# changelog

author: Steve Dickson <steved@redhat.com> 1.2.3-71
changelog:
  - rpc.mountd: set libtirpc nonblocking mode to avoid DO (bz 1301581)
  - nfsidmap: Clean up other exit status cases (bz 1313603)
  - gssd: Fix inner-loop variable reuse (bz 1313090)
  - mount.nfs manpage: Add nfsmount.conf (bz 1302981)
  - nfs.init: Set exit code on restarts (bz 1205055)


author: Steve Dickson <steved@redhat.com> 1.2.3-73
changelog:
  - mountd: fix is_subdirectory to understand '/' (bz 1331207)
  - mount.nfs: Fix for the bug in v1.2.4 that breaks mount.nfs (bz 1208385)
  - mount.nfs: Removed supported flag from usage string (bz 1000990)
  - mountd.man: Update to change -P option as an alias for -p (bz 1037926)
  - exportfs: Deal with path's trailing "/" in unexportfs_parsed() (bz 1276538)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1352856)


author: Christopher Aillon <caillon@redhat.com> 4.6-4
changelog:
  - Use the NSPR version numbering scheme reported by NSPR,
    which unfortunately is not exactly the same as the real
    version (4.6 != 4.6.0 according to RPM and pkgconfig).


author: Christopher Aillon <caillon@redhat.com>
changelog:
  - Stop shipping static libraries; NSS and dependencies no longer
    require static libraries to build.


author: Kai Engert <kengert@redhat.com> 4.6.1-2
changelog:
  - Do not use -ansi when compiling, because of a compilation
    problem with latest glibc and anonymous unions.
    See also bugzilla.mozilla.org # 322427.


author: Kai Engert <kengert@redhat.com> - 4.6.5-2
changelog:
  - Update to latest ipv6 upstream patch
  - Add upstream patch to fix a thread cleanup issue
  - Now requires pkgconfig


author: Kai Engert <kengert@redhat.com> - 4.6.6-2
changelog:
  - Update thread-cleanup patch to latest upstream version
  - Add upstream patch to support PR_STATIC_ASSERT


author: Elio Maldonado <emaldona@redhat.com> - 4.9.5-3
changelog:
  - Bump the release tag so it's higher than the one for rhel-6.4.z
  - Resolves: rhbz#919180 - Rebase to nspr-4.9.5


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-1
changelog:
  - Update Version to 4.10.0 to prevent Mozilla apps update problems as
  - reported and fixed on https://bugzilla.redhat.com/show_bug.cgi?id=981166
  - Resolves: rhbz#1002643 - Rebase RHEL 6 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Rebase to nspr-4.10.2
  - Resolves: rhbz#1032488 - CVE-2013-5607 (MFSA 2013-103) Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269361 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297891 - Rebase RHEL 6.8 to NSPR 4.11 in preparation for Firefox 45


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-14
changelog:
  - Fix bug where user was prompted for a password when listing keys on an empty system database (#527048)
  - Fix setup-nsssysinit to handle more general flags formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.8
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Fix nsssysinit to enable apps to use the system cert store, patch contributed by David Woodhouse (#546221)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)
  - Sysinit requires coreutils for post install scriplet (#547067)
  - Remove redundant header from the pem module


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.1
changelog:
  - Updated to 3.12.5 from CVS import from Fedora 12
  - Moved blank legacy databases to the lookaside cache
  - Reenabled the full test suite
  - Retagging for a RHEL-6-test-build


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.3
changelog:
  - Resolves: #551784 rebuilt after nss-softokn and nss-util builds
  - this will generate the coorect nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Appying the changes in previous log
  - Changing some BuildRequires to >= as well
  - Temporarily disabling all tests for faster builds


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - Resolves: Bug 784674 - nss should protect against being called before nss_Init
  - Resolves: Bug 784490 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-1
changelog:
  - Rebase to nss-3.14.0.0-1
  - Resolves: rhbz#837089
  - Update ssl-cbc-random-iv patch for new sources
  - Remove patches rendered obsoleted by rebase to 3.14
  - Add a patch to enforce no pkcs11 bypass


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Syncup with uptream changes for aes gcm and ecc suiteb
  - Enable ecc support for suite b
  - Apply several upstream AES GCM fixes
  - Use the pristine nss upstream sources with ecc included
  - Export NSS_ENABLE_ECC=1 in both the build and the check sections
  - Make failed requests for unsupoprted ssl pkcs 11 bypass non fatal
  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must preserve ABI
  - Related:  rhbz#918950  - rebase nss to 3.14.3


author: Kai Engert <kaie@redhat.com> - 3.14.3-33
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.
    Please ensure that older packages that don't use the alternatives
    system for libnssckbi.so have a smaller n-v-r.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-34
changelog:
  - Fix race condition in cert code related to smart cards
  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-37
changelog:
  - Do not hold issuer certificate handles in the crl cache
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-1
changelog:
  - Rebase to NSS_3.15.1_RTM
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x) 
  - Update patches on account of the shallow tree with the rebase to 3.15.1
  - Update the pem module sources  nss-pem-20130405.tar.bz2 with latest patches applied
  - Remove patches rendered obsolete by the nss rebase and the updated nss-pem sources
  - Enable the iquote.patch to access newly introduced types


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix relative path in %check section to prevent undetected test failures
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Disable the cipher suite already run as part of the nss-softokn build
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-6
changelog:
  - Fix all.sh test for which application was last build by updating nss-versus-softoken-test.path
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Kai Engert <kaie@redhat.com> - 3.15.1-7
changelog:
  - Additional syntax fixes in nss-versus-softoken-test.patch
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-8
changelog:
  - Don't require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-9
changelog:
  - Rebuild for the pem module to link with freel from nss-softokn-3.14.3-6.el6
  - Related: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]
  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP clients


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-10
changelog:
  - Restore a mistakenly removed patch
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-11
changelog:
  - Fix the test for zero failures in the %check section
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to NSS_3_15_3_RTM
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741
  - Resolves: Bug 1031238 - deadlock in trust domain lock and object lock


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Build nss without softoken, freebl, or util sources in the build source tree
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042686 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - make derEncodingsMatch work with encrypted keys
  - rename a patch, dropped the experimental moniker from it
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Fix the numbering and naming of the patches
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Install man pages for the nss security tools
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Improve support for ECDSA algorithm via pluggable ECC
  - Document the purpose of the iquote.patch
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-10
changelog:
  - Prevent users from disabling the internal crypto module
  - Resolves: Bug 1059176 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-11
changelog:
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree
  - Add define-uint32.patch to deal with using older version of nss-softokn
  - Fix suboptimal test failure detection shell code in the %check section


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-2
changelog:
  - Restore use of indentation patch until another bug is resolved
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-3
changelog:
  - Fix pem module trashing of private keys on failed login
  - Resolves: Bug 1002205 - PEM module trashes private keys if login fails


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-5
changelog:
  - Move removal of directories to the end of the %prep section
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-6
changelog:
  - Update pem sources to the same ones used on rhel-7
  - Remove no longer needed patches on account of this update
  - Resolves: Bug 1002205


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1123092 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Resolves: Bug 1131311 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824
  - Temporarily disable some tests until expired PayPalEE.cert is renewed


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.3
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Require softokn build 22 to ensure runtime compatibility.
  - Relax the requirement from pkcs11-devel to nss-softokn-freebl-devel
    to allow same or newer.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289890


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-2
changelog:
  - Enable two additional ciphers and keep another one disabled
  - Prevent enabling extended masker key derive


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Fix syntax errors in patch that disables sslv2 tests
  - Resolves: Bug 1297888 - Rebase RHEL 6.8 to NSS 3.21 for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.27.1
  - Remove nss-646045.patch, which is not necessary
  - Remove p-disable-md5-590364-reversed.patch,
    which is no-op here, because the patched code is removed later in
    %setup
  - Remove disable_hw_gcm.patch, which is no-op here, because the
    patched code is removed later in %setup.  Also remove
    NSS_DISABLE_HW_GCM setting, which was only required for RHEL 5
  - Add Bug-1001841-disable-sslv2-libssl.patch and
    Bug-1001841-disable-sslv2-tests.patch, which completedly disable
    EXPORT ciphersuites.  Ported from RHEL 7
  - Remove disable-export-suites-tests.patch, which is covered by
    Bug-1001841-disable-sslv2-tests.patch
  - Remove nss-ca-2.6-enable-legacy.patch, as we decided to not allow
    1024 legacy CA certificates
  - Remove ssl-server-min-key-sizes.patch, as we decided to support DH
    key size greater than 1023 bits
  - Remove nss-init-ss-sec-certs-null.patch, which appears to be no-op,
    as it clears memory area allocated with PORT_ZAlloc()
  - Remove nss-disable-sslv2-libssl.patch,
    nss-disable-sslv2-tests.patch, sslauth-no-v2.patch, and
    nss-sslstress-txt-ssl3-lower-value-in-range.patch as SSLv2 is
    already disabled in upstream
  - Remove fix-nss-test-filtering.patch, which is fixed in upstream
  - Add nss-check-policy-file.patch from Fedora
  - Install policy config in /etc/pki/nss-legacy/nss-rhel6.config


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-7
changelog:
  - Add patch to check if hash algorithms are backed by a token
  - Add patch to disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256,
    which have never enabled in the past


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-9
changelog:
  - Update fix_multiple_open patch to fix regression in openldap client
  - Remove pk11_genobj_leak patch, which caused crash with Firefox
  - Add comment in the policy file to preserve the last empty line
  - Disable SHA384 ciphersuites when CKM_TLS12_KEY_AND_MAC_DERIVE is not
    provided by softoken; this superseds check_hash_impl patch


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-10
changelog:
  - Add patch to fix SSL CA name leaks, taken from NSS 3.27.2 release
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Add patch to remove duplicate ciphersuites entries in sslinfo.c
  - Add patch to abort selfserv/strsclnt/tstclnt on non-parsable version range
  - Build with support for SSLKEYLOGFILE


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-11
changelog:
  - Adjust the sslstress.txt filename so that it matches with the
    disableSSL2tests patch ported from RHEL 7
  - Exclude SHA384 and CHACHA20_POLY1305 ciphersuites from stress tests
  - Don't add gtests and ssl_gtests to nss_tests, unless gtests are enabled


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-1
changelog:
  - Rebase to 3.28.3
  - Remove upstreamed moz-1282627-rh-1294606.patch,
    moz-1312141-rh-1387811.patch, moz-1315936.patch, and
    moz-1318561.patch
  - Remove no longer necessary nss-duplicate-ciphers.patch
  - Disable X25519 and exclude tests using it
  - Catch failed ASN1 decoding of RSA keys, by Kamil Dudka (#1427481)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Rebase to NSS 3.36.0 BETA
  - Remove upstreamed nss-is-token-present-race.patch
  - Revert the upstream changes that default to sql database


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Use the correct tarball of NSS 3.36 release
  - Ignore EncryptDeriveTest which only works with newer nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-5
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-3
changelog:
  - Update the tarball from upstream to version 38cd629e5c3c
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which can't
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Don't include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but can't
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they're not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-6
changelog:
  - Let snmp automatically pull in lm_sensors-devel if required
    and available on that arch (its not on s390x)


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.0-0.1-00d9bcac8775.hg
changelog:
  - Related: rhbz#rhbz#543948
  - Update the tarball from upstream to version 00d9bcac8775
    + High: PE: Bug 2213 - Ensure groups process location constraints so that clone-node-max works for cloned groups
    + High: PE: Bug lf#2153 - Update regression tests
    + High: PE: Bug lf#2153 - non-clones shouldn't restart when clones stop/start on other nodes
    + High: PE: Bug lf#2209 - Clone ordering should be able to prevent startup of dependant clones
    + High: PE: Bug lf#2216 - Correctly identify the state of anonymous clones when deciding when to probe
    + High: PE: Bug lf#2225 - Operations that require fencing should wait for 'stonith_complete' not 'all_stopped'.
    + High: PE: Bug lf#2225 - Prevent clone peers from stopping while another is instance is (potentially) being fenced
    + High: PE: Correctly anti-colocate with a group
    + High: PE: Correctly unpack ordering constraints for resource sets to avoid graph loops
    + High: Replace stonithd with the new fencing subsystem
    + High: cib: Ensure the loop searching for a remote login message terminates
    + High: cib: Finally fix reliability of receiving large messages over remote plaintext connections
    + High: cib: Fix remote notifications
    + High: cib: For remote connections, default to CRM_DAEMON_USER since thats the only one that the cib can validate the password for using PAM
    + High: cib: Remote plaintext - Retry sending parts of the message that didn't fit the first time
    + Medium: PE: Bug lf#2206 - rsc_order constraints always use score at the top level
    + Medium: PE: Provide a default action for resource-set ordering
    + Medium: PE: Silently fix requires=fencing for stonith resources so that it can be set in op_defaults
    + Medium: ais: Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf
    + Medium: cib: Create valid notification control messages
    + Medium: cib: Indicate where the remote connection came from
    + Medium: cib: Send password prompt to stderr so that stdout can be redirected
    + Medium: extra: Add the daemon parameter to the controld metadata
    + Medium: fencing: Re-engineer the stonith daemon to support RHCS agents
    + Medium: tools: Make crm_mon functional with remote connections
    + Medium: xml: Bug bnc#552713 - Treat node unames as text fields not IDs
    + Medium: xml: Bug lf#2215 - Create an always-true expression for empty rules when upgrading from 0.6


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.0-1
changelog:
  - Related: rhbz#543948
  - Update the tarball from upstream to version 07ab245be519
    + High: crmd: Always connect to stonith
    + High: crmd: Ensure batch-limit is correctly enforced
    + High: crmd: Ensure we have the latest status after a transition abort
    + High: Fencing: Overhaul the fencing daemon
    + High: PE: Bug lf#2153 - non-clones shouldn't restart when clones stop/start on other nodes - improved
    + Medium: PE: Allow resource sets to be reused between ordering and colocation constraints
    + Medium: PE: Implement serializing order constraints that dont cause restarts or inhibit migration
    + Medium: PE: Include node attributes for the node to be fenced
    + Medium: PE: Make crm_simulate a full replacement for ptest
    + Medium: PE: Only complain about target-role=master for non m/s resources
    + Medium: PE: Prevent non-multistate resources from being promoted through target-role
    + Medium: PE: Simplify the rsc_order syntax - don't make funky inferences based on score
    + Medium: PE: Support serialized sets of resources
    + Medium: Tools: Bug lf#2286 - Allow the shell to accept template parameters on the command line
    + Medium: Tools: Bug lf#2307 - Provide a way to determin the nodeid of past cluster members
    + Medium: Tools: crm: add update method to template apply (LF 2289)
    + Medium: Tools: crm: direct RA interface for stonith class resource agents (LF 2270)
    + Medium: Tools: crm: don't remove sets which contain id-ref attribute (LF 2304)
    + Medium: Tools: crm: exclude locations when testing for pathological constraints (LF 2300)
    + Medium: Tools: crm: fix exit code on single shot commands
    + Medium: Tools: crm: fix node delete (LF 2305)
    + Medium: Tools: crm: implement -F (--force) option
    + Medium: Tools: crm: rename status to cibstatus (LF 2236)
    + Medium: Tools: crm: stay in crm if user specified level only (LF 2286)


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.1-1
changelog:
  - Resolves: rhbz#559868
  - Split off the doc package as it has grown quite large
  - Split off the cluster test suite (CTS) so that it can be used by other projects
  - Update the tarball from upstream to version 46e288ab9014
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: Agents: Prevent shell expansion of '*' when there are files in /var/lib/heartbeat/cores/root
    + High: ais: Bug lf#2340 - Force rogue child processes to terminate after waiting 2.5 minutes
    + High: ais: Bug lf#2359 - Default expected votes to 2 inside Corosync/OpenAIS plugin
    + High: ais: Bug lf#2359 - expected-quorum-votes not correctly updated after membership change
    + High: ais: Bug rhbz#525552 - Move non-threadsafe calls to setenv() to after the fork()
    + High: crmd: Bug bnc#578644 - Improve handling of cancelled operations caused by resource cleanup
    + High: crmd: Make sure we wait for fencing to complete before continuing
    + High: crmd: Prevent use-of-NULL when non-DCs get stonith callbacks
    + High: Fencing: Account for stonith_get_info() always returning a pointer to the same static buffer
    + High: Fencing: Bug bnc#577007 - Correctly parse the hostlist output from stonith agents
    + High: Fencing: Correctly parse arg maps and do not return a provider for unknown agents
    + High: fencing: Fix can_fence_host_with_device() logic and improve hostlist output parsing
    + High: PE: Bug lf#2358 - Fix master-master anti-colocation
    + High: PE: Correctly implement optional colocation between primitives and clone resources
    + High: PE: Suppress duplicate ordering constraints to achieve orders of magnitude speed increases for large clusters
    + High: Shell: move scores from resource sets to the constraint element (lf#2331)
    + High: Shell: recovery from bad/outdated help index file
    + Medium: Shell: implement lifetime for rsc migrate and node standby (lf#2353)
    + Medium: Shell: node attributes update in configure (bnc#582767)


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-2
changelog:
  - Do not build on ppc and ppc64.
    Resolves: rhbz#590992
  - Rebase on new upstream release
    + High: ais: Do not count votes from offline nodes and calculate current votes before sending quorum data
    + High: ais: Ensure the list of active processes sent to clients is always up-to-date
    + High: ais: Look for the correct conf variable for turning on file logging
    + High: ais: Use the threadsafe version of getpwnam
    + High: Core: Bug lf#2414 - Prevent use-after-free reported by valgrind when doing xpath based deletions
    + High: Core: fix memory leaks exposed by valgrind
    + High: crmd: Bug 2401 - Improved detection of partially active peers
    + High: crmd: Bug lf#2379 - Ensure the cluster terminates when the PE is not available
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the PE connection after it dies
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the stonith-ng connection
    + High: crmd: Do not allow the target_rc to be misused by resource agents
    + High: crmd: Do not ignore action timeouts based on FSA state
    + High: crmd: Ensure we dont get stuck in S_PENDING if we loose an election to someone that never talks to us again
    + High: crmd: Fix memory leaks exposed by valgrind
    + High: crmd: Remove race condition that could lead to multiple instances of a clone being active on a machine
    + High: crmd: Send erase_status_tag() calls to the local CIB when the DC is fenced, since there is no DC to accept them
    + High: crmd: Use global fencing notifications to prevent secondary fencing operations of the DC
    + High: PE: Bug lf#2317 - Avoid needless restart of primitive depending on a clone
    + High: PE: Bug lf#2361 - Ensure clones observe mandatory ordering constraints if the LHS is unrunnable
    + High: PE: Bug lf#2383 - Combine failcounts for all instances of an anonymous clone on a host
    + High: PE: Bug lf#2384 - Fix intra-set colocation and ordering
    + High: PE: Bug lf#2403 - Enforce mandatory promotion (colocation) constraints
    + High: PE: Bug lf#2412 - Correctly locate clone instances by their prefix
    + High: PE: Don ot be so quick to pull the trigger on nodes that are coming up
    + High: PE: Fix memory leaks exposed by valgrind
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: PE: Rewrite native_merge_weights() to avoid Fix use-after-free
    + High: Shell: always reload status if working with the cluster (bnc#590035)
    + High: Shell: check timeouts also against the default-action-timeout property
    + High: Shell: Default to using the status section from the live CIB (bnc#592762)
    + High: Shell: edit multiple meta_attributes sets in resource management (lf#2315)
    + High: Shell: enable comments (lf#2221)
    + High: Tools: crm_mon - fix memory leaks exposed by valgrind


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-3
changelog:
  - Resolves: rhbz#590667
  - Rebase on new upstream release
    + High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-5
changelog:
  - Resolves: rhbz#594296 - rpmdiff checks
    + Remove legacy scripts
    + Add missing man pages
    + Fix sub-package version requires


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-6
changelog:
  - Resolves: rhbz#610815 - add cman support
    + High: cib: Also free query result for xpath operations that return more than one hit
    + High: cib: Fix the application of unversioned diffs
    + High: Core: Correctly unpack HA_Messages containing multiple entries with the same name
    + High: Core: Resolve coverity RESOURCE_LEAK defects
    + High: crmd: All nodes should see status updates, not just he DC
    + High: crmd: Allow non-DC nodes to clear failcounts too
    + High: crmd: Base DC election on process relative uptime
    + High: crmd: Make sure the membership cache is accurate after a sucessful fencing operation
    + High: crmd: Make sure we always poke the FSA after a transition to clear any TE_HALT actions
    + High: crmd: Prevent segmentation fault
    + High: PE: Avoid creating invalid ordering constraints for probes that are not needed
    + High: PE: Bug lf#1959 - Fail unmanaged resources should not prevent other services from shutting down
    + High: PE: Bug lf#2422 - Ordering dependencies on partially active groups not observed properly
    + High: PE: Bug lf#2424 - Use notify oepration definition if it exists in the configuration
    + High: PE: Bug lf#2433 - No services should be stopped until probes finish
    + High: PE: Correctly detect when there is a real failcount that expired and needs to be cleared
    + High: PE: Correctly handle pseudo action creation
    + High: PE: Fix colocation for interleaved clones
    + High: PE: Fix colocation with partially active groups
    + High: PE: Fix potential use-after-free defect from coverity
    + High: PE: Fix use-after-free in order_actions() reported by valgrind
    + High: PE: Prevent endless loop when looking for operation definitions in the configuration
    + High: stonith: Correctly parse pcmk_host_list parameters that appear on a single line
    + High: tools: crm_simulate - Resolve coverity USE_AFTER_FREE defect


author: Andrew Beekhof <andrew@beekhof.net> 1.1.2-7
changelog:
  - Resolves: rhbz#610815 - add cman support
    + High: ais: Use service slot 10 to avoid conflicting with cman


author: Andrew Beekhof <andrew@beekhof.net> 1.1.4-1
changelog:
  - Resolves: rhbz#668466
  - Update tarball to upstream version: 3ac6ac993d6d
    + Performance improvements for larger clusters
    + Miscellaneous bug fixes


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.5-1
changelog:
  - Fix rpmlint warnings
  - Rebase on new upstream release
    See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details
    + Bugs lf#2445, lf#2493, lf#2508, lf#2518, lf#2527, lf#2544,
           lf#2545, lf#2550, lf#2551, lf#2554, lf#2558, bnc#665131
  - Resolves: rhbz#676286 - Add per device 'diag' option to pacemaker stonith action


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.5-2
changelog:
  - Fix cman integration
  - Resolves: rhbz#684838 - Correctly notify fenced of a successful fencing event
  - Resolves: rhbz#684825 - Ensure Pacemaker uses the most recent membership/quorum information


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.5-6
changelog:
  - Update tarball to upstream version: b933cbea41b5
  - Resolves: rhbz#708797
  - Resolves: rhbz#451848
  - Resolves: rhbz#708722
  - Resolves: rhbz#720136


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.6-1
changelog:
  - Update tarball to upstream version: a02c0f1
    See included ChangeLog file or, for full details:
      https://github.com/ClusterLabs/pacemaker/compare/a12de08...a02c0f1
  - Do not build in support for snmp, esmtp by default
  - Create a package for cluster unaware libraries to minimze our footprint
    on non-cluster nodes
  - Better subpackage descriptions
  - Resolves: rhbz#743175


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.7-1
changelog:
  - Update tarball to upstream version: 148fccf
    See included ChangeLog file or, for full details:
      https://github.com/ClusterLabs/pacemaker/compare/148fccf...a12de08
  - Add libqb-devel as a build dependancy
  - Resolves: rhbz#782255 rhbz#754216 rhbz#729035
  - Related:  rhbz#790627


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.7-2
changelog:
  - Update patch level to upstream version: c26e624
  - Resolves: rhbz#720214 rhbz#720218 rhbz#754216 rhbz#789397
    For full details, see:
      https://github.com/ClusterLabs/pacemaker/compare/c26e624...148fccf


author: David Vossel <dvossel@redhat.com> - 1.1.7-3
changelog:
  - Add libqb-devel as a dependancy of pacemaker-libs-devel
  - Medium: PE: Report resources as active in correct data about resource location
    Resolves:  rhbz#799070
  - Low: Tools: Bug rhbz#801351 - Fix crm_report help text
    Resolves: rhbz#801351


author: David Vossel <dvossel@redhat.com> - 1.1.7-5
changelog:
  - Use default value for HB_DAEMON_DIR define when clusterglue does not provide one.
    Resolves: rhbz#808557


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-1
changelog:
  - Rebuild for upstream 1.1.8 release
  - Resolves: rhbz#816875

  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

    + New IPC implementation from libqb
    + New logging implementation from libqb
    + Quieter - info, debug and trace logs are no longer sent to syslog
    + Dropped dependancy on cluster-glue
    + Config and core directories no longer located in heartbeat directories
    + Support for managing systemd services
    + Rewritten local resource management daemon
    + Version bumps for every shared library due to API cleanups
    + Removes crm shell, install/use pcs shell and GUI instead


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-2
changelog:
  - Fix internal package dependancies
  - Resolves: rhbz#816875

  - Update to upstream 0b45588
    + Correctly disable syslog output when requested
    + Warn about node names containing a capital letter
    + Do not start fencing until entire device topology is found or query results timeout.
    + Allow nodes to use a name other than uname()


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-4
changelog:
  - Resolves: rhbz#816875
  - Update to upstream db9410b

    + Cluster: Detect node name collisions in corosync
    + Cluster: Strip domains from node names by default
    + Core: Prevent ordering changes when applying xml diffs
    + Fencing: On failure, only try a topology device once from the remote level.
    + Fencing: Retry stonith device for duration of action's timeout period.
    + Fencing: Support 'on_target' option in fencing device metadata for forcing unfence on target node
    + mcp: Re-attach to existing pacemaker components when mcp fails
    + pengine: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + pengine: Bug cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + pengine: Correctly unpack active anonymous clones
    + pengine: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + pengine: Support resources that require unfencing before start


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-5
changelog:
  - Resolves: rhbz#877364
  - Update to upstream e69dfc1

    + attrd: Correctly handle deletion of non-existant attributes
    + cib: Do not pass local variables to mainloop_add_fd() when creating remote connections
    + Cluster: Do not strip the domain from node names calculated from uname(2)
    + Core: Supply the correct number of arguments for the format string
    + corosync: Avoid errors when closing failed connections
    + fencing: Automatically append 'nodeid' to fencing agent args if it is detected agent supports 'nodeid' parameter
    + mcp: chmod the correct directory instead of /var/run
    + pengine: Prevent double-free for cloned primitive from template


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-6
changelog:
  - Resolves: rhbz#877364
  - Update to upstream d20d06f

    + cib: Avoid use-after-free by correctly support cib_no_children for non-xpath queries
    + cib: Remove text nodes from cib replace operations
    + Cluster: Preserve corosync membership state when matching node name/id entries
    + cman: Do not wait for unmanaged resources during shutdown
    + cman: Ensure reliable shutdown
    + cman: Ignore qdisk 'nodes'
    + Core: Prevent use-of_NULL in IPC code
    + corosync: Ensure peer state is preserved when matching names to nodeids
    + crmd: Avoid filling the ipc queue with data we don't need
    + crmd: Prevent election storms caused by getrusage() values being too close
    + Fencing: Correctly terminate when all device options have been exhausted
    + Fencing: Record delegated self-fencing operations in case they fail
    + legacy: Re-enable logging from the pacemaker plugin
    + pengine: Bug rhbz#880249 - Ensure orphan masters are demoted before being stopped
    + pengine: Bug rhbz#880249 - Teach the PE how to recover masters into primitives
    + pengine: Ensure previous migrations are completed before attempting another one
    + tools: crm_report - Fix node list detection


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-7
changelog:
  - Resolves: rhbz#880249
  - Update to upstream ca7bf5e

    + Fencing: Only try peers for non-topology based operations once
    + tools: Have crm_resource generate a valid transition key when sending resource commands to the crmd


author: Andrew Beekhof <andrew@beekhof.net> 1.1.10-1
changelog:
  - Update source tarball to revision: Pacemaker-1.1.10
  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

  - Resolves: rhbz#891766
  - Resolves: rhbz#902407
  - Resolves: rhbz#908450
  - Resolves: rhbz#913093
  - Resolves: rhbz#951340
  - Resolves: rhbz#951371
  - Related: rhbz#987355


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-3
changelog:
  + Fix: pengine: Do not restart resources that depend on unmanaged resources
    + Fix: crmd: Prevent recurring monitors being cancelled due to notify operations


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-4
changelog:
  + Fix: crmd: Prevent crash by passing log arguments in the correct order
    + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state
    + Fix: pengine: Do not allow colocation with blocked clone instances


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-5
changelog:
  + Fix: systemd: Prevent glib assertion - only call g_error_free with non-NULL arguments
    + Fix: systemd: Prevent additional use-of-NULL assertions in g_error_free
    + Fix: logging: glib CRIT messages should not produce core files in the background
    + Fix: crmd: Correcty update the history cache when recurring ops change their return code
    + Log: crm_mon: Unmangle the output for failed operations
    + Log: cib: Correctly log short-form xml diffs
    + Log: pengine: Better indicate when a resource has failed


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-7
changelog:
  + Fencing: Support agents that need the host to be unfenced at startup
      Resolves: rhbz#996850
    + Fix: crm_report: Collect corosync quorum data
      Resolves: rhbz#989292


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-8
changelog:
  + Fix: mcp: Remove LSB hints that instruct chkconfig to start pacemaker at boot time
      Resolves: rhbz#997346


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-9
changelog:
  + Fix: xml: Location constraints are allowed to specify a role
    + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised
      Resolves: rhbz#902407


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-10
changelog:
  - Remove unsupported resource agent
      Resolves: rhbz#1005678
  - Provide a meaningful error if --master is used for primitives and groups


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-11
changelog:
  + Fix: cman: Do not start pacemaker if cman startup fails
    + Fix: Fencing: Observe pcmk_host_list during automatic unfencing
      Resolves: rhbz#996850


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-12
changelog:
  - Fix: Consistently use 'Slave' as the role for unpromoted master/slave resources
      Resolves: rhbz#1011618
  - Fix: pengine: Location constraints with role=Started should prevent masters from running at all
      Resolves: rhbz#902407
  - Fix: crm_resource: Observe --master modifier for --move
      Resolves: rhbz#902407


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-14
changelog:
  - Log: crmd: Supply arguments in the correct order
      Resolves: rhbz#996850
  - Fix: Invalid formatting of log message causes crash
      Resolves: rhbz#996850


author: David Vossel <dvossel@redhat.com> - 1.1.10-15
changelog:
  - Fix: Removes unnecessary newlines in crm_resource -O output
      Resolves: rhbz#1038155
  - Fix: lrmd: Correctly cancel monitor actions for lsb/systemd/service resources on cleaning up (cherry picked from commit 1c14b9d69470ff56fd814091867394cd0a1cf61d)
      Resolves: rhbz#1046131
  - Fix: services: Fixes segfault associated with cancelling in-flight recurring operations.
      Resolves: rhbz#1046131


author: David Vossel <dvossel@redhat.com> - 1.1.10-16
changelog:
  - Fix: pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078954


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-1
changelog:
  - Update to upstream release 1.1.12-rc3
  - The CIB has O(2) better performance and updates are applied with greater reliablity
  - Transient attributes are now recorded in a truely atomic manner
  - Supports fencing agents that need the host to be unfenced at startup
  - CIB ACLs have been reimplemented and are now enabled 
  - Various bugs squashed

  - Resolves: rhbz#1020210 rhbz#1036631 rhbz#1069279
  - Resolves: rhbz#1069795 rhbz#1071995


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-2
changelog:
  - Bug rhbz#1054307 - cname pattern match should be more restrictive in init script
      Resolves: rhbz#1054307


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-3
changelog:
  - Fix: crmd: avoid double free caused by nested hash table removal
  - Fix: ignore SIGPIPE with gnutls is in use
  - Fix: cib: cl#5222 - Prevent assert in xml_calculate_changes() on performing cib operations
      Resolves: rhbz#1071995


author: David Vossel <dvossel@redhat.com> - 1.1.12-5
changelog:
  - Properly clear shutdown transient attribute after node leaves
    membership.

    Resolves: rhbz#1198638


author: David Vossel <dvossel@redhat.com> - 1.1.12-6
changelog:
  - Fixes invalid free in attrd
  - Fixes crm_mon -E option for external script.
  - Fixes acl read-only access role assignment.

    Resolves: rhbz#1205292
    Resolves: rhbz#1208896
    Resolves: rhbz#1207621


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-7
changelog:
  - Ensure relevant components clear cache entries are cleared when peers leave the cluster

    Resolves: rhbz#1193499


author: David Vossel <dvossel@redhat.com> - 1.1.12-8
changelog:
  - Reduce log severity for style upgrade notice.
   - Properly export pacemaker related sysconfig variables
   - Remove warning during yum update of pacemaker packages.

    Resolves: rhbz#1163982
    Resolves: rhbz#1177821
    Resolves: rhbz#1210291


author: Klaus Wenninger <kwenning@redhat.com> - 1.1.14-1.0
changelog:
  - Update to upstream release 1.1.14
   - added README_RGManager_porting to document replacement of
       ccs2cib, ccs_flatten & disable_rgmanager
   - added patchset (0100-0111) from master to implement graceful
       stop of pacemaker_remote
   - require minimum-version 0.17.0 of libqb

    Resolves: rhbz#1193499
    Resolves: rhbz#1195500
    Resolves: rhbz#1200853
    Resolves: rhbz#1215809
    Resolves: rhbz#1219103
    Resolves: rhbz#1235316
    Resolves: rhbz#1246490
    Resolves: rhbz#1246563
    Resolves: rhbz#1252206
    Resolves: rhbz#1257333
    Resolves: rhbz#1275223
    Resolves: rhbz#1287535
    Resolves: rhbz#1297564


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-3
changelog:
  - prevent crmd crash after unexpected Pacemaker Remote connection takeover
   - ensure package URL is displayed correctly

    Resolves: rhbz#1252206


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-1
changelog:
  - Rebase to upstream e174ec84857e087210b9dacee3318f8203176129 (1.1.15)

    Resolves: rhbz#1253325
    Resolves: rhbz#1312040
    Resolves: rhbz#1322595
    Resolves: rhbz#1326350
    Resolves: rhbz#1356727


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-2
changelog:
  - Include upstream fixes to init scripts
   - ClusterMon resource should verify pid is crm_mon's
   - Fix CVE-2016-7035

    Resolves: rhbz#1322595
    Resolves: rhbz#1360234
    Resolves: rhbz#1374775


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-3
changelog:
  - Show correct help and error messages in attrd_updater
   - Preserve rolling upgrades involving Pacemaker Remote nodes
   - Update status of clufter in README_RGManager_porting

    Resolves: rhbz#1388558
    Resolves: rhbz#1389028


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-4
changelog:
  - crm_report should avoid grep on binary logs
   - document that clufter is now supported

    Resolves: rhbz#1405205


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-1
changelog:
  - Rebase to upstream bfe4e8042065eb61506cd3ff10fc5f02dd2f3bb7 (1.1.18 plus patches)
   - Resolves: rhbz#1388102
   - Resolves: rhbz#1427643
   - Resolves: rhbz#1500510
   - Resolves: rhbz#1513199


author: Juan Antonio Martinez <jonsito at teleline.es 0:0.5-1
changelog:
  - upgrade to 0.5beta1 version
  - BuildRequires now complains compilation of html manual from xml file


author: Juan Antonio Martinez <jonsito at teleline.es 0:0.5.2-0
changelog:
  - Updated to 0.5.2 release
  - Changed /etc/pkcs11 for /etc/pam_pkcs11
  - Changed /usr/share/pkcs11_login for /usr/share/pam_pkcs11
  - Next item is change package name to pam_pkcs11


author: Robert Relyea <rrelyea at redhat.com> 0.5.3-6
changelog:
  - Include the login token in the environment
  - Conditionally turn on OCSP
  - Treat uninitialized tokens as not present.


author: Ray Strode <rstrode@redhat.com> 0.5.3-7
changelog:
  - add new wait_for_card option that stalls auth process
    until a card is inserted
  - if the user is reauthenticating (already logged in, but
    say unlocking the screen) then only treat the token the
    user logged in with as a valid authentication token
  - clean up "smart card" word.  Before we had a mix of 
    "smartcard", "Smart Card", "SmartCard", and "smart card" 
    i think.
  - only say "Please insert your smart card." instead of
    "Please insert your Smart Card or enter username" if 
    username based login isn't allowed.


author: Robert Relyea <rrelyea@redhat.com> 0.5.3-13
changelog:
  - Fix the default mapping order.
  - Make ocsp support controlled by a config entry.
  - Fix login crash
  - revert to explicit paths until we can fix 'login' and 'authconfig'


author: Robert Relyea <rrelyea@redhat.com> 0.5.3-15
changelog:
  - add l10n support
  - correct mapper order.
  - login should allow SSL Client Auth certs rather than restricting to Email
    Signing certs.


author: Robert Relyea <rrelyea@redhat.com> 0.5.3-17
changelog:
  - restrict reauthentication to the token used in the inital login.
  - don't require reauthentication apps to log into a token if the user
    didn't initally log into the token.
  - handle the case where we have more than one token.


author: Robert Relyea <rrelyea@redhat.com> 0.5.3-19
changelog:
  - Fix problem where pin was not being passed in the pam password variable
    correctly. Needed for Kerberos PKInit


author: Robert Relyea <rrelyea@redhat.com> 0.5.3-20
changelog:
  - Use pam_syslog rather than syslog (patch by Tmraz).
  - Signal to the user that change password is not supported by pam_pkcs11.


author: Robert Relyea <rrelyea@redhat.com> 0.5.3-21
changelog:
  - update password supported patch.
  - fix bug where the user and smart card prompt was coming up in login after
    the username had been entered.
  - use pam_ignore for the case where we always want to drop to the other
    pam_modules.
  - add environment variables for the certificate used to authenticate.


author: Bob Relyea <rrelyea@redhat.com> - 0.6.2-1
changelog:
  - Pick up the latest pam_pkcs11 from upstream

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild


author: Bob Relyea <rrelyea@redhat.com> 0.6.2-11.1
changelog:
  - Silence expected errors from the console
  - make sure change log has correct dates and email
    Resolves: #654460, #586149


author: Bob Relyea <rrelyea@redhat.com> 0.6.2-13
changelog:
  - If the ssl part is specified for ldap, default to ldaps unless
    otherwise specified in the .conf file


author: Bob Relyea <rrelyea@redhat.com> 0.6.2-14
changelog:
  - Handle PKCS #11 modules when NSS or pam_pkcs11 only specify a partial path
  - Fix coverity issues (found in 7.0 coverity scan)


author: Chris Feist <cfeist@redhat.com> - 0.9.26-6
changelog:
  - Added additional specific steps for configuring pcs on Red Hat Enterprise
    Linux 6
  - Resolves: rhbz#878682


author: Chris Feist <cfeist@redhat.com> - 0.9.26-9
changelog:
  - pcs now allows assigning constraints to group/clone/multistate resources
  - pcs no longer deletes resources from the lrm during resource removal
  - Resolves: rhbz#894174 rhbz#893221


author: Chris Feist <cfeist@redhat.com> - 0.9.26-10
changelog:
  - Removed one extra place where pcs incorrectly deleted resources from the lrm
  - Resolves: rhbz#893221


author: Chris Feist <cfeist@redhat.com> - 0.9.73-1
changelog:
  - Cluster name is now viewable on RHEL 6
  - Cluster.conf is now removed on destroy
  - Misc man page & usage updates
  - When removing the last resource from a group, remove any constraints still
    remaining on group


author: Chris Feist <cfeist@redhat.com> - 0.9.74-1
changelog:
  - pcs cluster edit should now work properly
  - Allow removal of group and resources inside group with
    pcs resource delete <group name>


author: Chris Feist <cfeist@redhat.com> - 0.9.75-1
changelog:
  - Removing a resource that is part of a resource set is now allowed
  - When you try to remove a group from a master that has more than one
    resource you now recieve a helpful error
  - Unclone works on clones where constraints have been added
  - Removing a group with constraints now works properly
  - Master/Slave groups now have constraints properly removed before being
    deleted


author: Chris Feist <cfeist@redhat.com> - 0.9.76-1
changelog:
  - Renamed resource group remove/delete to ungroup
  - Fixed moving resource masters
  - Allow cloing/mastering last resource in a group


author: Chris Feist <cfeist@redhat.com> - 0.9.77-1
changelog:
  - Fixed managing/unmanaging groups/clones/masters of resources
  - Fixed issue when using --group when creating a resource


author: Chris Feist <cfeist@redhat.com> - 0.9.78-1
changelog:
  - Fixed error codes and stdout/stderr output on errors from pcs resource
    enable/disable
  - Automatically add interval to operations which don't specify an interval


author: Chris Feist <cfeist@redhat.com> - 0.9.79-1
changelog:
  - Fixed OCF_CHECK_LEVEL operation setting in resource update
  - Return proper error codes when stopping/starting/enable/disabling resources
  - Return proper error code on auth


author: Chris Feist <cfeist@redhat.com> - 0.9.80-1
changelog:
  - More fixes for OCF_CHECK_LEVEL issues
  - Fix traceback when adding a resourcew with a provider that doesn't exist
  - Create proper two_node cluster when only two nodes are specified in cluster
    setup
  - Give useful error when bad options are used with 'op'


author: Chris Feist <cfeist@redhat.com> - 0.9.81-1
changelog:
  - Fix issues when updating resource with multiple operations with the same
    action
  - Fixed constraint rules and improved usage documentation


author: Chris Feist <cfeist@redhat.com> - 0.9.82-1
changelog:
  - Show constraint id when printing out location rules
  - Improve error messages when adding location rules with errors
  - Add ability to remove constraint rules
  - Allow move of master/slave resources if --master is present


author: Chris Feist <cfeist@redhat.com> - 0.9.87-1
changelog:
  - Allow two ordering constraints with same resources
  - Improved error messages when trying to master/clone resources
  - Updated error message when attempting to move a master/slave without
    --master


author: Chris Feist <cfeist@redhat.com> - 0.9.88-1
changelog:
  - Don't allow order/colocation constraints created for master primitives
  - Check in clones for stonith resources
  - Clarify 'constraint rule add' in man page/usage
  - Fixed minor usage issue with colocation sets


author: Chris Feist <cfeist@redhat.com> - 0.9.89-1
changelog:
  - Show location constraint role in pcs status/constraint
  - Disable resource before removing
  - Misc man/usage fixes


author: Chris Feist <cfeist@redhat.com> - 0.9.90-1
changelog:
  - Add ability to set node attributes
  - Fix issue setting meta attributes on a master when creating a resource


author: Chris Feist <cfeist@redhat.com> - 0.9.101-1
changelog:
  - Rebase for new features
  - Added ability to set uidgid in cluster.conf
  - Stonith level add now properly recognizes nodes
  - Resolves: rhbz#1025053 rhbz#1019410


author: Chris Feist <cfeist@redhat.com> - 0.9.101-3
changelog:
  - When creating a resource using --group/--clone/--master put the group
    inside the master/clone/group before putting it into the live CIB
  - Resolves: rhbz#1066927


author: Chris Feist <cfeist@redhat.com> - 0.9.118-2
changelog:
  - Re-synced to upstream sources
  - Fixed dependency on rubygems
  - Fixed pam long timeouts due to fprintd
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.120-2
changelog:
  - Use /usr/sbin/pcs for pcs instead of /sbin/pcs
  - Use Open4 instead of POpen4 for running commands
  - Fixed cluster setup for RHEL6
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.121-1
changelog:
  - Don't try to get metadata for fence_check, fence_tool & fence_node
  - Cloned M/S groups can now be deleted
  - Clone options can now follow --clone
  - Cloned resources with globally-unique=true can now be deleted
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.123-3
changelog:
  - Added ability to upgrade cluster cib and we auto upgrade cib if we're running
    an acl command (except show or help)
  - Resolves: rhbz#1112727


author: Chris Feist <cfeist@redhat.com> - 0.9.123-4
changelog:
  - Fixed resource delete for clones of groups with more than one resource
  - Fixed unclone of group so all resources are removed
  - Resolves: rhbz#1107612 rhbz#1108778


author: Chris Feist <cfeist@redhat.com> - 0.9.123-6
changelog:
  - Fixed issue with sync cluster.conf & adding uid/gid across cluster on RHEL6 w/ pcsd
  - Resolves: rhbz#1102836


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.138-1
changelog:
  - Rebased to latest upstream packages
  - Fixed creating default resource operations
  - Added support for RRP and corosync options for cman based clusters
  - Allowed scope=configuration in cib commands
  - Added support for configuring a cluster remotely using pcsd
  - Fixed globally-unique clone resources in pcsd
  - Added resource location to resources / stonith devices list
  - Fixed formatting of resource / fence agent description
  - Fence agent description now contains information about the agent
  - Parallelized cluster start and cluster stop
  - Added warning when nodes stop will cause a loss of the quorum
  - pcs status --full now displays Node attributes and Migration summary
  - Resolves: rhbz#1185738 rhbz#1031141 rhbz#1121769 rhbz#1126835 rhbz#1160359 rhbz#1168986 rhbz#1174244 rhbz#1174793 rhbz#1174798 rhbz#1174801 rhbz#1184763 rhbz#1184922


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-1
changelog:
  - Rebased to latest upstream packages
  - Fixed constraints removal and node standby/unstandby using remote GUI
  - Fixed displaying of fence / resource agent metadata in GUI
  - Added Pacemaker Resource defaults and Op defaults to 'pcs config' output
  - Fixed 'pcs resource clear' used on cloned group
  - Added support for scope option in cib commands
  - Added warning when creating a cluster with UDPU transport
  - Reload cluster.conf after node addition / removal
  - Resolves: rhbz#1185738 rhbz#1168982 rhbz#1174793 rhbz#1187488 rhbz#1190167 rhbz#1190168 rhbz#1191898 rhbz#1193433


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.145-1
changelog:
  - Rebased to latest upstream packages
  - Added a warning to "pcs cluster setup" when a node is already in a cluster
  - Fixes in help text and man page
  - Rubygems built with RELRO
  - Added option to put a node into maintenance mode
  - Ungrouping the last resource from a cloned group no longer produces an invalid CIB
  - Removing a resource from a group no longer removes constraints referencing that group
  - Fixed session and cookies processing
  - Fixed command injection vulnerability
  - Added support for exporting cluster configuration to a list of pcs commands using clufter
  - Added automatic removal of old config file backups
  - Fixed removing a fence device from fence levels on deleting the device
  - Resolves: rhbz#1260021 rhbz#1190732 rhbz#1203802 rhbz#1230368 rhbz#1242158 rhbz#1243744 rhbz#1245721 rhbz#1247883 rhbz#1247979 rhbz#1253288 rhbz#1253292 rhbz#1264795 rhbz#1273391 rhbz#1275254


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.146-1
changelog:
  - Rebased to latest upstream packages
  - Rubygems built with RELRO
  - Resolves: rhbz#1260021 rhbz#1242158


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.148-1
changelog:
  - Rebased to latest upstream packages
  - Fixed crashes on one-node clusters
  - Resolves: rhbz#1260021 rhbz#1283627


author: Ivan Devat <idevat@redhat.com> - 0.9.148-2
changelog:
  - Moved DISABLED_GUI option to /etc/sysconfig/pcsd
  - Added backend support for new cluster properties form in web UI
  - Fixed multilib .pyc/.pyo issue
  - Resolves: rhbz#1297782 rhbz#1298163


author: Ivan Devat <idevat@redhat.com> - 0.9.148-3
changelog:
  - Fixed updating cluster properties from older version of web UI
  - Fixed syntax error in utilization attributes functions
  - Resolves: rhbz#1298163
  - Related: rhbz#1260021


author: Ivan Devat <idevat@redhat.com> - 0.9.154-1
changelog:
  - Rebased to latest upstream packages
  - Keep a cluster qauorate as long as possible when shutting it down
  - Fixed disabling TLSv1.1 in pcsd
  - Fixed error message in node maintenance/unmaintenance commands
  - Fixed adding a node when fencing configuration has been manually changed in cluster.conf
  - Make pcsd init script wait for pcsd to fully start
  - Gracefully handle errors when reading cluster properties definition
  - Resolves: rhbz#1373874 rhbz#1353738 rhbz#1344928 rhbz#1369029 rhbz#1319070 rhbz#1328870 rhbz#1325459


author: Ivan Devat <idevat@redhat.com> - 0.9.155-1
changelog:
  - Rebased to latest upstream packages
  - When stopping a cluster with some of the nodes unreachable, stop the cluster completely on all reachable nodes
  - Fixed occasional crashes / failures when using locale other than en_US.UTF8
  - Added SBD support for cman clusters
  - Added alerts management in web UI
  - Resolves: rhbz#1373874 rhbz#1315748 rhbz#1380372 rhbz#1387106 rhbz#1380352 rhbz#1376480


author: Ivan Devat <idevat@redhat.com> - 0.9.155-2
changelog:
  - Fixed upgrading CIB to the latest schema version
  - Adding a node in a cluster does not cause the new node to be fenced immediately
  - Fixed handling of HTTP communication failure
  - Added dependency on cman
  - Resolves: rhbz#1397408 rhbz#1394846 rhbz#1394273 rhbz#1394857


author: Ondrej Mular <omular@redhat.com> - 0.9.155-3
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Resolves: rhbz#1557962


author: David Sommerseth <davids@redhat.com> - 3.10.7-3
changelog:
  - Fixed even more .spec file issues and removed explicit mentioning
    of /usr/share/python-dmidecode/pymap.xml


author: Nima Talebi <nima@it.net.au> - 3.10.8-1
changelog:
  - New Upstream release.
  - Big-endian and little-endian approved.
  - Packaged unit-test to tarball.
  - Rewritten unit-test to be able to run as non-root user, where it will not
    try to read /dev/mem.
  - Added two dmidump data files to the unit-test.


author: Roman Rakus <rrakus@redhat.com> - 3.10.13-1
changelog:
  - Update to 3.10.13 release
    Resolves: #621567, #627901, #667363
  - Signal handler for SIGILL
    Resolves #646429


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - Update description
  - Remove other distros from SPEC
  - Changed license
  - Change Source0 to Sourceforge
  - Resolves: #981637


author: Steve Dickson <steved@redhat.com> 0.1.4-1
changelog:
  - Initial commit
  - Spec reviewed (bz 228894)
  - Added the Provides/Obsoletes which should
    cause rpcbind to replace portmapper


author: Steve Dickson <steved@redhat.com> 0.1.4-2
changelog:
  - Added dependency on glibc-common which allows the
    rpcinfo command to be installed in the correct place.
  - Added dependency on man-pages so the rpcinfo man 
    pages don't conflict.
  - Added the creation of /var/lib/rpcbind which will be
    used to store state files.
  - Make rpcbind run with the 'rpc' uid/gid when it exists.


author: Jeremy Katz <katzj@redhat.com> - 0.1.4-4
changelog:
  - change man-pages requires into a conflicts as we don't have to have 
    man-pages installed, but if we do, we need the newer version


author: Steve Dickson <steved@redhat.com> 0.1.4-5
changelog:
  - Added dependency on setup which contains the correct
    rpcbind /etc/service entry which in turns stops 
    rpcbind from haning when NIS is enabled. (bz 236865)


author: Steve Dickson <steved@redhat.com> 0.1.4-8
changelog:
  - Fixed typo in init script (bz 248285)
  - Added autoconf rules to turn on secure host checking
    via libwrap. Also turned on host check by default (bz 248284)
  - Changed init script to start service in runlevel 2 (bz 251568)
  - Added a couple missing Requires(pre) (bz 247134)


author: Steve Dickson <steved@redhat.com> 0.1.4-11
changelog:
  - Reworked logic in initscript so the correct exit is 
    used when networking does not exist or is set up
    incorrectly.


author: Steve Dickson <steved@redhat.com> 0.1.4-12
changelog:
  - Changed is_loopback() and check_access() see if the calling
    address is an address on a local interface, just not a loopback
    address (bz 358621).


author: Steve Dickson <steved@redhat.com> 0.1.4-13
changelog:
  - Fixed connectivity with Mac OS clients by making sure handle_reply()
    sets the correct fromlen in its recvfrom() call (bz 244492)


author: Steve Dickson <steved@redhat.com> 0.1.4-14
changelog:
  - Fixed a warning in pmap_svc.c
  - Cleaned up warmstarts so uid are longer needed, also
    changed condrestarts to use warmstarts. (bz 428496)


author: Steve Dickson <steved@redhat.com> 0.1.6-2
changelog:
  - Added usptream patches 01 thru 03 that do:
      * Introduce helpers for ipprot/netid mapping
      * Change how we decide on the netids to use for portmap
      * Simplify port live check in pmap_svc.c


author: Steve Dickson <steved@redhat.com> 0.1.6-3
changelog:
  - Fixed a typo in the rpcbind.init script that stop warm starts
    from happening with conrestarts
  - Fixed scriptlet failure (bz 462533)


author: Steve Dickson <steved@redhat.com> - 0.2.0-2
changelog:
  - Fixed pre scriptle failure during upgrades (bz 507364)
  - Corrected the usage info to match what the rpcbind man
      page says. (bz 466332)
  - Correct package issues (bz 503508)


author: Steve Dickson <steved@redhat.com> - 0.2.0-10
changelog:
  - Make is_loopback check more permissive (bz 731542)
  - Removed the rpcbind(3) reference in the man page (bz 813898)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - adjust for rpmdb index name change
  - drop unnecessary vendor-macro patch for real
  - add ISA-dependencies among rpm subpackages
  - make lzma and sqlite deps conditional and disabled by default for now


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - rpm 4.5.90-0.git8424.1 (alpha snapshot)
  - adjust to build against Berkeley DB 4.5.20 from compat-db for now
  - add posttrans to clean up db environment mismatch after upgrade
  - forward-port devel autodeps patch


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8426.5
  - flip back to external bdb
  - fix tab vs spaces complaints from rpmlint
  - add dep for lzma and require unzip instead of zip in build (#310694)
  - add pkgconfig dependency to rpm-devel
  - drop ISA-dependencies for initial introduction
  - new snapshot from upstream for documentation fixes


author: Florian Festi <ffesti@redhat.com>
changelog:
  - 4.5.90-0.git8426.10
  - rpm-4.5.90-posttrans.patch
  - use header from rpmdb in posttrans to make anaconda happy


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8461.1
  - new snapshot from upstream
  - fixes #68290, #455972, #446202, #453364, #456708, #456103, #456321, #456913,
    - partial fix for #457360


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - add support for noarch subpackages
  - fix segfault in case of insufficient disk space detected (#460146)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - fix parsing of boolean expressions in spec (#456103)
    (unbreaks pam, jpilot and maybe other builds)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - create directory structure for rpmbuild prior to build if it doesn't exist (#455387)
  - create _topdir if it doesn't exist when installing SRPM
  - don't generate broken cpio in case of hardlink pointing on softlink,
    thanks to pixel@mandriva.com


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - add hack to support extracting gstreamer plugin provides (#438225)
  - fix another macro argument handling regression (#461180)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to official 4.5.90 alpha tarball 
  - a big pile of misc bugfixes + translation updates
  - isa-macro generation fix for ppc (#464754)
  - avoid pulling in pile of perl dependencies for an unused script
  - handle both "invalid argument" and clear env version mismatch on posttrans


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc1 
  - fixes #465586, #466597, #465409, #216221, #466503, #466009, #463447...
  - avoid using %configure macro for now, it has unwanted side-effects on rpm


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - Make noarch sub-packages actually work
  - Fix defaultdocdir logic in installplatform to avoid hardwiring mandir


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc2
  - fixes #471820, #473167, #469355, #468319, #472507, #247374, #426672, #444661
  - enable automatic generation of pkg-config and libtool dependencies #465377


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.2
changelog:
  - change platform sharedstatedir to something more sensible (#185862)
  - add rpmdb_foo links to db utils for documentation compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.3
changelog:
  - extract mimehandler provides from .desktop files
  - preliminaries for extracting font provides (not enabled yet)
  - dont classify font metrics data as fonts
  - only run script dep extraction once per file, duh


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-1
changelog:
  - update to 4.6.0 final
  - revert libmagic looking into compressed files for now, breaks ooffice build


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-4
changelog:
  - inherit group tag from the main package (#470714)
  - ignore BuildArch tags for anyarch actions (#442105)
  - don't check package BuildRequires when doing --rmsource (#452477)
  - don't fail because of missing sources when only spec removal
    is requested (#472427)


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-5
changelog:
  - remove two offending hunks from anyarch patch causing that
    RPMTAG_BUILDARCHS isn't written to SRPMs


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-7
changelog:
  - loosen up restrictions on dependency names (#455119)
  - handle inter-dependent pkg-config files for requires too (#473814)
  - error/warn on elf binaries in noarch package in build


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-0.beta1.9
changelog:
  - fix recorded file state of otherwise skipped files (#492947)
  - compress ChangeLog, drop old CHANGES file (#492440)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-1
changelog:
  - update to 4.7.0 final (http://rpm.org/wiki/Releases/4.7.0)
  - fixes #494049, #495429
  - dont permit test-suite failure anymore


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-2
changelog:
  - file classification tweaks for text files (#494817)
    - disable libmagic text token checks, it's way too error-prone
    - consistently classify all text as such and include description


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-3
changelog:
  - couple of merge-review fixes (#226377)
    - eliminate bogus leftover rpm:rpm rpmdb ownership
    - unescaped macro in changelog
  - fix find-lang --with-kde with KDE3 (#466009)
  - switch back to default file digest algorithm


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-4
changelog:
  - split cron-job into a sub-package to avoid silly deps on core rpm (#500722)
  - rpm requires coreutils but not in %post
  - build with libcap and libacl
  - fix pgp pubkey signature tag parsing


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-5
changelog:
  - don't mess up problem altNEVR in python ts.check() (#501068)
  - fix hardlink size calculation on build (#503020)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-8
changelog:
  - updated OSGi dependency extractor (#506471)
  - fix segfault in symlink fingerprinting (#505777)
  - fix invalid memory access causing bogus file dependency errors (#506323)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-5
changelog:
  - fix duplicate dependency filtering on build (#490378)
  - permit absolute paths in file lists again (#521760)
  - use permissions 444 for all .debug files (#522194)
  - add support for optional bugurl tag (#512774)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-6
changelog:
  - use relative paths within db environment (related to #507309, #507309...)
  - remove db environment on close in chrooted operation (related to above)
  - initialize rpmlib earlier in rpm2cpio (#523260)
  - fix file dependency tag extension formatting (#523282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-7
changelog:
  - fix build with BDB 4.8.x by removing XA "support" from BDB backend 
  - perl dep extractor heredoc parsing improvements (#524929)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-8
changelog:
  - support multiple python implementations in brp-python-bytecompile (#531117)
  - make disk space problem reporting a bit saner (#517418)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.2-2
changelog:
  - missing error exit code from signing password checking (#496754)
  - dont fail build on unrecognized data files (#532489)
  - dont try to parse subkeys and secret keys (#436812)
  - fix chmod test on selinux, breaking %{_fixperms} macro (#543035)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.1
changelog:
  - update to 4.8.0-beta1 (http://rpm.org/wiki/Releases/4.8.0)
  - rpm-build conflicts with current ocaml-runtime


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.2
changelog:
  - fix noise from python bytecompile on non-python packages (#539635)
  - make all our -devel [build]requires isa-specific
  - trim out superfluous -devel dependencies from rpm-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-5
changelog:
  - fix segfault on failed url retrieval (#557118)
  - fix verification error code depending on verbosity level (#557101)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-6
changelog:
  - Permit em64t architecture in query/erasure too (#547341)
  - Avoid accessing unrelated mount points in disk space checking (#495623)
  - Fix disk space reporting with erasures present in transaction (#561160)
  - Teach python bindings about RPMTRANS_FLAG_NOCONTEXTS (related to #573111)
  - Fix python match iterator regression wrt boolean representation
  - Support parallel python versions in python dependency extractor (#532118)
  - Python byte-compilation fixes + improvements (#538101)
  - Preserve empty lines in spec prep section (#573339)
  - Fix nosrc package generation regression
  - Avoid owning localized man directories through find_lang (#569536)
  - Lose useless symlink to berkeley_db_svc


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-9
changelog:
  - Handle non-existent dependency sets correctly in python (#593621)
  - Permit DOS-style line-endings in PGP armor headers (#532992)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-10
changelog:
  - Fix empty reply from server on url retrieve (#598988)
  - Drop suid/sgid bits and capabilities on upgrade/erase (#598832)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-13
changelog:
  - Require matching arch for freshen on colored transactions (#553108, #479608)
  - Verify that generated signature can be used by rpm (#608599)
  - Fix broken pipe on font provide generation + better error message (#609117)
  - Fix find-debuginfo.sh behavior on cross-directory hardlinks (#618428)
  - Generate gdb index for debuginfos (#652787)
  - Fix verifyscript return code on failure (#668629)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-14
changelog:
  - Fix signature comparison on package resigning (#608608)
  - Let error messages from gpg through on passphrase checking (#607222)
  - Only enforce default umask during transaction (#565843)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-17
changelog:
  - Allow self conflicts (#651951)
  - Add support for xz compression in rpm2cpio.sh (#674348)
  - Don't error out on already imported GPG keys (#680889)
  - Fix file conflict handling for uncolored files (#705115)
  - Fix file attribute handling with %defattr(-) (#705993)
  - Don't error out when trying to add the same signature again (#707449)
  - Fix signature checking (#721363)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-20
changelog:
  - -D is for --define, not --predefine (#785236)
  - Add runtime detection for /usr move (#761000)
  - Fix brace matching on multiline constructs in perl.req (#752119)
  - Make pretrans scriptlet failure fail the package installation (#736960)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-22
changelog:
  - Proper region tag validation on package/header read (CVE-2012-0060)
  - Double-check region size against header size (CVE-2012-0061)
  - Validate negated offsets too in headerVerifyInfo() (CVE-2012-0815)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-25
changelog:
  - Fix Lua script current directory behavior (#746190)
  - Copy rpmpkgs "log" into place instead of moving (#746637)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-28
changelog:
  - Handle identical binaries for debug-info (#727872)
  - Fix typos in Japanese rpm man page (#845065)
  - Document -D and -E options in man page (#845063)
  - Add --setperms and --setuids to the man page (#839126)
  - Update man page that SHA256 is also used for file digest (#804049)
  - Remove --fileid from man page to get rid of md5
  - Remove -s from patch calls (#773503)
  - Force _host_vendor to redhat to better match toolchain (#743229)
  - Backport reloadConfig for Python API (#825147)
  - Support for dpkg-style sorting of tilde in version/release (#825087)
  - Fix explicit directory %attr() when %defattr() is active (#730473)
  - Don't load keyring if signature checking is disabled (#664696)
  - Retry read() to fix rpm2cpio with pipe as stdin (#802839)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-33
changelog:
  - Fix build-time double-free on file capability processing (#904818)
  - Fix include-directive getting processed on false branch (#920190)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-38
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163059)


author: Lubos Kardos <lkardos@redhat.com> - 4.8.0-40
changelog:
  - Add check if source files aren't too big for payload (#833427)
  - Fix producing bogus dependencies by perl.req (#1024517, #1026750)
  - Fix color skipping of multiple files with the same content (#1170124)
  - Disable curl globbing for remote retrievals (#1076277)
  - Make rpm-build depend on redhat-rpm-config provide (#1122100)
  - Handle directory replaced with a symlink to one in verify (#1158377)
  - Restore default SIGPIPE handling for build scriptlets (#993868)
  - State --setperms and --setugids are mutually exclusive (#1119572)
  - Fix byteorder for 64 bit tags on big endian machines (#1040318)
  - File mode from %defattr is applied to directories with warning (#997774)
  - If an error occurs during printing log message then print the error
    on stderr (#1139444)
  - Error out on more than one --pipe option (#966093)
  - Extend PKG_CONFIG_PATH instead of override (#921969)
  - Add RPMCALLBACK_SCRIPT_START and RPMCALLBACK_SCRIPT_STOP. These events are
    not emitted by default (#606239)
  - Enable rpm to work with shebangs in format "!#/usr/bin/env interpeter"
    (#1151828)


author: Lubos Kardos <lkardos@redhat.com> - 4.8.0-41
changelog:
  - Add missing braces around the block of code (#606239)
  - Add missing patch for shebangs in format "!#/usr/bin/env interpeter"
    (#1151828)


author: Lubos Kardos <lkardos@redhat.com> - 4.8.0-43
changelog:
  - Fix for patch for color skipping (#1170124)
  - Add power64 macro (#1178083)
  - Plug segfault on NULL pointer dereference in debugedit (#903009)
  - Account for temporary disk-space requirements on update (#872314)


author: Lubos Kardos <lkardos@redhat.com> - 4.8.0-48
changelog:
  - Fixed race condition in rpm file deployment when updating an existing file
    (#1264052)
  - Fixed problems with perl.req script (#1268021)
  - Document option "--obsoletes" (#1203714)
  - Remove _isa from all BuildRequires (#1287557)
  - Turn removal failure debug messages into warning messages (#1142386)
  - Move bdb warnings from stdin to stdout (#1296212)
  - Improved error message (#1250006)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-57
changelog:
  - Very slow "rpm -q --specfile a.spec" if specfile has thousands of patches (#1383422)
  - Fix refcounting for Python hdr objects (#1438811)
  - Add sources to lua to prevent %autosetup failing in some cases (#1438815)


author: Peter Vrabec <pvrabec@redhat.com> 1.17.1-1
changelog:
  - upstream bug fix release
  - include html docs (#248712)
  - make "-r" option compatible with sysklogd config (248982)


author: Tomas Heinrich <theinric@redhat.com> 3.21.3-3
changelog:
  - fix a wrong module name in the rsyslog.conf manual page (#455086)
  - expand the rsyslog.conf manual page (#456030)


author: Peter Vrabec <pvrabec@redhat.com> 3.21.3-4
changelog:
  - use RPM_OPT_FLAGS
  - use same pid file and logrotate file as syslog-ng (#441664)
  - mark config files as noreplace (#428155)


author: Tomas Heinrich <theinric@redhat.com> - 4.4.2-1
changelog:
  - upgrade to new upstream stable version 4.4.2
    Resolves: #554998
  - add support for arbitrary number of open file descriptors
  - run libtoolize to avoid errors due mismatching libtool version
  - change exec-prefix to /


author: Tomas Heinrich <theinric@redhat.com> - 4.4.2-3
changelog:
  - remove '_smp_mflags' make argument as it seems to be
    producing corrupted builds
    Resolves: #556522


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-1
changelog:
  - upgrade to new upstream stable version 4.6.2
    Resolves: #554998
  - correct the default value of the OMFileFlushOnTXEnd directive
  - add upstream fix for message-induced off-by-one error
  - change the default value of the HUPisRestart directive to enabled
  - remove autoconf, automake, libtool from BuildRequires
  - change exec-prefix to nil
  - redefine _libdir as it doesn't use _exec_prefix
    Resolves: #591860


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-2
changelog:
  - Fix a potential segfault upon SIGHUP induced restart
    Resolves: #598421
  - Add Obsoletes: sysklogd
    Resolves: #513277


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-3
changelog:
  - build rsyslog with PIE and RELRO
    Resolves: #642994
  - add ChangeLog file to documentation
  - add /etc/pki/rsyslog directory


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-5
changelog:
  - provide omsnmp module in rsyslog-snmp subpackage
    Resolves: #618488
  - modify logrotate configuration to omit boot.log
    Resolves: #683537
  - use correct lock file name
    Resolves: #698705
  - provide ommail module
    Resolves: #702314


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-7
changelog:
  - add patch to correct the behavior of the ActionExecOnlyOnceEveryInterval
    configuration directive
    Resolves: #727208


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-8
changelog:
  - workaround the mysql_conf multilib issue by directly using
    the arch-specific script
    Resolves: #694414


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-11
changelog:
  - provide configuration directive for sysklogd message format compatibility
  - provide log format template for sysklogd message format compatibility
    Resolves: #737096


author: Tomas Heinrich <theinric@redhat.com> 5.8.7-1
changelog:
  - rebase to rsyslog-5.8.7
    - change license from 'GPLv3+' to '(GPLv3+ and ASL 2.0)'
      http://blog.gerhards.net/2012/01/rsyslog-licensing-update.html
    - remove patches obsoleted by rebase
    - add patches for better sysklogd compatibility (taken from upstream)
    - update included files for the new major version
    Resolves: #672182
    Resolves: #727380
    Resolves: #756664
    Resolves: #767527
    Resolves: #769025
  - add several directories for storing auxiliary data
    Resolves: #740420
  - fix source package URL


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-1
changelog:
  - rebase to rsyslog 5.8.10
    Resolves: #803550
    Resolves: #805424
    Resolves: #813079
    Resolves: #813084
  - consider lock file in 'status' action
    Resolves: #807608
  - add impstats and imptcp modules
  - include new license text files
  - specify which versions of sysklogd are obsoleted


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-2
changelog:
  - add patch to update information on debugging in the man page
    Resolves: #820311
  - add patch to prevent debug output to stdout after forking
    Resolves: #820996
  - add patch to support ssl certificates with domain names longer than 128 chars
    Resolves: #822118


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-5
changelog:
  - add a patch to permit RFC3339 timestamps in messages comming from
    the local log socket, patch taken from upstream - commit:
    bfae69d68b0032a383821a54bc52aeff36a90e52
    Resolves: #886004


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-6
changelog:
  - the previous patch to enable RFC3339 timestamps revealed a bug
    in the upstream code - adding another patch
    Resolves: #886004


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-7
changelog:
  - add a patch to support large groups in the $FileGroup directive
    resolves: #924754
  - add a patch to fix 'pri-text' property format
    resolves: #951727
  - add a patch to fix the behavior of the *QueueMaxFileSize directives
    resolves: #963942


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-8
changelog:
  - drop patch 5 which introduced a regression
    resolves: #927405
    reverts: #847568
  - add a patch to prevent 'RepeatedMsgReduction' causing missing hostnames
    resolves: #893197
  - add a patch to enable specifying UID/GID as a number
    resolves: #886117
  - add a patch to prevent a segfault in gssapi
    resolves: #862517


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-10
changelog:
  - add a patch to fix a segfault in the regex module
    resolves: #1109155
  - explicitly disable systemd service file generation
  - turn on verbose make output


author: Andrew Bartlett <abartlet@samba.org> - 0:4.0.0-0.4.alpha5.fc10
changelog:
  - Remove talloc and tdb dependency (per https://bugzilla.redhat.com/show_bug.cgi?id=453083)
  - Fix deps on chkconfig and service to main pkg (not -common) 
    (per https://bugzilla.redhat.com/show_bug.cgi?id=453083)


author: Andrew Bartlett <abartlet@samba.org> - 0:4.0.0-0.5.alpha5.fc10
changelog:
  - Fix licence tag (the binaries are built into a GPLv3 whole, so the BSD licence need not be mentioned)


author: Matthew Barnes <mbarnes@redhat.com> - 4.0.0-0.7.alpha6.GIT.3508a66
changelog:
  - Disable the winbind subpackage because it conflicts with samba-winbind
    and isn't needed to support OpenChange.


author: Simo Sorce <ssorce@redhat.com> - 4.0.0-7alpha7
changelog:
  - Compile and have separate packages for additional samba libraries
    Package in their own packages: talloc, tdb, tevent, ldb


author: Simo Sorce <ssorce@redhat.com> - 4.0.0-9alpha7
changelog:
  - Make talloc,tdb,tevent,ldb easy to exclude using defines
  - Fix package for non-mock "dirty" systems by deleting additional
    files we are not interested in atm


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-27.rc1
changelog:
  - Fix permission for init scripts.
  - Define a common KRB5CCNAME for smbd and winbind.
  - Set piddir back to /var/run in RHEL6.
  - related: #766333


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-30.rc2
changelog:
  - Fix multilib package installation.
  - resolves: #862047
  - Filter out libsmbclient and libwbclient provides.
  - resolves: #861892
  - Rebase to version 4.0.0rc2.
  - related: #766333


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-41.rc4
changelog:
  - Fix library dependencies found by rpmdiff.
  - Update winbind offline logon patch.
  - related: #766333


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-54.rc4
changelog:
  - Fix summary and description of dc subpackages.
  - resolves: #896142
  - Remove conflicting libsmbclient.7 manpage.
  - resolves: #896240


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-56.rc4
changelog:
  - Fix libwbclient.so.0 symlink.
  - resolves: #882338
  - Fix correct linking of libreplace with cmdline-credentials.
  - resolves: #911264


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-57.rc4
changelog:
  - resolves: #984809 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-61.rc4
changelog:
  - resolves: #1073356 - Fix CVE-2012-6150.
  - resolves: #1073356 - Fix CVE-2013-4496.
  - resolves: #1073356 - Fix CVE-2013-6442.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.0.0-62.rc4
changelog:
  - resolves: #1105502 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108843 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105572 - CVE-2014-0178: Uninitialized memory exposure.


author: Andreas Schneider <asn@redhat.com> - 4.0.0-67.rc4
changelog:
  - resolves: #1290709 - CVE-2015-7540
  - related: #1290709 - CVE-2015-5299
  - related: #1290709 - CVE-2015-5296
  - related: #1290709 - CVE-2015-5252
  - related: #1290709 - CVE-2015-5330


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-8
changelog:
  - Synchronize patches for Samba 4.2.10 with RHEL 7.2.z
  - Resolves: #1383685 - Update samba4 to be on par with RHEL 7.2.z


author: Shawn Wells <shawn@redhat.com> 0.1-6
changelog:
  - Corrected RPM versioning, we're on 0.1 release 6 (not version 1 release 6)
  - Updated RPM includes feedback received from DoD Consensus meetings


author: Shawn Wells <shawn@redhat.com> 0.1-7
changelog:
  - Corrected XCCDF content errors
  - OpenSCAP now supports CPE dictionaries, important to
    utilize --cpe-dict when scanning machines with OpenSCAP,
    e.g.:
    $ oscap xccdf eval --profile stig-server \
     --cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml


author: Shawn Wells <shawn@redhat.com> 0.1-8
changelog:
  - Significant copy editing to XCCDF rules per community
    feedback on the DISA RHEL/6 STIG Initial Draft


author: Shawn Wells <shawn@redhat.com> 0.1-14
changelog:
  - Formal RPM release
  - Inclusion of rht-ccp profile
  - OVAL unit testing patches
  - Bash remediation patches
  - Bugfixes


author: Shawn Wells <shawn@redhat.com> 0.1-15.rc3
changelog:
  - [bugfix] Updated rsyslog_remote_loghost to scan /etc/rsyslog.conf and /etc/rsyslog.d/*
  - Numberous XCCDF->OVAL naming schema updates
  - All rules now have CCE


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc5
changelog:
  - Point the spec's source to proper remote tarball location
  - Modify the main Makefile to use remote tarball when building RHEL/6's SRPM


author: Shawn Wells <shawn@redhat.com> 0.1-16.rc1
changelog:
  - [bugfix] RHEL6 no_empty_passwords remediation script overwrote
    system-auth symlink. Added --follow-symlink to sed command.


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.21-1
changelog:
  - Upgrade to upstream 0.1.21 version
  - Drop C2S profile patch since it has been adopted upstream
  - Include datastream forms of benchmarks for Red Hat Enterprise Linux 6
    and Red Hat Enterprise Linux 7
  - Include the kickstart file for United States Government Configuration
    Baseline (USGCB) profile for Red Hat Enterprise Linux 6


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.21-2
changelog:
  - Re-implement nodev, noexec, and nosuid removable media OVAL checks
    (RH BZ#1185426)
  - Don't include the 'test' profile into the SCAP content (RH BZ#1199946)
  - Document USGCB profile kickstart availability for Red Hat Enterprise Linux 6
    in the scap-security-guide manual page (RH BZ#1133963)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.21-3
changelog:
  - Rebuild scap-security-guide RPM against openscap >= 1.0.9 in order the
    upstream SCAP Security Guide logo to be rendered properly in the generated
    HTML guide


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.21-4
changelog:
  - Update R / BR to lightweight openscap-scanner >= 1.0.10-2 package
    (RH BZ#1243396)
  - Update URL to point to official SCAP Security Guide GitHub repository


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.27-1
changelog:
  - Rebase to upstream 0.1.27 version (RH BZ#1267509, RH BZ#1284045,
    RH BZ#1270329, RH BZ#1250895, RH BZ#1270710, RH BZ#1223865)
  - Perform the spec changes necessary for the rebase:
    * Update path to remediation functions library, list of provided
    kickstart files, path to scap-security-guide(8) manual page, path
    to LICENSE file
    * Drop:
    - scap-security-guide-0.1.21-dev-shm-removable.patch
    - scap-security-guide-0.1.21-dont-include-the-test-profile.patch
    patches since they have been merged upstream
    * Replace:
    - scap-security-guide-0.1.21-document-kickstart-in-manual-page.patch
    with its updated:
    - scap-security-guide-0.1.27-document-kickstarts-in-manual-page.patch
    version to also document inclusion of new kickstart files for Red Hat
    Enterprise Linux 6 that are available in upstream's 0.1.27 release
    * Introduce the new scap-security-guide-doc subpackage (to contain the
    HTML formatted documents containing security guides that have been
    generated from XCCDF benchmarks present in the scap-security-guide package)
    * Include the datastream versions of Firefox and Java Runtime Environment
    (JRE) benchmarks


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.27-2
changelog:
  - Modify the upstream provided kickstart files for Red Hat Enterprise Linux 6
    to use internal scap-security-guide RPM package rather than upstream git
    repository copies (RH BZ#1251929)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.28-1
changelog:
  - Rebase to upstream 0.1.28 version
  - Start using consistent IDs for OVAL definitions (RH BZ#1250808)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.28-2
changelog:
  - Update URL to PCI DSS standard (latest version is v3.1 from April 2015)
  - Enhance title of CNSS No.1253 profile for Red Hat Enterprise Linux 6
    (RH BZ#1284045#c8)
  - Drop 'install_hids' rule from PCI DSS profile for both Red Hat Enterprise
    Linux 6 and 7 (since we don't have an OVAL check for this requirement)


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-23
changelog:
  - Add cmirrord policy
  - Fixes for accountsd policy
  - Fixes for boinc policy
  - Allow cups-pdf to set attributes on fonts cache directory
  - Allow radiusd to setrlimit
  - Allow nscd sys_ptrace capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-24
changelog:
  - Add support for /dev/vhost-net
  - Allow psad to read files in /usr
  - Allow systat to use nscd socket
  - Fixes for boinc policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-25
changelog:
  - Fixes for cmirrord policy
  - Dontaudit xauth to list inotifyfs filesystem.
  - Allow xserver to translate contexts.
  - Allow kdumpgui domain sys_admin capability
  - Allow vpnc to relabelfrom tun_socket
  - Allow prelink_cron_system_t to signal
  - Fixes for gitolite
  - Allow virt domain to read symbolic links in device directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-26
changelog:
  - Allow krb5kdc to write krb5kdc_principal_t file
  - Allow hald to send generic signal to dhcp client
  - Fix dev_rw_vhost interface
  - Add /var/run/abrt.socket label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-27
changelog:
  - Allow ftpd ipc_lock capability
  - Allow audisp-remote to getcap and setcap
  - Allow iscsid to read and write raw memory devices
  - Fixes for bitlbee policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-30
changelog:
  - Allow sysadm to run ncftool
  - Fixes for cobbler policy
  - Allow Network Manager to transition to ipsec_mgmt domain
  - Add label for /usr/libexec/nm-openswan-service
  - Add label for /dev


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-31
changelog:
  - Remove daemons dontaudit to search all dirs 
  - Add support for epylog
  - All all domains to read lib files
  - Allow denyhosts to send syslog messages
  - Allow mysql-safe setrlimit
  - Allow rpm to execute rpm_tmp_t
  - Allow dmesg to appen abrt_var_cache files
  - Fixed label for abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-32
changelog:
  - Allow sectool to connect to users over unix stream socket
  - Add label for /var/spool/abrt-upload
  - Add audio_home_t type for homedir/Music files
  - Allow aiccu to read network config files
  - Allow qpidd to setsched
  - Allow virt domains to manage svirt_image_t fifo files
  - Fixes for NM-openswan
  - Fixes for admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-36
changelog:
  - Allow netutils to read and write USB monitor devices
  - Fix label for /rhev
  - Add user_setrlimit boolean
  - Allow initrc to manage virt lib files
  - Add support for ebtables
  - Add label for /bin/mksh
  - Dontaudit aiccu sys_tty_config capability
  - Add httpd_setrlimit boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-37
changelog:
  - Redefine hi_reserved_port_t to include ports from 512 to 599 
  - Add label for /sbin/sushell
  - Fixes for munin plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-38
changelog:
  - Allow xdm_t to manage gnome homedir content
  - Allow s-c-firewall to read and write virtual memory sysctls
  - Fixes for logwatch policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-39
changelog:
  - Allow munin_system_plugin to read files in /usr
  - Do not audit insmod attempts to write virt daemon unnamed pipes
  - Allow corosync to read ricci lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-40
changelog:
  - Fixes for puppetmaster
  - Fix label for kadmin init script
  - Fixes for logwatch-mail policy
  - Allow arpwatch to request the kernel to load modules
  - Allow cron jobs to run with context of user that started them


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-41
changelog:
  - Allow logwatch_mail to read read the networking state information.
  - Add label for /usr/bin/dosbox
  - Allow systat sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-42
changelog:
  - Allow kdump to read information from the debugging filesystem
  - Update boinc policy
  - Fixes for logwatch-mail policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-43
changelog:
  - Allow ncftool to run brctl
  - Fixes for ricci-modclusterd policy
  - Allow uucpd to execute ssh client
  - Add label for dayplanner
  - Allow sandbox_xserver execstack


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-45
changelog:
  - Fixes for cgroup policy
  - Fixes for ncftool policy
  - Add ncftool_read_user_content boolean
  - Fix label for boinc init script
  - Fix label for fence_tool
  - Allow vhostmd to write virt content
  - Allow ricci domtrans ot shutdown


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-47
changelog:
  - Fixes for boinc-project policy
  - Allow swat to read nmbd pid file
  - Allow fail2ban to read BIND log files
  - Fix cert handling from Dan 
  - Remove transition from unconfined to ncftool domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-48
changelog:
  - Fixes for shorewall policy
  - Allow sssd chown capability
  - Fix label for /usr/bin/mutter
  - Label dead.letter as mail_home_t
  - Allow pcscd to read  hardware state information 
  - Fixes for ulogd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-49
changelog:
  - Add label for /var/cache/rpcbind directory
  - Add chrome_role for xguest
  - Fix amavis_read_spool_files interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-55
changelog:
  - Add cluster_var_lib_t type and label for /var/lib/cluster
  - Add labeling for /root/.debug
  - Remove permissive from cmirrord domain
  - Dontaudit cmirrord_t sys_tty_config capability
  - Allow virtd to read from processes up to its clearance
  - Allow dovecot-deliver to create tmp files
  - Allow tor to send signals to itself
  - Handle /var/db/sudo
  - Remove allow_corosync_rw_tmpfs boolean
  Resolves: #631564


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-56
changelog:
  - Allow smartd to read usr files
  - Allow devicekit-power transition to dhcpc
  - Add label for /etc/timezone
  - Remove transition from unconfined_t to iptables_t
  - Allow domains with different mcs levels to send each other signals as long as they are not identified as mcsconstrainproc
  Resolves: #634945
  - Allow nrpe to send signal and sigkill to the plugins
  - Fix up xguest to allow it to read hwdata and gconf_etc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-57
changelog:
  - Allow system_mail_t to append ~/dead.letter
  - Allow mount to communicate with gfs_controld
  Resolves: #636683
  - Dontaudit hal leaks in setfiles
  - gpm needs to use the user terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-58
changelog:
  - Fix httpd_setrlimit boolean to allow sys_resource capability
  - Fix label for ip6tables.save
  - Allow ssh_t to exec ssh_exec_t
  - Dontaudit init leaks
  Resolves: #639083


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-59
changelog:
  - Allow cdrecord setrlimiit
  Resolves: #615731
  - Define debugfs_t as mountpoint
  Resolves: #646856
  - Fix fenced_can_network_connect boolean description
  Resolves: #650136
  - Add label for /var/run/faillock
  - Add dirsrv and dirsrv-admin policy
  Resolves: #655206
  - Fixes for cobbler policy
  - Allow certmonger to manage dirsrv config
  Resolves: #658591


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-60
changelog:
  - Fixes for certmonger
  - Backport passenger policy
  - Allow run_init to read console_device
  Resolves: #657568
  - Add label for /var/lib/dkim-milter
  - Fixes for munin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-61
changelog:
  - Fixes for passenger policy
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  Resolves: #663054


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-64
changelog:
  - Add namespace policy
  - Allow udev to stream connect to init
  Resolves: #667370
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-69
changelog:
  - Make Spacewalk to work with selinux-policy
  Resolves: #673112
  - Fix /root/.ssh labeling
  Resolves: #637109	
  - Fix for the spec file


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-71
changelog:
  - Allow cmirrord to create physical disk devices in /dev
  - Allow cluster domains to use the system bus and send each other dbus messages
  - Add label for /dev/tgt


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-74
changelog:
  - Add virt_home_ type files located in ~/.libvirt directory
  - virt creates monitor sockets in the users home dir
  - Allow lvm setfscreate
  Resolves: #680388
  - Make lsusb and lsblk working on MLS
  Resolves: #680426


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-75
changelog:
  - Allow svirt to manage sock_file in ~/.libvirt directory
  - Allow sysamd to run udev in udev_t domain
  - Remove capability from svirt
  - Add lvm_exec_t label for kpartx


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-76
changelog:
  - Fixes for ssh_keygen policy
  - Allow sysadm_t to run ssh-keygen in ssh_keygen_t domain
  - Backport spice vdagent policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-79
changelog:
  - Fixes for sandbox/seunshare policy 
  Resolves:#684919
  - Allow ssh_keygen_t dac_override
  - Add matahari policy 
  - Add label for /etc/securetty 
  - Fixes for pirahna-pulse policy
  - Fixes for radius, samba, dirsrv, kerberos policies 
  - Allow console login on MLS
  - Fix file context to show several labels as SystemHigh
  - Add port definition for dogtag, matahari, movaz ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-80
changelog:
  - Add support for a new cluster service - foghorn
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - Add support for vdsm
  - Allow syslogd setrlimit, sys_nice
  Resolves: #689431
  - ipsec_mgmt_t wants to cause ipsec_t to dump core, needs to be allowed


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-81
changelog:
  - Add allow_sysadm_manage_security boolean
  - Add label for /dev/dlm.*
  - Allow auditadm_screen_t and secadm_screen_t dac_override capability
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Fixes for nslcd policy
  Resolves: #693368
  - Allow qpidd to manage pid and lib matahari files
  - Allow rgmanager to send the kill signal to all users


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-83
changelog:
  - Add label for matahari-broker.pid file
  - Allow foghor to read snmp lib files
  - Make sysadm security admin
  - Fix ssh_sysadm_login boolean
  Resolves: #694551


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-87
changelog:
  - Allow $1_sudo_t to read default SELinux context
  - Allow tgtd to create a sock file
  - Allow initrc_t to manage faillock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-95
changelog:
  - Allow secadm to manage selinux config files
  - Allow apache to use jboss management port
  - Add fenced_can_ssh boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-97
changelog:
  - Allow postfix-pickup to write files and directories regardless of their MCS category set.
  - Make xinetd trusted to write outbound packets regardless of the network's or node's MLS range
  Resolves: #705772


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-104
changelog:
  - Allow puppet to Check access to the passwd executable
  - Add label for /var/www/html/logs directory
  - Add label for /var/lib/squeezeboxserver directory
  - Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-107
changelog:
  - Make new domains as unconfined
  - Add abrt_handle_event_t domain for ABRT event script
  - Add selinux_mysql man page
  - Fix httpd selinux man page
  - Fix interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-108
changelog:
  - Add squid man page
  - Add git man page
  - Make puppet working with passenger
  - Allow procmail to execute hostname command


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-110
changelog:
  - Add label for passwd.adjunct
  - Allow pulse to execute  /usr/sbin/fos
  - Fix labeling for passenger
  - Add selinux policy support for IP-in-SSH tunnelling
  - Allow sulogin to write /dev/pts/0 in single user mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-111
changelog:
  - Add git_cgit_read_gitosis_content boolean
  - Add support for cma port
  - Add virt_use_sanlock boolean and make sanlock working together libvirt
  - Make passenger and puppet working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-112
changelog:
  - Fix description of allow_* booleans
  - Allow sanlock to manage libvirt lib files
  - Fix bug in lsassd policy
  - Add label for /var/run/luci
  - move port 18001 from http_port_t to jboss_management_port_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-114
changelog:
  - Fix httpd_selinux man page
  - Add corenet_packet() interface
  - Add support for Clustered Samba commands


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-115
changelog:
  - Add unlabelednet policy module
  - Add chrome role for xguest
  - Fix for vdagent policy
  - Add fix to allow confined apps to execmod on chrome


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-118
changelog:
  - Fix label for /root/.hushlogin
  - Allow domain to send/recv unlabeled packet
  - Allow sshd to relabel tun socket
  - Allow puppetmasterd to relabel puppet config files
  - Add label for lvs.conf
  - Fix labeling for matahari-netd agents


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-123
changelog:
  - MLS Overrides needed for a user running at a level to be able to use sudo and talk to sssd
  - Allow initrc_t to manage dirsrv pid files with disabled unconfined module
  - Fixed for deltacloudd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-125
changelog:
  - Change the postinstall to load_policy separately from the semodule command
  - This will put the proper files in place even if the kernel rejects the policy.
  - Allow login programs to connect to the pki_ca_port
  - Allow vhostmd to read /dev/rand and signal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-128
changelog:
  - Add cronjob_role for sysadm
  - Change label for /var/spool/cron
  - Add interface to allow exec of mongod


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-131
changelog:
  - Fixes for rhev policy
  - Make ssh-keygen as unconfined domain
  - Add sanlock_use_nfs boolean
  - Add ssh_dontaudit_search_user_home_dir interface
  - namespace_init and MLS fix


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-132
changelog:
  - Fixes for nagios policy
  - Add a new interface for libra
  - Fix spec file to be testing SELinux status correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-134
changelog:
  - Backport ABRT policy
  - Backport matahari policy
  - Add interfaces for libra
  - Add jboss_dubeg port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-135
changelog:
  - Add fixes for qpidd policy, support for tmpfs_t
  Resolves:#769352
  - Add fixes for mcelog policy, for new location of pid,sock files
  - Make sendmail and postfix working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-136
changelog:
  - backport mozilla_plugin policy
  - backport sandbox policy to support nacl
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow system cronjobs to read kernel network state
  - Allow corosync to read and write to qpidd shared memory
  - More fixes for qpidd
  Resolves:#769352
  - Add policy for quota-nld


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-137
changelog:
  - Remove nfs_* booleans because nfs runs in kernel_t domain
  Resolves:#760405
  - Add httpd_manage_ipa boolean
  - Dontaudit sys_ptrace for matahari-netd
  - Allow vhostmd to getattr on virtd
  - Allow snmpd to connect to the ricci_modcluster
  - qpidd should be allowed to connect to the amqp port


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-138
changelog:
  - Add new policy for cfengine
  - Add new policy for sge gridengine jobs
  - Add support for nagios eventhandlers
  - Make system cron jobs run in the proper domain
  - Add policy to support privsep ssh process running in user domain
  - Add fixes relates to nss/FIPS
  - Add new rsync_use_* booleans
  - Allow qpidd to connect to matahari ports
  - Allow sysadm_u to read system_r in MLS
  - Remove razor labeling because we treat razor with spam policy
  - Add support for matahari-qmf-sysconfig-consoled, clean up matahari policy
  - Fixes for interfaces
  Resolves:#791294
  Resolves:#796351


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-139
changelog:
  - Allow nfsd_t to getattr on all fs
  Resolves:#738628
  - Make mailx working together with cron without unconfined module
  - Allow sssd sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-140
changelog:
  - Add additional fixes for nagios handlers
  Resolves:#749311
  - Add 7600 and 4447 as jboss_management ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-141
changelog:
  - Add man pages for apps, services
  - Allow nagios to use user terminals
  Resolves:#782325
  - Add support for unconfined certmonger scripts
  - Add support for matahari-qmf-rpcd service
  - Allow chsh to use PAM
  - Allow rpc.statd to execute sm-notify which has bin_t label
  - Make sure files which are created by /usr/bin/R get proper label in home directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-142
changelog:
  - Fixes for man pages
  - Allow rpcd to execute sm-notify
  Resolves:#802247
  - Add support for matahari-qmf-rpcd
  - Add support matahari vios-proxy-* apps
  - Allow quota-check to create files on nonxattr filesystems
  - Add support for ~/Maildir
  - Allow unconfined dyntransition
  - Fixes for certmonger_unconfined and certmonger
  - Fixes for certmonger policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-144
changelog:
  - Fixes for cfengine policy
    * changed labeling for /var/cfengine/outputs from var_log to cfengine_var_log_t
    * re-arranged policy to use template and cfengine_domain 
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Bacport libvirt-qmf policy for Fedora
  - Remove labeling for postmaster.pid file 
  - Fix for virtual network which looses network connection
  - Add man pages for SELinux users
  - cgconfig needs to use getpw calls
  - Allow lvm and fsadm to write sysfs_t
  - Allow rpc.mounted to list user tmp files
  - Fix permissivedomains declarations
  Resolves:#806220
  - Fix spec file to instal minimum policy properly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-146
changelog:
  - Add sysadm_secadm policy module to separate in secadm_r, sysadm_r
  Resolves:#787413
  - Fixes for libvirt-qmf
  - Add label for package-cleanup 
  - Add support for zfs
  - Make cfengine domains as unconfined
  Resolves:#753184
  - Allow sshd_t to dyntransition to sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-147
changelog:
  - Fix man pages for SELinux users
  - Allow all user domains to setexec
  - Allow cobblerd to get SELinux status and booleans
  - Add labeling for /etc/zipl.conf
  Resolves:#813803
  - Allow fenced to read SNMP lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-149
changelog:
  - Add labeling for /usr/sbin/matahari-dbus-sysconfigd
  - Add additional labeling for zarafa
  - Allow guest_t to fix labeling
  - Corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - squashfs does not support xattr in RHEL6
  Resolves:#815898
  - Remove pyzor labeling and move it to spamassassin.fc
  - Fix config.tgz


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-151
changelog:
  - Add openstack-nova, openstack-keystone, openstack-glance, openstack-quantum policies
  - Allow sysadm_t to create other crontabs
  - Allow nfsd_t to read defaul_t link files
  - Fix labeling for /var/run/heartbeat
  - Fixes for admin_template() interface to make sysadm_secadm.pp module working correctly
  - More fixes for condor policy
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Fix auth_role() interface
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-152
changelog:
  - Add label for condor_starter
  Resolves:#807682
  - Dontaudit sys_module for brctl
  - Allow winbind to send signull to smbd
  - Add jacorb port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-154
changelog:
  - Allow fenced to manage snmpd lib files
  - Allow certmonger to get attributes on init script files
  Resolves:#790967
  - Fix labeling for Firefox plugins
  Resolves:#747993
  - Add mta_signal_user_agent() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-155
changelog:
  - Allow setroubleshootd to execute rpm
  Resolves:#833053
  - Add labeling for /usr/lib/flash-plugin/libflashplayer.so


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-156
changelog:
  - Allow user to login using ssh with random MLS range
  Resolves:#837815
  - Allow virtd_t to create mtab with the proper labeling
  - Add support for check_icmp nagios plugin
  - Make chkconfig working on MLS for sysadm_t
  - Allow dovecot to manage mail_home_rw_t
  - Add support for fsav
  - Allow clamscan to use amavisd-new
  - Add support for rhnsd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-157
changelog:
  - Allow procmail to manage mail home data
  - We should only block MCS node_bind on mcsuntrustedproc
  - Fixes for amavis
  Resolves:#837815


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-159
changelog:
  - Allow munin_stats to read munin logs
  - Allow updpwd to write all MLS levels
  - Make piranha_web_t as nsswitch domain
  - Allow munin mail plugins to read exim log files
  - Backport sanlock policy from Fedora
  Resolves:#831908
  - Allos dac_override, sys_nice for sasl
  - Add labeling for /var/named/chroot/usr/lib64
  - Add support for gitolite3
  - Allow confined users to send mail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-160
changelog:
  - Add named_bind_http_port boolean
  - Add port definition for 8953/tcp
  - spice-vdagent(d)'s are going to log over to syslog
  - Fix labeling for /usr/sbin/rpc.* binaries to label them as rpcd_exec_t
  - Add sensord policy
  - Allow oddjob_mkhomedir to write on nfs share
  - Add virt_bridgehelper policy
  - Allow clamd to write/delete own pid file with clamd_var_run_t label
  - Add support for wdmd tmpfs
  - Add initrc_domain attribute 
  - Add bcfg2 policy
  - Modify ssh_chroot_rw_homedirs boolean to allow manage apache system r/w content if for /var/www as home
  - Add pacemaker policy
  - Allow snmpd to connect to corosync over unix stream socket
  - Allow crontab to read NFS
  - Add new type selinux_login_config_t for /etc/selinux/TYPE/logins directory and allow sssd to manage files in this directory
  Resolves:#843814
  - Add labeling for /opt/sartest directory
  - Add initrc_domain attribute to allow domains to work as initrc_t domain
  - heartbeat should be running as rgmanager_t instead of corosync_t
  - Add glusterd policy
  - Add l2tpd policy
  - Add numad policy
  Resolves:#801493


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-162
changelog:
  - Add pkcslotd policy
  Resolves:#851483
  - Allow cyrus-imapd init script to write cyrus data
  - Fix labeling for /dev/twa


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-166
changelog:
  - More fixes for openshift and add support for opeshift labeling instead of stickshift
  - /etc/selinux/<type>/logins should be owned by the policy package
  Resolves:#855889
  - Add labeling for /var/tmp/DNS_25      
  - Allow postfix_local_t to execute files on nfs_t
  - Add fixes for kadmind
  - Add rhnsd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-167
changelog:
  - Allow postfix_locat to search stickshift lib files
  - Dontaudit sys_ptrace cap for httpd if httpd_stickshift is on
  - Allow openshift domains change process identity
  - SELinux is reporting that openshift domains are trying to write into their proc directories
  Resolves:#855889


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-168
changelog:
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - pppd wants to read /usr/share/radiusclient-ng/dictionary
  - Add ssh_chroot_manage_apache_content and ssh_chroot_full_access booleans
  - snmp wants to also manage snmp dirs for amavisd-snmp support
  - Add labeling for virsh_fenced
  - Allow nmbd_t to crate dirs with samba_var_t labeling
  - Add clamscan_can_scan_system boolean
  - Allow all domains to getattr on prelink_exec_t
  - Add postgresql_can_rsync boolean
  - Allow pulse to domain transition to iptables
  - Allow nslcd sys_nice capability
  - Allow corosync to connect to saphostctrl ports
  - Allow passwd to read generic /tmp dirs
  - Add policy for qemu-qa
  - Add new antivirus policy module for antivirus programs
  Resolves:#838260


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-169
changelog:
  - Fix spec file to silent restorecon errors on files which do not exist
  - Fix passenger backport
  Resolves:#839831


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-172
changelog:
  - Update httpd_runstickshift boolean
  - Remove transition from sysadm_t to fsadm_t
  Resolves:#852763
  - Make vmware-host as unconfined domain
  - Allow all domains to read usr_t
  - Fix labeling for all log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-173
changelog:
  - syslogd_t now support kerberos
  Resolves:#867001
  - Fix openshift labeling for binaries
  - Allow passwd to read usr_t links/files
  - Add labeling for /var/lib/sss/mc


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-174
changelog:
  - openshift user domains wants to r/w ssh tcp sockets
  - Allow mount to relabelfrom unlabeled file systems
  - Additional fix for syslog/kerberos
  Resolves:#867001


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-175
changelog:
  - Add initial openswitch policy. Domains are unconfined
  Resolves:#845417
  - Add labeling for /usr/sbin/mcollectived
  - Allow openshift domains to read /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-177
changelog:
  - Allow dnsmasq to manage virt run files
  Resolves:#843543
  - Allow setroubleshootd to read /proc/irq
  - Backport fixes for virt_use_* booleans
  - Allow qemu-ga to use ttyS0
  - Allow dhcpc to manage dhclient-eth0.pid labeled as virt_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-178
changelog:
  - Fix labeling for OpenShift binaries
  - Add samba_portmapper boolean and labeling for /var/run/samba
  Resolves:#871816
  - Backport dspam policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-180
changelog:
  - Allow openshift domains to execute tmux
  - Allow wdmd to getattr on tmpfs_t
  Resolves:#831908
  - Add labeling for /var/nmbd/unexpected
  - Allow winbind to create samba pid dir
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes for syslogd
  - Fenced communicates with libvirt
  - Fix labeling for libflashplayer.so
  - Add labeling for /var/lib/zarafa-webapp
  - Allow dspam to read localization
  - Add labeling for Z-Push
  - Allow rpc.svcgssd to search nfsd_fs_t dirs
  - Allo cgred to read all sysctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-181
changelog:
  - Allow kdumpgui to read/write to zipl.conf
  Resolves:#877108
  - Add /proc/numactl support for confined users
  - Make proc_numa_t an MLS Trusted Object
  - Make ccs_tool and cman_tool labeled as rgmanager_exec_t
  - Fix cron_admin_role interface
  - Add support for opendkim


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-182
changelog:
  - Fix labeling for /var/named/chroot/usr/lib
  Resolves:#843732
  - Allow amavis to stream connect to snmpd
  Resolves:#839250
  - Additional fixes for log files related to logrotate
  - Allow all domains to read base etc_t file type
  - Allow logrotate to list root home directory
  - Fix labeling for /var/log/z-push
  - Allow cyrus init scriptu to manage cyrus data files
  - Dontaudit leaks of locks or generic log files to systemprocesses
  - Allow ricci-modrpm to send syslog msgs
  - Allow munin to have kill capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-184
changelog:
  - Add support for tcp/10026 port as dspam_port_t
  - Allow dspam to connect/bind to dspam_port_t
  - Add uconfined_munin_plugin_exec_t for all plugins which are not covered by munin plugins policy
  - Allow domains that can read sssd_public_t files to also list the directory
  Resolves:#881413
  - Allow programs to run in fips_mode using fips_mode boolean
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow sshd to look into the mysql home directory for authorized_keys
  - Make rsync as homemanager which allows to manage CIFS/NFS	  
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-185
changelog:
  - Apache is sending sinal to openshift_initrc_t now
  -  Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Allow winbind to manage samba_var_t sock files
  - Allow git-daemon and httpd to serve the same dir
  Resolves:#883143
  - Allow dac_override for nrpe


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-186
changelog:
  - Allow virtd to manage dnsmasq pid files
  - Allow all samba domains to create samba directory in var_t directory
  - Dontaudit attempts by openshift to read apache logs
  - Add labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-187
changelog:
  - Add missing labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432
  - Add labeling for /var/nmbd
  - apache/drupal can run clamscan on uploaded content


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-188
changelog:
  - Allow rpcd_t to read /var/run/utmp
  - Make glance domains as permissive instead of just glance_t
  - Allow kill capability for ftpd
  - Add labeling for prespawn helper script
  Resolves:#886619
  - Allow winbind to stream connect to nmbd
  - Allow transition from virt domains to bridgehelper domain
  - Add support for watchdog script from sanlock
  - Add labeling for tmp-inst
  - Fix rhev policy
  - Update virt_qemu_ga policy
  - Backport wm_domain policy
  - Backport virtd_lxc_t and make it as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-189
changelog:
  - Allow virt_qemu_ga to execute shutdown
  - sssd needs to connect to kerberos password port if a user changes his password
  - More fixes for the dspam domain
  - Allow dovecot to execute bash
  - Additional fixes for passenger
  Resolves:#886619
  - Add labeling for /var/run/checkquorum-timer


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-190
changelog:
  - Allow virtd to settattr on virt image dirs in MLS
  Resolves:#885045
  - Allow all postfix domains to connect to mysql stream
  - Call init_daemon_domain for rsync_t
  - Add labeling for /var/lib/pgsql/ssh 
  - Allow certmonger to send signal to itself
  - Allow rsyslog to read user tmp files using logging_syslog_can_read_tmp boolean
  - Add support for 1228/tcp and 1228/udp ports and allow corosync touse them
  - Allow corosync to read wdmd tmpfs
  - Allow wdmd to execute consoletype
  - Update man pages using sepolicy from Fedora
  - Fix admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-191
changelog:
  - Remove pam_selinux due to conflict
  - Add labeling for /etc/multipath - lvm_metadata_t
  Resolves:#880407
  - Add additional gitolite3 labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-192
changelog:
  - Label /usr/lib/yaboot/addnote as bin_t
  - Allow postfix_local to read/write /var/spool/postfix/active
  - Allow postfix domains to list /tmp
  - Allow wdmd to transition to kdump
  Resolves:#887793
  - Add labeling for /var/named/chroot/etc/localtime


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-193
changelog:
  - Fix ssh_sysadm_login boolean for MLS
  Resolves:#865759
  - Allow rpm_script_t to dbus communicate with certmonger_t
  - More fixes for qemu-ga to make "guest-fsfreeze-freeze" working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-194
changelog:
  - qdiskd needs to read usr_t/bin_t files
  - Allow dpsam to connect/bind to spamd ports
  - Allow munin services plugins to bind to generic node
  Resolves:#865759


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-195
changelog:
  - Make matahari domains as unconfined
  - Allow nscd to connect to nmbd
  Resolves:#901565
  - Allow setcap/getcap for syslogd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-196
changelog:
  - Backport openshfit fixes
  - Allow cgred to use notify 
  Resolves:#913673
  - Allow mount to transition to gluster 
  - Fix tuned policy to make it working with the lastet tuned package


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-197
changelog:
  - Fix /etc/dhcp labeling
  - Back port openshift fixes
  - Make dirsrv-admin server restarted from console working
  - Add ftpd_use_fusefs boolean
  Resolves:#913673
  - openshift_cron_t needs dac_override


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-198
changelog:
  - Allow dirsrv-admin script to exec apache modules
  - Add labeling for dirsrv-admin lock file
  - Add labeling for /var/lib/owncloud
  - Add labeling for /var/www/moodle
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-199
changelog:
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow dovecot-auth to execute bin_t
  - Allow mysqld-safe to execute bin_t
  - Allow procmail to manage user tmp files
  - Allow sanlock to kill svirt_t
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-203
changelog:
  - Allow dnsmasq to stream connect to quantum
  - Allow ifconfig domtrans to iptables and execute ldconfig
  Resolves:#966106
  - Make openshift_initrc_t as initrc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-204
changelog:
  - Allow iptables to read and write quantum inherited pipes
  - Allow iptables to send sigchld to quantum
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-205
changelog:
  - Remove domtrans for quantum which needs to stay in the same domain
  - Allow qemu to manage nova lib files
  - Allow hald to read svirt images
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-208
changelog:
  - Merge cluster administrative domains to cluster_t. Back ported from Fedora
  Resolves:#915151
  - Aadd additinal rules for disk plugins
  - Allow setuid/setgid caps for syslogd_t
  - Dontaudit sendmail to  write dovecote-deliver tmp files
  - Add suppport for /var/lib/openvpn
  - /var/spool/snmptt is a directory which snmdp needs to write to


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-210
changelog:
  - Allow nrpe to list /var
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Add support for strongswan
  - Fix description of ftpd_use_fusefs boolean
  - Allow kdumpgui to write dos files for /boot/efi/EFI/fedora/grub.cfg
  - Back port tgtd fixes from Fedora to allow sys_rawio cap
  - Add support for OpenDMARCD
  Resolves:#983551
  - Allow openvpn to run unconfined scripts
  - Allow amavis to execute shell
  Resolves:#979421
  - man pages should be owned only by selinux-policy-doc package
  - Fix fs_manage_nfs_files and fs_manage_nfs_dirs boolean to allow to search autofs
  - Allow mysqld-safe sys_nice/sys_resource caps
  Resolves:#975921
  - Add labeling for /boot/etc/yaboot.conf
  Resolves:#973156
  - /var/log/syslog-ng should be labeled var_log_t
  - Back port munin-cgi fixes
  - Fix ftp_home_dir boolean 
  - Allow kdump to read kcore on MLS system
  - Add support for svn ports
  - Add labels for /dev/ptp*
  - Add labels for /etc/security/opasswd
  - Fix labeling for /etc/localtime lnk file
  - Add  tftp booleans for NFS/CIFS access
  - Merge amavis,clamd,clamscan,freshclam policies to antivirus policy
  - Label all nagios plugins as nagios_unconfined_plugin_exec_t by default
  - Add additional ports as mongod_port_t
  - Allow sandbox domains to use inherted terminals
  - Allow pegasus to execute mount in pegasus_t domain
  - Fix *_admin interfaces  and interface descriptions
  - Allow yppasswdd to use NIS
  - Allow nagios to manage nagios spool files
  - Allow ABRT to domtrans to prelink
  Resolves:#921234
  - Fix labeling for /var/lib/dspam/
  Resolves:#919456
  - Label postfix-policyd-spf-perl as bin_t
  - Allow nrpe to run sudo
  - Label /usr/bin/yum-builddep as rpm_exec_t
  - Label /usr/local/bin/x11vnc as xserver_exec_t
  - Allow logwatch to domtrans to mdadm
  - Allow postfix-master to list /tmp dir
  - Add lldpad policy and make it as unconfined domain
  - Allow sysadm to admin postfix
  - ALlow postfix_virtual to stream connect to mysql
  - Update zabbix policy
  - Activate watchod policy and make it as unconfined
  - Add httpd_serve_cobbler_files boolean
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add oracleasm policy
  - Add support for pand
  - Add awstats_purge_apache_log_files boolean
  - Back port smstools policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-212
changelog:
  - Update rules for antivirus domains
  Resolves:#999471
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow chroot_user_t to read/write inherited user domain pty
  - Allow to start guest while the libvirtd is started with valgrind
  - Allow lldpad to talk with fcoemon
  - Allow chronyd sched_setscheduler


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-213
changelog:
  - Add openhpid policy
  Resolves:#1000521
  - Fix rhcs_domain_template to allow cluster_t to create socket in /var/run with correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-214
changelog:
  - Allow git daemons to read localization
  - Allow tgtd_t to connect to isns ports
  Resolves:#1003571
  - Cleanup antivirus policy and add additional fixes
  - Fix labeling for munin CGI scripts
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Fix fs_search_auto_mountpoints to allow search automount tmp dirs
  Resolves:#990661


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-215
changelog:
  - Add port definition of pka_ca to port 829 for openshift
  - Rename quantum to neutron
  - Allow rpcd to request the kernel to load a module
  - Allow ovsdb-server to create dirs/files in /tmp directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-216
changelog:
  - Remove transition from virtd_t to qemu_t to stay in virtd_t if selinux_driver is None in qemu.conf
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-217
changelog:
  - Fix virtd_lxc_t to be able to communicate with hal
  - Allow NM and wireless working together
  Resolves:#1009661
  - Allow my_print_default to read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-218
changelog:
  - Add support for /var/log/qemu-ga directory
  - Regenerate man pages for domains
  Resolves:#880728
  - Allow setgid capability for ipsec_t
  - Allow ipsec to send signull to itself
  - Add tcp/9000 as http_port_t
  - Allow dirsrv_t to create tmpfs_t directories
  - Fix git_role() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-219
changelog:
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Allow tzdate to unlink etc_t lnk files
  - Allow jabberd to connect to jabber_interserver port
  - Fix description for logging_syslog_can_read_tmp boolean
  - Update ipsec rules and labels
  Resolves:#986883
  - Allow pegasus transition to mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-220
changelog:
  - Allow cobblerd to stream connect to MySQL
  - Allow cobblerd to execute ldconfig
  - Allow openstack-glance to access to amqp
  - Add labeling for /var/run/charon.*
  - Make munin "df" plugins working
  Resolves:#908095


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-221
changelog:
  - Fix /var/run/charon labeling
  - More fix for strongswant and ipsec.secretes
  - Allow sandbox domain to use inherited user terminals


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-223
changelog:
  - Fix dovecot_rw_pipes() interface
  - Allow piranha_pulse_t to search tmpfs
  - Allow sysadm to stream connect to postfix-master process
  - Label /usr/sbin/fence_sanlockd as fenced_exec_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-225
changelog:
  - Re-write rules to create tmpfs for all piranha tmpfs files/dirs
  - Allow piranha-lvs to manage piranha_tmpfs_t
  Resolves:#1018306


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-226
changelog:
  - Label /usr/sbin/fence_scsi as fenced_exec_t
  - Fix cluster domains to create dirs in /var/run/cluster as var_run_t to make resource scripts working
  Resolves:#915151


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-227
changelog:
  - Resource agents needs to manage /etc/cluster to place own config files
  Resolves:#915151
  - tgtd needs ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-228
changelog:
  - Add daemons_enable_cluster_mode boolean and turn on it by default until RHEL6.6
  Resolves:#915151
  - Add tcp/8893 as milter port
  - Allow antivirus domain to read localization without the boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-229
changelog:
  - Add bootloader_exec_t labeling for /sbin/grubby
  Resolves:#915729
  - Add etc_runtime_t label for zipl.conf
  - Allow daemons to manage cluster lib files if daemons_enable_cluster_mode is enabled


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-231
changelog:
  - Add named_cache_t label for /var/lib/unbound
  - Fix puppet_domtrans_master() interface to make passenger working correctly if it wants to read puppet config files
  - Allow anitvirus domains to manage own log dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-232
changelog:
  - Add more fixes for zabbix-agent
  - Fix neutron labeling
  - Allow all domains to read sysfs_t due to glibc change
  - Allow ping to read inherited zabbix tmp files
  Resolves:#1039851
  - Allow hostname to read/write inherited rpm script files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-233
changelog:
  - Add support for OpenShift syslog plugin
  - Allow snmpd to getattr on removeable and fixed disks
  - Add shmemnetgrp and getnetgrp to access_vectors
  Resolves:#1025758


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-235
changelog:
  - Add support for nginx
  Resolves:#1045041
  - Change shutdown_t to also read wtmp
  - Added support for hypervkvpd
  - Add preupgrade policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-236
changelog:
  - Added conman policy
  - Added label for conman port
  - Added support for mip6d policy
  - Added support for isns
  - Added rtas_errd policy
  - Added support for keepalived policy
  - Add label samba_spool_t for /var/spool/samba
  - Allow httpd_t to bind preupgrade port if httpd_run_preupgrade boolean is enabled
  - Allow openshift_cron_t to append to openshift log files
  - dontaudit sudo domains listing /dev
  - Allow read/write to login records
  - Allow auditctl getattr access on blk_file
  - Allow nova-scheduler to read utmp
  - Added stapserver policy
  - Added support for freeipmi services
  - Added lsm policy
  - Added support for pcp service
  - Added chown capability to dhcpd_t domain
  - Add boolean to allow openshift domains nfs access
  - Allow abrt to read man pages and getcap
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Dontaudit smbd_t sending out random signuls
  - Backport all zabbix changes
  - Allow mcelog write access to nscd socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-237
changelog:
  - Fixes for mirrormanager
  - Fix swift interface
  - Allow lsmd_plugin_t to read localization
  - Allow keepalived read snmp libs, Allow keepalived connect to agentx port
  - Allow keepalived read localization
  - Added setuid capability to lsm service
  - Added some swift rules to rsync policy
  - Remove duplicate line entry in .fc
  - Do not send/receive packets when ftpd_use_passive_mode is disabled
  - Add mirrormanager policy to RHEL6 Fixes Bug 1042864
  - Update permissivedomains by mirrormanager
  - Add mirrormanager policy
  - Added support for openwsmand
  - Added policy for swift
  - Added support for sblim
  - label also 64bit heartbeat libs
  - Allow kill capability on varnish
  - Added haveged policy
  - Add missing kernel_rw_stream_socket_perms
  - Label tcp/udp port no. 3052 as apc, Allow apcups to bind on apc port
  - Allow logwatch stream connect to courier service
  - Fix mcelog policy
  - Back port rsyslog fixes from RHEL7 for rsyslog7
  - Fix whitespace
  - Add support for osad
  - Fix automount policy
  - Added policy for bacula
  - add radvd_read_pid_files inteface
  - Add missing syslog-conn port
  - Allow httpd_t write to kernel keyring
  - Allow httpd_sys_script_t domain to send system log messages 
  - Allow passwd_t to write to ipa trusted user files in /tmp 
  - Boolean to allow mcelog use all the user ttys 
  - Allow icecast to use any tcp ports 
  - Define oracleasm_t as a device node 
  - Allow sudomain to getattr of kernel interface
  - Add squid directory in /var/run
  - Allow automount read nfs symlinks
  - Allow asterisk to connect to the apache ports
  - allow abrt to read mcelog log file 
  - allow udev to search radvd files under the /run dir 
  - allow auditctl getattr access on blk_file 
  Resolves:#1080555
  - Allow ssh to manage nfs links


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-238
changelog:
  - Allow domain to read an append inherited tmp files
  - Dontauit leaks of var_t into ifconfig_t
  - Allow fsdaemon_t to read/write device_t char files 
  Resolves:#1035363
  - Remove sblim_filetrans_named_content in RHEL6
  - We don't have systemd in RHEL6.
  - one more fix for bacula_admin()
  - fix bacula_run_admin()
  - Remove shadow_t label from /etc/security/opasswd 
  - Fix logrotate_use_nfs boolean
  - Allow userdom to read inherited users files in /tmp 
  - Allow certmonger_t read puppet libs
  - Allow in logging_inherit_append_all_logs also ioctl and append
  - Label pacemaker_remoted as cluster_exec_t
  - Tag some conman exec files
  - Allow conman to read localization
  - Should use rw_socket_perms rather then sock_file on a unix_stream_socket
  - Added conman fixes
  - Allow apache to manage passenger sock_files
  - Allow bacula to bind on 9103 tcp port
  - Allow postfix stream connect to antivirus
  - Allow osad to read localization


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-239
changelog:
  - Fixed lsmd_plugin_t
  Resolves:#1111619
  - Added glusterd_conf_t alias glusterd_etc_t
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory 
  Resolves:#982160
  - Label zabbix-proxy files
  Resolves:#1018211
  - allow sshd to write to all process levels in order to change passwd when running at a level
  Resolves:#837616
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range 
  Resolves:#837616
  - Rename quantum port to neutron 
  Resolves:#1024927
  - Added zarafa_read_lib_files interface
  - Added dont audit list non security files in xdm_t 
  Resolves:#1030760
  - Added more fixes relates to 
  Resolves:#1060656
  - Added dontaudit rules to xdm_t 
  Resolves:#1030760
  - Allow procmail to run zarafa-degent 
  Resolves:#1060656
  - Add userdom_user_application_domain in xauth 
  Resolves:#1013832
  - Allow dmesg read raw memory 
  Resolves:#1030762
  - Allow communication between postfix and cyrus 
  Resolves:#1057307


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-240
changelog:
  - Allow nagios to stream connect to postgresqlBZ #1015708
  Resolves:#1015708
  - Allow hypervkvp read localization
  - Fix postfix_admin()
  - Add lldpad policy for MLS


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-241
changelog:
  - Remove deny_ptrace from interfaces
  - Add setpgid procces to mip6d_t
  - Added support for hv_vss_daemon
  - Allow keepalived also managed snmp lib dirs
  - Allow chroot_user_t unconfined shell domtrans
  Resolves:#1082183
  - Label swift-object-expirer as swift_exec_t
  - Allow keepalived manage snmp files, dontaudit list tmp files
  Resolves:#1053450
  - Additional fix for calling postfix interfaces in sysadm.te to make postfix_admin() working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-243
changelog:
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-244
changelog:
  - Add support for vdsm 
  Resolves:#1064270
  - Allow userdomain role to access prelink_mask_t
  - Rename module glusterfs to glusterd 
  Resolves:#1052206
  - Allow gfs_controld_t to getattr on all file systems 
  Resolves:#1110886
  - Allow apache to manage pid sock files 
  Resolves:#1042864
  - Bind TCP/UDP sockets to the nfs port
  - The /var/run/tuned directory is not a regular file 
  Resolves:#1117685
  - Allow utilize winbind for authentication to AD. 
  Resolves:#1084177
  - Dont audit access on /etc/init.d/mcollective for kdump_t
  - FIx labeling in networkmanager.fc
  - Allow passenger to connect to MySQL
  - ALlow passenger to read locales
  - Dontaudit relabelfrom/relabelto for all variablefiles for prelink_map_t
  - Change all var_lib_t types to have also variablestatefile attribute
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-245
changelog:
  - Allow setpgid for all sandbox domains.
  - Allow sandbox domains read all mountpoint symlinks to make symlinked homedirs working with sandbox.
  - One more fix for osad.te
  - Back port osad changes from RHEL7.
  - Rename svirt_lxc_file_t to svirt_sandbox_file_t.
  - Label nginx init script as httpd_initrc_exec_t 
  Resolves:#1045041
  - Allow postfix_smtpd to stream connect to antivirus 
  Resolves:#1105889
  - Label init thttpd file as httpd_initrc_exec_t 
  Resolves:#1069843
  - Allow httpd to setattr on httpd_log files
  Resolves:#1111581
  - Add tomcat
  - Allow zabbix to read system network state
  - Allow ndc to read random and urandom device 
  Resolves:#1110397
  - Add kerberos support for radiusd.
  - Allow procmail to ioctl on zarafa-deliver executable.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-246
changelog:
  - Add boolean to allow user login programs access to /etc/shadow
  - Use old icecast_connect_any boolean name and dontaudit list /tmp with tmp_t labeling
  - Remove unused interface rtas_errd_systemctl 
  Resolves:#1121169
  - Allow prelink_mask to use user terminals and dontaudit relabel tmpfiles.
  - Dontaudit r/w inherited lockfiles/tmpfiles for prelink_mask_t.
  - Allow prelink_mask to append all log files.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-247
changelog:
  - Add all login domain auth_can_read_shadow_passwords attribute.
  - Added support for dhcrelay service
  Resolves: #1123338
  - We need to call auth_tunable_read_shadow in auth_shadow boolean.
  - Move authlogin_shadow to authlogin.if.
  - Add filetrans also for bacula log files.
  - Dontaudit kdumpgui to read openshift_initrc_exec_t
  Resolves: #1023336
  - Allow squid to manage squid_var_run_t sock_file
  Resolves: #1102346
  - Alloe bacula manage bacula_log_t dirs
  Resolves: #1122545
  - Added sys_ptrace cap. to stapserver_t
  Resolves: #811366
  - Label also /var/run/glusterd.socket file as glusterd_var_run_t
  Resolves: #1052206
  - Added support for collectd daemon
  Resolves: #1024715
  - Label conmans pid file as conman_var_run_t, Resolves: #1122106
  - Fix authlogin_shadow boolean to have it for all login_pgm domains
  - Dontaudit r/w inherited all log files for prelink_mask_t
  - Label zabbix_var_lib_t directories
  Resolves: #1053205
  - Allow all sblim domain to read localization data
  Resolves:##1122022


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-248
changelog:
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift 
  Resolves: #1034206
  - Do not send/receive packets when ftpd_use_passive_mode is disabled 
  Resolves: #1105544
  - Allow qemu-ga domtrans to hwclock 
  Resolves: #1062384
  - Allow sshd read access to files on ftp directory 
  Resolves: #1097387
  - dontaudit r/w inherited certs for prelink_mask_t.
  - Allow sblim_gatherd_t to search all mountpoints. This is caused by ps. Should not be needed in Fedora.
  - Fix labeling in dhcpc.fc.
  - Add labels also for glusterd sockets.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-249
changelog:
  - Add support for luci.
  - Add support for rhsmd and treat it with rhsmcertd_t.
  - Make zabbix_agent_t as unconfined domain for rhel6.6.
  - Allow chroot_user_t to change process identity.
  Resolves:#1082183
  - Revert "Remove shadow_t label from /etc/security/opasswd
  - Dontaudit relabel lib_t files for prelink_mask_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-250
changelog:
  - Dontaudit read/write/setattr all pipes for prelink domains on all domains
  Resolves:#1103674
  - Allow chroot_user_t to change the role.
  - Add sys_time caps for virt_qemu_ga_t
  - Add label for /usr/sbin/luci


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-251
changelog:
  - Allow tgtd service to read kernel network state
  Resolves: 1130040
  - Allow mail-servers policies to read pcp libs
  Resolves: 1130934
  - Allow passwd_t to read/write stream sockets
  Resolves: #1129296
  - Add support for zabbix external scripts for which zabbix_script_t domain has been created. This domain is unconfined by default and user needs to run 'semodule -d unconfined' to make system running without unconfined domains. 
  - Dontaudit zebra to read getattr for all files and dirs
  Resolves: 1122031
  - Allow zebra to read /dev/urandom
  Resolves: #1122031
  - Label /var/lib/asterisk/agi-bin as bin_t
  - Added to lldpad policy sys_resource cap. and allow read localization 
  Resolves:1021984
  - Fix path to luci(/usr/sbin/luci) 
  Resolves:1023202
  - Add auth_can_read_shadow_passwords for rlogind.
  - Add authlogin_shadow boolean for all login domains.
  - Dontaudit rw all non security leaks.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-252
changelog:
  - Allow aide_t to read /dev/random and /dev/urandom.
  - Allow sysadm to talk with lldpad over unix dgram socket.
  - Allow sysadm to send/recv with unix dgram socket.
  - Allow crond_t to read lastlog.
  - Allow xdm_t to read plymouthd_spool_t files
  Resolves:#1131195
  - Allow hald to rpm dbus chat
  - Additional dontaudits for prelink_mask_t.
  - Add samba_domain attribute also for smbcontrol_t and winbind_helper_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-253
changelog:
  - Add additional dontaudits for prelink_mask_t
  Resolves:#1103674
  - Allow local_login_t and xdm_t to manage shadow_t because of PAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-254
changelog:
  - Dontaudit to read/write all dev nodes for prelink_mask_t.
  - Add label for path /var/lib/ctdb
  - Allow escd access to /var/run/pcscd.events directory
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-255
changelog:
  - Allow couriertcpd to read /var/spool/courier dir.
  - Allow prelink domain to rea /dev/mem.
  - ALlow transition to prelink_t instead of prelink_mask_t to ABRT domains/rpm.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-257
changelog:
  - Add fixes for sblim_sfcbd to make libvirt-cim working.
  - Allow keepalived stream connect to snmpd
  - Allow local_login_t and xdm_t to manage etc_t if authlogin_can_shadow boolean.
  - Allow prelink_transition_domain to send signal to prelink_mask_t.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-258
changelog:
  - Allow unlink lib_t located in /tmp for prelink_mask_t.
  Resolves:#1103674
  - Add support for pnp4nagios
  - Allow mysql to read all domain state
  - Allow sblim_sfcbd_t to search virt images
  - Revert "Remove shadow_t label from /etc/security/opasswd "


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260
changelog:
  - Add virt_getattr_images and call it for sblim_sfcbd_t.
  - We also need to call virt_search_images for sblim.
  Resolves:#1140614


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-261
changelog:
  - Allow sys_ptrace and dac_override caps for collectd.
  - Add labeling for /etc/rc\.d/init\.d/htcacheclean.
  - Allow /usr/sbin/sfcbd to send audit msgs.
  - Allow postdrop to connect to master process over unix stream socket.
  - Allow ssh_t to connect to all unreserved ports.
  - Allow setfiles domain to access files with admin_home_t. semanage -i /root/testfile.
  - Don't relabel files under /dev/shm/
  - Allow munin_disk_plugin_t getattr access on blk_file 
  - Allow xauth_t and sshd_t to search automount_tmp_t if use_nfs_home_dirs boolean.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow antivirus domains to read all dirs/files regardless of their MCS category set.
  - Add labeling for mariadb log/pid files/dirs.
  - Allow rsyslogd to read /proc/sys/vm/overcommit_memory file.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Remove ftpd_use_passive_mode boolean. It does not make sense due to ephemeral port handling.
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it.
  - Allow qpidd to read network state and sysctls dirs
  Resolves:#1171275
  - Add labeling for /var/bacula directory.
  - mcelog runs as a daemon domain 
  - Allow shutdown to r/w iherited rhev-agetnd pipes.
  - Allow sshd to seind signull itself.
  - Add the 'base_ro_file_type' and 'base_file_type' attributes to RHEL6.
  - Allow prelink_mask_t getattr on filesystems that support xattrs
  - Allow radious to connect to apache ports to do OCSP check.
  - remove transition from unconfined user to auditctl.
  - Backport RHEL7 sblim-sfcb fixes.
  - Add bacula fixes related to unconfined scripts based on ssekidde@redhat.com patch.
  - Allow zebra to communicate with sssd 
  - Add interfaces fixes.
  - Added some optional blogs from timemaster policy to chronyd.
  - Added linuxptp policy
  - Add interface to read mysql db link files
  - Added cinder policy
  - Make munin yum plugin as unconfined by default.
  - Allow bitlbee connections to the system DBUS.
  - Allow hv_vss_daemon to call ioctl(FIFREEZE) on /boot.
  - Add rsync_server boolean to don't have a transition from initrc by default.
  - Dontaudit to r/w inherited pipes from httpd because of certmonger unconfined scripts.
  - Backport all capabilities for cvs from RHEL7.
  - Allow dccproc to execute bash.
  - Fix labeling for /usr/libexec/nm-dispatcher.action.
  - Allow logrotate to manage virt_cache.
  - Allow osad to execute rhn_check.
  - Make osad_t as unconfined domain.
  - Allow osad connect to jabber client port.
  - Allow rhev-agentd to access /dev/.udev/db/block:sr0.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-262
changelog:
  - Allow lsmd_t getattr all exec.
  Resolves:#1141719
  - Update afs policy
  Resolves:#1136396
  - Add support for /usr/sbin/named-sdb.
  - Add support for mongos service.
  - Allow cyrus to use tcp/2005 port.
  - More service wants to auth_use_nsswitch.
  - Allow apps that need to read sysctl_vm_overcommit_t be able to read it.
  - Update passenger rules from RHEL7.
  - Allow smartd to manage generich devices if they are created with wrong label.
  - Allow sblim-sfcb to execute itself.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-263
changelog:
  - Allow userdomain to manage pcscd pid fifo files.
  - Allow prelink domain access to /dev/console 
  Resolves:#1145662
  - Allow httpd search access on tomcat6 directory
  - Allow apcupsd to get attributes of filesystems with xattrs
  - Allow qemu-ga getattr access of all filesystems
  - Allow abrt to read network state information
  - Make collectd_t as unconfined domain.
  - Make rpcbind as nsswitch domain.
  - Back port labeling for /etc/my.cnf.d dir.
  - Allow dhcpd kill capability.
  - Allow cachefilesd to create cachefilesd_var_t
  - cvs_home backport from RHEL7.
  - Add support for new fence agent fence_mpath which is executed by fence_node
  - Allow lsmd plugin to run with configured SSSD.
  - Allow bacula access to tape devices
  - Allow sblim-sfcb setuid.
  - Allow sblim domain to read sysctls.
  - Allow ntp to read localtime and allow timemaster send a signal to ntpd.
  - Add cobblerd_t fixes
  - Allow mysqld_t to use pam
  - Dontaudit xguest_t communication with avahi_t via dbus
  - Allow cobblerd_t to communicate with sssd
  - Allow pmwebd to send and receive messages from avahi over dbus
  - Allow conman_t to commmunicate with sssd
  - Allow mysqld_t to send audit messages
  - Allow load_policy rw access to inherited sssd pipes
  - Update label for /etc/mcelog/.* files
  - Allow bacula_t to connect to psql via tcp/unix socket
  - Remove type to only match directories on /boot
  - Add more labels for ownCloud
  - Dontaudit net_admin capability for munin


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-264
changelog:
  - Allow qpidd to read own init script file.
  - Allow passenger to accept connection
  - Back port hypervkvp fixes from RHEL7
  - ALlow load_policy to list inotifyfs filesystem
  - Allow cluster domain to execute ldconfig and update lvm_read_config() interface
  -  Allow sssd_t to connect to samba TCP port
  - Allow NetworkManager to run arping
  Resolves:#1209854
  - Backport RHEL7 redis policy
  - Add apache log and lib labels for roundcubemail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-265
changelog:
  - Allow redis to create /var/run/redis/redis.sock
  - Allow fence_mpathpersist to run mpathpersist which requires sys_admin capability.
  Resolves:#1206244
  - Allow rhn_check running as rpm to domtrans to shutdown domain
  - openshift_cache_t does exist


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-266
changelog:
  - Add audit_access permissions
  - Allow cupsd_t access to files in /etc dir
  - Allow hplip to dbus chat with all users.
  - Allow sblim-gathered sys_ptrace capability.
  - Allow sys_admin capability for gfs_controld
  - Add more cobbler labels to /var/lib/tftpboot/
  - Add new smbd_tmpfs_t type.
  - Add more fixes related to timemaster+ntp+ptp4l.
  - Fix cgdcbxd_admin() interface.
  - Add labeling for /var/tmp/kadmin_0 and /var/tmp/kiprop_0.
  - Dontaudit read access on admin_home_t for load_policy.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-267
changelog:
  - Allow ctdb to create rawip socket.
  - ALlow nmbd_t to crate nmbd_var_run_t dir under smbd_var_run_t.
  - Make ctdbd as userdom_home_reader.
  - Allow ctdbd to bind  smbd port.
  Resolves:#1219317


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-268
changelog:
  - Add labeling for /var/run/ctdb and allow samba domains to connect to ctdbd.
  Resolves:#1221929
  - Allow glusterd to read/write samba config files.
  - Update mysqld rules related to mysqld log files.
  - Add fixes for hypervkvp realed to ifdown/ifup scripts.
  - Update netlink_route_socket for ptp4l.
  - Allow sosreport to dbus chat with NM.
  - Allow glusterd to connect to /var/run/dbus/system_bus_socket.
  - ALlow glusterd to have sys_ptrace capability. Needed by gluster+samba configuration.
  - Add new boolean samba_load_libgfapi to allow smbd load libgfapi from gluster. Allow smbd to read gluster config files by default.
  - Allow gluster to transition to smbd. It is needed for smbd+gluster configuration.
  - Allow glusterd to read /dev/random.
  - Label all gluster hooks in /var/lib/gluster as bin_t. Thy are not created on the fly.
  - Update nagios_run_sudo boolean to allow run chkpwd.
  - Add labeling for /usr/sbin/kpropd.
  - Add nagios_run_sudo boolean
  - Allow ctdb to create rawip socket.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-269
changelog:
  - Fix labeling for /var/tmp/kiprop_0 to kadmind_tmp_t.
  - Allow postdrop runinng as postfix_postdrop_t to access /var/spool/postfix/public/pickup socket.
  - Allow gluster hooks scripts to transition to ctdbd_t.
  - Update policy rules for afs_fserver_t to allow connectto on unix_stream_socket.
  - Allow gluster transition to smbd_t also using samba init script.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-270
changelog:
  - Update policy rules for afs_fserver_t to allow connectto on unix_stream_socket instead of afs_t.
  - Allow smbd to access /var/lib/ctdb/persistent/secrets.tdb.0.
  - Allow glusterd to execute consoletype.
  - Glusterd wants to manage samba config files if they are setup together.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-271
changelog:
  - Remove ctdbd_manage_var_files() interface which is not used and is declared for the wrong type.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-272
changelog:
  - Allow hypervkvp to read default SELinux contexts.
  - Allow hypervkvp to write to /etc directories.
  - Update all man pages for RHEL6.7 SELinux domains/roles using the latest sepolicy-manpage from RHEL7.
  - Fix labeling for /var/lib/graphite-web
  - ALlow kpropd to connect to tcp/754 port.
  Resolves:#1220691
  - Allow php-fpm write access to /var/run/redis/redis.sock
  - Update fs_rw_inherited_nfs_files() to allow search auto mountpoints.
  - Dontaudit rpm leaks for prelink_mask_t.
  - Allow sysctl to have running under hypervkvp_t domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-273
changelog:
  - Fix redis_stream_connect interface.
  Resolves:#1220691
  - Allow kadmind to bind to kprop port.
  - Add new man pages for bacula


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have mknod capability. It creates a special file using mknod in a brick.
   - Update rules related to glusterd_brick_t.
   - Allow glusterd to execute lvm tools in the lvm_t target domain.
   - Allow glusterd to execute xfs_growfs in the target domain.
   - Add support for /usr/sbin/xfs_growfs.
   - Allow glusterd to create samba config files if it is started by service script and running with unconfined_u.
  Resolves:#1228109
  - Fix description for ftpd_use_passive_mode boolean.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have transition to insmod.
  - Allow glusterd to use geo-replication gluster tool.
  - Remove gluster from permissive domains.
  Resolves:#1229605


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-276
changelog:
  - Allow gluster to manage own log files.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  - Label gluster python hooks also as bin_t.
  - Allow samba_t net_admin capability to make CIFS mount working.
  Resolves:#1229605
  - Allow ssh_keygen_t to manage keys located in /var/lib/gluster.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-278
changelog:
  - Allow logrotate get attributes of all unallocated tty device nodes.
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  - Allow glusterd to connect to init.
  Resolves:#1230371
  - Allow gluster do dbus chat with domain running as initrc_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279
changelog:
  - Backport gluster fixes from RHEL7
   - execute showmount in own domain
   - execute nsfd in own domain
   - allow gluster to connect to all ports
  - Add support for /usr/sbin/ctdbd_wrapper.
  - nrpe needs kill capability to make gluster moniterd nodes working.
  Resolves:#1235405


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-280
changelog:
  - Allow Chromium to use setcap inside its SUID sandbox.
  - Allow qpidd to be working with MRG. It requires to manage symlinks in /var/lib/qpidd.
  Resolves:#1251584


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-282
changelog:
  - Add missing fs_setattr_nfs_dirs() and samba_setattr_samba_share_dirs() interfaces.
  - Allow g-k-daemon running as passwd_t to manage Gnome config files to allow a use change his/here password via SSH conncetions. 
  Resolves:#1131531
  - Allow chronyd to set attributes on chronyd keys.
  - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.conf. 
  Resolves;#1278771
  - Add default labeling for /var/run/qemu-ga.pid and /var/run/qga.state. 
  - Dontaudit sys_module capability for asterisk. Backported from RHEL7. 
  Resolves:#1277199
  - Allow nfsd to execute mount in nfsd_t domain. It wants also manage mount PID files. 
  Resolves:#1275221
  - Add tmpreaper_use_nfs and tmpreaper_use_samba booleans. 
  Resolves:#1271996
  - Add labeling for /usr/libexec/mock/mock as we have it for /usr/sbin/mock. 
  Resolves:#1271211
  - Allow jabberd to read /etc/pki/tls/cert.pem. 
  Resolves:#1261145
  - Turn the nagios_run_sudo boolean on by default. Previously a part of these rules was turn on by default and wit this boolean we turned them of. 
  Resolves:#1240793
  - In RHEL-6, we have a transition from unconfined_t to xauth_t. It causes xauth commands wants to reas/write inherited stream. 
  Resolves:#988117
  - Add unconfined_rw_stream() interface.
  - Add support for /dev/mptctl device used to check RAID status.
  - Update qpidd policy to set kerberos authentication. 
  Resolves:#1224666
  - Allow logwatch to read bacula store log files. 
  - Add cobler_var_lib_t labeling for /var/lib/tftpboot/boot/grub. It allows cobblerd to manage it by default. 
  Resolves:#1213539
  - Allow cobbler to execute reposync in the cobberld_t domain. It wants to manage rpm cache files. And add dontaudit rules for rpm db files. 
  Resolves:#1207260
  - Allow dnssec_t mounton access 
  Resolves:#1246460
  - Allow fenced node dbus msg when using foghorn witch configured foghorn, snmpd, and snmptrapd. 
  Resolves:#1242082
  - Allow all MTA user agent (postfix_postdrop_t for this fix) to read/write inherited fail2ban temporary files. 
  Resolves:#1241968


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-284
changelog:
  - Allow ipsec_mgmt_t to access netlink route socket and set attributes for /var/run/pluto directories.
  Resolves:#1287182


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-285
changelog:
  -Allow munin apache scripts to manage munin logs and talk with httpd over unix stream socket. 
  Resolves:#1286052
  -Allow httpd to send generic signal to httpd suexec if htpasswd is invoked. Resolves:#1286007
  -Dontaudit httpd running as piranha_web_t accesses to snmp mib indexes. 
  Resolves:#1285674
  -Allow ipsec running as ipsec_t to create pluto.log with correct labeling.
  Resolves:#1267212
  -Allow whack executed by sysadm SELinux user to access /var/run/pluto/pluto.ctl. It fixes "ipsec auto --status" executed by sysadm_t. 
  Resolves:#1257591
  -Dontaudit attemps to write generic tmp_t dirs if gnome-keyring-daemon runs under passwd_t domain. 
  Resovles:#1131531


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-286
changelog:
  - arping running as netutils_t sys_module capability for removing tap devices. Dontaudit this access.
  - Allow hv_vss_daemon to write access on all mount point directories to make VSS live backup if working if there is home partition.
  - Add support for squid to be able to create temoporary files. 
  Resolves:#1291164
  - Allow usbhid-ups to access /proc/bus/usb to have it working on ppc64 machines. 
  Resolves:#1290693
  - Add support for /var/run/chronyd.sock. 
  Resolves:#1290310
  - Update apache_content_template() inteface to allow "shutdown" permissions for apache scripts on unix_stream_socket. 
  Resolves:#1286052
  - Fix label for /var/lib/graphite-web 
  Resolves:#1221934
  - Dontaudit rpm write access for prelink_mask_t Resolves:#1216907
  - Allow apcupsd_t to communicate with sssd Add default label for /var/lock/subsys/apcupsd and /var/lock/LCK.
  Resolves:#1286030
  - Allow shorewall_t to create netlink_socket 
  Resolves:#1290705


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-287
changelog:
  - Allow sssd-ifp to dbus chat with all users. 
  Resolves:#1296693
  - Allow keepalived to connect to 3306/tcp port - mysqld_port_t.
  Resolves:#1296854
  - Add support for stunnel custom log files, allow transition and label /log/stunnel* log files. 
  Resolves:#1296238
  - Provide conman_unconfined_script_exec_t/conman_unconfined_script_t SELinux types used for conman scripts.
  - Resolves:#1290565
  - Allow ctdbd trasition to smbcontrol_t when "ctdb disablescript 50.samba" is executed.
  - Resolves:#1293787
  - Label ctdbd event scripts as ctdbd_exec_t instead of bin_t. 
  Resolves:#1293787
  - Allow watchdog to read localization files. It wants to access localtime. 
  Resolves:#1267974
  - Backport rules allowing sssd_t to be able to request the kernel to load a module.
  Resolves:#1246634


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-288
changelog:
  - Allow netutils_t domain to chown capability.
  Resolves:#1298514
  - Allow all jabber domain to access SSL certs.
  Resolves:#1261145
  - Allow shorewall request kernel load module
  Resolves:#1290705
  - Allow passwd to create temporary files to support ssh logins if gnome-keyring-daemon is called by passwd and runs in passwd_t.
  Resolves:#1131531
  - Allow stunnel to write log outputs on users pty.
  Resolves:#1296238
  - Allow polkit-1/actions to get attributes for all filesytems.
  Resolves:#1301561
  - Allow p11-child to connect to apache ports. Allow p11-child  to manage authentication cache.


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1326621


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-293
changelog:
  - Add setgid capability to winbind domain.
  - Allow getcap for winbind domain.
  Resolves: rhbz#1336394
  - Allow rebuild mdadm arraiy with SELinux enabled in enforcing mode.
  Resolves: rhbz#1343754
  - Allow kpropd_t domain to use nsswitch.
  Resolves: rhbz#1337895
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1331585


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-294
changelog:
  -  Added boolean: authlogin_yubikey
  Resolves:rhbz#1362033
   - Add new type: alsa_lock_t, Allow alsa_t domain creating files in /var/lock labeled as alsa_lock_t.
   Resolves:rhbz#1340150
   - Allow bacula send signull itself.
   Resolves: rhbz#1313382
   - label /var/lib/pcsd/ as cluster_var_lib_t.
   Resolves:rhbz#1326718
   - Allow httpd also write to anon_inodefs files
   Resolves: rhbz#1377644
   - Allow lsmd to read localization. Allow lsmd plugins to exec ldconfig
   Resolves: rhbz#1336590
   - Allow auditctl_t domain read localization.
   Resolves:rhbz#1316444
   - Allow cobblerd_t to delete dirs labeled as tftpdir_rw_t. Resolves: rhbz#1318166
   - Allow httpd_t domain to list inotify filesystem
   Resolves:rhbz#1299552
   - Allow dovecot_t send signull to dovecot_deliver_t
   Resolves:rhbz#1320037
   - Fix couple AVC to start roundup properly
   Resolves: rhbz#1286994
   - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6
   Resolves:rhbz#1299306
   - Add sys_ptrace capability to pegasus domain
   Resolves:rhbz#980439
   - Allow sshd to set mcs process categories.
   Resolves: rhbz#1322409
   - Add setgid capability to winbind domain. Allow getcap for winbind domain.
   Resolves: rhbz#1336394
   - Allow rebuild mdadm arraiy with SELinux enabled in enforcing mode.
   Resolves: rhbz#1343754
   - Allow kpropd_t domain to use nsswitch.
   Resolves: rhbz#1337895


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-296
changelog:
  - Allow hypervvssd_t to read all dirs.
  Resolves: rhbz#1335733
  - Dontaudit abrt_t writing to cert_t files.
  Resolves: rhbz#1334606
  - Allow isns_t domain to connect on port 51954 labeled as isns_port_t.
  Resolves: rhbz#1365501
  - Fixed vsftpd can access nfs even if allow_ftpd_use_nfs is off under specific conditions
  Resolves: rhbz#1310077
  - Allow asterisk domain to connect on port 5222 labeled as jabber_client_port_t
  Resolves:rhbz#1334756
  - Label /etc/puppetlabs as puppet_etc_t.
  Resolves:rhbz#1386181
  - Allow mount to read nvme devices
  Resolves: rhbz#1389982
  - Allow roundup to use nsswitch.
  Resolves: rhbz#1286994
  - Backport domain transition from pegasus_t to rpm_t
  - Allow pegasus to read all sysctls
  - Allow pegasus to read raw memory.
  Resolves:rhbz#980439


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-297
changelog:
  - Remove setgid and setuid capabilities from userdom_login_user_template
  Resolves: rhbz#1378463
  - Allow logrotate to read chronyd keys
  Resolves: rhbz#1390657
  - Allow fail2ban to domtrans to shorewall.
  Resolves: rhbz#1390810


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-298
changelog:
  - Allow isnsd_t to accept tcp connections
  Resolves:rhbz#1365501
  - Add label for alsa_var_lib_t dirs and files.
  Resolves: rhbz#1340150


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-300
changelog:
  - Allow sblim_reposd_t domain to read cert_f files
  Resolves:rhbz#1392382
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1392406


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-301
changelog:
  - Allow hald_t to read nvme devices.
  Resolves: rhbz#1389982
  - Allow ftpdctl_t domain to manage own sockets
  Resolves: rhbz#1392525


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-302
changelog:
  - Label /var/lock/kdump as kdump_lock_t.
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-303
changelog:
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565
  - Allow guest-set-user-passwd to set users password
  Resolves: rhbz#1369699


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-304
changelog:
  - Allow _java_t domain to read systemd state.
  Resolves:rhbz#1393938
  - Allow kdumpgui to read/write to nvme filesystem.
  Resolves:rhbz#1323293


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-305
changelog:
  - Fix typo bug sepgsql_contexts file
  Resolves: rhbz#1397703
  - Allow sssd_t domain to manage samba files and dirs.
  Resolves: rhbz#1395403
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1397117
  - Allow consolekit_t domain to manage consolekit_log_t dirs
  Resolves: rhbz#1397802


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-306
changelog:
  - Allow hostname_t domain to manage cluster_tmp_t files
  Resolves: rhbz#1400234
  - Allow ipsec_mgmt_t domain use nsswitch
  Resolves:rhbz#1401611
  - Allow conman_t domain to list conman_uconfined_script_exec_t dirs.
  Resolves:rhbz#1397117


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Label /usr/bin/puppet* binaries as puppet_exec_t
  Resolves: rhbz#1386181


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-308
changelog:
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1461064


author: Phil Knirsch <pknirsch@redhat.com> 1.17-1
changelog:
  - Update to sg3-utils-1.17
  - Split package up into 3 subpackages: sg3_utils, devel and libs
  - Some minor updates to the specfile


author: Phil Knirsch <pknirsch@redhat.com> - 1.25-4
changelog:
  - Dropped really unnecessary Provides of sg_utils (#226414)
  - Use --disable-static in configure (#226414)


author: Dan Horák <dan@danny.cz> - 1.28-1
changelog:
  - update to version 1.28
  - added fixes from RHEL to rescan-scsi-bus.sh
  - added scsi-rescan symlink to the rescan-scsi-bus.sh script


author: Dan Horák <dan@danny.cz> - 1.28-2
changelog:
  - include rescan-scsi-bus script 1.35
  - rebase patches and add fix for issue mentioned in #538787
  - Related: #538787


author: David Sommerseth <davids@redhat.com> - 1.28-9
changelog:
  - Added packaging of COPYING (#974147)
  - Removed packaging of INSTALL (info not needed for binary installs)


author: David Sommerseth <davids@redhat.com> - 1.28-11
changelog:
  - Avoid deletion of /dev/null (#1245302)
  - Fix sg_persist returns "Host_status=0x11 is invalid", backport of DID_TRANSPORT_*/DID_TARGET_/DID_NEXUS_FAILURE flags (#886611)


author: Adam Stokes <ajs at redhat dot com> = 1.8-21
changelog:
  - more sanitizing options for log files
  - rhbz fixes from RHEL version merged into trunk
  - progressbar update


author: Adam Stokes <ajs at redhat dot com> = 1.9-1
changelog:
  - version bump 1.9
  - replaced compression utility with xz
  - strip threading/multiprocessing
  - simplified progress indicator
  - pylint update
  - put global vars in class container
  - unittests
  - simple profiling
  - make use of xgettext as pygettext is deprecated


author: Adam Stokes <ajs at redhat dot com> = 2.1-0
changelog:
  - Resolves: bz585923
  - Resolves: bz585942
  - Resolves: bz586409
  - Resolves: bz586389
  - Resolves: bz548096
  - Resolves: bz557828
  - Resolves: bz563637
  - Resolves: bz584253
  - Resolves: bz462823
  - Resolves: bz528881
  - Resolves: bz566170
  - Resolves: bz578787
  - Resolves: bz581817
  - Resolves: bz581826
  - Resolves: bz584695
  - Resolves: bz568637
  - Resolves: bz584767
  - Resolves: bz586370


author: Adam Stokes <ajs at redhat dot com> = 2.2-0
changelog:
  - Resolves: bz581921
  - Resolves: bz584253
  - Resolves: bz562651
  - Resolves: bz566170
  - Resolves: bz586450
  - Resolves: bz588223
  - Resolves: bz559737
  - Resolves: bz586405
  - Resolves: bz598978
  - Resolves: bz584763


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-3
changelog:
  - Fix cluster plugin dlm lockdump for el6
    Resolves: bz622407
  - Add sssd plugin to collect configuration and logs
    Resolves: bz624162
  - Collect /etc/anacrontab in system plugin
    Resolves: bz622527
  - Correct handling of redhat-release for el6
    Resolves: bz622528


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-4
changelog:
  - Fix collection of logs and config files in sssd.py
    Resolves: bz624162
  - Add support for collecting entitlement certificates in rhn.py
    Resolves: bz678665


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-6
changelog:
  - Fix collection of chkconfig output in startup.py
    Resolves: bz659467
  - Collect /etc/dhcp in dhcp.py plugin
    Resolves: bz676522
  - Collect dmsetup ls --tree output in devicemapper.py
    Resolves: bz675559
  - Collect lsblk output in filesys.py
    Resolves: bz679433


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-9
changelog:
  - Collect yum repository list by default
    Resolves: bz600813
  - Add basic Infiniband plugin
    Resolves: bz673244
  - Add plugin for scsi-target-utils iSCSI target
    Resolves: bz677124
  - Fix autofs plugin LC_ALL usage
    Resolves: bz683404
  - Fix collection of lsusb and add collection of -t and -v outputs
    Resolves: bz691477
  - Extend data collection by qpidd plugin
    Resolves: bz726360
  - Add ethtool pause, coalesce and ring (-a, -c, -g) options to network plugin
    Resolves: bz726427


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-10
changelog:
  - Fix collection of data from LVM2 reporting tools in devicemapper plugin
    Resolves: bz704383
  - Add /proc/vmmemctl collection to vmware plugin
    Resolves: bz709491


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-11
changelog:
  - Truncate files that exceed specified size limit
    Resolves: bz683219
  - Add support for collecting Red Hat Subscrition Manager configuration
    Resolves: bz714293
  - Collect /etc/init on systems using upstart
    Resolves: bz694813
  - Don't strip whitespace from output of external programs
    Resolves: bz713449
  - Collect ipv6 neighbour table in network module
    Resolves: bz721163
  - Collect basic cgroups configuration data
    Resolves: bz729455


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-14
changelog:
  - Collect brctl show and showstp output
    Resolves: bz697899
  - Collect nslcd.conf in ldap plugin
    Resolves: bz682124


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-15
changelog:
  - Fix brctl collection when a bridge contains no interfaces
    Resolves: bz697899
  - Fix up2dateclient path in hardware plugin
    Resolves: bz736718


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-16
changelog:
  - Fix execution of RHN hardware.py from hardware plugin
    Resolves: bz736718
  - Fix hardware plugin to support new lsusb path
    Resolves: bz691477


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-18.el6
changelog:
  - Collect fence_virt.conf in cluster module
    Resolves: bz760995
  - Fix collection of /proc/net directory tree
    Resolves: bz730641
  - Gather output of cpufreq-info when present
    Resolves: bz760424
  - Fix brctl showstp output when bridges contain multiple interfaces
    Resolves: bz751273
  - Add /etc/modprobe.d to kernel module
    Resolves: bz749919
  - Ensure relative symlink targets are correctly handled when copying
    Resolves: bz782589
  - Fix satellite and proxy package detection in rhn plugin
    Resolves: bz749262
  - Collect stderr output from external commands
    Resolves: bz739080
  - Collect /proc/cgroups in the cgroups module
    Resolve: bz784874
  - Collect /proc/irq in the kernel module
    Resolves: bz784862
  - Fix installed-rpms formatting for long package names
    Resolves: bz767827
  - Add symbolic links for truncated log files
    Resolves: bz766583
  - Collect non-standard syslog and rsyslog log files
    Resolves: bz771501
  - Use correct paths for tomcat6 in RHN module
    Resolves: bz749279
  - Obscure root password if present in anacond-ks.cfg
    Resolves: bz790402
  - Do not accept embedded forward slashes in RHN usernames
    Resolves: bz771393
  - Add new sunrpc module to collect rpcinfo for gluster systems
    Resolves: bz784061


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-19.el6
changelog:
  - Collect additional diagnostic information for realtime systems
    Resolves: bz789096
  - Improve sanitization of RHN user and case number in report name
    Resolves: bz771393
  - Fix verbose output and debug logging
    Resolves: bz782339
  - Add basic support for CloudForms data collection
    Resolves: bz752666
  - Add support for Subscription Asset Manager diagnostics
    Resolves: bz752670


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-22.el6
changelog:
  - Correct aeolus debug invocation in CloudForms module
    Resolves: bz752666
  - Update gluster module for gluster-3.3
    Resolves: bz784061
  - Add additional command output to gluster module
    Resolves: bz768641
  - Add support for collecting gluster configuration and logs
    Resolves: bz752549


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-24.el6
changelog:
  - Fix katello and aeolus command string syntax
    Resolves: bz752666
  - Remove stray hunk from gluster module patch
    Resolves: bz784061


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-29.el6
changelog:
  - Collect the swift configuration directory in gluster module
    Resolves: bz822442
  - Update IPA module and related plug-ins
    Resolves: bz812395


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-31.el6
changelog:
  - Avoid calling volume status when collecting gluster statedumps
    Resolves: bz849546
  - Use a default report name if --name is empty
    Resolves: bz822113
  - Quote tilde characters passed to shell in RPM module
    Resolves: bz821005
  - Collect KDC and named configuration in ipa module
    Resolves: bz825149
  - Sanitize hostname characters before using as report path
    Resolves: bz822174
  - Collect /etc/multipath in device-mapper module
    Resolves: bz817093
  - New plug-in for PostgreSQL
    Resolves: bz852049
  - Add OpenStack module
    Resolves: bz840057
  - Avoid deprecated sysctls in /proc/sys/net
    Resolves: bz834594
  - Fix error logging when calling external programs
    Resolves: bz824378
  - Use ip instead of ifconfig to generate network interface lists
    Resolves: bz833170


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-32.el6
changelog:
  - Collect /proc/pagetypeinfo in memory module
    Resolves: bz809727
  - Strip trailing newline from command output
    Resolves: bz850433
  - Add sanlock module
    Resolves: bz850779
  - Do not collect archived accounting files in psacct module
    Resolves: bz850542
  - Call spacewalk-debug from rhn module to collect satellite data
    Resolves: bz859142


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-33.el6
changelog:
  - Add Red Hat Update Infrastructure module
    Resolves: bz821323
  - Collect /proc/iomem in hardware module
    Resolves: bz840975
  - Collect subscription-manager output in general module
    Resolves: bz825968
  - Collect rhsm log files in general module
    Resolves: bz826312
  - Fix exception in gluster module on non-gluster systems
    Resolves: bz849546
  - Fix exception in psql module when dbname is not given
    Resolves: bz852049


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-35.el6
changelog:
  - Report --name and --ticket values as defaults
    Resolves: bz822113
  - Fix device-mapper command execution logging
    Resolves: bz824378
  - Fix data collection and rename PostreSQL module to pgsql
    Resolves: bz852049


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-40.el6
changelog:
  - Backport SELinux enhancements from upstream
    Resolves: bz876309
  - Fix invocation of 'udevadm info' in device-mapper plug-in
    Resolves: bz947424


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-41.el6
changelog:
  - Exclude RPC files from procfs data collection in networking module
    Resolves: bz913201
  - Add NFS client plug-in
    Resolves: bz907861
  - Restrict wbinfo collection to local domain in samba plug-in
    Resolves: bz986973


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-42.el6
changelog:
  - Update sosreport user interface text
    Resolves: bz878589
  - Preserve ownership and permissions on collected files
    Resolves: bz888724
  - Do not collect krb5.keytab in samba plug-in
    Resolves: bz987103
  - Collect output of 'ls -l /var/named' in named plug-in
    Resolves: bz896713
  - Collect /var/log/squid in squid plug-in
    Resolves: bz955671
  - Fix systool invocation in device-mapper plug-in
    Resolves: bz868719
  - Add plug-in to collect OpenHPI configuration
    Resolves: bz924338
  - Fix traceback in sar module when /var/log/sa does not exist
    Resolves: bz883443
  - Collect mountstats and mountinfo files in filesys plug-in
    Resolves: bz988417
  - Add crm_report integration for pacemaker to cluster plug-in
    Resolves: bz989292


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-43.el6
changelog:
  - Add restricted rpm verify
    Resolves: bz888589
  - Add new foreman plug-in
    Resolves: bz976386
  - Collect saved vmcore-dmesg.txt files in kdump plug-in
    Resolves: bz924839
  - Obfuscate luci secrets in cluster plug-in
    Resolves: bz986301
  - Remove rpm list collection from RHN module
    Resolves: bz884609
  - Add gluster geo-replication status and sync with RHS version
    Resolves: bz868711
  - Obscure passwords in libvirt and corosync data
    Resolves: bz883811
  - Make krb5 plug-in conform with sos-2.2 plug-in API
    Resolves: bz987103
  - Add further NIS data collection
    Resolves: bz928748
  - Fix symbol collection for modern kernels
    Resolves: bz970417
  - Disable 'ipsec barf' collection in openswan plug-in
    Resolves: bz924925
  - Add pam_ldap.conf collection to ldap plug-in
    Resolves: bz877395
  - Force LC_ALL=C for external commands
    Resolves: bz888488
  - Rationalise lvm2 plug-in lvmdump options
    Resolves: bz980959
  - Backport addCopySpecs from upstream
    Resolves: bz924338, bz907861


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-45.el6
changelog:
  - Fix collection of squid log files
    Resolves: bz955671
  - Fix regex substitution in openhpi plug-in
    Resolves: bz924338
  - Fix typo in /proc/kallsyms collection
    Resolves: bz970417
  - Fix exception while post-processing command output
    Resolves: bz986301, bz883811


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-46.el6
changelog:
  - Fix obfuscation of luci secrets in cluster plug-in
    Resolves: bz986301
  - Fix password substitution in libvirt plug-in
    Resolves: bz883811


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-54.el6
changelog:
  - [hpasm] new plugin to collect HP ASM information
    Resolves: bz915115
  - [sos] improve handling of fatal IO errors
    Resolves: bz1085042
  - [bootloader] collect grub.conf for UEFI based systems
    Resolves: bz1076388
  - [ctdb] add plugin to collect Samba CTDB information
    Resolves: bz961041
  - [keepalived] new plugin
    Resolves: bz1107862
  - [sssd] scrub ldap_default_authtok in sssd plugin
    Resolves: bz1013366
  - [haproxy] new plugin
    Resolves: bz1107866
  - [gluster] add 'logsize' and 'all_logs' plugin options
    Resolves: bz1002619


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-55.el6
changelog:
  - [selinux] pass --input-logs when calling ausearch
    Resolves: bz1032706
  - [printing] fix cups log file size limiting
    Resolves: bz1061529
  - [auditd] fix log size limiting
    Resolves: bz1061529
  - [hardware] call hardware.py directly instead of invoking python
    Resolves: bz1041770


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-56.el6
changelog:
  - [ipa] add ipa-replica-manage output
    Resolves: bz1012410
  - [bootloader] Include /etc/yaboot.conf
    Resolves: bz1001941
  - [cluster] collect /sys/fs/gfs2/*/withdraw
    Resolves: bz997174
  - [general] do not collect /var/log/sa
    Resolves: bz1001600
  - [networking] avoid Cisco cdp paths in /proc and /sys
    Resolves: bz1004936
  - [sar] Handle compressed binary data files better
    Resolves: bz1001600
  - [sar] Add file size limits
    Resolves: bz1001600
  - [sar] Enable XML data collection
    Resolves: bz1001600


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-57.el6
changelog:
  - [tomcat] update for tomcat6 and add password filtering
    Resolves: bz1088070
  - [filesys] collect dumpe2fs -h output by default
    Resolves: bz1105629
  - [rpm] reduce number of calls to rpm
    Resolves: bz1019872
  - Verify fewer packages in rpm plug-in
    Resolves: bz1019872
  - [bootloader] elide bootloader password
    Resolves: bz1101311
  - [plugin] backport do_path_regex_sub()
    Resolves: bz1101311
  - [networking] do not attempt to read use-gss-proxy
    Resolves: bz1079954
  - [mysql] limit log collection by default
    Resolves: bz1015783
  - [mysql] add optional database dump support
    Resolves: bz1032262
  - [docs] update man pages
    Resolves: bz1022226
  - [sosreport] log exceptions during Plugin.postproc()
    Resolves: bz1020445
  - [distupgrade] elide passwords in kickstart user directives
    Resolves: bz1052344


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-60.el6
changelog:
  - [mongodb] backport new plugin from upstream
  - [activemq] backport new plugin from upstream
  - [openshift] sync plugin with upstream
  - [plugin] backport collectExtOutputs and addCopySpecs
  - Make OpenShift module collect domain information
  - Add 'gear' option to OpenShift module
  - Add OpenShift module
    Resolves: bz1039755
  - [plugin] backport addCopySpecLimit tailit parameter
    Resolves: bz1001600


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-61.el6
changelog:
  - [powerpc] backport plugin from upstream
    Resolves: bz977190
  - [devicemapper] set locking_type=0 when calling lvm2 commands
    Resolves: bz1102282
  - [nfsserver] collect 'exportfs -v'
    Resolves: bz985512
  - [openshift] improve password redaction
    Resolves: bz1039755
  - [openshift] don't collect all of /etc/openshift
    Resolves: bz1039755


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-62.el6
changelog:
  - Restrict ldap and ds plugin paths to avoid collecting secrets
    Resolves: bz994628
  - Add certutil output to ldap and ds plugins to summarize certs
    Resolves: bz994628


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-65.el6
changelog:
  - [grub] Fix grub.conf path for grub-1.x versions
    Resolves: bz1076388
  - [ds] Fix logging exception when plugin force-enabled
    Resolves: bz994628


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-68.el6
changelog:
  - [ds] add collection of ds admin server configuration
    Resolves: bz994628
  - [ldap] ensure /etc/openldap/ content is collected
    Resolves: bz994628
  - [plugintools] preserve permissions on directories
    Resolves: bz1069786


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-3
changelog:
  - [pam] add pam_tally2 and faillock support
  - [postgresql] obtain db password from the environment
  - [pcp] add Performance Co-Pilot plugin
  - [nfsserver] collect /etc/exports.d
  - [sosreport] handle --compression-type correctly
  - [anaconda] redact passwords in kickstart configurations
  - [haproxy] add new plugin
  - [keepalived] add new plugin
  - [lvm2] set locking_type=0 when calling lvm commands
  - [tuned] add new plugin
  - [cgroups] collect /etc/sysconfig/cgred
  - [plugins] ensure doc text is always displayed for plugins
  - [sosreport] fix the distribution version API call
  - [docker] add new plugin
  - [openstack_*] include broken-out openstack plugins
  - [mysql] support MariaDB
  - [openstack] do not collect /var/lib/nova
  - [grub2] collect grub.cfg on UEFI systems
  - [sosreport] handle out-of-space errors gracefully
  - [firewalld] new plugin
  - [networking] collect NetworkManager status
  - [kpatch] new plugin
  - [global] update to upstream 3.2 release


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-4
changelog:
  - [yum] call rhsm-debug with --no-subscriptions
  - [powerpc] allow PowerPC plugin to run on ppc64le
  - [package] add Obsoletes for sos-plugins-openstack


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-5
changelog:
  - [corosync] add postprocessing for corosync-objctl output
  - [ovirt_hosted_engine] fix exception when force-enabled


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-6
changelog:
  - [tomcat] add support for tomcat7 and default log size limits
  - [mysql] obtain database password from the environment


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-8
changelog:
  - [kpatch] do not attempt to collect data if kpatch is not installed
  - [archive] drop support for Zip archives


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-9
changelog:
  - [navicli] catch exceptions if stdin is unreadable
  - [docs] update man page for new options
  - [sosreport] make all utf-8 handling user errors=ignore


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-11
changelog:
  - [sosreport] do not make logging calls after OSError
  - [sosreport] catch OSError exceptions in SoSReport.execute()
  - [anaconda] make useradd password regex tolerant of whitespace


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-12
changelog:
  - [plugin] limit path names to PC_NAME_MAX
  - [squid] collect files from /var/log/squid
  - [sosreport] log plugin exceptions to a file
  - [ctdb] fix collection of /etc/sysconfig/ctdb
  - [sosreport] fix silent exception handling


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-14
changelog:
  - [mysql] test for boolean values in dbuser and dbpass
  - [mysql] improve handling of dbuser, dbpass and MYSQL_PWD


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-15
changelog:
  - [global] update el6 to upstream 3.2 release
    Resolves: bz1144525
  - [global] sync 3.2-15.el6 with RHEL-7.1
    Resolves: bz1144525


author: Shane Bradley <sbradley@redhat.com> = 3.2-16
changelog:
  - [cluster] Added package luci and fix lockdumps capturing.
    Resolves: bz1171186
  - [puppet] Adding new plugin for puppet
    Resolves: bz1172880
  - [block] parted will use sector units instead of human units.
    Resolves: bz1086537
  - [foreman] Added option to prevent generic resource collection with foreman plugin. Remove the plugin katello since data collection done by foreman-debug.
    Resolves: bz1135290


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-17
changelog:
  - [policy/redhat] use /tmp as default temporary directory
  - [global] remove dependency on python-six
    Resolves: bz1144525


author: Shane Bradley <sbradley@redhat.com> = 3.2-18
changelog:
  - [openshift] Collect additional config files.
    Resolves: bz1166874
  - [activemq] Honour all_logs and get config on RHEL.
    Resolves: bz1165878


author: Shane Bradley <sbradley@redhat.com> = 3.2-19
changelog:
  - [cluster] Ensure cluster sets 'make' to False when calling get_cmd_output_path().
    Resolves: bz1190723


author: Shane Bradley <sbradley@redhat.com> = 3.2-26
changelog:
  - [cluster] Scrub password from crm_report data.
    Resolves: bz1206581
  - [networking] Use the correct options for nmcli.
    Resolves: bz1206661


author: Shane Bradley <sbradley@redhat.com> = 3.2-29
changelog:
  - [networking] The commmand brctl will only be ran if bridge module loaded.
    Resolves: 1263887
  - [qpid] Added missing comma in list of command outputs to capture.
    Resolves: 1274710


author: Shane Bradley <sbradley@redhat.com> = 3.2-30
changelog:
  - [saphana/sapnw] Add plugins for SAP NetWeaver and SAP HANA.
    Resolves: bz1195606
  - [boot] Capture output for efibootmgr.
    Resolves: bz1209342


author: Shane Bradley <sbradley@redhat.com> = 3.2-32
changelog:
  - [general] Better handling of --name and --ticket-number options.
    Resolves: bz1232945
  - [policies] run PackageManager query_command under timeout


author: Shane Bradley <sbradley@redhat.com> = 3.2-37
changelog:
  - [utilities] Support glob expansion in command arguments
    Resolves: bz1276652
  - [rpm] Move extra rpm fields to a separate file
    Resolves: bz1267677


author: Shane Bradley <sbradley@redhat.com> = 3.2-38
changelog:
  - [openshift] Obfuscate LDAP bind passwords
    Resolves: bz1227462
  - [multipath] Add output of "multipathd show config" in sosreport
    Resolves: bz1289558
  - [archive] remove hand-rolled compression shell out.
    Resolves: bz1232940


author: Shane Bradley <sbradley@redhat.com> = 3.2-39
changelog:
  - [ipa] Improvements to plugin.
    Resolves: bz1203947
  - [networking] Blacklist Cisco CDP paths
    Resolves: bz1276262


author: Shane Bradley <sbradley@redhat.com> = 3.2-40
changelog:
  - [processor] Capture output of cpufreq-info
    Resolves: bz1275202
  - [archive] Check that compress utility exists
    Resolves: bz1310183


author: Shane Bradley <sbradley@redhat.com> = 3.2-49
changelog:
  - [sosreport] The reports were not generated.
    Resolves: bz1299892

  - [npm/nodejs] Add plugins npm and nodejs.
    The patch contained plugin classes that are not in rhel-6
    which were removed.
    Resolves: bz1368547


author: Filip Krska <fkrska@redhat.com> = 3.2-55
changelog:
  [networking] iptables: check module version and do ipv6
    Resolves: bz1451784
    [cluster] Scrub passwords in pcs config
    Resolves: bz1427589


author: Filip Krska <fkrska@redhat.com> = 3.2-57
changelog:
  [policies] get package list without a timeout
    [policies/redhat] make missing 'filesystem' package non-fatal
    Resolves: bz1506596


author: Filip Krska <fkrska@redhat.com> = 3.2-63
changelog:
  [archive] compress tarball without a timeout
    Resolves: bz1439943
    [policies] stop execution on Ctrl+C during user input
    Resolves: bz1567054


author: Martin Hunt <hunt@redhat.com>
changelog:
  - Set Version to use version from autoconf.
  - Fix up some of the path names.
  - Add Requires and BuildRequires.


author: Roland McGrath <roland@redhat.com> - 0.4.1-1
changelog:
  - Many fixes and improvements since 0.2.2; relevant PRs include:
    1122, 1134, 1155, 1172, 1174, 1175, 1180, 1186, 1187, 1191, 1193, 1195,
    1197, 1205, 1206, 1209, 1213, 1244, 1257, 1258, 1260, 1265, 1268, 1270,
    1289, 1292, 1306, 1335, 1257


author: Roland McGrath <roland@redhat.com> - 0.4.2-1
changelog:
  - Many fixes and improvements: PRs 1344, 1260, 1330, 1295, 1311, 1368,
    1182, 1131, 1332, 1366, 1456, 1271, 1338, 1482, 1477, 1194.


author: Frank Ch. Eigler <fche@redhat.com> - 0.5-1
changelog:
  - Many fixes and improvements: 1425, 1536, 1505, 1380, 1329, 1828, 1271,
    1339, 1340, 1345, 1837, 1917, 1903, 1336, 1868, 1594, 1564, 1276, 1295


author: Frank Ch. Eigler <fche@redhat.com> - 0.5.7-1
changelog:
  - PRs 2511 2453 2307 1813 1944 2497 2538 2476 2568 1341 2058 2220 2437
    1326 2014 2599 2427 2438 2465 1930 2149 2610 2293 2634 2506 2433


author: Frank Ch. Eigler <fche@redhat.com> - 0.5.14-1
changelog:
  - Many robustness improvements: 1117, 1134, 1305, 1307, 1570, 1806,
    2033, 2116, 2224, 2339, 2341, 2406, 2426, 2438, 2583, 3037,
    3261, 3282, 3331, 3428 3519, 3545, 3625, 3648, 3880, 3888, 3911,
    3952, 3965, 4066, 4071, 4075, 4078, 4081, 4096, 4119, 4122, 4127,
    4146, 4171, 4179, 4183, 4221, 4224, 4254, 4281, 4319, 4323, 4326,
    4329, 4332, 4337, 4415, 4432, 4444, 4445, 4458, 4467, 4470, 4471,
    4518, 4567, 4570, 4579, 4589, 4609, 4664


author: Frank Ch. Eigler <fche@redhat.com> - 0.6.1-1
changelog:
  - Add crash-devel buildreq to build staplog.so crash(8) module.
  - Many robustness & functionality improvements:


author: Frank Ch. Eigler <fche@redhat.com> - 0.6.1-3
changelog:
  - Add zlib-devel to buildreq; missing from crash-devel
  - Process testsuite .stp files for #!stap->#!/usr/bin/stap


author: Frank Ch. Eigler <fche@redhat.com> - 1.1-2
changelog:
  - rhbz561889 = CVE-2010-0411: __get_argv overflows
  - rhbz512202: update tcp/mib tapsets
  - rhbz560890: stap -L/-l argument order preservation
  - rhbz563114: syscall.* regression w/ sys_pipe32 disappearanced
  - rhbz559643: fix testsuite bugs in labels.exp causing dejagnu hangs
  - rhbz564445: fix sdt.h probes with prelinked libraries
  - rhbz564443: harden unprivileged mode
  - pr11286: fix stap-client --server=FOO
  - rhbz556565: CVE-2009-4273 + CVE-2010-0412: more stap-server fixes
  - pr11296: fix systemtap-testsuite sdt.h tests


author: Frank Ch. Eigler <fche@redhat.com> - 1.3-5
changelog:
  - bz607232 (patch)
  - bz646870 (bundle newer elfutils)
  - bz644350 (patch)
  - bz661424 (patch)
  - bz559599 (patch)


author: Frank Ch. Eigler <fche@redhat.com> - 1.8-5
changelog:
  - rebased to systemtap 1.8, including scox's fixes from rhel-5.9:
  - rhbz844910: grumble quietly about preexisting gid/uid conflicts in .spec  
  - rhbz843480: systemtap-server should work without systemtap-runtime preinstalled
  - rhbz843392: systemtap-testsuite unresolved deps
  - rhbz843389: sdt.c on systemtap-testsuite cannot be compiled
  - rhbz835027: systemtap-testsuite requires prelink on ia64
  - Backported fix for pr14325
  - No publican in rhel 5.
  - Add s390 to the publican blacklist.
  - rebase
  - Backported fixes for pr14230 pr14296


author: Lukas Berk <lberk@redhat.com> - 2.3-2
changelog:
  - rhbz998595: rpm -V systemtap-server complains
  - rhbz996091: systemtap.syscall/syscall.exp regressed on i686 and x86_64
  - rhbz996084: systemtap.exelib/exelib.exp regressed on s390x and x86_64
  - rhbz996097: systemtap.base/execve.exp fails on i686 and ppc64
  - rhbz996079: systemtap.base/warn_overflow.exp regressed on i686 and ppc64
  - rhbz915180: utrace_syscall_args.exp on s390x: "FAIL: 32_BIT_UTRACE_SYSCALL_ARGS shutdown (eof)"
  - rhbz996065: systemtap.base/bz10078.exp regressed
  - rhbz996072: systemtap.base/kmodule.exp regressed on s390x and ppc64
  - rhbz996080: systemtap.context/fib.exp regressed on s390x
  - rhbz996103: systemtap.base/bad-code.exp regressed on s390x
  - rhbz1008567: broken tapsets on s390x - print_ubacktrace() and print_ubacktrace_brief()
  - rhbz996087: systemtap.server/server_locale.exp regressed on all arches


author: Lukas Berk <lberk@redhat.com> - 2.3-3
changelog:
  - rhbz996084: systemtap.exelib/exelib.exp regressed on s390x and x86_64
  - rhbz996077: systemtap.base/utrace_p5.exp got unstable on i686 and x86_64
  - rhbz874205: [FJ6.2 Bug] systemtap crashes


author: Frank Ch. Eigler <fche@redhat.com> - 2.5-1
changelog:
  - rebase to upstream 2.5 release, including fixes for:
  - rhbz1027459: staprun/stapio fails if trace1 file is in same dir
  - rhbz1074541: kernel crash on netfilter_drop.stp sample
  - rhbz1038692: systemtap missing syscall pwritev


author: Frank Ch. Eigler <fche@redhat.com> - 2.5-4
changelog:
  - added BZ1099133.patch: at_var_cu test
  - added BZ1099472.patch: cast-scope.exp test
  - added BZ1099555.patch: gtod.exp test 
  - added BZ1099757.patch: vars.exp test
  - added BZ1099791.patch: vma_vdso test
  - added BZ1099825.patch: probe_by_pid test
  - added BZ1100813.patch: buildok tests
  - added BZ1109084.patch: initscript name sensitivity


author: Bill Nottingham <notting@redhat.com> - 0.3.9-13
changelog:
  - Ignore rpm temporary files of the foo;<somehex> format
  - Make ignores of .rpm{new,orig,save} match only at the end of the name


author: Casey Dahlin <cdahlin@redhat.com> - 0.3.9-22
changelog:
  - Re-add 'telinit u' support along with patch to fix it (#450488). Patch due to
    <pspencer@fields.utoronto.ca>


author: Lukas Nykryn <lnykryn@redhat.com> 0.6.5-11
changelog:
  - set BUGREPORT value to launchpad (#771736)
  - add support for override files (#663594)
  - add usage stanza (#735427)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 0.6.5-15
changelog:
  - fix issue with multiple nih_error_raise calls in previous patch
  - reset console only for console owners (#1046190)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.1.0-5
changelog:
  - Use tarball from upstream
  - Add COPYING, README and AUTHORS to sources (previously placed in the, probably modified, tarball)


author: Mike A. Harris <mharris@redhat.com> 6.5.6-1
changelog:
  - Update BuildRoot to use Fedora Packaging Guidelines.
  - Deglob file manifest.
  - Use _smp_mflags with make, to speed up SMP builds.
  - Add "alpha sparc sparc64" to ExclusiveArch


author: Mike A. Harris <mharris@redhat.com> 6.5.6.1-1
changelog:
  - Updated xorg-x11-drv-ati to version 6.5.6.1 from X11R7 RC1
  - Fix *.la file removal.
  - Add "BuildRequires: mesa-libGL-devel >= 6.4-4 for DRI builds"


author: Mike A. Harris <mharris@redhat.com> 6.5.7.2-1
changelog:
  - Updated xorg-x11-drv-ati to version 6.5.7.2 from X11R7 RC4
  - Removed 'x' suffix from manpage dirs to match RC4 upstream.


author: Mike A. Harris <mharris@redhat.com> 6.5.7.3-1
changelog:
  - Updated xorg-x11-drv-ati to version 6.5.7.3 from X11R7.0
  - Added ati.xinf videoalias file for hardware autodetection.


author: Mike A. Harris <mharris@redhat.com> 6.5.7.3-2
changelog:
  - Added r128.xinf and radeon.xinf videoalias files to fix bug (#174101).
  - Added "BuildRequires: libdrm-devel >= 2.0-1" to fix bug (#178613)


author: Mike A. Harris <mharris@redhat.com> 6.5.7.3-3
changelog:
  - Updated radeon.xinf to be up to date with the xf86PciInfo.h from the Xorg
    X server 1.0.1-1 source.  This should account for all supported Radeon
    models now modulo errors/omissions.


author: Kristian Høgsberg <krh@redhat.com> 6.5.7.3-4.cvs20060322
changelog:
  - Update to CVS snapshot of 20060322.
  - Drop xorg-x11-drv-ati-6.5.7.3-radeon-metamodes-SEGV-fix.patch.


author: Mike A. Harris <mharris@redhat.com> 6.6.1-1
changelog:
  - Updated xorg-x11-drv-ati to version 6.6.1 update release for X11R7.1
  - Drop db-root-visual.patch, as it is included in 6.6.1
  - Enable DRI support for sparc/sparc64 builds.


author: Adam Jackson <ajackson@redhat.com> 6.6.1-2
changelog:
  - Filter the EDID mode list by the monitor's reported pixel clock.  Bump
    the BuildReq to a server that provides the necessary ABI field.


author: Mike A. Harris <mharris@@redhat.com> 6.6.1-4
changelog:
  - Added "BuildRequires: xorg-x11-server-sdk >= 1.1.0-12" to fix the same
    problem at build time as were added in 6.6.1-2 to fix it at runtime.


author: Mike A. Harris <mharris@redhat.com> 6.6.1-5.fc6
changelog:
  - Added r128-missing-xf86ForceHWCursor-symbol-bug168753.patch to fix (#168753)
  - Add {?dist} tag to Release field


author: Adam Jackson <ajackson@redhat.com> 6.6.1-10.fc6
changelog:
  - radeon-6.6.1-use-mtdriver.patch: Use new M_T_DRIVER mode type for mode
    synthesis.
  - Bump Requires to match.


author: Adam Jackson <ajackson@redhat.com> 6.6.2-1.fc6
changelog:
  - Update to 6.6.2 from upstream:
    - Mach64 stability and correctness fixes
    - Mach64 EXA support.
    - Misc bugfixes for radeon.


author: Adam Jackson <ajackson@redhat.com> 6.6.2-2.fc6
changelog:
  - radeon-6.6.2-dac-fix.patch: Backport 25fa71... from git.  Turn on the DAC
    before doing CRT connection probe, otherwise we might incorrectly detect
    a CRT where there isn't one. (#202240 and others)


author: Adam Jackson <ajackson@redhat.com> 6.6.2-4
changelog:
  - ati-prefer-radeon-then-r128.patch: When loading through the 'ati' wrapper,
    prefer radeon to rage128 to mach{64,32,16,8,4,2,1}. 
  - r128-fp-dpms.patch: Hook up DPMS for Rage128 DFPs. (#197436)
  - radeon-6.6.2-dac-fix.patch: Even though we turn DACs on for probing, don't
    turn them off.  Fixes black screen of death post-rhgb.  (#208610)
  - radeon-6.6.2-pmac-bios.patch: Be more suspicious of ROMs before interpreting
    their content.  (#208694)
  - radeon-6.6.2-usefbdev-patch.patch: Use the framebuffer stride from fbdev,
    instead of making up numbers.  (#208694)


author: Adam Jackson <ajax@redhat.com> 6.6.3-4
changelog:
  - radeon-6.6.3-renderaccel-buglet.patch: Fix OpenOffice font corruption
    when RenderAccel is disabled. (#244675)


author: Dave Airlie <airlied@redhat.com> 6.7.191-1
changelog:
  - xf86-video-ati 6.7.191. - Add a pre-release of radeon randr code
    This will break old zaphod mode further than the current 6.6.193
    driver, and will probably break mergedfb configs, however it will
    work with randr-1.2 properly and is the more supported codebase going
    forward.


author: Dave Airlie <airlied@redhat.com> 6.7.194-2
changelog:
  - radeon-6.7.194-disable-rc410-dri.patch - Disable DRI on
    RC410 by default as it seems to need some more work.


author: Adam Jackson <ajax@redhat.com> 6.7.195-4
changelog:
  - radeon-6.7.195-faster-ddc.patch: Speed up X startup by assuming the
    monitor doesn't need a dead chicken waved over it to get DDC.


author: Dave Airlie <airlied@redhat.com> 6.7.196-3
changelog:
  - radeon-git-upstream-fixes.patch - update for latest git master
  - radeon-6.7.196-atombios-support.patch - update for r500/r600


author: Dave Airlie <airlied@redhat.com> 6.8.0-7
changelog:
  - Major upstream fixes backported - render accel, xv etc.
  - This is done with a separate patch as upstream has split mach64/r128 already


author: Dave Airlie <airlied@redhat.com> 6.8.0-8
changelog:
  - Hopefully fix quirks not applying on radeon LVDS (#435126)
  - quirk connector table from (#428515)
  - fix rotate on r500 cards


author: Adam Jackson <ajax@redhat.com> 6.9.0-1
changelog:
  - Move to 6.9.0, now that the r128 and mach64 drivers are split out.
  - Add git fixes since 6.9.0.
  - Rebase the modesetting patch onto git master.


author: Dave Airlie <airlied@redhat.com> 6.9.0-5
changelog:
  - Add a perl script to generate the radeon.xinf from the actual PCI IDs the driver supports.
  - not build integrated yet though
  - update pciids


author: Adam Jackson <ajax@redhat.com> 6.9.0-10
changelog:
  - radeon-6.9.0-fb-size.patch: Yet more lame heuristics to preallocate a
    usable framebuffer for laptops. (#458864)


author: Soren Sandmann <sandmann@redhat.com> 6.9.0-13
changelog:
  - Remove the fb size hack since there is a fix in the server now.
  - Unfortunately, the driver prevents this fix from working by applying 
    its own heuristics. Remove those.


author: Adam Jackson <ajax@redhat.com> 6.9.0-14
changelog:
  - radeon-6.9.0-panel-size-sanity.patch: Panels smaller than 800x480 are
    highly implausible, disable them if we find them.  If you have one,
    you can force it with Option "PanelSize".


author: Kristian Høgsberg <krh@redhat.com> - 6.9.0-15
changelog:
  - Add copy-fb-contents.patch to initialize the root window contents
    with the fbdev contents for slick startup.


author: Dave Airlie <airlied@redhat.com> 6.9.0-16
changelog:
  - rebase to a later tree - still not fully up to git master
  - add some fixes to the resize stuff - not fully done


author: Dave Airlie <airlied@redhat.com> 6.9.0-23
changelog:
  - rebase to upstream master
  - radeon-6.9.0-lvds-mapping.patch - merged upstream
  - copy-fb-contents.patch merged into modesetting tree.


author: Dave Airlie <airlied@redhat.com> 6.9.0-27
changelog:
  - modeset - radeon add support for basic r100/r200 EXA
  - modeset - add Download from screen accel.
  - radeon-6.9.0-to-git.patch : fix 30" monitor


author: Dave Airlie <airlied@redhat.com> 6.9.0-32
changelog:
  - move to CS2 mechanism - using chunks to avoid multiple relocations
  - add kernel requires about 2.6.27.4-52 for new CS mechanism


author: Dave Airlie <airlied@redhat.com> 6.9.0-36
changelog:
  - radeon-6.9.0-add-hd3300.patch - add missing pciid (#466706)
  - radeon-6.9.0-quirk-agp.patch - from Ubuntu.


author: Adam Jackson <ajax@redhat.com> 6.11.0-9
changelog:
  - radeon-r600-kms-shadowfb.patch: Make R600 fall back to shadowfb whne KMS
    is enabled (as opposed to crashing).


author: Dave Airlie <airlied@redhat.com> 6.11.0-10
changelog:
  - radeon-modeset.patch: merge patches into kms patch
  - radeon-6.11.0-git.patch: fix suspend/resume on r600


author: Adam Jackson <ajax@redhat.com> 6.12.1-10
changelog:
  - radeon-6.12.1-r600-fb-size.patch: Bump fb size max on R600+ when no KMS
    so single-link dualhead stands a chance of working.


author: Adam Jackson <ajax@redhat.com> 6.12.2-13
changelog:
  - radeon-6.12.2-lvds-default-modes.patch: Add default modes to the LVDS mode
    list if we got no EDID from the kernel.


author: Kyle McMartin <kyle@redhat.com> 6.12.2-14
changelog:
  - radeon-modeset-still-more-fixes.patch: Bump the GEM interface version to
    31 so we don't activate it... (#500801)


author: Adam Jackson <ajax@redhat.com> 6.12.2-15
changelog:
  - Update to tip of 6.12 branch, 74cb2aba79049b792c22abf25ade3693b802b260
  - Drop stuff from radeon-modeset-fixes.patch to match
  - Generate radeon.xinf automatically from the CSV
  - radeon-6.12.2-hax.patch: Fix cursor setup and initial framebuffer clear
    in KMS.


author: Lyude Paul <cpaul@redhat.com> 7.6.1-2
changelog:
  - Fix annoying trailing whitespace after %description
  - Update firmware license
  - Added missing firmware file TAHITI_vce.bin (#1310823)


author: Lyude Paul <lyude@redhat.com> 7.6.1-4
changelog:
  - Add missing firmware file OLAND_pfp.bin (#1361525)
  - While we're at it since this is the last time we'll have a chance to do this,
    also go through and add missing firmware files for all of the generations
    that should have been included when this tarball was made so we don't have
    to deal with problems like this in the future. This includes RS780, RV610,
    RV620, RV630, RV635, RV670, RV710, RV730, and RV770


author: Mike A. Harris <mharris@redhat.com> 1.1.2-1
changelog:
  - Update BuildRoot to use Fedora Packaging Guidelines.
  - Deglob file manifest.
  - Limit "ExclusiveArch" to x86, x86_64, ia64, ppc


author: Mike A. Harris <mharris@redhat.com> 1.2.0.1-1
changelog:
  - Updated xorg-x11-drv-mga to version 1.2.0.1 from X11R7 RC1
  - Fix *.la file removal.
  - Remove hardware specific {_bindir}/stormdwg utility.


author: Mike A. Harris <mharris@redhat.com> 1.2.1.2-1
changelog:
  - Updated xorg-x11-drv-mga to version 1.2.1.2 from X11R7 RC4
  - Removed 'x' suffix from manpage dirs to match RC4 upstream.


author: Mike A. Harris <mharris@redhat.com> 1.4.1-3
changelog:
  - Added with_dri conditionalization (not yet working for non-dri case).
  - Added "BuildRequires: libdrm-devel >= 2.0-1" for (#192358).
  - Added "BuildRequires: mesa-libGL-devel >= 6.4-4".
  - Bumped sdk dep to pick up proto-devel indirectly.


author: Adam Jackson <ajackson@redhat.com> 1.4.1-4
changelog:
  - mga.xinf updates.  Add G200SE cards, remove Impression and Mistral IDs
    (since they do not and never have worked), and comment each line with
    the appropriate card name.


author: Adam Jackson <ajax@redhat.com> 1.4.7-0.20080102
changelog:
  - Today's git snapshot for pciaccess goodness.
  - mga-1.4.7-death-to-cfb.patch: Remove what little cfb support there was.
  - mga-1.4.7-alloca.patch: Fix ALLOCATE_LOCAL references.


author: Adam Jackson <ajax@redhat.com> 1.4.13-6
changelog:
  - Fix rendering corruption on RANDR-enabled setups (#814381)
  - Fix display setup on G200ER (#810224)


author: Adam Jackson <ajax@redhat.com> 1.6.1-10
changelog:
  - mga-1.6.1-char-cell-modes.patch: Filter out modes whose horizontal timings
    aren't character-cell aligned on G200SE and friends (#894959)


author: Adam Jackson <ajax@redhat.com> 1.10.0-2
changelog:
  - Merge from F16:

      * Wed Mar 09 2011 Adam Jackson <ajax@redhat.com> 1.10.0-2
      - Disable filesystem caps in paranoia until module loading is audited

      * Fri Feb 25 2011 Peter Hutterer <peter.hutterer@redhat.com> 1.9.99.902-1
      - xserver 1.10.0
      - server-1.9-99.901-xkb-repeat-issues.patch: drop, merged
      - xserver-1.4.99-pic-libxf86config.patch: drop, see 60801ff8
      - xserver-1.6.99-default-modes.patch: drop, see dc498b4
      - xserver-1.7.1-multilib.patch: drop, see a16e282
      - ABI bumps: xinput to 12.2, extension to 5.0, video to 10.0


author: Adam Jackson <ajax@redhat.com> 1.10.0-4
changelog:
  - xserver-1.10-pointer-barriers.patch: Backport CRTC confinement from master
    and pointer barriers from the development tree for same.
  - xserver-1.10-vbe-malloc.patch: Fix a buffer overrun in the VBE code.


author: Adam Jackson <ajax@redhat.com> 1.10.0-7
changelog:
  - xserver-1.10-glx-pixmap-crash.patch, xserver-1.10-bg-none-revert.patch:
    bugfixes from xserver-next


author: Peter Hutterer <peter.hutterer@redhat.com> 1.10.99.1-2.20110418
changelog:
  - rebase all patches
  - xserver-1.10-vbe-malloc.patch: drop, d8caa782009abf4d
  - "git rm" all unused patches


author: Soren Sandmann <ssp@redhat.com> 1.10.99.1-3.20110418
changelog:
  - xserver-1.10-fix-trapezoids.patch: this patch is necessary to prevent
    trap corruption with pixman 0.21.8.


author: Hans de Goede <hdegoede@redhat.com> 1.10.99.1-4.20110418
changelog:
  - Drop xserver-1.9.0-qxl-fallback.patch, since the latest qxl driver
    supports both revision 1 and 2 qxl devices (#642153)


author: 1.10.99.1-5.20110511
changelog:
  - Today's server from git
  - xserver-1.10-fix-trapezoids.patch: drop, c6cb70be1ed7cf7
  - xserver-1.10-glx-pixmap-crash.patch: drop, 6a433b67ca15fd1
  - xserver-1.10-bg-none-revert.patch: drop, dc0cf7596782087


author: Peter Hutterer <peter.hutterer@redhat.com> 1.11.99.1-1.20111109
changelog:
  - Update to today's git snapshot
  - xserver-1.6.1-nouveau.patch: drop, upstream
  - xserver-1.10.99-config-add-udev-systemd-multi-seat-support.patch: drop,
    upstream
  - 0001-dix-block-signals-when-closing-all-devices.patch: drop, upstream


author: Adam Jackson <ajax@redhat.com> 1.11.99.1-9
changelog:
  - xserver-1.8-disable-vboxvideo.patch: Drop, should be fixed now
  - Drop vesamodes and extramodes, rhpxl is no more
  - Stop building libxf86config, pyxf86config will be gone soon


author: Peter Hutterer <peter.hutterer@redhat.com> 1.11.99.901-1.20120103
changelog:
  - Git snapshot 98cde254acb9b98337ddecf64c138d38c14ec2bf
  - xserver-1.11.99-optionstr.patch: drop
  - 0001-Xext-don-t-swap-CARD8-in-SProcSELinuxQueryVersion.patch: drop


author: Peter Hutterer <peter.hutterer@redhat.com> 1.11.99.901-2.20120103
changelog:
  - xserver-1.12-Xext-fix-selinux-build-failure.patch: fix build error
    triggered by Red Hat-specific patch to libselinux


author: Peter Hutterer <peter.hutterer@redhat.com> 1.11.99.901-4.20120124
changelog:
  - xserver-1.12-dix-reset-last.scroll-when-resetting-the-valuator-45.patch:
    reset last.scroll on the device whenever the slave device switched to
    avoid jumps during scrolling (#788632).


author: Peter Hutterer <peter.hutterer@redhat.com> 1.11.99.901-6.20120124
changelog:
  - Fix installation of xserver-sdk-abi-requires script, if stable_abi is set
    always install the relese one, not the git one


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.0-1
changelog:
  - xserver 1.12
  - xserver-1.12-dix-reset-last.scroll-when-resetting-the-valuator-45.patch:
    drop, 6f2838818


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.1-1
changelog:
  - server 1.12.1
  - force autoreconf to avoid libtool errors
  - update patches for new indentation style.


author: Dave Airlie <airlied@redhat.com> 1.12.1-2
changelog:
  - xserver-fix-pci-slot-claims.patch: backport slot claiming fix from master
  - xserver-1.12-modesetting-fallback.patch: add modesetting to fallback list


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.2-4
changelog:
  - send keycode/event type down the wire when SlowKeys enable, otherwise
    GNOME won't warn about it (#816764)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.99.903-2
changelog:
  - xserver-1.12-os-print-newline-after-printing-display-name.patch: drop,
    014ad46f1b353a95e2c4289443ee857cfbabb3ae


author: Adam Jackson <ajax@redhat.com> 1.12.99.903-4
changelog:
  - Install xserver-sdk-abi-requires.release based on stable_abi not gitdate,
    so drivers built against a server that Provides multiple ABI versions will
    Require the stable version.


author: Peter Hutterer <peter.hutterer@redhat.com> 1.13.0-9
changelog:
  - Fix server crash when a XI 1.x device grab is activated on a disabled
    synaptics touchpad is disabled


author: Adam Jackson <ajax@redhat.com>
changelog:
  - Drop -sdk Prov/Obs, changed to -devel in F9
  - Drop xorg-x11-X* Obsoletes, leftover from the modular transition in FC5


author: Dave Airlie <airlied@redhat.com> 1.14.0-4
changelog:
  - fix bug with GPU hotplugging while VT switched
  - reenable reverse optimus and some missing patch from F18


author: Peter Hutterer <peter.hutterer@redhat.com> 1.14.1-2
changelog:
  - Add -resizeable option to Xephyr, enable by default (#962572)
  - Fix crash on 24bpp host server (#518960)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.14.2-1
changelog:
  - xorg-server 1.4.2
  - drop merged patches
  - Add a quirk to set the synaptics resolution to 0 by default. The pre-scale
    patch in the server clashes with synaptics inaccurate resolution numbers,
    causing the touchpad movement to be stunted.


author: Peter Hutterer <peter.hutterer@redhat.com> 1.14.2-5
changelog:
  - Fix logspam when trying to free a non-existant grab.
  - Update touch patch to upstream version (from fdo #66720)
  - re-add xephyr resizable patch, got lost in rebase (#976995)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.14.2-6
changelog:
  - Add new version of the resolution-based scaling patch - scale y down
    instead of x up. That gives almost the same behaviour as current
    synaptics. Drop the synaptics quirk, this needs to be now removed from the
    driver.


author: Peter Hutterer <peter.hutterer@redhat.com> 1.14.2-7
changelog:
  - Fix erroneous valuator 1 coordinate when an absolute device in relative
    mode doesn't send y coordinates.


author: Peter Hutterer <peter.hutterer@redhat.com> 1.14.2-9
changelog:
  - Fix active touch grabs, second touchpoint didn't get sent to client
  - Fix version mismatch for XI 2.2+ clients (where a library supports > 2.2
    but another version than the originally requested one).


author: Adam Jackson <ajax@redhat.com> 1.14.99.3-1
changelog:
  - xserver 1.14.99.3
  - xwayland branch refresh
  - Drop some F17-era Obsoletes
  - Update BuildReqs to match reality


author: Adam Jackson <ajax@redhat.com> 1.15.0-25
changelog:
  - CVE fixes for: CVE-2014-8099, CVE-2014-8098, CVE-2014-8097, CVE-2014-8096,
    CVE-2014-8095, CVE-2014-8094, CVE-2014-8093, CVE-2014-8092, CVE-2014-8091,
    CVE-2014-8101, CVE-2014-8100, CVE-2014-8103, CVE-2014-8102


author: Adam Jackson <ajax@redhat.com> 1.15.0-28
changelog:
  - Restore basic driver Requires: for Xorg
  - Fix CVE-2014-8092-3 patch to be valid C++, fixes tigervnc build


author: Olivier Fourdan <ofourdan@redhat.com> 1.15.0-31
changelog:
  - Synchronize CAPS-Lock state in nested X servers such as Xnest
    and Xephyr (#1161061)
  - Add a new command line option "--auto-display" to xvfb-run to take
    advantage of the XServer's "-displayfd" option to get the display
    number directly from Xfvb (#1049297)


author: Olivier Fourdan <ofourdan@redhat.com> 1.17.4-3
changelog:
  - Add missing hw/xfree86/Xorg.sh.in to xorg-x11-server-source package.
    This is needed to build packages depending on xorg-x11-server-source
    (e.g. tigervnc), otherwise the build will fail.


author: Adam Jackson <ajax@redhat.com> 1.17.4-7
changelog:
  - Add bug-compatibility for exposure event generation for backing store's
    Always mode, and re-enable the feature


author: Shawn Starr <shawn.starr@rogers.com>
changelog:
  - Add yum-utils.1 manual page
  - Rename yum-complete-transaction manual page to 8
  - Move yum-complete-transaction to /usr/sbin


author: Tim Lauridsen <timlau@fedoraproject.org>
changelog:
  - Remove yum-kernel-module & yum-fedorakmod plugins (no obsoleting yet)
  - Remove yum-skip-broken plugin leftovers


author: Tim Lauridsen <timlau@fedoraproject.org>
changelog:
  - set yum require to 3.2.21 (the 3.2.21 in rawhide is patched to yum head, so it matches the need yum 3.2.22 code)
  - Added versioned Provides: yum-<pluginname> to make rpm/yum happy.
  - yum-updateonboot is not renamed and dont need Obsoletes/Conflicts/Provides


author: Seth Vidal <skvidal at fedoraproject.org>
changelog:
  - add python compileall to all plugins so we get .pyc/.pyo files in them
  - fixes https://bugzilla.redhat.com/show_bug.cgi?id=493174


author: Tim Lauridsen <timlau@fedoraproject.org>
changelog:
  - remove basearchonly since all versions of yum for quite some time obsolete it
  - truncate changelog to last 2 years


author: Tim Lauridsen <timlau@fedoraproject.org>
changelog:
  - mark as 1.1.25
  - add touch /etc/yum.repos.d/_local.repo to install section
  - this need for for the ghost in files section of yum-plugin-local


author: James Antill <james.antill@redhat.com> - 1.1.26-7
changelog:
  - Get lots of fixes from latest HEAD. Also:
  - --alldeps default in repoquery.
  - repoquery will now do a full provides version check.
  - Add repoclosure --group.
  - Big repodiff speedup.
  - Resolves: rhbz#576705


author: James Antill <james.antill@redhat.com> - 1.1.26-8
changelog:
  - Fix versionlock with follow_obsoletes=true
  - Resolves: rhbz#592206
  - Fix repodiff
  - Resolves: rhbz#592943


author: James Antill <james.antill@redhat.com> - 1.1.30-1
changelog:
  - Rebase to upstream 1.1.30 for bugfixes and new features.
  - Resolves: rhbz#659497
  - Some of the changes included in the above are:
  - yum-plugin-verify reports small changes in mtime
  - Resolves: rhbz#604529
  - yumdownloader man page do not mention --archlist option
  - Resolves: rhbz#616408
  - deprecation warning messages in repomanage
  - Resolves: rhbz#620652
  - tsflags plugin is using deprecated function setConfigOption
  - Resolves: rhbz#627533
  - yum-debug-dump saves the output to a wrong file
  - Resolves: rhbz#641837
  - Update the "security" plugin for the new updateinfo data
  - Resolves: rhbz#662790


author: James Antill <james.antill@redhat.com> - 1.1.30-4
changelog:
  - Fix typo in the FS snapshot patch.
  - Resolves: rhbz#669178
  - yumdownloader man page do not mention --archlist option
  - Resolves: rhbz#616408
  - Resolves: rhbz#659497


author: James Antill <james.antill@redhat.com> - 1.1.30-6
changelog:
  - Fix yum-config-manager repo file saving error when in repo id is $basearch
  - Resolves: rhbz#679098


author: James Antill <james.antill@redhat.com> - 1.1.30-7
changelog:
  - Fix some yum-security man page typos.
  - Resolves: rhbz#720967
  - Fix for repo setup in reposync, mainly for RHN repos.
  - Resolves: rhbz#713108
  - Add RHN source repos. patterns to yumdownloader and yum-builddep.
  - Resolves: rhbz#710469
  - Make yumdownloader exit with a failure when it fails to download.
  - Resolves: rhbz#699470
  - Fix yum-groups-manager to accept non-default config. files.
  - Resolves: rhbz#694188


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.30-8
changelog:
  - Check doUtilBuildTransaction return value.
  - Resolves: rhbz#709043
  - Force ASCII apostrophes in man page examples.
  - Resolves: rhbz#659740
  - Updated previous patch, adding RHN source repos.
  - Resolves: rhbz#732649
  - Related: rhbz#710469


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.30-11
changelog:
  - Add show-changed-rco command
  - Resolves: rhbz#684925
  - Return 1 if any pkg download/gpg check fails.
  - Resolves: rhbz#701096
  - Add --compare-arch option.
  - Resolves: rhbz#710579
  - Get rid of double download attempts.
  - Resolves: rhbz#711767
  - yum-debug-restore: handle multiple kernel packages
  - Resolves: rhbz#737597
  - package-cleanup: handle kernel-PAE, keep N of each kernel package name.
  - Resolves: rhbz#769775
  - package-cleanup man page: update description of --count option.
  - Resolves: rhbz#782338


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.30-15
changelog:
  - yum-complete-transaction: fix interrupted update processing.
  - Resolves: bug#1013475
  - fs-snapshot: add the "-c" option to dmsetup.
  - Resolves: bug#850612
  - fs-snapshot: new dmsetup does not support "-o".
  - Resolves: bug#954358


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-23
changelog:
  - Fix 'yum-config-manager --save' traceback.
  - Resolves: bug#1075705
  - post-transaction-actions: fix filename matching.
  - Resolves: bug#1045494
  - Add description of '-l' option to manpage.
  - Resolves: bug#1015191
  - Fix yumdownloader when a package already exists and is oversized.
  - Resolves: bug#1004089
  - repoquery: don't check timestamps for repofrompath repos.
  - Resolves: bug#880944
  - yumdownloader: stop ignoring enabled source repos.
  - Resolves: bug#808347
  - Allow --old=/foo urls for repodiff.
  - Resolves: bug#802784


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-26
changelog:
  - repoquery: handle Yum exceptions on .conf setup.
  - Resolves: bug#1097560
  - yum-config-manager: --save when --setopt contains wildcards.
  - Resolves: bug#1097297
  - Print depsolving errors in yumdownloader instead of ignoring them.
  - Resolves: bug#998892


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-27
changelog:
  - yum-config-manager: fix confusing repo names and IDs.
  - Resolves: bug#971598
  - yum-plugin-security: add --sec-severity option to the man page.
  - Resolves: bug#1026317


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-30
changelog:
  - Add missing manpages.
  - Related: bug#981773
  - needs-restarting: catch IOError.
  - Related: bug#1078724


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-32
changelog:
  - post-transaction-actions: allow colons in command part.
  - Resolves: bug#1134973
  - ovl plugin: new plugin for overlayfs issue workaround.
  - Resolves: bug#1260977


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-33
changelog:
  - Fix yum-security manpage.
  - Resolves: bug#865694
  - Resolves: bug#1208155
  - Add libxml2-python to Requires for repo-rss.
  - Resolves: bug#1155093
  - yumdownloader: fix description of --archlist in the manpage.
  - Resolves: bug#1165661
  - Add missing options to reposync manpage.
  - Resolves: bug#1189033
  - Exclude dups from the list of security updates.
  - Resolves: bug#1209212
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1225753
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1225754
  - Remove -v from repoquery man page.
  - Resolves: bug#1285748


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-34
changelog:
  - Fix 'updateinfo list available' logic and make 'updates' the default.
  - Resolves: bug#1144887
  - Fix updateinfo to exclude wrong arch updates.
  - Resolves: bug#1191313


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-36
changelog:
  - Fix performance issue when excluding dups from the list of security updates.
  - Related: bug#1209212


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-38
changelog:
  - Fix count of applicable security updates.
  - Resolves: bug#1347813
  - auto-update-debuginfo: fix check for repos in opts.
  - Resolves: bug#1293982
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1313574
  - repoquery: fix --pkgnarrow=installed.
  - Resolves: bug#1280453


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-39
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1272025
  - Update yum-verify man page.
  - Related: bug#1347813


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - auto rebuild in the new build environment (release 10)
  - fix the texi source
  - patch to detect & link against nsl


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - fix postun script so that we don't remove ourselves on every update
    doh...
  - add a trigger to fix old versions of the package


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - 3.0.8
  - use %configure and %makeinstall
  - updated URL
  - disable old patches
  - add better patch for texi source
  - use %{_mandir} and %{_infodir}
  - use %{_tmppath}


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - fix the post script, so we only have only line for zsh
    and can remove the trigger
  - get rid of some instances of "/usr/local/bin/zsh"


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Remove contents from /etc/zshenv file - no reason to duplicate things
    from /etc/profile, which is sourced from /etc/zprofile (#32478)


author: Trond Eivind Glomsrød <teg@redhat.com> 4.0.4-5
changelog:
  - Source /etc/profile from /etc/zshenv instead of /etc/zprofile, 
    to run things the same way bash do (#62788)


author: Jens Petersen <petersen@redhat.com>
changelog:
  - 4.0.6
  - add url
  - add --without check build option
  - don't autoconf
  - make "make test" failure not go ignored
  - move sourcing of profile from zshenv to new .zshrc file for now (#65509)
  - preserve dates when installing rc files


author: Florian La Roche <Florian.LaRoche@redhat.de> 4.0.6-2
changelog:
  - make sure /bin/zsh is owned by root and not bhcompile
  - do not package zsh-%{version} into binary rpm


author: Jens Petersen <petersen@redhat.com> - 4.0.6-7
changelog:
  - don't set stty erase in a dumb terminal with tput kbs in /etc/zshrc (#89856)
    [reported by Ben Liblit]
  - make default prompt more informative, like bash


author: Jens Petersen <petersen@redhat.com> - 4.0.7-2
changelog:
  - quote % in file glob'ing completion code (#110852)
    [reported with patch by Keith T. Garner]
  - add zsh-4.0.7-bckgrnd-bld-102042.patch from Philippe Troin to allow
    configure to run in the background (#102042) [reported by Michael Redinger]
  - above patch requires autoconf to be run
  - include html manual in separate -html subpackage
  - changed url to master site
  - skip completion tests on ppc and ppc64 for now, since they hang


author: Jens Petersen <petersen@redhat.com> - 4.0.9-1
changelog:
  - update to 4.0.9 release
  - zsh-4.0.7-completion-_files-110852.patch no longer needed
  - update zsh-4.0.7-bckgrnd-bld-102042.patch to better one with --with-tcsetpgrp
    configure option by Philippe Troin
  - configure --with-tcsetpgrp
  - buildrequire texinfo for makeinfo
  - fix ownership of html manual (Florian La Roche, #112749)


author: Jens Petersen <petersen@redhat.com> - 4.2.0-1
changelog:
  - update to 4.2.0 stable release
  - zsh-4.0.7-bckgrnd-bld-102042.patch no longer needed
  - add compinit and various commented config improvements to .zshrc
    (Eric Hattemer,#114887)
  - include zshprompt.pl in doc dir (Eric Hattemer)
  - drop setenv function from zshrc


author: Jens Petersen <petersen@redhat.com> - 4.2.0-3
changelog:
  - source profile in zprofile rather than .zshrc (Péter Kelemen,
    Magnus Gustavsson, 102187,126539)
  - add zsh-4.2.0-jobtable-125452.patch to fix job table bug
    (Henrique Martins, 125452)
  - buildrequire tetex for texi2html (Maxim Dzumanenko, 124182)


author: Colin Walters <walters@redhat.com> - 4.2.1-1
changelog:
  - New upstream version 4.2.1
  - FEATURES, MACHINES, and NEWS moved to toplevel dir
  - Update zsh-4.0.6-make-test-fail.patch, but do not apply it for now
  - Remove upstreamed zsh-4.2.0-jobtable-125452.patch


author: James Antill <james@and.org> - 4.2.6-4
changelog:
  - Fix buildroot to new Fedora default.
  - Remove /etc/skel from ownership.
  - Remove explicit libcap dep.
  - Tweak postun script.
  - Move checking to generic rpm infrastructure.
  Resolves: rhbz#226813


author: James Antill <james@and.org> - 4.2.6-5
changelog:
  - Fix sed typo.
  - Fix skel expansion problem.
  - Add Requires for mktemp/info/etc.
  - Use cp again due to SELinux context
  Resolves: rhbz#226813


author: James Antill <james@and.org> - 4.2.6-6
changelog:
  - Move requires to be scriptlet specific
  - chmod functions, to shut rpmlint up (false positive warning)
  - sed only the requied functions (again, shuts rpmlint up)
  - Remove zsh-4.0.6-make-test-fail.patch
  - Remove RPM_SOURCE_DIR var, using %{SOURCEx} and basename
  Resolves: rhbz#226813


author: James Antill <james@fedoraproject.org> - 4.3.4-7
changelog:
  - Tweak /etc/zshrc to source /etc/profile.d/*.sh in ksh compat. mode
  - Tweak /etc/zprofile to source /etc/profile in ksh compat. mode
  - Resolves: rhbz#430665


author: James Antill <james@fedoraproject.org> - 4.3.6-5
changelog:
  - Import new upstream 4.3.6
  - Rebase 8bit prompt patch
  - Add patch fuzz=2
  - Add BuildReq on /bin/hostname directly
  - FIXME: These should all be unpatched, at some point.
  - Don't test /dev/fd as mock doesn't like it
  - Don't test the modload module, as mock doesn't like loading them all
  - Don't test the select test in A01grammar, stdin/stderr racy?


author: James Antill <james.antill@redhat.com> - 4.3.10-5
changelog:
  - Change invocation as "zsh foo" to search the path by default.
  - Add new option PATH_SCRIPT for old behaviour.
  - Resolves: rhbz#612685
  - Solve defect in emulation of ksh with math substituion.
  - Resolves: rhbz#657300


author: James Antill <james.antill@redhat.com> - 4.3.10-7
changelog:
  - Change {NAME:OFFSET:LENGTH} substitution feature to ignore KSH_ARRAYS option.
  - Fixup tests.
  - Resolves: rhbz#820530


author: Kamil Dudka <kdudka@redhat.com> - 4.3.10-12
changelog:
  - avoid using uninitialised memory after lexer realloc (#1146119)
  - replace an incorrect comment in /etc/zshenv (#1103697)
  - optimize matching of multiple * in wildcards (#1131172)
  - use heap rather than stack allocation for variable length arrays (#567215)
  - prevent jobs -Z from destroying environment variables (#878324)
  - shell emulation doc addition (#1104021)


author: Kamil Dudka <kdudka@redhat.com> - 4.3.11-7
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)


