# changelog

author: Jan Macku <jamacku@redhat.com> - 1.27-1
changelog:
  - alternatives: properly handle chars with const in normalize_path
  - alternatives: use exit in main instead of return for critical failures
  - alternatives: fix leak
  - alternatives: fix leak
  - alternatives: fix possible overrun
  - alternatives: fix all the leaks of groups in readConfig
  - alternatives: fix all the leaks of read line in readConfig
  - alternatives: fix leak
  - alternatives: fix memory leak
  - alternatives: fix memory leak
  - alternatives: initialize parameters in main to NULL
  - alternatives: fix memory leak
  - Translated using Weblate (Korean)
  - Translated using Weblate (English (United Kingdom))
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Japanese)
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Japanese)
  - Translated using Weblate (Polish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Georgian)
  - Update translation files
  - Translated using Weblate (Japanese)
  - Fix systemd dependency


author: Jan Macku <jamacku@redhat.com> - 1.29-1
changelog:
  - add basic mkosi config
  - remove not used directory from makefile
  - ntsysv: fix leaks
  - leveldb: security_context_t is deprecated
  - leveldb: fix leak
  - leveldb: fix leak
  - leveldb: fix leak
  - leveldb: fix leak
  - leveldb: fix leak
  - chkconfig: fix leak
  - chkconfig: fix leak
  - chkconfig: fix memory leak when deleting a service
  - leveldb: add destructors for service
  - leveldb: fix memory leak
  - leveldb.c: fix memory leak
  - chkconfig: fix leak
  - leveldb: fix memory leak
  - alternatives: ensure the current alt. is freed if parsing fails
  - alternatives: ensure the current group is freed
  - Translated using Weblate (English (United Kingdom))
  - Translated using Weblate (Turkish)


author: Jan Macku <jamacku@redhat.com> - 1.31-1
changelog:
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (French)
  - Update translation files
  - Translated using Weblate (Turkish)


author: Jan Macku <jamacku@redhat.com> - 1.32-1
changelog:
  - Allow paths with /usr/sbin and /usr/bin as equivalent
  - mkosi: update conf to match latest mkosi version
  - Translated using Weblate (Italian)


author: Jiri Konecny <jkonecny@redhat.com> - 40.22.3.21-1
changelog:
  - Disable keyboard shortcut switching on gnome-kiosk (jkonecny)
    Related: RHEL-71880
    Resolves: RHEL-74504
  - Improve name of compositor layout selection method (jkonecny)
    Related: RHEL-71880
    Resolves: RHEL-74504
  - Split LocaledWrapper code for compositor (jkonecny)
    Related: RHEL-71880
    Resolves: RHEL-74504
  - security: do not crash initramfs ks parsing on failing certificate dump
    (rvykydal)
    Resolves: RHEL-61434
  - security: require pykickstart version with %certificates support (rvykydal)
    Resolves: RHEL-61434
  - security: add service to transfer certificates from initramfs (rvykydal)
    Resolves: RHEL-61434
  - security: import certificates in initramfs (rvykydal)
    Resolves: RHEL-61434
  - security: install certificates in pre-install phase only for dnf payload
    (rvykydal)
    Resolves: RHEL-61434
  - security: raise exception if certificate destination is unknown (rvykydal)
    Resolves: RHEL-61434
  - security: log a warning when dumping certificate over an existing file
    (rvykydal)
    Resolves: RHEL-61434
  - security: pre-install certificates before payload installation (rvykydal)
    Resolves: RHEL-61434
  - security: add API to install certificates early before payload (rvykydal)
    Resolves: RHEL-61434
  - security: install certificates on target system (rvykydal)
    Resolves: RHEL-61434
  - security: Add API for installation on target system (rvykydal)
    Resolves: RHEL-61434
  - security: import certificates early after Anaconda start (rvykydal)
    Resolves: RHEL-61434
  - security: add API to import certificates to Anaconda environment (rvykydal)
    Related: RHEL-61434
  - security: add API: Certificate getter (rvykydal)
    Resolves: RHEL-61434
  - kickstart: extend section specification for list of section data (rvykydal)
    Resolves: RHEL-61434
  - security: implement the support to install certificates to Anaconda
    (k.koukiou)
    Resolves: RHEL-61434


author: Jiri Konecny <jkonecny@redhat.com> - 40.22.3.22-1
changelog:
  - Fix RDP question will switch to GUI instead of TUI (jkonecny)
    Resolves: RHEL-77162
  - rpmostree: Use `--merge` for kargs (walters)
    Resolves: RHEL-73029
  - Revert "dracut: Remove 'linear' from modules to load" (vtrefny)
    Resolves: RHEL-76805


author: Radek Vykydal <rvykydal@redhat.com> - 40.22.3.23-1
changelog:
  - security: add a development note for certificates import in initramfs
    (rvykydal)
    Related: RHEL-77156
  - security: do not issue warning on existing certificate file during dump
    (rvykydal)
    Resolves: RHEL-77156
  - Add systemd override to make /usr RW in Dracut (mkolman)
    Resolves: RHEL-77192
  - network: pass NM global dns configuration to the installed system (rvykydal)
    Resolves: RHEL-71415
  - network: pass global dns initrd option to the installed system (rvykydal)
    Resolves: RHEL-71415


author: Radek Vykydal <rvykydal@redhat.com> - 40.22.3.25-1
changelog:
  - network: add dnsconfd to installer environment (rvykydal)
    Resolves: RHEL-79800
  - network: add dnsconfd to selected packages if used in installer (rvykydal)
    Resolves: RHEL-79802


author: Radek Vykydal <rvykydal@redhat.com> - 40.22.3.26-1
changelog:
  - network: start dnsconfd in initramfs (rvykydal)
    Resolves: RHEL-80302
  - network: enable dnsconfd service on installed system if required (rvykydal)
    Resolves: RHEL-80011
  - network: pass 16-dns-backend.conf to target system (rvykydal)
    Resolves: RHEL-80232
  - netowrk: enable dnsconfd service in installer environment (rvykydal)
    Resolves: RHEL-80011


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.27-1
changelog:
  - Update the tests/README.rst file (jkonecny)
    Related: RHEL-48821
  - Move shell testing to a separated directory (jkonecny)
    Related: RHEL-48821
  - Enable dynamic bash commands disable for tests (jkonecny)
    Related: RHEL-48821
  - Add test for config_get dracut function (jkonecny)
    Related: RHEL-48821
  - Fix trailing `/` when downloading stage2 image (jkonecny)
    Resolves: RHEL-48821
  - Fix whitespace chars broke Dracut config parsing (jkonecny)
    Related: RHEL-48821


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.28-1
changelog:
  - network: update NM autoconnections configuration for centos (rvykydal)
    Resolves: RHEL-67815
  - Run restorecon after copying logs (champetier.etienne)
    Resolves: RHEL-86788
  - s390x - enable raid1 as a stage2 device (dan)
    Resolves: RHEL-83924
    Resolves: INSTALLER-4148
  - edns: restart dnsconfd only after the first kickstart parsing (rvykydal)
    Resolves: RHEL-83931
  - edns: allow dnsconfd name resolution for kickstart fetching (rvykydal)
    Resolves: RHEL-83931
  - network: disable autoconnections on RHEL also for BOOTIF option (rvykydal)
    Resolves: RHEL-69400
  - security: fix dnsconfd backend option check in initramfs (rvykydal)
    Resolves: RHEL-83576


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.38-1
changelog:
  - bootloader: efi: utilize grub2-common script for handling config file
    generation (k.koukiou)
    Resolves: RHEL-58830


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.39-1
changelog:
  - Remove --root-mount-spec to enable bootc's btrfs subvolume auto-detection
    (k.koukiou)
    Related: RHEL-58215
  - bootc: Collect kernel arguments before installation to pass to bootc
    (k.koukiou)
    Related: RHEL-58215
  - bootc: Bind mount /boot into sysroot for %post scripts (k.koukiou)
    Related: RHEL-58215
  - pyanaconda: bootc: specify the bootloader to grub for bootc (k.koukiou)
    Related: RHEL-58215
  - Add bootc installation method (ppolawsk)
    Resolves: RHEL-58215
  - Include bootc command in expected pykickstart commands (ppolawsk)
    Related: RHEL-58215


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.40-1
changelog:
  - rhsm: add --flatpak-registry-url support (bciconel)
    Resolves: RHEL-132652
  - flatpak: handle self-signed certificate errors in registry sources (bciconel)
    Resolves: RHEL-132652
  - flatpak: add utility to check for self-signed certificate errors (bciconel)
    Resolves: RHEL-132652
  - Fix permissions of the ssh config created by Anaconda (ppolawsk)
    Resolves: RHEL-99673
  - Add x-initrd.attach to /etc/crypttab device for / volumes (mkolman)
    Resolves: RHEL-112702
    Related: RHEL-132666


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.41-1
changelog:
  - ostree needs to have /boot be bindmounted into sysroot (k.koukiou)
    Resolves: RHEL-66155
  - modules: rpm_ostree: allow /boot/efi mount point in bootc installation
    (k.koukiou)
    Resolves: RHEL-141155


author: Bruno <bciconel@redhat.com> - 40.22.3.42-1
changelog:
  - payloads: flatpak: fix SSL error detection on older Python versions
    (bciconel)
    Related: RHEL-141069
    Resolves: RHEL-142694


author: Bruno <bciconel@redhat.com> - 40.22.3.43-1
changelog:
  - installation: run subscription tasks after network configuration (bciconel)
    Resolves: RHEL-135111
  - subscription: ensure /var/lib/insights exists before running insights-client
    (bciconel)
    Resolves: RHEL-135111
  - spec: Require zram-generator-defaults for RHEL-10 (k.koukiou)
    Resolves: RHEL-117685
  - Only show compatible translations in text mode (mkolman)
    Resolves: RHEL-16168


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.44-1
changelog:
  - storage: stop creating /etc/mtab symlink during installation (k.koukiou)
    Related: RHEL-135116
  - rescue: Add warning for immutable systems (k.koukiou)
    Related: RHEL-135116
  - rescue: detect OSTree deployments in rescue mode and show deployment path
    (k.koukiou)
    Resolves: RHEL-135116
  - pyanaconda: storage: fix FindExistingSystems API for ostree based OSes
    (k.koukiou)
    Related: RHEL-135116
  - network: List all network interfaces IP for RDP session (ppolawsk)
    Resolves: RHEL-74268


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.45-1
changelog:
  - Fix user input in driver disk menu is not displayed (adamkankovsky)
    Resolves: RHEL-58828
  - flatpak: tests: fix unreachable code (fsouza.bruno)
    Related: RHEL-143566
  - flatpak: Only override remote URLs when subscription module is available
    (bciconel)
    Related: RHEL-143566
  - flatpak: Make installation failures non-blocking (bciconel)
    Resolves: RHEL-143566
  - Reload installer SELinux policy at exit so dracut shutdown works (k.koukiou)
    Resolves: RHEL-144456


author: Vojtech Trefny <vtrefny@redhat.com> - 3.10.0-17
changelog:
  - Do not remove PVs from devices file if disabled or doesn't exist
    Resolves: RHEL-65846
  - iscsi: Use node.startup=onboot option for Login
    Resolves: RHEL-53719
  - tests: Make sure selinux_test doesn't try to create mountpoints
    Resolves: RHEL-78988


author: Vojtech Trefny <vtrefny@redhat.com> - 3.13.0-3
changelog:
  - iSCSI: don't crash when LUN ID >= 256
    Resolves: RHEL-122305
  - Remove the safe_dbus module
    Related: RHEL-122305


author: Lukáš Zaoral <lzaoral@redhat.com> - 9.6-1
changelog:
  - rebase to latest upstream version (rhbz#2338620)
  - sync i18n patch with SUSE (Kudos to Berny Völker!)


author: Aaron Merey <amerey@redhat.com> - 0.193-1
changelog:
  - Upgrade to upstream elfutils 0.193
  - Drop upstreamed patches
    elfutils-0.192-fix-configure-conditional.patch
    elfutils-0.192-fix-free.patch
    elfutils-0.192-libelf-static.patch
    elfutils-0.192-stacktrace-lto.patch


author: Aaron Merey <amerey@redhat.com> - 0.195-1
changelog:
  - Upgrade to upstream elfutils 0.195
  - Drop upstreamed patches
    elfutils-0.194-zero-sh_addr.patch
    elfutils-0.194-alloc-jobs.patch


author: Michel Lind <salimma@centosproject.org> - 1:30.1-6
changelog:
  - Pick up changes from Fedora 42/43's emacs-1:30.1-5
  - Fixes: CVE-2024-53920
  - Fixes: CVE-2025-1244
  - Resolves: https://pagure.io/centos-sig-hyperscale/package-updates/issue/384


author: Michel Lind <salimma@fedoraproject.org> - 3.41-1
changelog:
  - Update to upstream v3.41
  - Update upstream URL (see README.rst) and download protocol to https
  - Related: rhbz#2393562


author: Michel Lind <salimma@centosproject.org> - 0.9.10-0.1
changelog:
  - Update to 0.9.10
  - Enable kpatch-build on aarch64
  - Rebase EL-only patches
  - Refresh clang PGO patches
  - Switch to autopatch for easier application of upstream patches


author: Michel Lind <salimma@centosproject.org> - 0.9.10-0.3
changelog:
  - Make kpatch-runtime obsolete a floating version of kpatch
    This preserves the upgrade path if in the future cXs's kpatch is updated


author: Michel Lind <salimma@centosproject.org> - 0.9.11-0.3
changelog:
  - Refresh for liu-song-6's fb-v0.9.11-v3 branch
  - create-diff-object: filter inert jump labels to fix objtool abort


author: Vojtech Trefny <vtrefny@redhat.com> - 3.1.0-6
changelog:
  - Fix passing size for pvresize over DBus
    Resolves: RHEL-45872
  - Upstream kernel VDO support
    Resolves: RHEL-31953


author: Michel Lind <salimma@centosproject.org> - 6.17.10-1
changelog:
  - Update to 6.17.10
  - Switch to using the full Linux tarball as the standalone one is missing
    some aarch64 files since 6.15.0
  - Workaround for some header files incorrectly shipped in kernel-headers


author: Michel Lind <salimma@centosproject.org> - 6.19~rc6-1
changelog:
  - Update to 6.19-pre6
  - this includes https://github.com/torvalds/linux/commit/bdf96c4ecd69523d97
    c98e47284caddde20b1df7
  - remove workaround bumping the hs+fb release number, we no longer build
    for hsx


author: Michel Lind <salimma@centosproject.org> - 6.19~rc6-4
changelog:
  - Backport cs-etm proposed fix for cross-pid attribution
  - Also exclude perf/core.h on EL10, shipped in kernel-headers


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.1-3
changelog:
  - Use a SPDX license tag
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - udiskslinuxmanager: Fix use after free
  - tests: Fix targetcli_config.json


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.90-4
changelog:
  - Rebase to upstream 2.10.90 (pre-)release
  - lvm2: Try opening for unused device detection harder (RHEL-39935)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.11.0-1
changelog:
  - Version 2.11.0 (RHEL-114981)
  - tests: Rework nvme revision check (RHEL-90572)
  - tests: Adapt for missing fstab and crypttab (RHEL-78987)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.11.1-1
changelog:
  - Version 2.11.1 (RHEL-150897)
  - udiskslinuxnvmecontroller: Fix sanitize job start (RHEL-69113)
  - udiskslinuxpartitiontable: Fix missing job completion (RHEL-124987)
  - udiskslinuxdevice: multipath handling fixes (RHEL-128598)
  - lvm2: Prevent a segfault on discarded probe output (RHEL-138293)
  - udisksmodulemanager: Silence console warnings when requested module is not available (RHEL-144145)
  - tests: Make sure to load sr_mod for cdrom tests (RHEL-153132)


author: Brian C. Lane <bcl@redhat.com> - 3.52.7-1
changelog:
  - Add support for inline certificates with `%certificate` section (k.koukiou)
    Resolves: RHEL-61435


author: Brian C. Lane <bcl@redhat.com> - 3.52.8-1
changelog:
  - Update %certificate section documentation (rvykydal)
    Related: RHEL-61435
  - Make %certificate section option --dir mandatory. (rvykydal)
    Resolves: RHEL-76502


author: Brian C. Lane <bcl@redhat.com> - 3.52.9-1
changelog:
  - workflows: Switch to using ubuntu-latest (bcl)
    Related: RHEL-80086
  - Do not remove "md" prefix from RAID names (vtrefny)
    Resolves: RHEL-80086


author: Neal Gompa <ngompa@centosproject.org> - 3.52.9-1.1
changelog:
  - Merge upstream/c10s changes into Hyperscale
  - Restore Btrfs support to the autopart kickstart command


author: Brian C. Lane <bcl@redhat.com> - 3.52.10-1
changelog:
  - pylint: Ignore files in .git (bcl)
    Related: RHEL-96217
  - Add support for RDP (jkonecny)
    Resolves: RHEL-96217


author: Brian C. Lane <bcl@redhat.com> - 3.52.11-1
changelog:
  - Add support for new bootc kickstart command (ppolawsk)
    Resolves: RHEL-132612
    Related: RHEL-58215


author: Brian C. Lane <bcl@redhat.com> - 3.52.12-1
changelog:
  - rhsm: Add Flatpak registry option for RHEL10 (bciconel)
    Resolves: RHEL-132652
    Related: RHEL-132663


author: Roberto Campesato <render@metalabs.org> - 9.1.1-1.1
changelog:
  - Merge latest changes from Fedora
  - Added fb-only patch based on experimental AMD changes for SEV/SNP
    to make PCI passthrough work with SNP


author: Zdenek Pytela <zpytela@redhat.com> - 41.26-1
changelog:
  - [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  - [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  - [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  - [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  - [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  - Allow systemd-networkd read mount pid files
  - Update policy for samba-bgqd
  - Allow chronyd read networkmanager's pid files
  - Allow staff user connect to generic tcp ports
  - Allow gnome-remote-desktop dbus chat with policykit
  - Allow tlp the setpgid process permission
  - Update the bootupd policy
  - Allow sysadm_t use the io_uring API
  - Allow sysadm user dbus chat with virt-dbus
  - Allow virtqemud_t read virsh_t files
  - Allow virt_dbus_t connect to virtd_t over a unix stream socket
  - Allow systemd-tpm2-generator read hardware state information
  - Allow coreos-installer-generator execute generic programs
  - Allow coreos-installer domain transition on udev execution
  - Revert "Allow unconfined_t execute kmod in the kmod domain"
  - Allow iio-sensor-proxy create and use unix dgram socket
  - Allow virtstoraged read vm sysctls
  - Support ssh connections via systemd-ssh-generator
  - Label all semanage store files in /etc as semanage_store_t
  - Add file transition for nvidia-modeset


author: Zdenek Pytela <zpytela@redhat.com> - 41.27-1
changelog:
  - Update ktlsh policy
  - Allow request-key to read /etc/passwd
  - Allow request-key to manage all domains' keys
  - Add support for the KVM guest memfd anon inodes
  - Allow auditctl signal auditd
  - Dontaudit systemd-coredump the sys_resource capability
  - Allow traceroute_t bind rawip sockets to unreserved ports
  - Fix the cups_read_pid_files() interface to use read_files_pattern
  - Allow virtqemud additional permissions for tmpfs_t blk devices
  - Allow virtqemud rw access to svirt_image_t chr files
  - Allow virtqemud rw and setattr access to fixed block devices
  - Label /etc/mdevctl.d/scripts.d with bin_t
  - Allow virtqemud open svirt_devpts_t char files
  - Allow virtqemud relabelfrom virt_log_t files
  - Allow svirt_tcg_t read virtqemud_t fifo_files
  - Allow virtqemud rw and setattr access to sev devices
  - Allow virtqemud directly read and write to a fixed disk
  - Allow virtqemud_t relabel virt_var_lib_t files
  - Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  - Add gnome_filetrans_gstreamer_admin_home_content() interface
  - Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  - Make bootupd_t permissive
  - Allow init_t nnp domain transition to locate_t
  - allow gdm and iiosensorproxy talk to each other via D-bus
  - Allow systemd-journald getattr nsfs files
  - Allow sendmail to map mail server configuration files
  - Allow procmail to read mail aliases
  - Allow cifs.idmap helper to set attributes on kernel keys
  - Allow irqbalance setpcap capability in the user namespace
  - Allow sssd_selinux_manager_t the setcap process permission
  - Allow systemd-sleep manage efivarfs files
  - Allow systemd-related domains getattr nsfs files
  - Allow svirt_t the sys_rawio capability
  - Allow alsa watch generic device directories
  - Move systemd-homed interfaces to seperate optional_policy block
  - Update samba-bgqd policy
  - Update virtlogd policy
  - Allow svirt_t the sys_rawio capability
  - Allow qemu-ga the dac_override and dac_read_search capabilities
  - Allow bacula execute container in the container domain
  - Allow httpd get attributes of dirsrv unit files
  - Allow samba-bgqd read cups config files
  - Add label rshim_var_run_t for /run/rshim.pid


author: Zdenek Pytela <zpytela@redhat.com> - 41.28-1
changelog:
  - Update virtqemud policy regarding the svirt_tcg_t domain
  - Allow virtqemud domain transition on numad execution
  - Support virt live migration using ssh
  - Allow virtqemud permissions needed for live migration
  - Allow virtqemud the getpgid process permission
  - Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  - Allow virtqemud relabelfrom virt_log_t files
  - Allow virtqemud relabel tun_socket
  - Add policy for systemd-import-generator
  - Confine vsftpd systemd system generator
  - Allow virtqemud read and write sgx_vepc devices
  - Allow systemd-networkd list cgroup directories
  - Allow xdm dbus chat with power-profiles-daemon
  - Allow ssh_t read systemd config files
  - Add Valkey rules to Redis module


author: Zdenek Pytela <zpytela@redhat.com> - 41.29-1
changelog:
  - Allow virtqemud domain transition to nbdkit
  - Add nbdkit interfaces defined conditionally
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  - Confine the switcheroo-control service
  - Allow svirt_t read sysfs files
  - Add rhsmcertd interfaces
  - Add the ssh_exec_sshd() interface
  - Add the gpg_domtrans_agent() interface
  - Label /usr/bin/dnf5 with rpm_exec_t
  - Label /dev/pmem[0-9]+ with fixed_disk_device_t
  - allow kdm to create /root/.kde/ with correct label
  - Change /usr/sbin entries to use /usr/bin or remove them
  - Allow systemd-homed get filesystem quotas
  - Allow login_userdomain getattr nsfs files
  - Allow virtqemud send a generic signal to the ssh client domain
  - Dontaudit request-key read /etc/passwd


author: Zdenek Pytela <zpytela@redhat.com> - 41.30-1
changelog:
  - Allow systemd-generator connect to syslog over a unix stream socket
  - Allow virtqemud manage fixed disk device nodes
  - Allow iio-sensor-proxy connect to syslog over a unix stream socket
  - Allow virtstoraged write to sysfs files
  - Allow power-profiles-daemon write sysfs files
  - Update iiosensorproxy policy
  - Allow pcmsensor write nmi_watchdog state information
  - Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  - Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  - Add the gpg_read_user_secrets() interface
  - Allow gnome-remote-desktop read resolv.conf
  - Update switcheroo policy
  - Allow nfsidmap connect to systemd-homed over a unix socket
  - Add the auth_write_motd_var_run_files() interface
  - Add the bind_exec_named_checkconf() interface
  - Add the virt_exec_virsh() interface


author: Zdenek Pytela <zpytela@redhat.com> - 41.31-1
changelog:
  - Allow snapperd execute systemctl in the caller domain
  - Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  - Allow iio-sensor-proxy read iio devices
  - Label /dev/iio:device[0-9]+ devices
  - Allow systemd-coredump the sys_admin capability
  - Allow apcupsd's apccontrol to send messages using wall
  - contrib/thumb: also allow per-user thumbnailers
  - contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  - Allow virt_domain to use pulseaudio - conditional
  - Allow pcmsensor read nmi_watchdog state information
  - Allow init_t nnp domain transition to gssproxy_t


author: Zdenek Pytela <zpytela@redhat.com> - 41.32-1
changelog:
  - Allow virtqemud use hostdev usb devices conditionally
  - Allow virtqemud map svirt_image_t plain files
  - Allow virtqemud work with nvdimm devices
  - Support saving and restoring a VM to/from a block device
  - Allow virtnwfilterd dbus chat with firewalld
  - Dontaudit systemd-logind remove all files
  - Add the files_dontaudit_read_all_dirs() interface
  - Add the files_dontaudit_delete_all_files() interface
  - Allow rhsmcertd notify virt-who
  - Allow irqbalance to run unconfined scripts conditionally
  - Fix binsbin-convert.sh to handle exceptions


author: Zdenek Pytela <zpytela@redhat.com> - 41.33-1
changelog:
  - Allow systemd-networkd the sys_admin capability
  - Update systemd-networkd policy in systemd v257
  - Separate insights-core from insights-client
  - Removed unused insights_client interfaces calls from other modules
  - Update policy for insights_client wrt new rules for insights_core_t
  - Add policy for insights-core
  - Allow systemd-networkd use its private tmpfs files
  - Allow boothd connect to systemd-machined over a unix socket
  - Update init_explicit_domain() interface
  - Allow tlp to read/write nmi_watchdog state information
  - Allow power-profiles-daemon the bpf capability
  - Allow svirt_t to connect to nbdkit over a unix stream socket
  - Update ktlshd policy to read /proc/keys and domain keyrings
  - Allow virt_domain read hardware state information unconditionally
  - Allow init mounton crypto sysctl files
  - Rename winbind_rpcd_* types to samba_dcerpcd_*
  - Support peer-to-peer migration of vms using ssh


author: Zdenek Pytela <zpytela@redhat.com> - 41.34-1
changelog:
  - Add context for plymouth debug log files
  - Allow rlimit inheritance for domains transitioning to local_login_t
  - Update insights-core policy
  - Allow insights-core map all non-security files
  - Allow insights-core map audit config and log files
  - Allow insights-client manage insights_client_var_log_t files
  - Remove duplicate dev_rw_dma_dev(xdm_t)
  - Allow thumbnailer read and write the dma device
  - Allow named_filetrans_domain filetrans raid/mdadm named content
  - Allow afterburn to mount and read config drives
  - Allow mptcpd the net_admin capability


author: Zdenek Pytela <zpytela@redhat.com> - 42.20-1
changelog:
  - Support cockpit privileged access for the staff user
  - Update su_domain_type policy for kerberized su
  - Allow sshd-session inherit limits from its parent process
  - Allow systemd-machined read virtd process state
  - Allow kl2tpd create and use netlink_generic_socket
  - Update policy for redfish-finder
  - Label the greetd login manager framework as a display manager
  - Allow sshd-auth get attributes of sshd vsock socket
  - Confine redfish_finder - host api discovery service
  - Allow iptables read firewalld process state
  - Allow tuned_t use its private tmpfs files
  - The commit addresses the following AVC denials:


author: Zdenek Pytela <zpytela@redhat.com> - 42.21-1
changelog:
  - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  - Allow sshd-session read, write, and map ica tmpfs files
  - Allow aide get attributes of a filesystem with extended attributes
  - Set correct label for glycin fontconfig (bsc#1253682)
  - Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  - Logwatch zz-runtime uses uptime (bsc#1255862)
  - Add auth_login_pgm_signull interface (bsc#1255862)
  - Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  - Allow l2tpd_t access to netlink and sysfs
  - Label miscellaneous /dev/papr-* devices
  - Allow qemu-ga to skip authentication
  - Revert "Allow systemd-coredump signull containers"
  - Allow systemd-coredump signull containers
  - Allow virtqemud setattr dri devices
  - Allow irqbalance create and use netlink generic socket
  - Allow thumb_t connect to XDM over a unix domain stream socket
  - Allow systemd-homework to remove ~/.identity-blob
  - Revert "Allow kl2tpd create and use netlink_generic_socket"


author: Zdenek Pytela <zpytela@redhat.com> - 42.22-1
changelog:
  - Allow thumb_t stream connect to systemd-machined
  - Allow thumb_t stream connect to systemd-homed
  - Allow aide get attributes of tmpfs and devtmpfs filesystems
  - Allow sshd noatsecure on sshd-session execution
  - Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  - Allow kernel_t to read/write all domains' pipes
  - Allow domain read sysfs files
  - allow abrt_dump_oops to write to init sockets
  - Add insights_client service interfaces
  - Allow plasma login manager stop login services
  - Allow NM nvme dispatcher script start systemd services


author: Zdenek Pytela <zpytela@redhat.com> - 42.23-1
changelog:
  - Allow thumbnailer mount on fonts cache directories
  - Support confined users usage of bubblewrap
  - Allow vdagent get attributes of the pidfs filesystem
  - Allow sshd-session inherit limits from its parent sshd process
  - Revert "Allow sshd-session inherit limits from its parent process"
  - Allow sshd-session read network sysctls
  - Add the fs_write_tmpfs_files() interface
  - Update gpg policy for interactions with rhc-playbook-verifier
  - Allow rhc_playbook_verifier_t stream connect to itself
  - Update policy for rhc-worker-playbook
  - Allow sudodomain connect to gkeyringd over a unix stream socket
  - Allow tlshd communication to unconfined_t over a tcp socket
  - Allow tlshd write generic certificates
  - Allow thumbnailer connect to abrt over a unix stream socket


author: Zdenek Pytela <zpytela@redhat.com> - 42.24-1
changelog:
  - Allow mdadm to use CAP_BPF during RAID monitoring
  - Allow rhsmcertd read anaconda run files
  - Allow rpc.mountd setuid and setgid capabilities
  - Use kernel_dgram_send() for systemd_notify_t
  - Allow lttng-sessiond to use sd_notify
  - Label /etc/aliases.cdb with etc_aliases_t
  - Add aliases.lmdb to mta_filetrans_named_content()
  - Update gpg_role() interface with unix_stream_socket permissions
  - Allow systemd-hostnamed to create its Varlink socket


author: Zdenek Pytela <zpytela@redhat.com> - 42.25-1
changelog:
  - Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  - TLP uses ps aux to check for different services (bsc#1257527)
  - Introduce separate types for generic systemd generators.
  - Confine system generator nm-initrd-generator.sh (bsc#1257754)
  - Allow rtkit-daemon dbus chat with systemd-logind
  - ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  - Dontaudit tlshd write generic certificate dirs
  - Allow systemd-coredump the kill capability in the user namespace
  - Allow NetworkManager list bpf directories
  - Allow virtnodedevd the dac_read_search capability
  - Allow pkcsslotd read files in /proc and /sys
  - Allow pkcsslotd map its private tmpfs files
  - Allow dovecoth-auth to connect to systemd-logind over a unix socket
  - Allow tlshd write generic certificate dirs


author: Zdenek Pytela <zpytela@redhat.com> - 43.1-1
changelog:
  - Allow redis_t to create netlink_rdma_socket
  - Allow systemd create symlinks in /run/varlink/registry
  - Support hooks in /run/systemd/resolve.hook
  - Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  - Allow mdadm use modprobe (bsc#1257793)
  - Allow systemd-mountfsd the perfmon capability
  - Allow lttng tracing in default configuration
  - Allow rtkit-daemon write systemd inhibit pipes
  - Apply the systemd system generator template to the kdump-dep generator
  - Apply the systemd system generator template to the anaconda generator


author: Zdenek Pytela <zpytela@redhat.com> - 43.2-1
changelog:
  - Allow fedoratp_exec_t be an entrypoint of unconfined_t
  - Allow rasdaemon_t to list pstore (bsc#1259742)
  - Allow virtqemud_t send kill signal to svirt_tcg_t
  - Allow virtqemud_t get priority of a svirt_t process
  - Allow sysadm user connect to lvm over a unix stream socket
  - Allow staff user delete thump_tmp_t files
  - Allow staff user connect to systemd-logind over a unix stream socket
  - Allow staff user mount /proc
  - Allow virtqemud map vhost net device
  - Dontaudit ps to read proc (bsc#1257527)
  - Allow dovecot_deliver_t map its private tmp files
  - Allow rpcbind get attributes of the pidfs filesystem
  - Fix names in mysql.if
  - Allow create kerberos files in mysql db home
  - Allow systemd-resolved connect to systemd-networkd over a unix stream socket


author: Michel Lind <salimma@centosproject.org> - 3.7b-3
changelog:
  - Rebase to Fedora 44's fixed 3.7b spec and backport Ben Maurer's committed
    PRs #5244, #5356, #5357


author: Dominique Martinet <asmadeus@codewreck.org> - 0.9.0-1
changelog:
  - Update to 0.9.0
  - fix fd leak (probably #2290715)
  - enable lz4 compression by default
  - add supprt for av1 software encoding/decoding
  - add support for vsock transport
  - fix build with gcc-14


author: Dominique Martinet <asmadeus@codewreck.org> - 0.9.1-1
changelog:
  - Update to 0.9.1
  - don't abort on double-^C (#2262447)
  - fix for compositors using drm_syncobj protocol


