fix timeout if ipv6 is disabled (#1330973)
  - readahead: do not increase nr_requests for root fs block device (#1314559)
  - manager: reduce complexity of unit_gc_sweep (#3507) (#1344556)
  - hwdb: selinuxify a bit (#3460) (#1343648)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-23
changelog:
  - udevadm: explicitly relabel /etc/udev/hwdb.bin after rename (#1350756)
  - systemctl: return diffrent error code if service exist or not (#3385) (#1047466)
  - systemctl: Replace init script error codes with enum (#3400) (#1047466)
  - systemctl: rework "systemctl status" a bit (#1047466)
  - journal-verify: don't hit SIGFPE when determining progress (#1350232)
  - journal: avoid mapping empty data and field hash tables (#1350232)
  - journal: when verifying journal files, handle empty ones nicely (#1350232)
  - journal: explain the error when we find a non-DATA object that is compressed (#1350232)
  - journalctl: properly detect empty journal files (#1350232)
  - journal: uppercase first character in verify error messages (#1350232)
  - journalctl: make sure 'journalctl -f -t unmatched' blocks (#1350232)
  - journalctl: don't print -- No entries -- in quiet mode (#1350232)
  - sd-event: expose the event loop iteration counter via sd_event_get_iteration() (#1342173)
  - manager: Only invoke a single sigchld per unit within a cleanup cycle (#1342173)
  - manager: Fixing a debug printf formatting mistake (#1342173)
  - core: support IEC suffixes for RLIMIT stuff (#1351415)
  - core: accept time units for time-based resource limits (#1351415)
  - time-util: add parse_time(), which is like parse_sec() but allows specification of default time unit if none is specified (#1351415)
  - core: support <soft:hard> ranges for RLIMIT options (#1351415)
  - core: fix rlimit parsing (#1351415)
  - core: dump rlim_cur too (#1351415)
  - install: fix disable via unit file path (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-25
changelog:
  - units: increase watchdog timeout to 3min for all our services (#1267707)
  - core: bump net.unix.max_dgram_qlen really early during boot (#1267707)
  - core: fix priority ordering in notify-handling (#1267707)
  - tests: fix personality tests on ppc64 and aarch64 (#1361049)
  - systemctl: consider service running only when it is in active or reloading state (#3874) (#1362461)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
  - install: do not crash when processing empty (masked) unit file (#1159308)
  - Revert "install: fix disable via unit file path" (#1348208)
  - systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
  - tmpfiles: enforce ordering when executing lines (#1365870)
  - Introduce bus_unit_check_load_state() helper (#1256858)
  - core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
  - udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
  - rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
  - fix gcc warnings about uninitialized variables (#1318994)
  - journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
  - journalctl: Improve boot ID lookup (#1318994)
  - journalctl: only have a single exit path from main() (#1318994)
  - journalctl: free all command line argument objects (#1318994)
  - journalctl: rename boot_id_t to BootId (#1318994)
  - util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
  - journald: don't employ inner loop for reading from incoming sockets (#1318994)
  - journald: fix count of object meta fields (#1318994)
  - journal-cat: return a correct error, not -1 (#1318994)
  - journalctl: introduce short options for --since and --until (#1318994)
  - journal: s/Envalid/Invalid/ (#1318994)
  - journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
  - lz4: fix size check which had no chance of working on big-endian (#1318994)
  - journal: normalize priority of logging sources (#1318994)
  - Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
  - journal: Drop monotonicity check when appending to journal file (#1318994)
  - journalctl: unify how we free boot id lists a bit (#1318994)
  - journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
  - units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
  - logind: don't assert if the slice is missing (#1371437)
  - core: enable transient unit support for slice units (#1370299)
  - sd-bus: bump message queue size (#1371205)
  - install: fix disable when /etc/systemd/system is a symlink (#1285996)
  - rules: add NVMe rules (#3136) (#1274651)
  - rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
  - rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
  - systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
  - systemctl/core: ignore masked units in preset-all (#1375097)
  - shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
  - shared/install: ignore unit symlinks when doing preset-all (#1375097)
  - 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
  - If the notification message length is 0, ignore the message (#4237) (#1381573)
  - systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
  - 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
  - pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
  - pid1: process zero-length notification messages again (#1381573)
  - pid1: more informative error message for ignored notifications (#1381573)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
  - on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-31
changelog:
  - If the notification message length is 0, ignore the message (#4237) (#1380175)
  - systemctl: suppress errors with "show" for nonexistent units and properties (#1380259)
  - 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1375603)
  - pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1380259)
  - pid1: process zero-length notification messages again (#1380259
  - pid1: more informative error message for ignored notifications (#1380259)
  - manager: 219 needs u->id in log_unit_debug (#1380259)
  - virt: add possibility to skip the check for chroot (#1379852)
  - load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
  - core: fix assertion check (#1396312)
  - tmp.mount.hm4: After swap.target (#3087) (#1298355)
  - make sure all swap units are ordered before the swap target (#1298355)
  - Recognise Lustre as a remote file system (#4530) (#1390542)
  - unit: don't add Requires for tmp.mount (#1372249)
  - core: return 0 from device_serialize() (#1403249)
  - mtd_probe: include stdint (#1404251)
  - tests: fix failure of test-execute if /dev/mem is not available (#5028) (#1410056)
  - sd-journal: properly export has_{persistent|runtime}_files() (#1409527)
  - core: add possibility to set action for ctrl-alt-del burst (#4105) (#1353028)
  - failure-action: generalize failure action to emergency action (#1353028)
  - core: use emergency_action for ctr+alt+del burst (#1353028)
  - udev/path_id: introduce support for NVMe devices (#4169) (#1373150)
  - core: fix CapabilityBoundingSet merging (#1409586)
  - core: fix capability bounding set parsing (#1409586)
  - core: make parsing of RLIMIT_NICE aware of actual nice levels (#1409588)
  - shared: fix double free in unmask (#5005) (#1409997)
  - shared: fix double free in link (#1409997)
  - shared: check strdup != NULL (#1409997)
  - core: improve error message when RefuseManualStart(Stop) is hit (#5132) (#1026648)
  - systemctl: fix 'is-enabled' exit status on failure when executed in chroot (#4773) (#1413964)
  - man: document that the automatic journal limits are capped to 4G by default (#1418547)
  - random-seed: raise POOL_SIZE_MIN to 1024 (#1386824)
  - bash-completion: add support for --now (#5155) (#1351806)
  - basic: fix touch() creating files with 07777 mode (#1416062)
  - udev: net_id: add support for phys_port_name attribute (#4506) (#1392426)
  - install: introduce UnitFileFlags (#1413041)
  - shared, systemctl: teach is-enabled to show installation targets (#1413041)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-32
changelog:
  - udev: fix crash with invalid udev.log-priority (#1245293)
  - core: make exec code a bit more readable (#1421181)
  - core: Private*/Protect* options with RootDirectory (#1421181)
  - core: if the start command vanishes during runtime don't hit an assert (#1421658)
  - systemctl: make sure that --now is carried out (#5209) (#1417459)
  - udev: inform systemd how many workers we can potentially spawn (#4036) (#1361601)
  - service: log_unit consumes id of unit not a unit (#1421658)
  - automount: add expire support (#1354410)
  - fstab-generator: fix memleak (#1354410)
  - remove bus-proxyd (#1317518)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-33
changelog:
  - execute: Add new PassEnvironment= directive (#1426214)
  - test-execute: Add tests for new PassEnvironment= directive (#1426214)
  - test-execute: Clarify interaction of PassEnvironment= and MANAGER_USER (#1426214)
  - load-fragment: resolve specifiers in RuntimeDirectory (#1428110)
  - Add microphone mute keymap for Dell Precision (#1413477)
  - hwdb: update micmute YCODE on device node at DELL LATITUDE laptops for mic mute button. (#5012) (#1413477)
  - udev/path_id: improve and enhance bus detection for Linux on z Systems (#1274401)
  - core: port config_parse_bounding_set to extract_first_word (#1387398)
  - core: simplify parsing of capability bounding set settings (#1387398)
  - test: add test for capability bounding set parsing (#1387398)
  - capabilities: keep bounding set in non-inverted format. (#1387398)
  - capabilities: added support for ambient capabilities. (#1387398)
  - man: add AmbientCapabilities entry. (#1387398)
  - test-capability: rebase to upstream version (#1387398)
  - namespace: don't fail on masked mounts (#1433687)
  - sysv-generator: Provides: $network should also pull network.target to transaction (#5652) (#1438749)
  - Install: correctly report symlink creations (#1435098)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-35
changelog:
  - tmpfiles: add new 'e' action which cleans up a dir without creating it (#1225739)
  - util:bind_remount_recursive(): handle return 0 of set_consume() (#1433687)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-37
changelog:
  - core: add support for the "pids" cgroup controller (#1337244)
  - core: add new DefaultTasksMax= setting for system.conf (#1337244)
  - logind: add a new UserTasksMax= setting to logind.conf (#1337244)
  - core: support percentage specifications on TasksMax= (#1337244)
  - core: reinstate propagation of stop/restart jobs via RequsiteOf dependencies (#1436021)
  - core: when propagating restart requests due to deps, downgrade restart to try-restart (#1436021)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-39
changelog:
  - tests: set tasks_max to infinity (#1337244)
  - Avoid forever loop for journalctl --list-boots command (#4278) (#1294516)
  - sd-journal: return SD_JOURNAL_INVALIDATE only if journal files were actually deleted/moved (#5580) (#1446140)
  - load-fragment: don't print error about incorrect syntax when IPv6 is disabled (#1377055)
  - core: manager: add some missing dbus properties (#1427927)
  - core: manager: expose DefaultLimit* as properties on dbus (#1427927)
  - fstab-generator: remove bogus condition (#1446171)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-40
changelog:
  - readahead-collect: don't print warning message when handling symlink (#1387095)
  - tmpfiles: don't recursively descend into journal directories in /var (#1411199)
  - tmpfiles: also set acls on /var/log/journal (#1411199)
  - tmpfiles: set acls on system.journal explicitly (#1411199)
  - sysctl: configure kernel parameters in the order they occur in each sysctl configuration files (#4205) (#1382244)
  - units: drop explicit NotifyAccess setting from journald's unit file (#5749) (#1444356)
  - systemd-notify: Always pass a valid pid to sd_pid_notify (#1381743)
  - sd_pid_notify_with_fds: fix computing msg_controllen (#1381743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.1
changelog:
  - Revert "udev: net_id: add support for phys_port_name attribute (#4506)" (#1477285)
  - reintroduce naming based on phys_port_name for mlxsw and rocker via udev rule


author: David Hill <djh[at]ii.net>
changelog:
  - update to latest CVS (0.4a)
  - update Enigmail to 0.82.2
  - alter mozconfig for new build requirements
  - add missing BuildReq (#987)


author: Warren Togami <warren@togami.com> 0:0.4-0.fdr.3
changelog:
  - open-browser.sh release 3
  - patch broken /usr/bin/mozilla script during install
  - dir ownership
  - XXX: Source fails build on x86_64... fix later


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.1
changelog:
  - update Enigmail to 0.83.3
  - use official source tarball (after removing the CRLFs)
  - package renamed to thunderbird


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.4
changelog:
  - add Mozilla x86_64 patch (Oliver Sontag)
  - Enigmail source filenames now include the version
  - modify BuildRoot


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.6
changelog:
  - update open-browser script, modify BuildRequires (Warren)
  - add Blizzard's x-remote patch
  - initial attempt at x-remote-enabled startup script


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.8
changelog:
  - minor improvements to open-browser.sh and startup script
  - update to latest version of Blizzard's x-remote patch


author: David Hill <djh[at]ii.net> 0.6-0.fdr.0.20040415
changelog:
  - update to latest CVS, update mozconfig and %build accordingly
  - update to Enigmail 0.83.6
  - remove x-remote and x86_64 patches
  - build with -Os


author: David Hill <djh[at]ii.net> 0.6-0.fdr.3
changelog:
  - installation directory now versioned
  - allow root to run the program (for installing extensions)
  - remove unnecessary %pre and %post
  - remove separators, update mozconfig and launch script (M. Schwendt, #1460)


author: David Hill <djh[at]ii.net> 0.7-0.fdr.0
changelog:
  - update to 0.7
  - temporarily disable Enigmail 0.84.1, make ftp links work (#1634)
  - specify libdir, change BR for apt (V. Skyttä, #1617)


author: David Hill <djh[at]ii.net> 0.7-0.fdr.1
changelog:
  - re-enable Enigmail 0.84.1
  - add gcc-3.4 patch (Kaj Niemi)
  - use official branding (with permission)


author: David Hill <djh[at]ii.net> 0.7.2-0.fdr.0
changelog:
  - update to 0.7.2, just because it's there
  - update gcc-3.4 patch (Kaj Niemi)
  - add EM registration patch and remove instdir hack


author: David Hill <djh[at]ii.net> 0.7.3-0.fdr.1
changelog:
  - update to Thunderbird 0.7.3 and Enigmail 0.85.0
  - remove XUL.mfasl on startup, add Debian enigmail patches
  - add Xvfb hack for -install-global-extension


author: Warren Togami <wtogami@redhat.com> 0.7.3-3
changelog:
  - rawhide import
  - apply NetBSD's freetype 2.1.8 patch
  - apply psfonts patch
  - remove BR on /usr/bin/ex, breaks beehive


author: Christopher Aillon <caillon@redhat.com> 0.8.0-1
changelog:
  - Update to 0.8.0
  - Remove enigmail
  - Update BuildRequires
  - Remove gcc34 and extension manager patches -- they are upstreamed.
  - Fix for gnome-vfs2 error at component registration


author: Christopher Blizzard <blizzard@redhat.com> 0.8.0-8
changelog:
  - Pull over patches from firefox build:
    - disable default application dialog
    - don't include software update since it doesn't work
    - make external app support work


author: Christopher Aillon <caillon@redhat.com> 1.0.2-3
changelog:
  - Don't have downloads "disappear" when downloading to desktop (#139015)
  - Fix for some more cursor issues in textareas (149991, 150002, 152089)
  - Add upstream patch to fix bidi justification of pango
  - Add patch to fix launching of helper applications
  - Add patch to properly link against libgfxshared_s.a
  - Fix multilib conflicts


author: Kristian Høgsberg <krh@redhat.com> 1.0.2-7
changelog:
  - Add firefox-1.0-pango-cairo.patch to get rid of the last few Xft
    references, fixing the "no fonts" problem.


author: Christopher Aillon <caillon@redhat.com> - 1.5-0.5.3.rc1
changelog:
  - Once again, disable ppc64 because of a new issue.
    See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175944

  - Use the system NSS libraries
  - Build on ppc64


author: Christopher Aillon <caillon@redhat.com> - 1.5-0.5.6.rc1
changelog:
  - Fix crash when deleting highlighted text while composing mail within
    plaintext editor with spellcheck enabled.


author: Christopher Aillon <caillon@redhat.com> - 1.5.0.5-5
changelog:
  - Update nopangoxft.patch
  - Fix rendering of MathML thanks to Behdad Esfahbod.
  - Update start page text to reflect the MathML fixes.
  - Enable pango by default on all locales
  - Build using -rpath
  - Re-enable GCC visibility


author: Christopher Aillon <caillon@redhat.com> - 1.5.0.7-2
changelog:
  - Fix crash when changing gtk key theme
  - Prevent UI freezes while changing GNOME theme
  - Remove verbiage about pango; no longer required by upstream.


author: Christopher Aillon <caillon@redhat.com> 1.5.0.8-1
changelog:
  - Update to 1.5.0.8
  - Allow choosing of download directory
  - Take the user to the correct directory from the Download Manager.
  - Patch to add support for printing via pango from Behdad.


author: Christopher Aillon <caillon@redhat.com> 1.5.0.9-7
changelog:
  - Updated cursor position patch from tagoh to fix issue with "jumping"
    cursor when in a textfield with tabs.


author: Christopher Aillon <caillon@redhat.com> 2.0.0.0-0.5.rc1
changelog:
  - Fix the desktop file
  - Clean up the files list
  - Remove the default client stuff from the pref window


author: Christopher Aillon <caillon@redhat.com> 2.0.0.6-4
changelog:
  - Fix crashes when using GTK+ themes containing a gtkrc which specify 
    GtkOptionMenu::indicator_size and GtkOptionMenu::indicator_spacing


author: Jan Horak <jhorak@redhat.com> - 3.0-2.beta2
changelog:
  - Fixed clicked link does not open in browser (#489120)
  - Fixed missing help in thunderbird (#488885)


author: Remi Collet <fedora@famillecollet.com> - 3.1.6-8
changelog:
  - fix cairo + nspr required version
  - lightning: fix thunderbird version required
  - lightning: fix release (b3pre)
  - lightning: clean install


author: Christopher Aillon <caillon@redhat.com> - 3.1.9-7
changelog:
  - Make gvfs-open launch a compose window (salimma)
  - Spec file cleanups (salimma, caillon)
  - Split out mozilla crashreporter symbols to its own debuginfo package (caillon)


author: Jan Horak <jhorak@redhat.com> - 8.0-2
changelog:
  - Enable Mozilla's crash reporter again for all archs
  - Temporary workaround for langpacks
  - Disabled addon check UI (#753551)


author: Martin Stransky <stransky@redhat.com> - 14.0-4
changelog:
  - Removed StartupWMClass (rhbz#844863)
  - Fixed -g parameter
  - Removed thunderbird-devel before packing to avoid debugsymbols duplicities (rhbz#823940)


author: Martin Stransky <stransky@redhat.com> - 24.2.0-4
changelog:
  - Fixed rhbz#1024232 - thunderbird: squiggly lines used 
    for spelling correction disappear randomly


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.15-1
changelog:
  - Update spec for renamed README.md. (dgoodwin@redhat.com)
  - Moves fakevirt._decode() to util.decode() (csnyder@redhat.com)
  - Adds the report.config.name to log message when refusing to send a report due
    to lack of change (csnyder@redhat.com)
  - VirtWho: Clears list of reports on reload (csnyder@redhat.com)
  - Revises change detection tests to account for changes in master
    (csnyder@redhat.com)
  - Libvirtd: Sends a report on start up, and on events (csnyder@redhat.com)
  - Removes trailing line at the end of the file (csnyder@redhat.com)
  - Test_Esx: Test Oneshot to ensure it queues a report (csnyder@redhat.com)
  - Esx: only queue data if the version has changed (csnyder@redhat.com)
  - Test_VirtWho:Patches manager.Manager.fromOptions, removes unnecessary mocks
    (csnyder@redhat.com)
  - Removes unhelpful debug log message (csnyder@redhat.com)
  - Fix spacing, remove unused imports (csnyder@redhat.com)
  - Test_VirtWho: Adds test to show same report will not be sent twice
    (csnyder@redhat.com)
  - VirtWho: Adds basic change detection using report hashs (csnyder@redhat.com)
  - Adds hash property to config (csnyder@redhat.com)
  - Adds hash property to DomainListReport and HypervisorGuestAssociationReport
    (csnyder@redhat.com)
  - Hypervisor: Adds getHash class method (csnyder@redhat.com)
  - Limits interval settings (wpoteat@redhat.com)
  - Retry sending data to subscription manager multiple times before dropping
    (rnovacek@redhat.com)
  - SubscriptionManager: nicely order keys in debug report (rnovacek@redhat.com)
  - Fix serialization of guest list in print mode (rnovacek@redhat.com)
  - Do not exit oneshot mode if any job exists (rnovacek@redhat.com)
  - SubscriptionManager: check if report result has failedUpdate item
    (rnovacek@redhat.com)
  - SubscriptionManager: minor logging fixes (rnovacek@redhat.com)
  - SubscriptionManager: add env var to disable asynchronous reporting
    (rnovacek@redhat.com)
  - Check jobs status in increasing interval (rnovacek@redhat.com)
  - Esx: report host even if it doesn't have any guests (rnovacek@redhat.com)
  - Hypervisors reported by hyperv now include hostname. (csnyder@redhat.com)
  - Removes completed jobs. (csnyder@redhat.com)
  - Fix output format in print mode (rnovacek@redhat.com)
  - Fix using empty list as default parameter value (rnovacek@redhat.com)
  - satellite: support new hypervisor format (rnovacek@redhat.com)
  - Fix tests failures (rnovacek@redhat.com)
  - Removes timeouts for jobs. All jobs in the list are now executed just before
    a new report is sent. (csnyder@redhat.com)
  - The virtwho loop now blocks on the report queue with a one second timeout
    (csnyder@redhat.com)
  - Removes unnecessary imports and queue (csnyder@redhat.com)
  - Rewrite readme to markdown syntax (rnovacek@redhat.com)
  - CI: install unittest2 from pypi (rnovacek@redhat.com)
  - CI: add -y option to add-apt-repository (rnovacek@redhat.com)
  - CI: another attempt on cloud archive for libvirt (rnovacek@redhat.com)
  - CI: try to install newer version of libvirt from cloud archive
    (rnovacek@redhat.com)
  - CI: add libvirt-dev dependency (rnovacek@redhat.com)
  - CI: install libvirt-python via pip (rnovacek@redhat.com)
  - CI: another attempt without site-packages (rnovacek@redhat.com)
  - CI: install python-rhsm dependencies (rnovacek@redhat.com)
  - Adds support for facts in Hypervisor profile. (csnyder@redhat.com)
  - Adds count of unchanged mappings to the info logged for the result of an
    async job (csnyder@redhat.com)
  - Adds tests for jobs in virtwho, removes unnecessary tests for managerprocess.
    (csnyder@redhat.com)
  - Changes to ensure backwards compatibility with python-rhsm
    (csnyder@redhat.com)
  - Fixes RhevM.getHostGuestMapping() as suggested by rnovacek
    (csnyder@redhat.com)
  - Adds layer to hypervisorId. Removes completed TODO (csnyder@redhat.com)
  - Moves all functionality of managerprocess into virtwho. (csnyder@redhat.com)
  - CI: use python with system side packages enabled (rnovacek@redhat.com)
  - CI: install m2crypto using apt instead of pip (rnovacek@redhat.com)
  - CI: install python-libvirt using apt instead of pip (rnovacek@redhat.com)
  - Add requirements.txt and .travis.yml for the CI (rnovacek@redhat.com)
  - Adds tests to verify the hostGuestAssociation is generated correctly.
    (csnyder@redhat.com)
  - Updates libvirtd and tests to add host name to hypervisor profile
    (csnyder@redhat.com)
  - Updates managerprocess with better logging and changes for the new tests.~~
    (csnyder@redhat.com)
  - Updates to use the new hypervisor class (csnyder@redhat.com)
  - print mode: format debug message about found hypervisors
    (rnovacek@redhat.com)
  - Removing uncesasary comments (csnyder@redhat.com)
  - Removes unused dictionary of jobs and associated methods.
    (csnyder@redhat.com)
  - Fixes tests data to include "status" key. (csnyder@redhat.com)
  - Updates tests to make use of new Hypervisor class. (csnyder@redhat.com)
  - Host name is now included in the hypervisor profile using the new Hypervisor
    class (csnyder@redhat.com)
  - Adds new Hypervisor class. (csnyder@redhat.com)
  - Adds new test for the updates to subscriptionmanager.py (csnyder@redhat.com)
  - Updates fakevirt to make use of virt.Guest classes (csnyder@redhat.com)
  - Changes to ensure proper execution post-merge (csnyder@redhat.com)
  - Removing more unnecessary prints (csnyder@redhat.com)
  - Fixes oneshot mode for work with new managerprocess (csnyder@redhat.com)
  - Cleaning up unneeded prints and adding more useful debug log messages
    (csnyder@redhat.com)
  - Adds async job status polling for use with the new report API
    (csnyder@redhat.com)
  - This (along with python-rhsm/csnyder/new_report_api ee38f15, allows
    communication with new report api (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.19-1
changelog:
  - 1415497: Support rhev4 auto detection and usage (pcreech@redhat.com)
  - 1388577: Adding UTF-8 support (pcreech@redhat.com)
  - 1410000: Include org_id in hv base channel (pcreech@redhat.com)
  - 1400431: Fix AttributeError where val is missing (pcreech@redhat.com)
  - 1405967: Filter host via glob or regex (pcreech@redhat.com)
  - Adds --password option to virt-who-pasword (tstrachota@redhat.com)
  - 1392390 Fix default interval handling (pcreech@redhat.com)
  - BZ1405967  Add filter_hosts_regex, and exclude_hosts_regex to allow filtering
    large numbers of hosts easily (chris@chrisprocter.co.uk)
  - 1369107: Only load files with .conf extension (pcreech@redhat.com)
  - 1383436: Obey the interval setting (csnyder@redhat.com)
  - 1299643: Update virt-who-config man page to include NO_PROXY
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-2
changelog:
  - 1437229: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - 1437228: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-3
changelog:
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - 1436811: Send reports on the interval per destination (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-4
changelog:
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-5
changelog:
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)


author: Daniel Veillard <veillard@redhat.com> 1.2.1-1
changelog:
  - initial packaging based on the upstream one and libxml2 one.
  - desactivated mozilla-nss due to detection/architecture problems


author: Daniel Veillard <veillard@redhat.com> 1.2.7-1
changelog:
  - Upstream release of 1.2.7, mostly bug fixes plus new functions
    to GetKeys from simple store and X509 handling.


author: Christopher Aillon <caillon@redhat.com> 1.2.9-4
changelog:
  - NSS has been split out of the mozilla package, so require that now
    and update separate_nspr.patch to account for the new NSS as well


author: Tom "spot" Callaway <tcallawa@redhat.com> - 1.2.16-1
changelog:
  - update to 1.2.16
  - cleanup spec file
  - disable static libs
  - disable rpath
  - enable gcrypt subpackage


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1.2.19-3
changelog:
  - Fix duplicate documentation (#1001250)
  - Turn on verbose build output via V=1 make
  - Use %?_isa in explicit package deps
  - Fix base package Group tag to "System Environment/Libraries"
  - Remove %defattr


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


