# changelog

author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Michal Hlavinka <mhlavink@redhat.com> 56-1
changelog:
  - Upgrade to 56 (#1479800)
  - fixes wait exit codes of co-processes when run in interactive mode (#1479320)


author: Michal Sekletar <msekleta@redhat.com> - 0.26-14
changelog:
  - start timer after the installation (#1278587)
  - make mlocate-updatedb.service of the type simple, systemd will then not wait for its completion (#1282232)


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1877343


author: Ilya Okomin <ilya.okomin@oracle.com> - 0.3.0-10.0.1
changelog:
  - Add more info to --sb-state: show when we're in SetupMode or
    with shim validation disabled [Orabug: 31887197]


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.18-15
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073842)


author: Alex Burmashev <alexander.burmashev@oracle.com> 1.0-4
changelog:
  - update MySQL server and tools repositories to 8.4 version [JIRA: OLDIS-40482]
  - update connectors repository to latest version [JIRA: OLDIS-40482]
  - Do not install yum-utils if dnf is not installed or in transaction [JIRA: OLDIS-38673]


author: Lukáš Zaoral <lzaoral@redhat.com> - 2.9.8-3
changelog:
  - fix incomplete backport of the fix for the emergency file replacement
    vulnerability (RHEL-35236)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.0-14.20170916
changelog:
  - update to 6.0-20170916 (CVE-2017-13728 CVE-2017-13729 CVE-2017-13730
    CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 CVE-2017-13734)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-2
changelog:
  - fix default configuration file (#1589480 and #1594147)
  - modify permissions for /var/log files (#1601060)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-12.1
changelog:
  - fix double free or corruption error caused by freeing security context (#1802055)
  - remove deprecated CFLAG


author: Josef Ridky <jridky@redhat.com> - 1:5.8-14
changelog:
  - fix double free or corruption error when freeing security context (#1809077)
  - remove deprecated CFLAG


author: Josef Ridky <jridky@redhat.com> - 1:5.8-15
changelog:
  - proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
  - UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
  - expand SNMPCONFPATH variable (#1660146)
  - remove file with Apple license (#1690936)
  - log meningful message on duplicate IP address (#1692286)
  - memory reporting adjustment (#1695497 and #1766521)
  - fix typos in man page (#1700262)
  - speedup ipAddressTable loading(#1700391)
  - fix memory leak when shut down librpm (#1763008)
  - services starts after network-online.target (#1775304)
  - add missing part of memory leak patch (#1829860)
  - add support for AES192 and AES256 (#1846252)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-30
changelog:
  - fix crash when configured as proxy - issue 82 (RHEL-14454)
  - log once truncating issue (RHEL-13597)
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.50.20160912git
changelog:
  - Resolves: 1557470 - netstat -i cut's interface names
  - Resolves: 1566084 - netstat -agn only shows 10 character interface name for IPv4 addressing


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.3-5
changelog:
  - Removed executables from the library to allow parallel installation
    of x86-64 and x86 packages. The executables had testing purpose, and
    may be re-introduced in a separate package if needed.


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Steve Dickson <steved@redhat.com> 0.3.5-2
changelog:
  - nfs4_getfacl: Add new option -c/--omit-header (bz 1698281)
  - nfs4_setfacl: Skip comment field while reading ACE(s) (bz 1687299)


author: Phil Sutter <psutter@redhat.com> - 1:0.9.0-9
changelog:
  - Allow variables in jump statement
  - Make example configs readable only by root
  - Document nft list parameters
  - Document vmap statement
  - Install netdev-ingress.nft sample config in the right spot
  - Backport upstream fixes since last release


author: Phil Sutter - 1:0.9.0-4
changelog:
  - Add fixes for covscan report
  - Fix for ECN keyword in LHS of relational
  - Update meta pkt_type value description
  - Fix for segfault with JSON output if xt expression is present
  - Add missing nft suffix to files included from /etc/sysconfig/nftables.conf
  - Use native JSON API in nft monitor


author: Phil Sutter <psutter@redhat.com> [0.9.3-6.el8]
changelog:
  - monitor: Do not decompose non-anonymous sets (Phil Sutter) [1774742]
  - main: restore --debug (Phil Sutter) [1778883]
  - main: enforce options before commands (Phil Sutter) [1778883]


author: Phil Sutter <psutter@redhat.com> [0.9.3-8.el8]
changelog:
  - cache: Fix for doubled output after reset command (Phil Sutter) [1790793]
  - tests: shell: Search diff tool once and for all (Phil Sutter) [1790793]
  - xfrm: spi is big-endian (Phil Sutter) [1790963]


author: Phil Sutter <psutter@redhat.com> [0.9.3-9.el8]
changelog:
  - netlink: Avoid potential NULL-pointer deref in netlink_gen_payload_stmt() (Phil Sutter) [1793030]
  - netlink: Fix leaks in netlink_parse_cmp() (Phil Sutter) [1793030]
  - netlink: Fix leak in unterminated string deserializer (Phil Sutter) [1793030]


author: Phil Sutter <psutter@redhat.com> [0.9.3-10.el8]
changelog:
  - scanner: Extend asteriskstring definition (Phil Sutter) [1763652]
  - doc: nft.8: Mention wildcard interface matching (Phil Sutter) [1763652]
  - tests: py: Support testing host binaries (Phil Sutter) [1754047]
  - tests: monitor: Support testing host's nft binary (Phil Sutter) [1754047]
  - tests: monitor: Support running individual test cases (Phil Sutter) [1754047]
  - tests: json_echo: Support testing host binaries (Phil Sutter) [1754047]
  - tests: json_echo: Fix for Python3 (Phil Sutter) [1754047]


author: Phil Sutter <psutter@redhat.com> [0.9.3-11.el8]
changelog:
  - Package requires libnftnl-1.1.5-3 (Phil Sutter) [1795224]
  - src: Add support for concatenated set ranges (Phil Sutter) [1795224]
  - src: Add support for NFTNL_SET_DESC_CONCAT (Phil Sutter) [1795224]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795224]
  - parser: add a helper for concat expression handling (Phil Sutter) [1795224]


author: Phil Sutter <psutter@redhat.com> [0.9.3-12.el8.1]
changelog:
  - src: Set NFT_SET_CONCAT flag for sets with concatenated ranges (Phil Sutter) [1854532]
  - include: Resync nf_tables.h cache copy (Phil Sutter) [1854532]


author: Phil Sutter <psutter@redhat.com> [0.9.3-14.el8]
changelog:
  - JSON: Improve performance of json_events_cb() (Phil Sutter) [1835300]
  - doc: Document notrack statement (Phil Sutter) [1841292]


author: Phil Sutter <psutter@redhat.com> [0.9.3-15.el8]
changelog:
  - segtree: Fix get element command with prefixes (Phil Sutter) [1832235]
  - tests: 0034get_element_0: do not discard stderr (Phil Sutter) [1832235]
  - segtree: Merge get_set_interval_find() and get_set_interval_end() (Phil Sutter) [1832235]
  - segtree: Use expr_clone in get_set_interval_*() (Phil Sutter) [1832235]
  - segtree: Fix missing expires value in prefixes (Phil Sutter) [1832235]


author: Phil Sutter <psutter@redhat.com> [0.9.3-16.el8]
changelog:
  - src: Set NFT_SET_CONCAT flag for sets with concatenated ranges (Phil Sutter) [1820684]
  - include: Resync nf_tables.h cache copy (Phil Sutter) [1820684]


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Phil Sutter <psutter@redhat.com> [1.0.4-1.el8]
changelog:
  - Synchronize patch level with nftables-1.0.4-10.el9 (Phil Sutter) [2211076]
  - Rebase onto version 1.0.4 (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-2.el8]
changelog:
  - Add expected error records for testsuite runs (Phil Sutter) [2211076]
  - tests: monitor: Summarize failures per test case (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-3.el8]
changelog:
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5160]


author: Phil Sutter <psutter@redhat.com> [1.0.4-5.el8]
changelog:
  - xt: Fix fallback printing for extensions matching keywords (Phil Sutter) [RHEL-5806]
  - xt: Fall back to generic printing from translation (Phil Sutter) [RHEL-5806]
  - xt: Rewrite unsupported compat expression dumping (Phil Sutter) [RHEL-5806]
  - xt: Purify enum nft_xt_type (Phil Sutter) [RHEL-5806]
  - xt: Delay libxtables access until translation (Phil Sutter) [RHEL-5806]
  - Warn for tables with compat expressions in rules (Phil Sutter) [RHEL-5806]


author: Dridi Boukelmoune <dridi@fedoraproject.org>- 2.1-1
changelog:
  - Update to 2.1
  - Upstream moved to github
  - Upstream switched to autotools
  - Disable --as-needed until it's patched upstream
  - Drop defunct 32bit x86 support
  - Add ppc64le support
  - Run the new test suite


author: luto@kernel.org - 1.9-1
changelog:
  - Update to 1.9
  - Certain fabric functionality may not work yet due to missing dracut
    support and missing hostid and hostnqn configuration.


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-6.el6
changelog:
  - vendor: rhel: remove redhat-lsb* dependency (Junxiao Bi)
  - scandisk: remove unnecessary scansysfs op (Junxiao Bi)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-8.el6
changelog:
  - BUILDINFO: commit=f0e130273b7eed12385e1d0aa7704b414bceeff0
  - vendor: rhel5: fix build failure (Junxiao Bi)
  - tunefs.ocfs2: fix double free bug (Junxiao Bi)
  - fsck.ocfs2: the members of 'o2fsck_state' need to be freed at the end of main() (Jun Piao)
  - fsck.ocfs2: fix the mistake of clearing valid flag in o2fsck_check_blocks() (Jun Piao)
  - mkfs.ocfs2: disable append-dio feature by default (Junxiao Bi)
  - fsck.ocfs2: support append direct io incompat feature (Joseph Qi)
  - tunefs.ocfs2: support append direct io incompat feature (Joseph Qi)
  - mkfs.ocfs2: support append direct io incompat feature (Joseph Qi)
  - mkfs.ocfs2: clean up deadcode in is_cluster_info_valid() (Jun Piao)
  - fsck.ocfs2: return error if o2fsck_check_journals fails (Joseph Qi)
  - ocfs2: fix cluster unlocked if journal is replayed (Joseph Qi)
  - fsck.ocfs2: close ost_fs in case of check superblock fails (Joseph Qi)
  - mkfs.ocfs2: fix a potential segment fault in main() (Jun Piao)
  - fsck.ocfs2: clean up useless assignment in dup_insert() (piaojun)
  - o2info: clean up useless branch in o2info_append_task() (piaojun)
  - tunefs.ocfs2: fix the parameter misuse of tunefs_dlm_lock (Weiwei Wang)
  - debugfs.ocfs2: encode 'M' lockname with generation only for sysfile (piaojun)
  - mkfs.ocfs2: fix memory leak problems in main() (piaojun)
  - tunefs.ocfs2: fix memory leak problems in tunefs_journal_check() and parse_options() (piaojun)
  - o2image: fix a memory leak problem in ocfs2_image_free_bitmap() (piaojun)
  - debugfs.ocfs2: fix NULL pointer dereference risk in dump_dir_entry (Joseph Qi)
  - o2image: clean up unused variable 'install_flag' in o2image_initialize() (piaojun)
  - libocfs2: close fd if read fails in create_generation (Joseph Qi)
  - o2image: Free 'filepath' before return in prompt_image_creation() (Jun Piao)
  - libocfs2: fix risk of using uninitialized variables (Joseph Qi)
  - mkfs.ocfs2: fix command line segfault (Valentin Vidic)
  - debugfs.ocfs2: fix command line segfault (Valentin Vidic)
  - Update udev rule for newer kernels (Valentin Vidic)
  - ocfs2-tools: add support for vd devices (Valentin Vidić)
  - fsck.ocfs2: Free 'ci' in each cycle of for loop in check_journal_walk (Jun Piao)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-9.el6
changelog:
  - BUILDINFO: commit=8b8e9d3b017f6e9bb23bd137878669831eec0f4d
  - o2cb.service: drop unknown lvalue ExecRestart (Junxiao Bi)


author: Ashish Samant <ashish.samant@oracle.com> - 1.8.6-11.el8
changelog:
  - tunefs.ocfs2: read journal superblock even for online operations (Ashish
    Samant)  [Orabug: 28804934]


author: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com> - 1.8.6-15.el8
changelog:
  - fsck.ocfs2: Avoid taking all available physical pages for cache (Gautham
    Ananthakrishna)  [Orabug: 31069094]


author: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com> - 1.8.6-17.el8
changelog:
  - libocfs2: fix non-zero value in Next Leaf field in the rightmost leaf metadata
    block (Gautham Ananthakrishna)  [Orabug: 36975814]


author: Honggang Li <honli@redhat.com> - 10.3.1.0-9
changelog:
  - Rebase to latest upstream branch v10_3_1 as required.
  - Clean up change log.
  - Apply Epoch tag.
  - Resolves: bz1382796


author: Lukas Lemes <lukas.lemes@oracle.com> - 10.10.0.0.445-1.0.1
changelog:
  - Add oracle-linux.patch
  - Add modify_to_suitable_os_release.patch
  - Added patch to properly identify oracle as redhat (Alex Burmashev)


author: Honggang Li <honli@redhat.com> - 10.3.1.0-8
changelog:
  - Rebase to upstream branch v10_3_1 as required.
  - Clean up change log.
  - Apply Epoch tag.
  - Resolves: bz1257452, bz1382792


author: Lukas Lemes <lukas.lemes@oracle.com> - 10.10.0.0.444-2.0.1
changelog:
  - Support os_vendor checking for OL
  - Add modify_to_suitable_os_release.patch
  - Added patch to identify OL as redhat vendor (Alex Burmashev)


author: Than Ngo <than@redhat.com> - 3.10.0-3
changelog:
  - Resolves: #1657683, can't establish libica token in FIPS mode
  - Resolves: #1652856, EP11 token fails when using Strict-Session mode or VHSM-Mode


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1667941, 3des tests failures due to FIPS incompatible test scenarios
  - Resolves: #1651731, ep11 token: enhanced IBM z14 functions
  - Resolves: #1651732, ep11 token: support m_*Single functions from ep11 lib
  - Resolves: #1525407, use CPACF hashes in ep11 token
  - Resolves: #1651238, rebase to 3.11.0
  - Resolves: #1682530, gating


author: Than Ngo <than@redhat.com> - 3.14.0-1
changelog:
  - Resolves: #1723863 - ep11 token: Enhanced Support
  - Resolves: #1780285 - ep11 token: Support for new IBM Z hardware z15
  - Resolves: #1780293 - rebase to 3.14.0
  - Resolves: #1800549 - key management tool: list keys function
   -Resolves: #1800555 - key management tool: random key generation function


author: Than Ngo <than@redhat.com> - 3.15.0-1
changelog:
  - Resolves: #1847433, rebase to 3.15.0 
  - Resolves: #1851105, PKCS #11 3.0 - baseline provider support
  - Resolves: #1851108, openCryptoki ep11 token: enhanced functionality
  - Resolves: #1851109, openCryptoki key management tool: key deletion function


author: Than Ngo <than@redhat.com> - 3.15.1-1
changelog:
  - Related: #1847433
    upstream fixes:
      - Free generated key in all error cases
      - CCA: Zeroize key buffer to avoid CCA 8/32 error
      - Do not delete the map-btree entry if destroying an object is not allowed
      - Remove now unused header timeb.h
      - TESTCASES: Use FIPS conforming keys for 3DES CBC-MAC test vectors
      - Fix buffer overrun in C_CopyObject
      - TPM: Fix double free in openssl_gen_key


author: Than Ngo <than@redhat.com> - 3.15.1-3
changelog:
  - Resolves: #1902022
     Fix compiling with c++
     Added error message handling for p11sak remove-key command


author: Than Ngo <than@redhat.com> - 3.15.1-7
changelog:
  - Resolves: #1995919, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Than Ngo <than@redhat.com> - 3.16.0-1
changelog:
  - Resolves: #1919223, rebase to 3.16.0
  - Resolves: #1922195, Event Notification Support
  - Resolves: #1959936, Soft token does not check if an EC key is valid
  - Resolves: #1851104, import and export of secure key objects
  - Resolves: #1851106, openCryptoki ep11 token: protected key support
  - Resolves: #1851107, openCryptoki ep11 token: support attribute bound keys


author: Than Ngo <than@redhat.com> - 3.16.0-5
changelog:
  - Resolves: #1987256, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2043845, rebase to 3.18.0
  - Resolves: #2043854, add crypto counters
  - Resolves: #2043855, support crypto profiles


author: Than Ngo <than@redhat.com> - 3.18.0-3
changelog:
  - Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
  - Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL


author: Than Ngo <than@redhat.com> - 3.18.0-4
changelog:
  - Resolves: #2129059, C_GenerateKeyPair() fails after generating > 500 RSA keys with CEX7 crypto cards


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126612, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110315, rebase to 3.19.0
  - Resolves: #2110990, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110477, openCryptoki ep11 token: master key consistency
  - Resolves: #1984871, openCryptoki ep11 token: vendor specific key derivation


author: Than Ngo <than@redhat.com> - 3.21.0-1
changelog:
  - Resolves: #1984865, ep11 and cca: support concurrent HSM master key changes
  - Resolves: #2110500, ep11 token: PKCS #11 3.0 - support AES_XTS 
  - Resolves: #2111011, cca token: protected key support
  - Resolves: #2159697, update to 3.21.0
  - Resolves: #2159740, pkcsslotd hardening
  - Resolves: #2159741, p11sak support Dilithium and Kyber keys
  - Resolves: #2159742, ica and soft tokens: PKCS #11 3.0 - support AES_XTS


author: Than Ngo <than@redhat.com> - 3.21.0-2
changelog:
  - add missing /var/lib/opencryptoki/HSM_MK_CHANGE
  - disable unsupported sandbox options and add /run to ReadWritePaths to exclude
    /run directory from being made read-only on rhel8
  Related: #2159697


author: Than Ngo <than@redhat.com> - 3.21.0-3
changelog:
  - pkcsstats: Fix handling of user name
  - p11sak: Fix user confirmation prompt behavior when stdin is closed
  Related: #2159697


author: Than Ngo <than@redhat.com> - 3.21.0-7
changelog:
  - Resolves: #2222595, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222594, p11sak fails as soon as there reside non-key objects


author: Than Ngo <than@redhat.com> - 3.21.0-10
changelog:
  - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
  Resolves: RHEL-22791


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.4.46-2
changelog:
  - Perl 5.28 rebuild
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.46-19
changelog:
  - Bump version to 2.4.46-19
  - Resolves: RHEL-34283 - openldap: null pointer dereference in ber_memalloc_x function


author: Simon Pichugin <spichugi@redhat.com> - 2.4.46-21
changelog:
  - Bump version to 2.4.46-21
  - Resolves: RHEL-75823 - Fix double file close when first TLS connection fails


author: Jakub Jelen <jjelen@redhat.com> - 0.17.0-10
changelog:
  - Install the PKCS#11 modules also to the new NSS DB
  - Drop the pkcs11-switch as the coolkey is gone


author: Jakub Jelen <jjelen@redhat.com> - 0.18.0-3
changelog:
  - Do not add pkcs11 module to NSS after installation
    (NSS is loading p11-kit modules by default)
  - Remove pkcs11-switch since there is nothing to switch to


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - New upstream release fixing various CVE-2018-16418 - 16421, 16423 - 16427
  - Add support for RSA-PSS signatures


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-2
changelog:
  - Avoid mismatching coolkey cards for muscle ones (#1588722)
  - Implement legacy CAC1 driver (#1638052)
  - Disable pinpad
  - Fixup verification after RSA-PSS implementation


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-3
changelog:
  - Unbreak the RSA-PSS mechanisms (#1595626)
  - Unbreak the signing using hashed mechanisms in CardOS and others (#1644338)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-5
changelog:
  - Avoid potential crash because of missing list terminator (#2196234)
  - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093)
  - Backport upstream changes regarding to reader removal (#2097048)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-7
changelog:
  - Fix file caching with different offsets (RHEL-4077)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-1 + 0.10.3-4
changelog:
  - New upstream release (#1563223)
  - Add support for ECDSA keys in PKCS#11 (#1354510)
  - Add support for PKCS#11 URIs


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-6 + 0.10.3-4
changelog:
  - Fix listing of kex algoritms in FIPS mode
  - Allow aes-gcm cipher modes in FIPS mode
  - Coverity fixes


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-2 + 0.10.3-5
changelog:
  - New upstream release fixing CVE 2018-15473
  - Remove unused patches
  - Remove reference to unused enviornment variable SSH_USE_STRONG_RNG
  - Address coverity issues
  - Unbreak scp between two IPv6 hosts (#1620333)
  - Unbreak GSSAPI key exchange (#1624323)
  - Unbreak rekeying with GSSAPI key exchange (#1624344)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-3 + 0.10.3-5
changelog:
  - Disable OpenSSH hardening flags and use the ones provided by system (#1630615)
  - Ignore unknown parts of PKCS#11 URI (#1631478)
  - Do not fail with GSSAPI enabled in match blocks (#1580017)
  - Fix the segfaulting cavs test (#1629692)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-4 + 0.10.3-5
changelog:
  - Unbreak PKCS#11 URI tests (#1648262)
  - Allow to disable RSA signatures with SHA1 (#1648898)
  - Dump missing GSS options from client configuration (#1649505)
  - Minor fixes from Fedora related to GSSAPI and keberos
  - Follow the system-wide PATH settings


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-1 + 0.10.3-7
changelog:
  - New upstream release (#1691045)
  - Remove support for unused VendorPatchLevel configuration option
  - Fix kerberos cleanup procedures (#1683295)
  - Do not negotiate arbitrary primes with DH GEX in FIPS (#1685096)
  - Several GSSAPI key exchange improvements and sync with Debian
  - Allow to use labels in PKCS#11 URIs even if they do not match on private key (#1671262)
  - Do not fall back to sshd_net_t SELinux context (#1678695)
  - Use FIPS compliant high-level signature OpenSSL API and KDF
  - Mention crypto-policies in manual pages
  - Do not fail if non-FIPS approved algorithm is enabled in FIPS
  - Generate the PEM files in new PKCS#8 format without the need of MD5 (#1712436)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-2 + 0.10.3-7
changelog:
  - Allow specifying a pin-value in PKCS #11 URI in ssh-add (#1639698)
  - Whitelist another syscall variant for s390x cryptographic module (ibmca engine) (#1714915)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-3 + 0.10.3-7
changelog:
  - Fix typos in manual pages (#1668325)
  - Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
  - Unbreak ssh-keygen -A in FIPS mode (#1732424)
  - Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-5 + 0.10.3-7
changelog:
  - Do not print "no slots" warning by default (#1744220)
  - Unbreak connecting using gssapi through proxy commands (#1749862)
  - Document in manual pages that CASignatureAlgorithms are handled by crypto policies (#1790604)
  - Use SHA2-based signature algorithms by default for signing certificates (#1790610)
  - Prevent simple ProxyJump loops in configuration files (#1804099)
  - Teach ssh-keyscan to use SHA2 RSA variants (#1744108)
  - Do not fail hard if getrandom() is not available and no SSH_USE_STRONG_RNG is specified (#1812120)
  - Improve wording of crypto policies references in manual pages (#1812854)
  - Do not break X11 forwarding if IPv6 is disabled (#1662189)
  - Enable SHA2-based GSSAPI key exchange algorithms by default (#1816226)
  - Mark RDomain server configuration option unsupported in RHEL (#1807686)
  - Clarify crypto policies defaults in manual pages (#1724195)
  - Mention RSA SHA2 variants in ssh-keygen manual page (#1665900)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-7 + 0.10.3-7
changelog:
  - SFTP sort upon the modification time (#1909988)
  - ssh-keygen printing fingerprint issue with Windows keys (#1901518)
  - PIN is lost when iterating over tokens when adding pkcs11 keys to ssh-agent (#1843372)
  - ssh-agent segfaults during ssh-add -s pkcs11 (#1868996)
  - ssh-copy-id could not resolve ipv6 address ends with colon (#1933517)
  - sshd provides PAM an incorrect error code (#1879503)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-9
changelog:
  - CVE-2020-14145 openssh: Observable Discrepancy leading to an information
    leak in the algorithm negotiation (#1882252)
  - Hostbased ssh authentication fails if session ID contains a '/' (#1944125)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Dmitry Belyavskiy - 8.0p1-17
changelog:
  - Fix parsing of IPv6 IPs in sftp client (#2151334)
  - Avoid ssh banner one-byte overflow (#2138344)
  - Avoid crash of sshd when Include folder does not exist (#2133087)


author: Alan Steinberg <alan.steinberg@oracle.com> - 8.0p1-19.2
changelog:
  - Forbid shell metasymbols in username/hostname
    Resolves: CVE-2023-51385
  - Fix Terrapin attack
    Resolves: CVE-2023-48795


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-20
changelog:
  - Limit artificial delays in sshd while login using AD user
    Resolves: RHEL-1684
  - Add comment to OpenSSH server config about FIPS-incompatible key
    Resolves: RHEL-5221
  - Avoid killing all processes on system in case of race condition
    Resolves: RHEL-11548
  - Avoid sshd_config 256K limit
    Resolves: RHEL-5279
  - Using DigestSign/DigestVerify functions for better FIPS compatibility
    Resolves: RHEL-5217
  - Fix GSS KEX causing ssh failures when connecting to WinSSHD
    Resolves: RHEL-5321


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-22
changelog:
  - Fix Terrapin attack
    Resolves: RHEL-19308
  - Forbid shell metasymbols in username/hostname
    Resolves: RHEL-19788


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1-1
changelog:
  - update to the final 1.1.1 version
  - for consistent support of security policies we build
    RC4 support in TLS (not default) and allow SHA1 in SECLEVEL 2
  - use only /dev/urandom if getrandom() is not available
  - disable SM4


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-6
changelog:
  - backport of S390x ECC CPACF enhancements from master
  - FIPS mode: properly disable 1024 bit DSA key generation
  - FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
  - FIPS mode: allow AES-CCM ciphersuites


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-8
changelog:
  - fix CVE-2019-1547 - side-channel weak encryption vulnerability
  - fix CVE-2019-1563 - padding oracle in CMS API
  - fix CVE-2019-1549 - ensure fork safety of the DRBG
  - fix handling of non-FIPS allowed EC curves in FIPS mode
  - fix TLS compliance issues


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-14
changelog:
  - fix incorrect error return value from FIPS_selftest_dsa
  - S390x: properly restore SIGILL signal handler


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1b-1
changelog:
  - update to the 1.1.1b release
  - EVP_KDF API backport from master
  - SSH KDF implementation for EVP_KDF API backport from master
  - add S390x chacha20-poly1305 assembler support from master branch


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2.1
changelog:
  - add selftest of the RAND_DRBG implementation
  - fix incorrect error return value from FIPS_selftest_dsa


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-7
changelog:
  - Disallow dropping Extended Master Secret extension
    on renegotiation
  - Return alert from s_server if ALPN protocol does not match
  - SHA1 is allowed in @SECLEVEL=2 only if allowed by
    TLS SigAlgs configuration


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-9
changelog:
  - Rewire FIPS_drbg API to use the RAND_DRBG
  - Use the well known DH groups in TLS even for 2048 and 1024 bit parameters


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-11.1
changelog:
  - Implemented new FIPS requirements in regards to KDF and DH selftests
  - Disallow certificates with explicit EC parameters


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14245
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14239


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16538


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17696


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14243
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14237


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16536


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17694


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067144


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-1
changelog:
  - Update to 0.4.8-1
  - RSA key generation on the token
  - RSA-OAEP and RSA-PKCS encryption support
  - RSA-PSS signature support
  - Support for OpenSSL 1.1.1 beta
  - Removed support for OpenSSL 0.9.8
  - Various bug fixes and enhancements


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
changelog:
  - Require OpenSSL >= 1.0.2
  - Fixed missing declaration of ERR_get_CKR_code()
  - Add support to use EC keys and tests (#1625338)
  - Exposed check_fork() API
  - Fixed memory leak of RSA objects in pkcs11_store_key()
  - Updated OpenSSL license in eng_front.c
  - Fixed build for old C dialects
  - Allow engine to use private key without PIN
  - Require DEBUG to be defined to print debug messages
  - Changed package description


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
changelog:
  - Update to 0.4.10 (#1745082)
  - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
  - Print tests logs if failed during build
  - Small bug fixes such as removal of unused variable
  - Search objects in all matching tokens (#1705505)


author: Stephen Gallagher <sgallagh@redhat.com> - 80.1-2
changelog:
  - Separate desktop backgrounds into their own subpackage
  - Correct the description to match the license terms
  - Drop vestiges of fedora-logos


author: Ray Strode <rstrode@redhat.com> - 80.3-1
changelog:
  - Make night time pattern lighter
    Resolves: #1628092
  - Remove Alpha from logos
    Resolves: #1637446
  - Remove Alpha from wallpapers
    Resolves: #1636822


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 80.5-1.0.3
changelog:
  - Removed Dtrace related banner image anaconda/rnotes/en/orcl_linux_dtrace_750x120.png
    [Orabug: 29839540]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 80.5-1.0.6
changelog:
  - Correct grammar in installer banner images [Orabug: 31261316]
  - Fix scaling in backgroup images [Orabug: 31260679]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 84.5-1.0.1
changelog:
  - Provide: system-logos(httpd-logo-ng) for httpd subpackage
  - Resolves: #1934800 - Apache trademark update (luhliari@redhat.com)


author: Alex Burmashev <alexander.burmashev@oracle.com> 1.0-3
changelog:
  - Use $ocidomain instead of hardcoded .oracle.com [Orabug: 35256560]
  - Update post scripts to support new self-service DNS hostnames [JIRA: OLDIS-22726]


author: Petr Kovar <pkovar@redhat.com> - 8-3
changelog:
  - New content tarball for RHEL 8 Beta
  - Remove outdated translations
  - Update fr-FR, ja-JP, ko-KR and zh-CN translations
  - Remove unneeded files
  - Change file permissions to 644
  - Update description
  - Resolves: rhbz1562063


author: Darren Archibald <darren.archibald@oracle.com> - 8-7.0.1
changelog:
  - Rebrand and replace upstream references from description tag
  - Replace upstream references in the index.html files


author: Murali Annamneni <murali.annamneni@oracle.com> - 1.0-12.el8
changelog:
  - Deprecate the package with old name of olcne and rename it to ocne
  - Added ocne 2.0 repositories for x86_64 and aarch64 on ol8 and ol9


author: Shubha Kulkarni <shubha.kulkarni@oracle.com> 1.0-1.0.21
changelog:
  - Pipe output to dev null and remove unnecessary echo statements
  - Remove unnecessary OCI related manipulations


author: Saksham Srivastava <saksham.sa.srivastava@oracle.com> 1.0-1.0.24
changelog:
  - Adding the "--follow-symlinks" in sed command to avoid removing symlinks between yum.conf and dnf.conf


author: Shubha Kulkarni <shubha.kulkarni@oracle.com> 1.0-1.0.25
changelog:
  - Remove anisble-core-2.13 versionlock since it is not needed with OLVM-4.5.5
  - Always disable gluster repo in ULN setup
  - Change Maven module from disable to reset
  - Add version lock for ansible-core - lock version 2.15*
  - Add exclusion for grafana packages coming from ol8_appstream


author: Shubha Kulkarni <shubha.kulkarni@oracle.com> 1.0-1.0.31
changelog:
  - The dnf update for slf4j fails due to dependency packages. So, excluding it.
  - Fix ansible-core exclusion


author: Rafael Barron <rafael.barron@oracle.com> - 2.3-1
changelog:
  - Release ol8_automation2.3
  - Add condition to don't change repo file when ol8_automation2.2 is enabled


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-11
changelog:
  - Added 8.2 base repository [Orabug: 31056571]
  - Revert patch for bug 31056604 to remove beta repositories


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-14
changelog:
  - Added 8.3 base repository [Orabug: 32002214]
  - Revert patch for bug 32002203 to remove beta repositories


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-26
changelog:
  - Enable UEKR7 repositories by default [ Orabug: 34662093].
  - Added developer preview repositories [ Orabug: 34662124]


author: Alex Burmashev <alexander.burmashev@oracle.com> 1.0-31
changelog:
  - Exclude unused leapp repository from repo files [Orabug: 35294364]
  - rebase aarch64 patch [Orabug: 35294364]


author: Alex Burmashev <alexander.burmashev@oracle.com> 1.0-32
changelog:
  - Added Oracle Linux 8.8 Repositories [Orabug: 35264178]
  - Removed Oracle Linux 8 developer preview repositories [OraBug: 35264178]


author: Alex Burmashev <alexander.burmashev@oracle.com> 1.0-34
changelog:
  - Added Oracle Linux 8.9 Repositories [Orabug: 35981244]
  - Removed Oracle Linux 8.9 Pre-GA [OraBug: 35981244]


author: Alex Burmashev <alexander.burmashev@oracle.com> 1.0-38
changelog:
  - Added Oracle Linux 8.10 repositories [Orabug: 36587464]
  - Removed Oracle Linux 8.10 Pre-GA repositories [OraBug: 36587464]


author: Neal Gompa <ngompa13@gmail.com> - 1.74-1
changelog:
  - Update to upstream version 1.74
  - Drop merged patches
  - Rediff remaining patches
  - Move newns to /usr/libexec/os-prober (debuginfo generation works)
  - Mark copyright file as license file


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Kai Engert <kaie@redhat.com> - 0.23.8-2
changelog:
  - Fix a regression caused by a recent nss.rpm change, add a %ghost file
    for %{_libdir}/libnssckbi.so that p11-kit-trust scripts install.


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Tomáš Mráz <tmraz@redhat.com> 1.3.1-5
changelog:
  - pam_faillock: Support configuration file /etc/security/faillock.conf
  - pam_faillock: Support local_users_only option
  - pam_namespace: Support noexec, nosuid and nodev flags for tmpfs mounts
  - Drop tallylog and pam_tally[2] documentation
  - pam_lastlog: Do not display failed attempts with PAM_SILENT flag
  - pam_lastlog: Support unlimited option to override fsize limit
  - pam_unix: Log if user authenticated without password
  - pam_tty_audit: Improve manual page
  - Optimize closing fds when spawning helpers
  - Fix duplicate password verification in pam_authtok_verify()


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-9
changelog:
  - pam_usertype: new module to tell if uid is in login.defs ranges (#1810474)
  - pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357)


author: Peter Robinson <pbrobinson@redhat.com> - 1.3.1-12
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them (#1847501)


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-13
changelog:
  - pam_wheel: if getlogin fails fallback to PAM_RUSER: fixed malformed patch (#1866866)
  - pam_namespace: polyinstantiation refer to gdm doc (#1861841)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25
changelog:
  - pam_motd: avoid unnecessary logging. Resolves: #2091062
  - pam_lastlog: check localtime_r() return value. Resolves: #2012871
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-33
changelog:
  - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS
    situations. CVE-2024-22365. Resolves: RHEL-21242


author: EL Errata <el-errata_ww@oracle.com> - 1.3.1-34.0.1
changelog:
  - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695]
  - pam_access: clean up the remote host matching code [Orabug: 36733488]


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-35
changelog:
  - pam_unix: always run the helper to obtain shadow password file entries.
    CVE-2024-10041. Resolves: RHEL-62877
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-23018
  - libpam: support long lines in service files. Resolves: RHEL-5051


author: Brian C. Lane <bcl@redhat.com> - 3.2-29
changelog:
  - Add support for NVDIMM devices (sparschauer)
  - libparted/labels: link with libiconv if needed (arnout)


author: Brian C. Lane <bcl@redhat.com> - 3.2-33
changelog:
  - Switch gpt-header-move and msdos-overlap to python3 (bcl)
    Resolves: rhbz#1595810
  - Modify gpt-header-move and msdos-overlap to work with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-34
changelog:
  - Fix the length of several strncpy calls (bcl)
    Related: rhbz#1602652
  - parted.c: Always free peek_word (bcl)
    Related: rhbz#1602652
  - parted.c: Make sure dev_name is freed (bcl)
    Related: rhbz#1602652
  - t6100-mdraid-partitions: Use v0.90 metadata for the test (bcl)
  - Fix msdos-overlap to work correctly with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-35
changelog:
  - Use python3-devel in buildroot
    Resolves: rhbz#1615576
  - linux.c: Use sys/sysmacros.h for major/minor
    Resolves: rhbz#1615592


author: Brian C. Lane <bcl@redhat.com> - 3.2-37
changelog:
  - Add CI tests
    Resolves: rhbz#1653912
  - t6000-dm: Stop using private lvm root
    Related: rhbz#1653912


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Gulam Mohamed <gulam.mohamed@oracle.com> - 3.2-39.0.2
changelog:
  - Fix race between systemd and parted command [Orabug: 36406368]
  - Add test to detect race between parted and systemd


author: Than Ngo <than@redhat.com> - 2.7.6-10
changelog:
  - CVE-2019-13636 , Don't follow symlinks unless --follow-symlinks is given
  - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Petr Pisar <ppisar@redhat.com> - 8.41-5
changelog:
  - Fix out-of-bounds read for partial matching of /./ against an empty string
    when the newline type is CRLF (upstream bug #2226)


author: Petr Pisar <ppisar@redhat.com> - 8.41-6
changelog:
  - Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
    starting offset (upstream bug #2244)


author: Petr Pisar <ppisar@redhat.com> - 8.42-2
changelog:
  - Fix handling UTF and start-of-pattern options in C++ wrapper
    (upstream bug #2283)
  - Fix an error message and locale handling in pcregrep tool


author: Petr Pisar <ppisar@redhat.com> - 8.42-3
changelog:
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256
    (bug #1619228)


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Petr Pisar <ppisar@redhat.com> - 10.31-3
changelog:
  - Add support to pcre2grep for binary zeros in -f files (upstream bug #2222)
  - Fix compiler warnings in pcre2grep


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Jarod Wilson <jarod@redhat.com> - 3.0-6
changelog:
  - Update to upstream 3.0-3.1.gb36a595 tarball for upstream fixes
  - Add in manpages
  - Related: rhbz#1365750
  - Resolves: rhbz#948476


author: Jarod Wilson <jarod@redhat.com> - 3.0-7
changelog:
  - Address a myriad more coverity/clang warnings
  - Add raw_ethernet_* man page symlinks
  - Related: rhbz#1273176
  - Related: rhbz#948476


author: Petr Pisar <ppisar@redhat.com> - 4:5.26.1-407
changelog:
  - Fix parsing braced subscript after parentheses (RT#8045)
  - Fix a heap use after free when moving a stack (RT#131954)
  - Call ldconfig scriptlets using a macro


author: Petr Pisar <ppisar@redhat.com> - 4:5.26.2-410
changelog:
  - 5.26.2 bump
  - Fix CVE-2018-6913 (heap buffer overflow in pp_pack.c) (bug #1567776)
  - Fix CVE-2018-6798 (heap read overflow in regexec.c) (bug #1567777)
  - Fix CVE-2018-6797 (heap write overflow in regcomp.c) (bug #1567778)


author: Petr Pisar <ppisar@redhat.com> - 4:5.26.2-412
changelog:
  - perl-devel requires redhat-rpm-config because of hardened compiler profiles
    (bug #1557667)
  - Do not clobber file bytes in :encoding layer (RT#132833)
  - Fix line numbers in multi-line s/// (RT#131930)
  - Fix parsing extended bracketed character classes (RT#132167)
  - Fix a possibly unitialized memory read in the Perl parser (RT#133074)
  - Fix an infinite loop in the regular expression compiler (RT#133185)


author: Petr Pisar <ppisar@redhat.com> - 4:5.26.2-413
changelog:
  - Adjust tests to gdbm-1.15 (RT#133295)
  - Fix an integer wrap when allocating memory for an environment variable
    (RT#133204)
  - Fix printing a warning about a wide character when matching a regular
    expression while ISO-8859-1 locale is in effect
  - Fix invoking a check for wide characters while ISO-8859-1 locale is in effect


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Paul Howarth <paul@city-fan.org> - 1.1903-1
changelog:
  - Update to 1.1903
    - Fix documentation typos (CPAN RT#84981)
    - Add -w and -i switches to diffnew.pl (CPAN RT#69945)
    - Remove Algorithm::DiffOld from the index; the module is still distributed
      with Algorithm::Diff, but is not indexed on CPAN because this is an
      ***UNAUTHORIZED*** release of Algorithm::DiffOld
  - Add patch to generate provide for perl(Algorithm::DiffOld)
  - Drop %defattr, redundant since rpm 4.4
  - General spec tidy-up


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.54-6
changelog:
  - Adjust to sqlite-3.22.0 (bug #1543286)
  - Add new index constraint ops introduced in SQLite 3.21.0 to PerlData


author: Jan Pazdziora <jpazdziora@redhat.com> - 6.56-1
changelog:
  - 1372494 - Rebase to upstream version 6.56.
  - 1372494 - Rebase to upstream version 6.55, build failed due to
    https://rt.cpan.org/Public/Bug/Display.html?id=117404.


author: Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
changelog:
  - Replace versioned MODULE_COMPAT by non-versioned perl-libs
  - Package tests
  - Resolves: rhbz#2219504


author: Petr Pisar <ppisar@redhat.com> - 2.12-367
changelog:
  - Fix CVE-2017-6512 (setting arbitrary mode on an arbitrary file in rmtree()
    and remove_tree()) (bug #1457834)


author: Paul Howarth <paul@city-fan.org> - 2.059-1
changelog:
  - Update to 2.059 (bug #1610017)
    - Fix memory leak when CRLs are used (CPAN RT#125867)
    - Fix memory leak when using stop_SSL and threads
      (https://rt.cpan.org/Ticket/Display.html?id=125867#txn-1797132)


author: Petr Pisar <ppisar@redhat.com> - 2.059-2
changelog:
  - Adapt to OpenSSL 1.1.1, it requires patched Net-SSLeay (bug #1610017)
  - Enable tests (bug #1610017)


author: Paul Howarth <paul@city-fan.org> - 2.060-1
changelog:
  - Update to 2.060 (bug #1610017)
    - Support for TLS 1.3 with OpenSSL 1.1.1 (needs Net::SSLeay ≥ 1.86); see
      also CPAN RT#126899
    - TLS 1.3 support is not complete yet for session reuse


author: Petr Pisar <ppisar@redhat.com> - 2.060-3
changelog:
  - Client sends a post-handshake-authentication extension if a client key and
    a certificate are available (bug #1633636)


author: Paul Howarth <paul@city-fan.org> - 1.84-1
changelog:
  - Update to 1.84
    - Fixed an error in t/local/04_basic.t causing a test failure if
      Test::Exception not installed


author: Paul Howarth <paul@city-fan.org> - 1.85-1
changelog:
  - Update to 1.85
    - Preparations for transferring maintenace to a new maintainer
    - Fixed test failure in t/local/33_x509_create_cert.t for some versions of
      OpenSSL
    - Fixed free() error that causes "Free to wrong pool ..." message on Windows


author: Petr Pisar <ppisar@redhat.com> - 1.85-3
changelog:
  - Adapt to OpenSSL 1.1.1 (bug #1610376)
  - Adapt tests to system-wide crypto policy (bug #1610376)
  - Adapt tests to security level 2 system-wide crypt policy (bug #1610376)


author: Petr Pisar <ppisar@redhat.com> - 1.85-5
changelog:
  - Revert retry in Net::SSLeay::{read,write}() (bug #1610376)
  - Revert retry in Net::SSLeay::write_partial() (bug #1610376)


author: Petr Pisar <ppisar@redhat.com> - 3.28-2
changelog:
  - Introduce a build-condition on groff
  - Rename a _without_tk build-condition to
    _without_perl_Pod_Perldoc_enables_tk_test


author: Paul Howarth <paul@city-fan.org> - 1.71-5
changelog:
  - Soften Business::ISBN dependency from Requires: to Suggests: to avoid
    pulling in gd and X libraries (#1380152)


author: Petr Pisar <ppisar@redhat.com> - 3.10-2
changelog:
  - Net::libnetFAQ document replaced with a hyper link because of the Artistic
    license (CPAN RT#117888)


author: Paul Howarth <paul@city-fan.org> - 1:0.236-1
changelog:
  - Update to 0.236
    - Add Travis test configuration
    - Make test for PMC availability more reliable
    - Disable benchmark test rt62341.t as it runs out of memory on many smoker
      systems (CPAN RT#118310)
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1:0.237-1
changelog:
  - Update to 0.237
    - Don't load vars.pm (CPAN RT#132077)
  - Drop legacy Group: tag
  - Drop buildroot cleaning in %install section


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.7-1
changelog:
  - Update to 3.6.7 (rhbz#1627739)
  - Re-enable test_gdb (rhbz#1639536)
  - Re-enable test_faulthandler (rhbz#1640147)


author: Tomas Orsava <torsava@redhat.com> - 3.6.7-2
changelog:
  - Switch to requiring platform-python-pip/setuptools instead of the python3-
    versions
  - Resolves: rhbz#1638836


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.8-9
changelog:
  - Reduced default build flags used to build extension modules
    https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
  Resolves: rhbz#1634784


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.8-12
changelog:
  - Use RPM built wheels of pip and setuptools in ensurepip instead of our rewheel patch
  - Require platform-python-setuptools from platform-python-devel to prevent packaging errors
  Resolves: rhbz#1701286


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-13
changelog:
  - Do not set PHA verify flag on client side (rhbz#1725721)
  - Enable TLS 1.3 post-handshake authentication in http.client (rhbz#1671353)


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-14
changelog:
  - Adding a new patch 329 that adds support for OpenSSL FIPS mode
  - Explicitly listing man pages in files section to fix an RPM warning
  Resolves: rhbz#1731424


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-15
changelog:
  - Patch 329 that adds support for OpenSSL FIPS mode has been improved and
    bugfixed
  Resolves: rhbz#1744670 rhbz#1745499 rhbz#1745685


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-15.1
changelog:
  - Patch 329 (FIPS) modified: Added workaround for mod_ssl:
    Skip error checking in _Py_hashlib_fips_error
  Resolves: rhbz#1760106


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-16
changelog:
  - Properly pass the -Og optimization flag to the debug build
  Resolves: rhbz#1712977 and rhbz#1714733


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Reduce the number of tests running during the profile guided optimizations build
  - Enable profile guided optimizations for all the supported architectures
  Resolves: rhbz#1749576


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Skip windows specific test_get_exe_bytes test case and enable test_distutils
  Resolves: rhbz#1754040


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-22
changelog:
  - Changed Requires into Recommends for python3-pip to allow a lower RHEL8
    footprint for containers and other minimal environments
  Resolves: rhbz#1756217


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-23
changelog:
  - Modify the test suite to better handle disabled SSL/TLS versions and FIPS mode
  - Use OpenSSL's DRBG and disable os.getrandom() function in FIPS mode
  Resolves: rhbz#1754028, rhbz#1754027, rhbz#1754026, rhbz#1774471


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-24
changelog:
  - Build Python with -fno-semantic-interposition for better performance
  - https://fedoraproject.org/wiki/Changes/PythonNoSemanticInterpositionSpeedup
  - Also fix test_gdb failures with Link Time Optimizations
  Resolves: rhbz#1724996


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-26
changelog:
  - Skip test_startup_imports from test_site if we have a .pth file in sys.path
  Resolves: rhbz#1814392


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-27
changelog:
  - Add a sentinel value on the Hmac_members table of the fips compliant hmac module
  Resolves: rhbz#1800512


author: Victor Stinner <vstinner@python.org> - 3.6.8-30
changelog:
  - Remove downstream 00178-dont-duplicate-flags-in-sysconfig.patch which
    introduced a bug on distutils.sysconfig.get_config_var('LIBPL')
    (rhbz#1851090).


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-31
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-32
changelog:
  - Security fix for CVE-2020-26116: Reject control chars in HTTP method in http.client
  Resolves: rhbz#1883257


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-33
changelog:
  - Add support for upstream architecture names
  https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
  Resolves: rhbz#1868003


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-34
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1890237


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-39
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Victor Stinner <vstinner@redhat.com> - 3.6.8-39
changelog:
  - Fix reentrant call to threading.enumerate() (rhbz#1959459)
  - Don't exit Python with abort() when a thread exit and there is no available
    file descriptor to load dynamically the libgcc_s.so.1 library (rhbz#1972293)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-43
changelog:
  - Change shouldRollover() methods of logging.handlers to only rollover regular files
  Resolves: rhbz#2009200


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-48.1
changelog:
  - Security fixes for CVE-2020-10735, CVE-2021-28861 and CVE-2022-45061
  Resolves: rhbz#1834423, rhbz#2120642, rhbz#2144072


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: Darren Archibald <darren.archibald@oracle.com> - 3.6.8-56.2
changelog:
  - Security fix for CVE-2022-48560
  Resolves: rhbz#2249755
  - Security fix for CVE-2022-48564
  Resolves: rhbz#2249750


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-58
changelog:
  - Security fix for CVE-2022-48564
  Resolves: RHEL-16674
  - Skip tests failing on s390x
  Resolves: RHEL-19252


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-70
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98030, RHEL-97987, RHEL-98232, RHEL-98065, RHEL-98189


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-5
changelog:
  - Split part of the python3-pip package into platform-python-pip
  - python3-pip will only contain binaries in /usr/bin
  - Resolves: rhbz#1638836


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - python3-pip requires python36 and obsoletes previous version
    where python3- and platform-python- were in one package
  - Resolves: rhbz#1638836


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-10
changelog:
  - Bump the NVR so it's higher than previous builds of python3-pip that have
    mistakenly gotten into the python27 module build when we were dealing with an
    MBS filtering problem. See BZ#1650568.
  - Resolves: rhbz#1638836


author: Victor Stinner <vstinner@redhat.com> - 9.0.3-11
changelog:
  - Prevent removing of the system packages installed under /usr/lib
    when pip install -U is executed. Patch by Michal Cyprian.
    Resolves: rhbz#1626408.


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-13
changelog:
  - Use the system level root certificate instead of the one bundled in certifi
  - Resolves: rhbz#1655255


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  Resolves: rhbz#1962856


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-15
changelog:
  - chcat: use check_call instead of getstatusoutput
  - semanage: Use standard argparse.error() method
  - semanage: Fix handling of -a/-e/-d/-r options


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-16.1
changelog:
  - semanage: move valid_types initialisations to class constructors
  - semanage: import sepolicy only when it's needed
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: Start exporting "ibendport" and "ibpkey" entries


author: Livy Ge <livy.ge@oracle.com> - 2.8-16.1.0.1
changelog:
  - python/semanage: Load a store policy and set the store SELinux policy root [Orabug: 29494757]
  - python/sepolicy: Make policy files sorting more robust [Orabug: 29494757]
  - Lazy unmount private, shared entry (Joe Jin) [OraBug: 12560705]


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-10
changelog:
  - python/semanage: Sort imports in alphabetical order
  - python/semanage: empty stdout before exiting on BrokenPipeError (#1822100)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-19
changelog:
  - semodule: move module hashing into libsemanage (requires libsemanage-2.9-7)
  - semodule: add command-line option to detect module changes (#2049189)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-20
changelog:
  - python: Split "semanage import" into two transactions (#2063353)
  - semodule: rename --rebuild-if-modules-changed to --refresh (#2089802)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: EL Errata <el-errata_ww@oracle.com> - 2.9-20.0.1
changelog:
  - Fixed issue sepolicy generate command does not create the .spec file [Orabug: 34124962]
  - Lazy unmount private, shared entry (Joe Jin) [OraBug: 12560705]


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-21.1
changelog:
  - python: Harden tools against "rogue" modules (#2128976)
  - Update "pathfix" arguments to match ^^^ (#2128976)
  - python: Do not query the local database if the fcontext is non-local (#2124825)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-25
changelog:
  - Harden more tools against "rogue" modules (RHEL-17351)
  - sepolicy: port to dnf4 python API (RHEL-17398)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-26
changelog:
  - python/semanage: Allow modifying records on "add" (RHEL-28167)
  - python/semanage: Do not sort local fcontext definitions (RHEL-24461)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-4
changelog:
  - semanage: Do not use default s0 range in "semanage login -a" (#1554360)
  - gui: Fix remove module in system-config-selinux (#1748763)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-5
changelog:
  - fixfiles: Fix "verify" option (#1647532)
  - semanage: Improve handling of "permissive" statements (#1417455)
  - semanage: fix moduleRecords.customized()
  - semanage: Add support for DCCP and SCTP protocols (#1563742)


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Jan Rybar <jrybar@redhat.com> - 0.115-15.1
changelog:
  - reduce waking session monitor on uninteresting session changes
  - make polkit-pkla-compat uninstallable (for cases when no .pkla on system)
  - Resolves: RHEL-34029


author: Jan Rybar <jrybar@redhat.com> - 0.115-2
changelog:
  - Error message about getting authority is too elaborate (forward of #1342855)
  - Bus disconnection report moved to debug mode (forward of #1249627)


author: Panu Matilainen <pmatilai@redhat.com> - 1.18-1
changelog:
  - Rebase to popt 1.18 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.18-release)
  - Update URLs to rebooted upstream
  - Clean up ancient cruft from spec, use modern build macros


author: Michal Ruprich <mruprich@redhat.com> - 0.0.5-20
changelog:
  - RHEL-2863 - Creating tmp files for systemd on behalf of portreserve references legacy directory /var/run/ instead of /run


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.3.1-10
changelog:
  - Release bump and rebuild for relengs to be able to ship postfix-pcre,
    postfix-cdb, postfix-sqlite
    Resolves: rhbz#1745321


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.3.1-1
changelog:
  - New version
    Resolves: rhbz#1548222
  - Updated libnsl2 library and header paths
    Resolves: rhbz#1543928
  - Updated license for dual licensing


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Tomas Korbar <tkorbar@redhat.com> - 2:3.5.8-5
changelog:
  - Backport dns SRV record resolution feature (RFC6186)
    Resolves: rhbz#1787010
  - Fix building in ZUUL CI
    Resolves: rhbz#2196577


author: Michal Sekletár <msekleta@redhat.com> - 0.1.0-5
changelog:
  - if interface has name in expected format print it to stdout (#1643515)
  - don't assign names to virtual devices (#1644294)


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-5
changelog:
  - version bump due to unspotted malformed backport patch
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-8
changelog:
  - vmstat: added -y option to omit first report
  - Resolves: rhbz#2027350
  - sysctl: backport config directory order, align with systemd
  - Resolves: rhbz#2111915


author: Kaylin Devchand <kaylin.devchand@oracle.com> - 3.3.15-13.0.2
changelog:
  - ps: remove uptime integer conversion [Orabug: 35909165]
  - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35909165]


author: Stephen Brennan <stephen.s.brennan@oracle.com> - 3.3.15-14.0.1
changelog:
  - ps: remove uptime integer conversion [Orabug: 35909165]
  - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35909165]
  - Set TZ to avoid repeated stat("/etc/localtime") [Orabug: 32769816]


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-3
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: align manpage with procfs wording
  - watch: manpage presumes NTP on system
  - Resolves: rhbz#1827731
  - Resolves: rhbz#1829920
  - Resolves: rhbz#1583669


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-4
changelog:
  - pidof: new option to show kernel worker threads
  - pidof: empty input causes to show kernel worker threads
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640
  -


author: Jan Rybar <jrybar@redhat.com> - 6.6.3-2
changelog:
  - lastcomm: added new --pid option to show process PID and PPID
  - changelog update: 6.6.3-1 author change
  - spec file update: added correct access mode to created /var/account/pacct


author: Jan Rybar <jrybar@redhat.com> - 23.1
changelog:
  - Rebase to the newest upstream official release
  - Source0 updated to latest functional SourceForge URL format
  - peekfd manpage now not present if peekfd binary missing on given architecture
  - URL of the project updated
  - new tool pslog added with rebase
  - Resolves: #1460695


author: Ray Strode <rstrode@redhat.com> - 3.28.3-2
changelog:
  - Add lock to avoid two type object wrappers getting generated at
    the same time in multi-threaded programs.
    Resolves: #1844578


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Christian Heimes <cheimes@redhat.com> - 2.2.1-2
changelog:
  - Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1589754
  - Remove unnecessary copy and shebang mangling


author: Christian Heimes <cheimes@redhat.com> - 2.3-1
changelog:
  - New upstream release 2.3
  - Fix AEAD tag truncation bug, CVE-2018-10903, RHBZ#1602755, RHBZ#1602932


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12.2-9
changelog:
  - Python 2 binary package renamed to python2-dmidecode
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 0.13-1
changelog:
  - Updated to 0.13
  - Added python3 and python2 subpackages
  - Add --with tests
  - Modernize spec
  - Remove merged patch
  - Update upstream URL


author: Lumír Balhar <lbalhar@redhat.com> - 0.14-3
changelog:
  - Backport patch from upstream/rhel7 which allows pifconfig to show
    multiple IPv4 addresses for each interface
  - Move patches to dist-git
  - Resolves: rhbz#1652174


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.9-16
changelog:
  - Python 2 binary package renamed to python2-kmod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: John Kacur <jkacur@redhat.com> - 0.6.2-1
changelog:
  - Add bitmasklist_test
  - Clean-ups including using a more modern python spacing, tabbing, etc
  - Fix to parse number of cpus correctly on s390(x)
  Resolves: rhbz#1849215


author: John Kacur <jkacur@redhat.com> - 0.6.3-4
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2016204


author: John Kacur <jkacur@redhat.com> - 0.7.3-1
changelog:
  - Rebase to upstream python-linux-procfs-0.7.3
  - This rebase removes upstream spec files and
  - syncs the git tag with version
  Resolves: RHEL-9195


author: John Dennis <jdennis@redhat.com> - 2.0.1-1
changelog:
  - Upgrade to upstream 2.0.1
  - port from jwt to jwcrypto (conditional build)
  - bring into alignment with rhel spec file


author: mulhern <amulhern@redhat.com> - 0.19.0
changelog:
  - Never raise a DeviceNotFoundError when iterating over a device enumeration
  - Device.subsystem() now returns None if device has no subsystem
  - Add DeprecationWarnings to deprecated Device methods
  - Replace "/" with "!" in Device.from_name() sys_name parameter
  - Add some unstable classes for parsing some kinds of values
  - Make version info more like Python's including micro numbers and levels
  - Refactor some internal modules into subdirectories
  - Work on tests and reproducers


author: mulhern <amulhern@redhat.com> - 0.20.0
changelog:
  - Remove parsing code added in previous release
  - No longer do CI for Python 2.6
  - Eliminate all wildcard imports and __all__ statements
  - No longer use deprecated Device.from_sys_path() method
  - Minor pylint induced changes
  - Documentation fixes


author: mulhern <amulhern@redhat.com> - 0.21.1
changelog:
  - Deprecate use of Device object as mapping from udev property names to values
  - Add a Properties class and a Device.properties() method for udev properties
  - Fix places where Device object was incorrectly used in a boolean context
  - Return an empty string, not None, if the property value is an empty string
  - Exceptions re-raised from libudev calls now have a message string
  - Insert a warning about using a Device in a boolean context in docs
  - Infrastructure for vagrant tests is removed
  - Various internal refactorings
  - Extensive test improvements
  - Numerous documentation fixes


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Lumír Balhar <lbalhar@redhat.com> - 2.20.0-4
changelog:
  - Bump release to fix upgrade path
    from 2.20.0-2.1.el8_1 via 2.20.0-3.el8_8 to 2.20.0-4.el8
  Related: rhbz#2209469


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb67-4
changelog:
  - epydoc is used only with python2 but the latter is not supported in RHEL8
    I remove the dependency


author: EL Errata <el-errata_ww@oracle.com> - 2.1.71-4.0.1.el8
changelog:
  - Corrected changelog entry.
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]
  - Add patch 0014-reenable-vhost to fix [Orabug: 27707403] <alan.adamson@oracle.com>


author: Alan Steinberg <alan.steinberg@oracle.com> - 2.1.73-2.0.1
changelog:
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]
  - Add patch 0014-reenable-vhost to fix [Orabug: 27707403] <alan.adamson@oracle.com>


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 2.1.75-4.0.1
changelog:
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]
  - Add patch 0014-reenable-vhost to fix [Orabug: 27707403] (alan.adamson@oracle.com)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-5
changelog:
  - Python 2 binary package renamed to python2-schedutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-8
changelog:
  - Python 2 binary package renamed to python2-slip
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-10
changelog:
  - Also rename python-slip-dbus and python-slip-gtk to python2-*
  - Add missing %python_provide macros
  - Use new python2- names in dependencies


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6.4-12
changelog:
  - Make firewalld to not log errors when running commands as root
    in the absence of polkitd.
  Resolves: rhbz#2076606


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.22-9
changelog:
  - Do not lowercase hostnames with custom-protocol (rhbz 1567862)
  - upstream: https://github.com/urllib3/urllib3/issues/1267


author: Tomas Orsava <torsava@redhat.com> - 1.24.2-1
changelog:
  - Rebased to 1.24.2 to fix CVE-2019-11324
  - Added patches for CVE-2019-11236 (AKA CVE-2019-9740)
  - Resolves: rhbz#1703361 rhbz#1706026


author: Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
changelog:
  - Enable TLS 1.3 post-handshake authentication
  - Adjust RECENT_DATE variable according to rules
  Resolves: rhbz#1726743


author: Darren Archibald <darren.archibald@oracle.com> - 1.24.2-5.2
changelog:
  - Security fix for CVE-2023-45803
  Resolves: rhbz#2246840
  - Security fix for CVE-2023-43804
  Resolves: rhbz#2242493


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3.0-11
changelog:
  - Python 2 binary package renamed to python2-urwid
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David Cantrell <dcantrell@redhat.com> - 1.3.1-2
changelog:
  - Apply upstream fix for EINTR handling in test_vterm test case
  - Apply upstream fix for test_remove_watch_file flakiness
  - Apply upstream fix for test_vterm handling of NUL characters


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.10.0-3
changelog:
  - Python 2 binary package renamed to python2-pywbem
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tony Asleson <tasleson@redhat.com> - 0.11.0-8
changelog:
  - Fix the conflict with sblim-wbemcli: RHBZ #1757855
  - Corrected warning about multiple file inclusion


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-1
changelog:
  - Buildrequire audit-libs-devel to actually enable the feature (#1607612)
  - Update to rpm 4.14.2 final (http://rpm.org/wiki/Releases/4.14.2)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-7
changelog:
  - Move python-macro-helper to main package where the macros are (#1651926)
  - Document --noverify in the man page (#1646458)
  - Handle unsupported digests the same as disabled ones (#1652529)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-16
changelog:
  - Sort list of hard linked files in find-debuginfo.sh (#1421272)
  - Correct rpm -ql exit value when optional -p is omitted (#1680610)
  - Show list of files only once when use rpm -ql and multiple rpm files (#1689898)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-23
changelog:
  - Use --dpbath only with full path (#1696408)
  - Fix memory leaks (#1714657)
  - Remove capabilities instead of setting empty caps via. --setcaps (#1700920)
  - Fix bash warning from solution for #1689810


author: Florian Festi <ffesti@redhat.com> - 4.14.2-31
changelog:
  - Parallelize /usr/lib/rpm/brp-strip-static-archive (#1691824)
  - Parallelize /usr/lib/rpm/check-buildroot (#1704354)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-0.rc2.1
changelog:
  - Update to rpm 4.14.2-rc2
  - Fixes a regression in rpmlog error handling (#1597274)
  - Fixes several resource leaks found by covscan (#1602681)
  - Fixes DISTTAG not getting copied to source rpms (#1596193)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-28
changelog:
  - Backport file handling code from rpm-4.19 to fix CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939


author: Alex Burmashev <alexander.burmashev@oracle.com> - 4.14.3-28.0.2
changelog:
  - Import additional patches to fix regressions with CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939 patchset [Orabug: 36256318]


author: Darren Archibald <darren.archibald@oracle.com> - 4.14.3-31.0.1
changelog:
  - Import additional patches to fix regressions with CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939 patchset [Orabug: 36256318]
  - Fixed infinte loop for db_create with error check [Orabug: 36202920]


author: Sourav Sharma <sourav.ss.sharma@oracle.com> - 4.14.3-31.0.2
changelog:
  - Fixes RPM crash while installing/cleaning same package [Orabug: 36653282]
  - Add TR_RPMDB element type for representing packages from the rpmdb
  - Use an erase element to delete packages with same NEVRA
  - Legalize proper reinstall within transaction
  - Refactor pre-flight checks for added packages to helper function
  - Add a pre-flight check for removed packages too


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-32
changelog:
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63069)
  - Fix IMA signature lengths assumed constant (RHEL-39896)
  - Fix root relocation regression (RHEL-49494)
  - Report unsafe symlinks during installation as a specific case (RHEL-39897)
  - Don't segfault on missing priority tag (RHEL-39894)


author: EL Errata <el-errata_ww@oracle.com> - 4.14.3-32.0.1
changelog:
  - Reverting patches 1005,1006,1007,1008 and 1009 due to erase
  - failed issue    [Orabug: 37044807]
  - Fixes RPM crash while installing/cleaning same package [Orabug: 36653282]
  - Add TR_RPMDB element type for representing packages from the rpmdb
  - Use an erase element to delete packages with same NEVRA
  - Legalize proper reinstall within transaction
  - Refactor pre-flight checks for added packages to helper function
  - Add a pre-flight check for removed packages too
  - Import additional patches to fix regressions with CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939 patchset [Orabug: 36256318]
  - Fixed infinte loop for db_create with error check [Orabug: 36202920]


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
changelog:
  - Disable/remove neverallow options in frontends (#2184141)
  - AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)


author: Petr Pisar <ppisar@redhat.com> - 1:4.04-3
changelog:
  - rpcgen tool split from glibc-common package
  - Pass TIRPC header files location to all RPC compilation units
  - Do not iterate over negative UIDs in repquota
  - Fix mistakes in warnquota reported by GCC 8


author: Petr Pisar <ppisar@redhat.com> - 1:4.04-4
changelog:
  - Avoid questions in quotacheck non-interactive mode
  - Report an error when quotacheck fails to cache quota files
  - Report an error if quota file magic is invalid


author: Aristeu Rozanski <aris@redhat.com> 0.6.1-9
changelog:
  - Prevent ras-mc-ctl trying to access extlog and mce tables if rasdaemon was built without support for them [2011404]


author: William Roche <william.roche@oracle.com> 0.6.1-13.0.1
changelog:
  - ipmitool to be used with AER on Ampere Altra platforms [Orabug: 33536155]
  - Add error handling for Ampere-specific errors. [Orabug: 33536155]
  - Add code to decode Ampere specific error
  - rasdaemon: fix memory leak in parse_ras_data
  - rasdaemon: Fix error print
  - rasdaemon: Modify non-standard error decoding interface using linked list
  - rasdaemon: add closure and cleanups for the database
  - rasdaemon: fix error handling in ras_mc_event_opendb()
  - rasdaemon: fix cleanup issues in ras-events.c:read_ras_event_all_cpus()
  - rasdaemon: fix memory leak in ras-events.c:add_event_handler()
  - rasdaemon: fix missing fclose in ras-events.c:select_tracing_timestamp()
  - rasdaemon: update iteration logic for the non-standard error decoding functions
  - rasdaemon: rearrange HiSilicon HIP07 decoding function table
  - parse_ras_data: flush trace buffer immediately, not on next call
  - rasdaemon:print non-standard error data if not decoded
  - libtrace: Fix get_field_str() for dynamic strings
  - mce-amd-k8: be sure to not go past error_msg buffer
  - rasdaemon: use separate string array for error status
  - rasdaemon: fix PCIe AER error type


author: René Genz <liebundartig@freenet.de> - 0.16.3-12
changelog:
  - use correct authselect syntax for *-disable-logins to fix rhbz#1558245
  - Iryna Shcherbina <ishcherb@redhat.com>
    Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Sumit Bose <sbose@redhat.com> - 0.16.3-13
changelog:
  - Add latests patches from RHEL7
  - Add polkit runtime dependency
    Resolves: rhbz#1577179
  - Drop python2 build dependency
    Resolves: rhbz#1595813
  - Fix documentation reference in systemd unit file
    Resolves: rhbz#1596325


author: Sumit Bose <sbose@redhat.com> - 0.16.3-14
changelog:
  - Fix python BuildRequires
    Resolves: rhbz#1615564
  - Add RHEL specific patch for IPA
    Resolves: rhbz#1615320
  - Fix issues found by Coverity
    Resolves: rhbz#1602677


author: Sumit Bose <sbose@redhat.com> - 0.16.3-17
changelog:
  - rebuild fails if DISTRO variable is exported
    Resolves: rhbz#1747454
  - realmd.conf user-principal RFE and clarification
    Resolves: rhbz#1747452
  - realmd.conf documentation incorrect
    Resolves: rhbz#1747457
  - Document realmd.conf and how realmd reads the configuration
    Resolves: rhbz#1747456


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Sumit Bose <sbose@redhat.com> - 0.16.3-24
changelog:
  - Avoid duplicated log messages and use Samba's new CLI options
    Resolves: rhbz#2024248
    Resolves: rhbz#2028528


author: Sumit Bose <sbose@redhat.com> - 0.17.1-2
changelog:
  - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - migrated to SPDX license
  - allow multiple names and _srv_ ad_server option
    Resolves: RHEL-12113
  - fix ccache handling for leave operation
    Resolves: RHEL-26166


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 8-7.0.1
changelog:
  - Replaced the reference from the redhat icon to the oracle linux icon [Orabug: 18272222]
  - Replace redhat references in index.html
  - Updated index.html for en-US (Avi Miller)


author: Livy Ge <livy.ge@oracle.com> - 8.0-0.44.0.1.el8
changelog:
  - Remove package eula
  - Remove Provides: system-release as this is provided by orclelinux-release.
  - Set the epoch to prevent upgrade conflict with OL7 version [Orabug: 20681742]
  - Remove content provided by oraclelinux-release package


author: Alan Steinberg <alan.steinberg@oracle.com> - 8.1-3.3.0.1.el8
changelog:
  - Remove package eula
  - Remove Provides: system-release as this is provided by oraclelinux-release.
  - Set the epoch to prevent upgrade conflict with OL7 version [Orabug: 20681742]
  - Remove content provided by oraclelinux-release package


author: Darren Archibald <darren.archibald@oracle.com> - 8.9-0.1.0.1
changelog:
  - Remove Provides: base-module platform as this is provided by oraclelinux-release [Orabug: 33754707]
  - Remove package eula
  - Remove Provides: system-release as this is provided by oraclelinux-release.
  - Set the epoch to prevent upgrade conflict with OL7 version [Orabug: 20681742]
  - Remove content provided by oraclelinux-release package


author: Josh Boyer <jwboyer@redhat.com> - 8.2-0.8.el8
changelog:
  - Allow stateless system usage of os-release (RhBug: 1766754)
  - Based on a contribution from Neal Gompa


author: Leon Kang <lekang@redhat.com> - 8.2-0.9.el8
changelog:
  - enable nvmefc-boot-connections.service in
    /usr/lib/systemd/system-preset/90-default.preset
  - Resolves: RCM-77224


author: David Sloboda <david.x.sloboda@oracle.com> - 8.5-0.8.0.2.el8
changelog:
  - Remove Provides: base-module platform as this is provided by oraclelinux-release [Orabug: 33754707]


author: Neil Horman <nhorman@redhat.com> - 6.8-2
changelog:
  - Fix erroneous message due to bad errno check (bz 1776710)
  - Enable addition of 0 value for fill-watermark (bz 1776710)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Vladis Dronov <vdronov@redhat.com> - 6.14-4.git.b2b7934e
changelog:
  - Update rng-tools to v6.14 @ b2b7934e (bz 2015570)
  - Update jitterentropy library to v3.3.1 @ 887c9871
  - Add a config file for storing rngd options
  - Fix a security issue found by a covscan in jitterentropy library


author: Vladis Dronov <vdronov@redhat.com> - 6.14-5.git.b2b7934e
changelog:
  - Fix udevadm issues on systems lacking it (bz 2057030)
  - Fix a missing working directory issue (bz 2053160)
  - Add some upstream patches


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update rng-tools to v6.15 @ 172bf0e3 (bz 2075974)
  - Update jitterentropy library to v3.4.0 @ 887c9871
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update rng-tools to v6.15 @ 6dcc9ec2 (bz 2124602)
  - Update jitterentropy library to v3.4.1 @ 4544e113
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update rng-tools to v6.15 @ cb8cc624 (bz 2141379)
  - Update jitterentropy library to v3.4.1 @ 7bf9f85d
  - Fix a stack corruption on s390x
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update rng-tools to v6.16 @ 0e560296 (bz 2174908)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Ondrej Vasik <ovasik@redhat.com> 0.1-13
changelog:
  - copy content of /etc/skel directory for root as posstrans,
    don't overwrite  existing files (#999114)


author: Steve Dickson <steved@redhat.com> - 1.2.5-1
changelog:
  - Fixed stack buffer overflow in rpcinfo (bz 1637565)
  - Make sure /var/lib/rpcbind exists (bz 1628901)


author: Nils Philippsen <nils@redhat.com> - 0.2.4-8.rc2
changelog:
  - create and formally own the state directory so it is available from the time
    of first installation until reboot


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-20
changelog:
  - Resolves: RHEL-70207 - Path traversal vulnerability in rsync
  - Resolves: RHEL-70209 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-72502 - Race Condition in rsync Handling Symbolic Links
  - Resolves: RHEL-70157 - Info Leak via Uninitialized Stack Contents


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.5.0-4
changelog:
  - Python 2 binary package renamed to python2-sanlock
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Petr Stodulka <pstodulk@redhat.com> - 4.2.2-14
changelog:
  - remove meaningless redefinition of _bindir - it's standard macro now;
    sed will be store in /usr/bin/sed
    Resovles: #1305835


author: Jakub Martisko <jamartis@redhat.com> - 4.4-4
changelog:
  - When editing file inplace, the SELinux context should
    be based on the link instead of the target file itself.
    --follow-symlinks option remains unchanged
  - Resolves: #1401442


author: Jakub Martisko <jamartis@redhat.com> - 4.5-2
changelog:
  - fix "in-place edits on FUSE filesystems create files with all-zero mode bits"
  - Resolves: #1835761


author: Jakub Martisko <jamartis@redhat.com> - 4.5-5
changelog:
  - Minor cleanup - remove unused patch from the spec file too (related to 4.5-3)
  - Resolves: rhbz#1869253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-54
changelog:
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-55
changelog:
  - Fix broken config files because of missing level specification in user_t contexts
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-56
changelog:
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Add dac_override capability for ipa_helper_t
  Resolves: rhbz#1668168
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861
  - Allow opafm_t domain to manage kdump_crash_t files and dirs
  Resolves: rhbz#1627861
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-57
changelog:
  - Allow read network state of system for processes labeled as ibacm_t
  Resolves: rhbz#1635674
  - Allow ibacm_t domain to send dgram sockets to kernel processes
  Resolves: rhbz#1635674
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-58
changelog:
  - Allow ibacm_t domain to read system state and label all ibacm sockets and symlinks as ibacm_var_run_t in /var/run
  Resolves: rhbz#1635674
  - Update mount_read_pid_files macro to allow also list mount_var_run_t dirs
  Resolves: rhbz#1664448
  - Allow userdomain to stop systemd user session during logout.
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-60
changelog:
  - Update kdump_manage_crash() interface to allow also manage dirs by caller domain
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-61
changelog:
  - Add dac_override capability for sbd_t SELinux domain
  Resolves: rhbz#1677325
  - Allow syslogd_t domain to send null signal to all domains on system
  Resolves: rhbz#1676923


author: Jingdong Lu <jingdong.lu@oracle.com> - 3.14.1-61.0.1.1
changelog:
  - Allow init_t to relabel all lock files [Orabug: 29846265] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Edward Leung <edward.leung@oracle.com> - 3.14.1-61.0.1
changelog:
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-100
changelog:
  - Update logging_create_generic_logs() to use create_files_pattern()
  Resolves: rhbz#2081907
  - Add the auth_read_passwd_file() interface
  Resolves: rhbz#2083504
  - Allow auditd_t noatsecure for a transition to audisp_remote_t
  Resolves: rhbz#2081907
  - Add support for samba-dcerpcd
  Resolves: rhbz#2083504
  - Allow rhsmcertd create generic log files
  Resolves: rhbz#1852086
  - Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
  Resolves: rhbz#2090800


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-101
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2091117
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2091117
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2091117
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2091117
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2091117
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2091117
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2091117
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2091117
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2091117
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2091117
  - Add rpm setattr db files macro
  Resolves: rhbz#2091117
  - Fix insights client
  Resolves: rhbz#2091117
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-102
changelog:
  - Allow transition to insights_client named content
  Resolves: rhbz#2091117
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-103
changelog:
  - Allow domain read usermodehelper state information
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls
  Resolves: rhbz#2083504
  - Allow samba-dcerpcd work with sssd
  Resolves: rhbz#2096825
  - Allow winbind_rpcd_t connect to self over a unix_stream_socket
  Resolves: rhbz#2096825
  - Update samba-dcerpcd policy for kerberos usage
  Resolves: rhbz#2096825
  - Allow keepalived read the contents of the sysfs filesystem
  Resolves: rhbz#2098189
  - Update policy for samba-dcerpcd
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls 2/2
  Resolves: rhbz#2083504
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-105
changelog:
  - Do not call systemd_userdbd_stream_connect() for winbind-rpcd
  Resolves: rhbz#2108383
  - Update winbind_rpcd_t
  Resolves: rhbz#2108383
  - Allow irqbalance file transition for pid sock_files and directories
  Resolves: rhbz#2111916
  - Update irqbalance runtime directory file context
  Resolves: rhbz#2111916


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-106
changelog:
  - Allow networkmanager to signal unconfined process
  Resolves: rhbz#1918148
  - Allow sa-update to get init status and start systemd files
  Resolves: rhbz#2011239
  - Allow samba-bgqd get a printer list
  Resolves: rhbz#2114737
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2104913
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Make default file context match with named transitions
  Resolves: rhbz#2104913
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2104913
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2104913


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-107
changelog:
  - Label 319/udp port with ptp_event_port_t
  Resolves: rhbz#2118628
  - Allow unconfined and sysadm users transition for /root/.gnupg
  Resolves: rhbz#2119507
  - Add the kernel_read_proc_files() interface
  Resolves: rhbz#2119507
  - Add userdom_view_all_users_keys() interface
  Resolves: rhbz#2119507
  - Allow system_cronjob_t domtrans to rpm_script_t
  Resolves: rhbz#2118362
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  Resolves: rhbz#2117199
  - Allow chronyd bind UDP sockets to ptp_event ports
  Resolves: rhbz#2118628
  - Allow samba-bgqd to read a printer list
  Resolves: rhbz#2118958
  - Add gpg_filetrans_admin_home_content() interface
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution
  Resolves: rhbz#2119507
  - Allow gpg read and write generic pty type
  Resolves: rhbz#2119507
  - Allow chronyc read and write generic pty type
  Resolves: rhbz#2119507
  - Disable rpm verification on interface_info
  Resolves: rhbz#2119472


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108
changelog:
  - Allow unconfined_service_t insights client content filetrans
  Resolves: rhbz#2119507
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  Resolves: rhbz#2119507
  - Add init_status_all_script_files() interface
  Resolves: rhbz#2119507
  - Add dev_dontaudit_write_raw_memory() and dev_read_vsock() interfaces
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 5
  Resolves: rhbz#2119507
  - Confine insights-client systemd unit
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 4
  Resolves: rhbz#2119507
  - Change rhsmcertd_t to insights_client_t in insights-client policy
  Resolves: rhbz#2119507
  - Allow insights-client send signull to unconfined_service_t
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 3
  Resolves: rhbz#2119507
  - Allow journalctl read init state
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 2
  Resolves: rhbz#2119507


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-108.0.1
changelog:
  - Allow kdumpctl_t to execmem [Orabug: 34712872]
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Add file context for /var/run/fsck [Orabug: 32789338]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108.1
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2136762
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2136762
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2136762
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2136762
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2136762
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2136762
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2136762


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-108.0.2
changelog:
  - Allow tuned_t to manage information from the debugging filesystem [Orabug: 34685730]
  - Allow kdumpctl_t to execmem [Orabug: 34712872]
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Add file context for /var/run/fsck [Orabug: 32789338]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108.2
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2170510
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2170510
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2170510
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2170510
  - Allow insights-client read nvme devices
  Resolves: rhbz#2170510
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2170510
  - Add insights additional capabilities
  Resolves: rhbz#2170510
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2170510
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2170510
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2170510
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2170510
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2170510
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2170510
  - Allow insights client read raw memory devices
  Resolves: rhbz#2170510
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2170510
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2170510
  - Allow insights-client manage generic locks
  Resolves: rhbz#2170510
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2170510


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-108.0.3
changelog:
  - Label /var/log/kdump.log with kdump_log_t [Orabug: 32911792]
  - Allow tuned_t to manage information from the debugging filesystem [Orabug: 34685730]
  - Allow kdumpctl_t to execmem [Orabug: 34712872]
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Add file context for /var/run/fsck [Orabug: 32789338]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-109
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2132230
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2132230
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2132230
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2132230
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2132230
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2132230
  - Allow snmpd_t domain to trace processes in user namespace
  Resolves: rhbz#2121084
  - Allow sbd the sys_ptrace capability
  Resolves: rhbz#2124552
  - Allow pulseaudio create gnome content (~/.config)
  Resolves: rhbz#2124387


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-110
changelog:
  - Add the systemd_connectto_socket_proxyd_unix_sockets() interface
  Resolves: rhbz#208441
  - Add the dev_map_vhost() interface
  Resolves: rhbz#2122920
  - Allow init remount all file_type filesystems
  Resolves: rhbz#2122239
  - added policy for systemd-socket-proxyd
  Resolves: rhbz#2088441
  - Allow virt_domain map vhost devices
  Resolves: rhbz#2122920
  - Allow virt domains to access xserver devices
  Resolves: rhbz#2122920
  - Allow rotatelogs read httpd_log_t symlinks
  Resolves: rhbz#2030633
  - Allow vlock search the contents of the /dev/pts directory
  Resolves: rhbz#2122838
  - Allow system cronjobs dbus chat with setroubleshoot
  Resolves: rhbz#2125008
  - Allow ptp4l_t name_bind ptp_event_port_t
  Resolves: rhbz#2130168
  - Allow pcp_domain execute its private memfd: objects
  Resolves: rhbz#2090711
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  Resolves: rhbz#2121709
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-111
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2141311
  - Allow iptables list cgroup directories
  Resolves: rhbz#2134820
  - Allow systemd-hostnamed dbus chat with init scripts
  Resolves: rhbz#2111632
  - Allow systemd to read symlinks in /var/lib
  Resolves: rhbz#2118784
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2141311
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2141311
  - Allow insights-client manage generic locks
  Resolves: rhbz#2141311
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2141311
  - Allow winbind-rpcd use the terminal multiplexor
  Resolves: rhbz#2107106
  - Allow mrtg send mails
  Resolves: rhbz#2103675
  - Allow sssd dbus chat with system cronjobs
  Resolves: rhbz#2132922
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-112
changelog:
  - Allow ipsec_t only read tpm devices
  Resolves: rhbz#2147380
  - Allow ipsec_t read/write tpm devices
  Resolves: rhbz#2147380
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#1972230
  - Allow the spamd_update_t domain get generic filesystem attributes
  Resolves: rhbz#2144501
  - Allow cdcc mmap dcc-client-map files
  Resolves: rhbz#2144505
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2143878
  - Allow insights client read raw memory devices
  Resolves: rhbz#2143878
  - Allow winbind-rpcd get attributes of device and pty filesystems
  Resolves: rhbz#2107106
  - Allow postfix/smtpd read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-113
changelog:
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  Resolves: rhbz#2088441
  - Allow systemd-socket-proxyd get filesystems attributes
  Resolves: rhbz#2088441
  - Allow sysadm read ipmi devices
  Resolves: rhbz#2148561
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2151111
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2151111
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2152867
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2152867
  - Allow redis get user names
  Resolves: rhbz#2112228
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  Resolves: rhbz#2143696


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-114
changelog:
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2141311
  - Allow sysadm_t read/write ipmi devices
  Resolves: rhbz#2148561
  - Allow sudodomain use sudo.log as a logfile
  Resolves: rhbz#2143762
  - Add insights additional capabilities
  Resolves: rhbz#2158779
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2141311
  - Allow prosody manage its runtime socket files
  Resolves: rhbz#2157902
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-115
changelog:
  - Fix syntax problem in redis.te
  Resolves: rhbz#2112228
  - Allow unconfined user filetransition for sudo log files
  Resolves: rhbz#2164047
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: rhbz#2152642
  - Allow winbind-rpcd manage samba_share_t files and dirs
  Resolves: rhbz#2152642
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2134125
  - Allow insights-client read nvme devices
  Resolves: rhbz#2143878
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2143878
  - Allow redis-sentinel execute a notification script
  Resolves: rhbz#2112228


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-116
changelog:
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  Resolves: rhbz#2039662
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2166802
  - Add journalctl the sys_resource capability
  Resolves: rhbz#2136189


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-117
changelog:
  - Fix opencryptoki file names in /dev/shm
  Resolves: rhbz#2028637
  - Allow system_cronjob_t transition to rpm_script_t
  Resolves: rhbz#2154242
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  Resolves: rhbz#2154242
  - Allow httpd work with tokens in /dev/shm
  Resolves: rhbz#2028637
  - Allow keepalived to set resource limits
  Resolves: rhbz#2168638
  - Allow insights-client manage fsadm pid files


author: David Sloboda <david.x.sloboda@oracle.com> - 3.14.3-117.2
changelog:
  - Add support for the systemd-pstore service
  Resolves: rhbz#2188268
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2188268
  - Add fs_read_pstore_files() interface
  Resolves: rhbz#2188268
  - Label /run/fsck with fsadm_var_run_t
  Resolves: rhbz#2212328


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 3.14.3-117.0.1.2
changelog:
  - Label /var/log/kdump.log with kdump_log_t [Orabug: 32911792]
  - Allow tuned_t to manage information from the debugging filesystem [Orabug: 34685730]
  - Allow kdumpctl_t to execmem [Orabug: 34712872]
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: David Sloboda <david.x.sloboda@oracle.com> - 3.14.3-117.0.1.3
changelog:
  - Oracle changes are now applied on top of new upstream patchset
  - Allow insights-client work with teamdctl
  Resolves: rhbz#2233929
  - Allow insights-client read unconfined service semaphores
  Resolves: rhbz#2233929
  - Allow insights-client get quotas of all filesystems
  Resolves: rhbz#2233929
  - Allow insights-client read all sysctls
  Resolves: rhbz#2233931


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-120
changelog:
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2177254
  - Allow systemd-pstore delete kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow certmonger manage cluster library files
  Resolves: rhbz#2177836
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107106
  - Allow snmpd read raw disk data
  Resolves: rhbz#2160000
  - Allow cluster_t dbus chat with various services
  Resolves: rhbz#2196524


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-121
changelog:
  - Update pkcsslotd policy for sandboxing 2/2
  Resolves: rhbz#2208162
  - Update pkcsslotd policy for sandboxing 1/2
  Resolves: rhbz#2208162
  - Allow abrt_t read kernel persistent storage files
  Resolves: rhbz#2207914
  - Add allow rules for lttng-sessiond domain
  Resolves: rhbz#2203509
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107106
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: rhbz#2107106
  - Dontaudit targetd search httpd config dirs
  Resolves: rhbz#2203720


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-122
changelog:
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: rhbz#2165752
  - Allow insights-client map generic log files
  Resolves: rhbz#2214572
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2207819
  - Allow insights-client getsession process permission
  Resolves: rhbz#2207819
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179335


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-123
changelog:
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213606
  - Allow httpd tcp connect to redis port conditionally
  Resolves: rhbz#2213965
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: rhbz#2218362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-124
changelog:
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076937
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076937
  - Dontaudit sfcbd sys_ptrace cap_userns
  Resolves: rhbz#2076937
  - Label /usr/sbin/sos with sosreport_exec_t
  Resolves: rhbz#2167731
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2222200
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2222200
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  Resolves: rhbz#2222200


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-125
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2216151
  - Allow unconfined user filetrans chrome_sandbox_home_t 1/2
  Resolves: rhbz#2221573
  - Allow unconfined user filetrans chrome_sandbox_home_t 2/2
  Resolves: rhbz#2221573
  - Allow insights-client execmem
  Resolves: rhbz#2225233
  - Allow svnserve execute postdrop with a transition
  Resolves: rhbz#2004843
  - Do not make postfix_postdrop_t type an MTA executable file
  Resolves: rhbz#2004843
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2210771
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2210771


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-126
changelog:
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
  Resolves: rhbz#2229726
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: rhbz#2177704
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
  Resolves: rhbz#2229726
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225527
  - Allow insights-client create all rpm logs with a correct label
  Resolves: rhbz#2229559
  - Allow insights-client manage generic logs
  Resolves: rhbz#2229559


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128
changelog:
  - Allow ssh_agent_type manage generic cache home files
  Resolves: rhbz#2177704
  - Add chromium_sandbox_t setcap capability
  Resolves: rhbz#2221573


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 3.14.3-128.0.1
changelog:
  - Label /var/log/kdump.log with kdump_log_t [Orabug: 32911792]
  - Allow tuned_t to manage information from the debugging filesystem [Orabug: 34685730]
  - Allow kdumpctl_t to execmem [Orabug: 34712872]
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]
  - Add support for the systemd-pstore service
  Resolves: rhbz#2188268


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 3.14.3-128.0.3.1
changelog:
  - Oracle changes are now applied on top of new upstream patchset
  - Update "Allow systemd-pstore to transfer files from /sys/fs/pstore" [Orabug: 31594666]
  - Revert "Add support for the systemd-pstore service"
  Resolves: rhbz#2188268
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-15427
  - Allow winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-16274


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-132
changelog:
  - Allow sudodomain read var auth files
  Resolves: RHEL-16567
  - Update cifs interfaces to include fs_search_auto_mountpoints()
  Resolves: RHEL-14072
  - Allow systemd-localed create Xserver config dirs
  Resolves: RHEL-16715
  - Label /var/run/auditd.state as auditd_var_run_t
  Resolves: RHEL-14376
  - Allow auditd read all domains process state
  Resolves: RHEL-14471
  - Allow sudo userdomain to run rpm related commands
  Resolves: RHEL-1679
  - Remove insights_client_watch_lib_dirs() interface
  Resolves: RHEL-16185


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-133
changelog:
  - Label /dev/acpi_thermal_rel char device with acpi_device_t
  Resolves: RHEL-18027
  - Allow sysadm execute traceroute in sysadm_t domain using sudo
  Resolves: RHEL-9947
  - Allow sysadm execute tcpdump in sysadm_t domain using sudo
  Resolves: RHEL-15398
  - Add support for syslogd unconfined scripts
  Resolves: RHEL-10087
  - Label /dev/wmi/dell-smbios as acpi_device_t
  Resolves: RHEL-18027
  - Make named_zone_t and named_var_run_t a part of the mountpoint attribute
  Resolves: RHEL-1954
  - Dontaudit rhsmcertd write memory device
  Resolves: RHEL-17721


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-134
changelog:
  - Allow syslog to run unconfined scripts conditionally
  Resolves: RHEL-10087
  - Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
  Resolves: RHEL-10087
  - Allow collectd connect to statsd port
  Resolves: RHEL-19482
  - Allow collectd_t read network state symlinks
  Resolves: RHEL-19482
  - Allow collectd_t domain to create netlink_generic_socket sockets
  Resolves: RHEL-19482
  - Allow opafm search nfs directories
  Resolves: RHEL-19426
  - Allow mdadm list stratisd data directories
  Resolves: RHEL-21374


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-135
changelog:
  - Label /tmp/libdnf.* with user_tmp_t
  Resolves: RHEL-11249
  - Allow su domains write login records
  Resolves: RHEL-2606
  - Allow gpg read rpm cache
  Resolves: RHEL-11249
  - Allow unix dgram sendto between exim processes
  Resolves: RHEL-21903
  - Allow hypervkvp_t write access to NetworkManager_etc_rw_t
  Resolves: RHEL-17687
  - Add interface for write-only access to NetworkManager rw conf
  Resolves: RHEL-17687
  - Allow conntrackd_t to use sys_admin capability
  Resolves: RHEL-22276


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-136
changelog:
  - Transition from sudodomains to crontab_t when executing crontab_exec_t
  Resolves: RHEL-1388
  - Fix label of pseudoterminals created from sudodomain
  Resolves: RHEL-1388
  - Allow login_userdomain to manage session_dbusd_tmp_t dirs/files
  Resolves: RHEL-22500
  - Label /dev/ngXnY and /dev/nvme-subsysX with nvme_device_t
  Resolves: RHEL-23442
  - Allow admin user read/write on fixed_disk_device_t
  Resolves: RHEL-23434
  - Only allow confined user domains to login locally without unconfined_login
  Resolves: RHEL-1628
  - Add userdom_spec_domtrans_confined_admin_users interface
  Resolves: RHEL-1628
  - Only allow admindomain to execute shell via ssh with ssh_sysadm_login
  Resolves: RHEL-1628
  - Add userdom_spec_domtrans_admin_users interface
  Resolves: RHEL-1628
  - Move ssh dyntrans to unconfined inside unconfined_login tunable policy
  Resolves: RHEL-1628
  - Allow utempter_t use ptmx
  Resolves: RHEL-25002
  - Dontaudit subscription manager setfscreate and read file contexts
  Resolves: RHEL-21639
  - Don't audit crontab_domain write attempts to user home
  Resolves: RHEL-1388
  - Add crontab_domtrans interface
  Resolves: RHEL-1388
  - Add dbus_manage_session_tmp_files interface
  Resolves: RHEL-22500
  - Allow httpd read network sysctls
  Resolves: RHEL-22748
  - Allow keepalived_unconfined_script_t dbus chat with init
  Resolves: RHEL-22843


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-137
changelog:
  - Differentiate between staff and sysadm when executing crontab with sudo
  Resolves: RHEL-1388
  - Allow su domains write login records
  Resolves: RHEL-2606
  - Revert "Allow su domains write login records"
  Resolves: RHEL-2606
  - Add crontab_admin_domtrans interface
  Resolves: RHEL-1388
  - Allow gpg manage rpm cache
  Resolves: RHEL-11249


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-138
changelog:
  - Allow wdmd list the contents of the sysfs directories
  Resolves: RHEL-27507
  - Allow linuxptp configure phc2sys and chronyd over a unix domain socket
  Resolves: RHEL-27394


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-139.1
changelog:
  - Allow setsebool_t relabel selinux data files
  Resolves: RHEL-55432
  - Allow dirsrv-snmp map dirsv_tmpfs_t files
  Resolves: RHEL-32441
  - Allow dirsrv_snmp_t to manage dirsrv_config_t & dirsrv_var_run_t files
  Resolves: RHEL-32441


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-139.0.1
changelog:
  - Allow kdump create and use its memfd: objects [Orabug: 36538844]
  - Allow cgred_t to get attributes of cgroup filesystems [Orabug: 36226040]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36170954]
  - Allow mailman_domain to manage mailman_log_t link files [Orabug: 36160497]
  - Label /var/log/kdump.log with kdump_log_t [Orabug: 32911792]
  - Allow tuned_t to manage information from the debugging filesystem [Orabug: 34685730]
  - Allow kdumpctl_t to execmem [Orabug: 34712872]
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-131
changelog:
  - Additional permissions for ip-vrf
  Resolves: RHEL-9981
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-9981
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-5845
  - Allow system_mail_t manage exim spool files and dirs
  Resolves: RHEL-14186


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-12
changelog:
  - Make working wireshark execute byt confined users staff_t and sysadm_t
  Resolves: rhbz#1712788
  - Label user cron spool file with user_cron_spool_t
  Resolves: rhbz#1727342
  - Allow ptp4l_t domain to write to pmc socket which is created by pmc command line tool
  Resolves: rhbz#1668667
  - Update svnserve_t policy to make working svnserve hooks
  Resolves: rhbz#1729955
  - Allow varnishlog_t domain to check for presence of varnishd_t domains
  Resolves: rhbz#1730270
  - Allow lsmd_t domain to execute /usr/bin/debuginfo-install
  Resolves: rhbz#1720648
  - Update sandboxX policy to make working firefox inside SELinux sandbox
  Resolves: rhbz#1663874
  - Remove allow rule from svirt_transition_svirt_sandbox interface to don't allow containers to connect to random services
  Resolves: rhbz#1695248
  - Allow httpd_t domain to read /var/lib/softhsm/tokens to allow httpd daemon to use pkcs#11 devices
  Resolves: rhbz#1690484
  - Allow opafm_t domain to modify scheduling information of another process.
  Resolves: rhbz#1725874
  - Allow gssd_t domain to list tmpfs_t dirs
  Resolves: rhbz#1674470
  - Allow mdadm_t domain to read tmpfs_t files
  Resolves: rhbz#1669996
  - Allow sbd_t domain to check presence of processes labeled as cluster_t
  Resolves: rhbz#1669595
  - Dontaudit httpd_sys_script_t to read systemd unit files
  Resolves: rhbz#1670139
  - Allow blkmapd_t domain to read nvme devices
  Resolves: rhbz#1669985
  - Update cpucontrol_t domain to make working microcode service
  Resolves: rhbz#1669485
  - Allow domain transition from logwatch_t do postfix_postqueue_t
  Resolves: rhbz#1669162
  - Allow chronyc_t domain to create and write to non_security files in case when sysadmin is redirecting output to file e.g: 'chronyc -n tracking > /var/lib/test'
  Resolves: rhbz#1696252
  - Allow httpd_sys_script_t domain to mmap httpdcontent
  Resolves: rhbz#1693137
  - Allow sbd_t to manage cgroups_t files
  Resolves: rhbz#1715134
  - Update wireshark policy to make working tshar labeled as wireshark_t
  Resolves: rhbz#1711005
  - Update virt_use_nfs boolean to allow svirt_t domain to mmap nfs_t files
  Resolves: rhbz#1719083
  - Allow sbd_t domain to use nsswitch
  Resolves: rhbz#1723498
  - Allow sysadm_t and staff_t domains to read wireshark shared memory
  Resolves: rhbz#1712788
  - Label /usr/libexec/utempter/utempter  as utemper_exec_t
  Resolves: rhbz#1729571
  - Allow unconfined_domain_type to setattr own process lnk files.
  Resolves: rhbz#1730500
  - Add interface files_write_generic_pid_sockets()
  - Dontaudit writing to user home dirs by gnome-keyring-daemon
  Resolves: rhbz#1689797
  - Allow staff and admin domains to setpcap in user namespace
  Resolves: rhbz#1673922
  - Allow staff and sysadm to use lockdev
  Resolves: rhbz#1673269
  - Allow staff and sysadm users to run iotop.
  Resolves: rhbz#1671241
  - Dontaudit traceroute_t domain require sys_admin capability
  Resolves: rhbz#1671672
  - Dontaudit dbus chat between kernel_t and init_t
  Resolves: rhbz#1669095
  - Allow systemd labeled as init_t to create mountpoints without any specific label as default_t
  Resolves: rhbz#1696144


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-13
changelog:
  - Allow search krb5_keytab_t dirs for interfaces kerberos_read_keytab() and kerberos_rw_keytab
  Resolves: rhbz#1730144
  - Allow virtlockd process read virtlockd.conf file
  Resolves: rhbz#1733185
  - Relabel  /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t.
  Resolves: rhbz#1733185
  - Allow brltty to request to load kernel module
  Resolves: rhbz#1689955
  - Add svnserve_tmp_t label forl svnserve temp files to system private tmp
  Resolves: rhbz#1729955
  - Dontaudit svirt_tcg_t domain to read process state of libvirt
  Resolves: rhbz#1732500
  - Allow mysqld_t domain to domtrans to ifconfig_t domain when executing ifconfig tool
  Resolves: rhbz#1732381
  - Allow cyrus work with PrivateTmp
  Resolves: rhbz#1725023
  - Make cgdcbxd_t domain working with SELinux enforcing.
  Resolves: rhbz#1651991
  - Remove system_r role from staff_u user.
  Resolves: rhbz#1677052
  - Add systemd_private_tmp_type attribute
  Resolves: rhbz#1725023
  - Allow systemd to load kernel modules during boot process.
  Resolves: rhbz#1644805


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-15
changelog:
  - Dontaudit abrt_t domain to read root_t files
  Resolves: rhbz#1734403
  - Allow ipa_dnskey_t domain to read kerberos keytab
  Resolves: rhbz#1730144
  - Update ibacm_t policy
  - Allow dlm_controld_t domain setgid capability
  Resolves: rhbz#1738608
  - Allow auditd_t domain to create auditd_tmp_t temporary files and dirs in /tmp or /var/tmp
  Resolves: rhbz#1740146
  - Update systemd_dontaudit_read_unit_files() interface to dontaudit alos listing dirs
  Resolves: rhbz#1670139


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-17
changelog:
  - Label /usr/libexec/microcode_ctl/reload_microcode as cpucontrol_exec_t
  Resolves: rhbz#1669485
  - Fix typo in networkmanager_append_log() interface
  Resolves: rhbz#1687460
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1640296


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-20
changelog:
  - Label /var/log/hawkey.log as rpm_log_t and update rpm named filetrans interfaces.
  - Allow sysadm_t to create hawkey log file with rpm_log_t SELinux label
  Resolves: rhbz#1720639


author: Natalya Naumova <natalya.naumova@oracle.com> - 3.14.3-20.0.1
changelog:
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow init_t to relabel all lock files [Orabug: 29846265] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-33
changelog:
  - Update files_create_var_lib_dirs() interface to allow caller domain also set attributes of var_lib_t directory
  Resolves: rhbz#1778126


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-34
changelog:
  - Added macro for stratisd to chat over dbus
  - Add dac_override capability to stratisd_t domain
  - Allow userdomain to chat with stratisd over dbus.
  Resolves: rhbz#1787298


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-35
changelog:
  - Allow stratisd_t domain to read/write fixed disk devices and removable devices.
  Resolves: rhbz#1790795


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-37
changelog:
  - Make stratisd_t domain unconfined for RHEL-8.2
  Resolves: rhbz#1791557
  - stratisd_t policy updates
  Resolves: rhbz#1791557


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-39
changelog:
  - Allow vhostmd communication with hosted virtual machines
  - Add and update virt interfaces
  Resolves: rhbz#1782925


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41
changelog:
  - Allow NetworkManager read its unit files and manage services
  - Mark nm-cloud-setup systemd units as NetworkManager_unit_file_t
  Resolves: rhbz#1806894


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-41.0.1.el8
changelog:
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671] (Naoki Tanaka)
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow init_t to relabel all lock files [Orabug: 29846265] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41.1
changelog:
  - Allow ssh-keygen create file in /var/lib/glusterd
  Resolves: rhbz#1821759
  - Update ctdbd_manage_lib_files() to also allow mmap ctdbd_var_lib_t files
  Resolves: rhbz#1821226
  - Remove container interface calling by named_filetrans_domain.


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41.6
changelog:
  - Label systemd-growfs and systemd-makefs as fsadm_exec_t
  Resolves: rhbz#1859162
  - Update xserver_rw_session macro
  Resolves: rhbz#1866362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-46
changelog:
  - Fix description tag for the sssd_connect_all_unreserved_ports tunable
  Related: rhbz#1826748
  - Allow journalctl process set its resource limits
  Resolves: rhbz#1825894
  - Add sssd_access_kernel_keys tunable to conditionally access kernel keys
  Resolves: rhbz#1802062
  - Make keepalived work with network namespaces
  Resolves: rhbz#1815281
  - Create sssd_connect_all_unreserved_ports boolean
  Resolves: rhbz#1826748
  - Allow hypervkvpd to request kernel to load a module
  Resolves: rhbz#1842414
  - Allow systemd_private_tmp(dirsrv_tmp_t)
  Resolves: rhbz#1836820
  - Allow radiusd connect to gssproxy over unix domain stream socket
  Resolves: rhbz#1813572
  - Add fwupd_cache_t file context for '/var/cache/fwupd(/.*)?'
  Resolves: rhbz#1832231
  - Modify kernel_rw_key() not to include append permission
  Related: rhbz#1802062
  - Add kernel_rw_key() interface to access to kernel keyrings
  Related: rhbz#1802062
  - Modify systemd_delete_private_tmp() to use delete_*_pattern macros
  Resolves: rhbz#1836820
  - Allow systemd-modules to load kernel modules
  Resolves: rhbz#1823246
  - Add cachefiles_dev_t as a typealias to cachefiles_device_t
  Resolves: rhbz#1814796


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-47
changelog:
  - Allow virtlogd_t manage virt lib files
  Resolves: rhbz#1832756
  - Allow pdns server to read system state
  Resolves: rhbz#1801214
  - Support systemctl --user in machinectl
  Resolves: rhbz#1788616
  - Allow chkpwd_t read and write systemd-machined devpts character nodes
  Resolves: rhbz#1788616
  - Allow init_t write to inherited systemd-logind sessions pipes
  Resolves: rhbz#1788616
  - Label systemd-growfs and systemd-makefs as fsadm_exec_t
  Resolves: rhbz#1820798
  - Allow staff_u and user_u setattr generic usb devices
  Resolves: rhbz#1783325
  - Allow sysadm_t dbus chat with accountsd
  Resolves: rhbz#1828809


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-49
changelog:
  - Additional support for keepalived running in a namespace
  Resolves: rhbz#1815281
  - Allow keepalived manage its private type runtime directories
  Resolves: rhbz#1815281
  - Run ipa_helper_noatsecure(oddjob_t) only if the interface exists
  Resolves: rhbz#1853432
  - Allow oddjob_t process noatsecure permission for ipa_helper_t
  Resolves: rhbz#1853432
  - Allow domain dbus chat with systemd-resolved
  Resolves: rhbz#1852378
  - Define file context for /var/run/netns directory only
  Related: rhbz#1815281


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-50
changelog:
  - Revert "Allow qemu-kvm read and write /dev/mapper/control"
  This reverts commit f948eaf3d010215fc912e42013e4f88870279093.
  - Allow smbd get attributes of device files labeled samba_share_t
  Resolves: rhbz#1851816
  - Allow tomcat read user temporary files
  Resolves: rhbz#1857675
  - Revert "Dontaudit and disallow sys_admin capability for keepalived_t domain"
  Resolves: rhbz#1815281
  - Label /tmp/krb5_0.rcache2 with krb5_host_rcache_t
  Resolves: rhbz#1848953
  - Allow auditd manage kerberos host rcache files
  Resolves: rhbz#1855770


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-51
changelog:
  - Allow kadmind manage kerberos host rcache
  Resolves: rhbz#1863043
  - Allow virtlockd only getattr and lock block devices
  Resolves: rhbz#1832756
  - Allow qemu-ga read all non security file types conditionally
  Resolves: rhbz#1747960
  - Allow virtlockd manage VMs posix file locks
  Resolves: rhbz#1832756
  - Add dev_lock_all_blk_files() interface
  Resolves: rhbz#1832756
  - Allow systemd-logind dbus chat with fwupd
  Resolves: rhbz#1851932
  - Update xserver_rw_session macro
  Resolves: rhbz#1851448


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-52
changelog:
  - Add ipa_helper_noatsecure() interface unconditionally
  Resolves: rhbz#1853432
  - Conditionally allow nagios_plugin_domain dbus chat with init
  Resolves: rhbz#1750821
  - Revert "Update allow rules set for nrpe_t domain"
  Resolves: rhbz#1750821
  - Add ipa_helper_noatsecure() interface to ipa.if
  Resolves: rhbz#1853432
  - Allow tomcat map user temporary files
  Resolves: rhbz#1857675
  - Allow tomcat manage user temporary files
  Resolves: rhbz#1857675
  - Add file context for /sys/kernel/tracing
  Resolves: rhbz#1847331
  - Define named file transition for sshd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1848953


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-53
changelog:
  - Allow certmonger fowner capability
  Resolves: rhbz#1870596
  - Define named file transition for saslauthd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1870300
  - Label /usr/libexec/qemu-pr-helper with virtd_exec_t
  Resolves: rhbz#1867115


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-54.0.1
changelog:
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671] (Naoki Tanaka)
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 3.14.3-54.0.3
changelog:
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files BZ(1758634) [Orabug: 31405299]
  - Make udev work with mls policy [Orabug: 31405299]


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-54.1
changelog:
  - Add fstools_rw_swap_files() interface
  Resolves: rhbz#1890884
  - Confine systemd-sleep service
  Resolves: rhbz#1890884


author: John Mcwalters <john.mcwalters@oracle.com> - 3.14.3-54.0.5.2
changelog:
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files BZ(1758634) [Orabug: 31405299]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671] (Naoki Tanaka)
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-54.0.9.3
changelog:
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files BZ(1758634) [Orabug: 31405299]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671] (Naoki Tanaka)
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-59
changelog:
  - Add cron_dbus_chat_system_job() interface
  Resolves: rhbz#1883906
  - Dontaudit firewalld dac_override capability
  Resolves: rhbz#1759010
  - Allow tcsd the setgid capability
  Resolves: rhbz#1898694
  - Allow timedatex dbus chat with cron system domain
  Resolves: rhbz#1883906
  - Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
  Resolves: rhbz#1854299
  - Allow pcp-pmcd manage perf_events
  Resolves: rhbz#1901958
  - Label /dev/isst_interface as cpu_device_t
  Resolves: rhbz#1902227
  - Allow ipsec set the context of a SPD entry to the default context
  Resolves: rhbz#1880474
  - Allow sysadm_u user and unconfined_domain_type manage perf_events
  Resolves: rhbz#1901958
  - Add manage_perf_event_perms object permissions set
  Resolves: rhbz#1901958
  - Add perf_event access vectors.
  Resolves: rhbz#1901958
  - Remove "ipa = module" from modules-targeted-contrib.conf
  Resolves: rhbz#1461914


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-60
changelog:
  - Allow wireshark create and use rdma socket
  Resolves: rhbz#1844370
  - Allow to use nnp_transition in pulseaudio_role
  Resolves: rhbz#1854471
  - Allow certmonger fsetid capability
  Resolves: rhbz#1873211
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  Resolves: rhbz#1889673
  - Allow sysadm read and write /dev/rfkill
  Resolves: rhbz#1831630
  - Allow staff_u run pam_console_apply
  Resolves: rhbz#1817690
  - Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t
  Resolves: rhbz#1907485


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-61
changelog:
  - Add kpatch_exec() interface
  Resolves: rhbz#1895322
  - Allow rhsmcertd execute kpatch
  Resolves: rhbz#1895322
  - Allow openvswitch_t perf_event open permission
  Resolves: rhbz#1916046
  - Allow openvswitch fowner capability and create netlink sockets
  Resolves: rhbz#1883980
  - Add net_broadcast capability to openvswitch_t domain
  Resolves: rhbz#1883980
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
  Resolves: rhbz#1883980
  - Allow machinectl to run pull-tar
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-62
changelog:
  - Allow rhsmcertd_t domain transition to kpatch_t
  Resolves: rhbz#1895322
  - Revert "Add kpatch_exec() interface"
  Resolves: rhbz#1895322
  - Revert "Allow rhsmcertd execute kpatch"
  Resolves: rhbz#1895322
  - Dontaudit NetworkManager_t domain to write to kdump temp pipies
  Resolves: rhbz#1842897
  - Allow NetworkManager_t domain to get status of samba services
  Resolves: rhbz#1781806
  - Allow openvswitch create and use xfrm netlink sockets
  Resolves: rhbz#1916046
  - Allow openvswitch_t perf_event write permission
  Resolves: rhbz#1916046
  - Add write_perf_event_perms object permission set
  Related: rhbz#1916046


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
changelog:
  - Allow rtkit_daemon_t domain set process nice value in user namespaces
  Resolves: rhbz#1910507
  - Allow gpsd read and write ptp4l_t shared memory.
  Resolves: rhbz#1803845
  - Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
  Resolves: rhbz#1804626
  - Allow Certmonger to use opencryptoki services
  Resolves: rhbz#1894132
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  Resolves: rhbz#1815603
  - Allow rhsmcertd_t read kpatch lib files
  Resolves: rhbz#1895322
  - Allow ipsec_t connectto ipsec_mgmt_t
  Resolves: rhbz#1848355
  - Allow IPsec to use opencryptoki services
  Resolves: rhbz#1894132
  - Allow systemd-importd create /run/systemd/machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
changelog:
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  Resolves: rhbz#1874527
  Resolves: rhbz#1877044
  - Allow rhsmcertd bind tcp sockets to a generic node
  Resolves: rhbz#1923985
  - Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
  Resolves: rhbz#1889542
  - Allow strongswan start using swanctl method
  Resolves: rhbz#1889542
  - Allow systemd-importd manage machines.lock file
  Resolves: rhbz#1788055


author: John Mcwalters <john.mcwalters@oracle.com> - 3.14.3-67.0.1
changelog:
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671] (Naoki Tanaka)
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-67.0.6
changelog:
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Add file context for /var/run/fsck [Orabug: 32789338]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671] (Naoki Tanaka)
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511] (Naoki Tanaka)
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Obsolete docker-engine-selinux [Orabug: 26439663]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
changelog:
  - Allow systemd-sleep get attributes of fixed disk device nodes
  Resolves: rhbz#1931460
  - Allow systemd-sleep create hardware state information files
  Resolves: rhbz#1968610
  - virtiofs supports Xattrs and SELinux
  Resolves: rhbz#1899703
  - Label 4460/tcp port as ntske_port_t
  Resolves: rhbz#1961207
  - Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
  Resolves: rhbz#1961207
  - Allow chronyd_t to accept and make NTS-KE connections
  Resolves: rhbz#1961207
  - Dontaudit NetworkManager write to initrc_tmp_t pipes
  Resolves: rhbz#1963162
  - Allow logrotate rotate container log files
  Resolves: rhbz#1892170
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1878020


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
changelog:
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
  Resolves: rhbz#1947841
  - Allow transition from xdm domain to unconfined_t domain.
  Resolves: rhbz#1947841
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Create a policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Add dev_getattr_infiniband_dev() interface.
  Resolves: rhbz#1972522
  - Allow tcpdump and nmap get attributes of infiniband_device_t
  Resolves: rhbz#1972522
  - Allow fcoemon create sysfs files
  Resolves: rhbz#1978562
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Allow radius map its library files
  Resolves: rhbz#1854650
  - Allow arpwatch get attributes of infiniband_device_t devices
  Resolves: rhbz#1936522


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
changelog:
  - Add the unconfined_dgram_send() interface
  Resolves: rhbz#1978562
  - Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
  Resolves: rhbz#1936522
  - Add checkpoint_restore cap2 capability
  Resolves: rhbz#1973325
  - Allow fcoemon talk with unconfined user over unix domain datagram socket
  Resolves: rhbz#1978562
  - Allow hostapd bind UDP sockets to the dhcpd port
  Resolves: rhbz#1977676
  - Allow NetworkManager read and write z90crypt device
  Resolves: rhbz#1938203
  - Allow abrt_domain read and write z90crypt device
  Resolves: rhbz#1938203
  - Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
  Resolves: rhbz#1937111
  - Allow mdadm read iscsi pid files
  Resolves: rhbz#1924716


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
changelog:
  - Allow login_userdomain read and map /var/lib/systemd files
  Resolves: rhbz#1965251
  - Allow sysadm acces to kernel module resources
  Resolves: rhbz#1965251
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1965251
  - Allow sysadm access to files_unconfined and bind rpc ports
  Resolves: rhbz#1965251
  - Allow sysadm read and view kernel keyrings
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Update the policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Allow journal mmap and read var lib files
  Resolves: rhbz#1965251
  - Allow tuned to read rhsmcertd config files
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Confine rhsm service and rhsm-facts service as rhsmcertd_t
  Resolves: rhbz#1846081
  - Allow virtlogd_t read process state of user domains
  Resolves: rhbz#1797899
  - Allow cockpit_ws_t get attributes of fs_t filesystems
  Resolves: rhbz#1979182


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
changelog:
  - Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
  Resolves: rhbz#1887739
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1956302
  - Allow rhsmcertd execute gpg
  Resolves: rhbz#1887572
  - Allow lldpad send to kdump over a unix dgram socket
  Resolves: rhbz#1979121
  - Remove glusterd SELinux module from distribution policy
  Resolves: rhbz#1816718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
changelog:
  - Label /usr/bin/Xwayland with xserver_exec_t
  Resolves: rhbz#1984584
  - Label /usr/libexec/gdm-runtime-config with xdm_exec_t
  Resolves: rhbz#1984584
  - Allow D-bus communication between avahi and sosreport
  Resolves: rhbz#1916397
  - Allow lldpad send to kdumpctl over a unix dgram socket
  Resolves: rhbz#1979121
  - Revert "Allow lldpad send to kdump over a unix dgram socket"
  Resolves: rhbz#1979121
  - Allow chronyc respond to a user chronyd instance
  Resolves: rhbz#1993104
  - Allow ptp4l respond to pmc
  Resolves: rhbz#1993104
  - Allow lldpad send to unconfined_t over a unix dgram socket
  Resolves: rhbz#1993270


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
changelog:
  - Introduce xdm_manage_bootloader booelan
  Resolves: rhbz#1994096
  - Rename samba_exec() to samba_exec_net()
  Resolves: rhbz#1855215
  - Allow sssd to set samba setting
  Resolves: rhbz#1855215
  - Allow dirsrv read slapd tmpfs files
  Resolves: rhbz#1843238
  - Allow rhsmcertd to create cache file in /var/cache/cloud-what
  Resolves: rhbz#1994718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-87
changelog:
  - Set default file context for /sys/firmware/efi/efivars
  Resolves: rhbz#2039458
  - Allow sysadm_t start and stop transient services
  Resolves: rhbz#2031065
  - Label /etc/cockpit/ws-certs.d with cert_t
  Resolves: rhbz#1907473
  - Allow smbcontrol read the network state information
  Resolves: rhbz#2033873
  - Allow rhsm-service read/write its private memfd: objects
  Resolves: rhbz#2029873
  - Allow fcoemon request the kernel to load a module
  Resolves: rhbz#1940317
  - Allow radiusd connect to the radacct port
  Resolves: rhbz#2038955
  - Label /var/lib/shorewall6-lite with shorewall_var_lib_t
  Resolves: rhbz#2041447
  - Exclude container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-89
changelog:
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2044048
  - Allow system_mail_t read inherited apache system content rw files
  Resolves: rhbz#1988339
  - Add apache_read_inherited_sys_content_rw_files() interface
  Related: rhbz#1988339
  - Allow rhsm-service execute its private memfd: objects
  Resolves: rhbz#2029873
  - Allow dirsrv read configfs files and directories
  Resolves: rhbz#2042568
  - Label /run/stratisd with stratisd_var_run_t
  Resolves: rhbz#1879585
  - Fix path for excluding container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-90
changelog:
  - Fix badly indented used interfaces
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 1/2
  Resolves: rhbz#2022690
  - Allow confined users to use kinit,klist and etc.
  Resolves: rhbz#2026598
  - Allow login_userdomain open/read/map system journal
  Resolves: rhbz#2046481
  - Allow init read stratis data symlinks 2/2
  Resolves: rhbz#2048514
  - Label new utility of NetworkManager nm-priv-helper
  Resolves: rhbz#1986076
  - Label NetworkManager-dispatcher service with separate context
  Resolves: rhbz#1989070
  - Allow domtrans to sssd_t and role access to sssd
  Resolves: rhbz#2030156
  - Creating interface sssd_run_sssd()
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 2/2
  Resolves: rhbz#2022690
  - Allow timedatex dbus chat with xdm
  Resolves: rhbz#2040214
  - Associate stratisd_data_t with device filesystem
  Resolves: rhbz#2048514
  - Allow init read stratis data symlinks 1/2
  Resolves: rhbz#2048514
  - Allow rhsmcertd create rpm hawkey logs with correct label
  Resolves: rhbz#1949871


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-92
changelog:
  - Allow postfix_domain read dovecot certificates 1/2
  Resolves: rhbz#2043599
  - Dontaudit dirsrv search filesystem sysctl directories 1/2
  Resolves: rhbz#2042568
  - Allow chage domtrans to sssd
  Resolves: rhbz#2054718
  - Allow postfix_domain read dovecot certificates 2/2
  Resolves: rhbz#2043599
  - Allow ctdb create cluster logs
  Resolves: rhbz#2049481
  - Allow alsa bind mixer controls to led triggers
  Resolves: rhbz#2049730
  - Allow alsactl set group Process ID of a process
  Resolves: rhbz#2049730
  - Dontaudit mdadm list dirsrv tmpfs dirs
  Resolves: rhbz#2011174
  - Dontaudit dirsrv search filesystem sysctl directories 2/2
  Resolves: rhbz#2042568
  - Revert "Label NetworkManager-dispatcher service with separate context"
  Related: rhbz#1989070
  - Revert "Allow NetworkManager-dispatcher dbus chat with NetworkManager"
  Related: rhbz#1989070


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
changelog:
  - Allow systemd-networkd dbus chat with sosreport
  Resolves: rhbz#1949493
  - Allow sysadm_passwd_t to relabel passwd and group files
  Resolves: rhbz#2053457
  - Allow confined sysadmin to use tool vipw
  Resolves: rhbz#2053457
  - Allow sosreport dbus chat with abrt and timedatex
  Resolves: rhbz#1949493
  - Remove unnecessary /etc file transitions for insights-client
  Resolves: rhbz#2031853
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  Resolves: rhbz#2031853
  - Update insights-client policy
  Resolves: rhbz#2031853
  - Update insights-client: fc pattern, motd, writing to etc
  Resolves: rhbz#2031853
  - Remove permissive domain for insights_client_t
  Resolves: rhbz#2031853
  - New policy for insight-client
  Resolves: rhbz#2031853
  - Add the insights_client module
  Resolves: rhbz#2031853
  - Update specfile to buildrequire policycoreutils-devel >= 2.9-19
  - Add modules_checksum to %files


author: Nikola Knazekova nknazeko@redhat.com - 3.14.3-94
changelog:
  - Allow chronyd send a message to sosreport over datagram socket
  - Allow systemd-logind dbus chat with sosreport
  Resolves: rhbz#1949493


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-95.0.1
changelog:
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Add file context for /var/run/fsck [Orabug: 32789338]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: EL Errata <el-errata_ww@oracle.com> - 3.14.3-95.0.2
changelog:
  - Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Add file context for /var/run/fsck [Orabug: 32789338]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make logrotate work with mls policy [Orabug: 32343731]
  - Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
  - Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-95.2
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2103606
  - Allow transition to insights_client named content
  Resolves: rhbz#2103606
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2103606
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2103606
  - Add the gpg_manage_admin_home_content() interface
  Resolves: rhbz#2103606
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2103606
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2103606
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2103606
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2103606
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2103606
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2103606
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2103606
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2103606
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2103606
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2103606
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2103606
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2103606
  - Add rpm setattr db files macro
  Resolves: rhbz#2103606
  - Fix insights client
  Resolves: rhbz#2103606
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2103606
  - Allow insights-client manage gpg admin home content
  Resolves: rhbz#2103606
  - Label /var/cache/insights with insights_client_cache_t
  Resolves: rhbz#2103606
  - Allow insights-client search gconf homedir
  Resolves: rhbz#2103606
  - Allow insights-client create and use unix_dgram_socket
  Resolves: rhbz#2103606
  - Allow insights-client create_socket_perms for tcp/udp sockets
  Resolves: rhbz#2103606
  - Allow insights-client read rhnsd config files
  Resolves: rhbz#2103606
  - Allow insights-client search rhnsd configuration directory
  Resolves: rhbz#2103606


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-95.3
changelog:
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2103606
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2103606
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2103606
  - Make default file context match with named transitions
  Resolves: rhbz#2103606
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2103606
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2103606


author: Ondrej Vasik <ovasik@redhat.com> - 2.11.1-1
changelog:
  - saslauthd belongs to cyrus-sasl and cyrus-imap packages
  - provide a way how to override set envvars through sh.local file(#1344007)
  - provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.0-1
changelog:
  - move /etc/networks from initscripts to setup
  - move /etc/profile.d/lang.{sh,csh} from initscripts to setup


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - Update to current upstream release 4.6
  - Raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-5
changelog:
  - use cap_setxid file capabilities for newxidmap instead of making them setuid
  - limit the SYS_U/GID_MIN value to 1 as the algorithm does not work with 0
    and the 0 is always used by root anyway
  - manual page improvements
  - flush sssd caches - patch by Jakub Hrozek


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-8
changelog:
  - properly audit group password change
  - do not add uid of a new (not yet added) user to the audit message
  - use lckpwdf() again to disable concurrent edits of databases by
    other applications
  - clarify chage manual page in regards to shadow and passwd
    inconsistency
  - fix minor issues in groupadd and login.defs manual pages
  - Ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - force regeneration of getdate.c otherwise the date parsing fix
    is not applied


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-18
changelog:
  - Update patch to close label to reset libselinux state. Resolves: #1984740
  - useradd: check if subid range exists for user. Resolves: #2012929
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #1994269


author: Björn Esser <besser82@fedoraproject.org> - 2:4.5-9
changelog:
  - Add patch to include crypt.h, if present
  - Use %make_{build,install} macros
  - Refresh other patches for proper alignment


author: Javier Martinez Canillas <javierm@redhat.com> - 15-7
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1715879
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717061


author: Natalya Naumova <natalya.naumova@oracle.com> - 15-11.0.2
changelog:
  - updated with shimaa64.efi, shimia32.efi and shimx64.efi taken from OL7.6 shim-signed rpm
  - updated BOOT*.CSV files to contain Oracle Linux [Orabug: 28073193]
  - new secure boot signing key
  - changed shim-unsigned dependencies to 15-3.0.1 version


author: Ilya Okomin <ilya.okomin@oracle.com> - 15-11.0.5
changelog:
  - removed shim{efiarchlc}-redhat.efi [Orabug: 31663217]
  - updated with shimia32.efi and shimx64.efi signed by Microsoft [Orabug: 31663217]
  - added oracle(grub2-sig-key) and oracle(kernel-sig-key) to package Requires [Orabug: 31663217]
  - added shim-{efiarchlc} to yum protected [Orabug: 31663217]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.3-1.0.1
changelog:
  - Update the shim-unsigned version to 15.3-1.0.1 with SBAT implementation [Orabug: 32670000]
  - Update shimia32.efi and shimx64.efi signed by Test certificate [Orabug: 32670000]
  - Update shimaa64.efi and unsigned version for aarch64 [Orabug: 32670000]


author: Jan Setje-Eilers <Jan.SetjeEilers@oracle.com> - 15.3-1.0.3
changelog:
  - pick up fallback fix from shim-unsigned this does not update the signed shim binaries [Orabug: 33216012]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.5-1.0.1
changelog:
  - Allow MokListTrusted to be enabled by default [Orabug: 33770149]
  - Add patchset to load additional certificates from vendor signed EFI binary [Orabug: 33770149]


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.6-1.0.4
changelog:
  - Rebase to shim v15.6-1 [Orabug: 34821864]
  - Update vendor certs [Orabug: 34821864]
  - Update oracle(grub2-sig-key) [Orabug: 34821864]
  - Update shim-unsigned to v15.6-1.0.3 [Orabug: 34821864]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.1
changelog:
  - Update to 15.8 [Orabug: 36072863]
  - fix CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 [Orabug: 36072863]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.2
changelog:
  - Use binaries with correct shim.ol generation [Orabug: 36072863]
  - Set SBAT_AUTOMATIC_DATE=2021030218 [Orabug: 36072863]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.8-4.0.1
changelog:
  - Add support for Oracle signed shim [Orabug: 36540084]
  - Add shim binaries signed with Oracle Secure Boot Signing (key 1) [Orabug: 36540084]


author: Fabian Arrotin <arrfab@centos.org> - 15-2.centos
changelog:
  - Rolled in CentOS CA for secureboot
  - Added 0005-MokListRT-Fatal.patch to avoid crashing legacy uefi/non SB machines


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15-2.0.1
changelog:
  - Build shim binaries without timestamps [Orabug: 29793968]
  - Remove call to TPM2 get_event_log(), update README.tpm [Orabug: 29793968]
  - Replace certificate with Oracle Corporate one
  - Use redhat as efidir name


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.3-1.0.1
changelog:
  - Update to upstream 15.3 [Orabug: 32670000]
  - Update vendor EFI Signature List [Orabug: 32670000]
  - Remove vendor certificates [Orabug: 32670000]
  - Use bundled gnu-efi [Orabug: 32670000]
  - Fix dos2unix [Orabug: 32670000]


author: Javier Martinez Canillas <javierm@redhat.com> - 15-3
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1715878
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717064


author: Peter Jones <pjones@redhat.com> - 15-4
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-5
changelog:
  - Once more with the MokListRT config table patch added.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1861977
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.7-1.0.1.el8
changelog:
  - Update to shim-15.7 [Orabug: 34821864]
  - Update Oracle sbat metadata and vendor certificates [Orabug: 34821864]
  - Update ol.shim sbat generation to 3 [Orabug: 34821864]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.1.el8
changelog:
  - Update to 15.8 [Orabug: 36072863]
  - Bump ol.shim sbat generation to 4 [Orabug: 36072863]
  - fix CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 [Orabug: 36072863]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.3.el8
changelog:
  - Set SBAT_AUTOMATIC_DATE=2021030218 [Orabug: 36072863]
  - Set ol.shim sbat generation back to 3 [Orabug: 36072863]


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.3-1
changelog:
  - Resolves: RHEL-11417 Upgrade smc-tools to latest version
  - smc_stats: Fix man page name
  - Bump version.


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.4-2
changelog:
  - Rebuilt with https://github.com/google/snappy/archive/1.1.4.tar.gz since
    %{source0} contains different and buggy code.
    https://groups.google.com/forum/#!topic/snappy-compression/uhELq553TrI


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-4
changelog:
  - [apparmor,ceph] fix typo in add_forbidden_path
    Resolves: bz1614955
  - [policies] sanitize report label
    Resolves: bz1614956
  - [policies,process] make lsof execution optional, dont call on RHOSP
    Resolves: bz1614957
  - [sosreport] Add mechanism to encrypt final archive
    Resolves: bz1614952
  - [archive] fix stat typo
    Resolves: bz1614953
  - [rhui] Fix detection of CDS for RHUI3
    Resolves: bz1614954
  - [archive] fix add_string()/do_*_sub() regression
    Resolves: bz1599701


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-5
changelog:
  - [rhv-log-collector-analyzer] Add new plugin for RHV
    Resolves: bz1620049
  - [kubernetes|etcd] Support OpenShift 3.10 deployments
    Resolves: bz1620048
  - [krb5|gssproxy] add new plugin, collect more krb5 files
    Resolves: bz1607630
  - [block] collect luksDump for all encrypted devices
    Resolves: bz1599739
  - [archive] Dont copystat /sys and /proc paths
    Resolves: bz1619234


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-6
changelog:
  - [archive] fix leading path creation
    Resolves: bz1627543
  - [atomic] Define valid preset for RHEL Atomic
    Resolves: bz1627546
  - [utilities] wait till AsyncReader p.poll() returns None
    Resolves: bz1627544


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-7
changelog:
  - [plugin,archive] fix remaining add_link issues
    Resolves: bz1627543
  - [kernel] dont collect some tracing instance files
    Resolves: bz1638637
  - [openstack_*] relax enabling of OSP RedHat plugins
    Resolves: bz1638638
  - [powerpc] Add support to collect DLPAR and LPM related logs
    Resolves: bz1637127


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-8
changelog:
  - [plugins] fix exception when collecting empty strings
    Resolves: bz1632607
  - [crypto] collect more configs and commands
    Resolves: bz1638492
  - [networking] Replace "brctl: by "bridge" commands
    Resolves: bz1644021
  - [firewalld] collect nftables ruleset
    Resolves: bz1644022
  - [composer] New plugin for lorax-composer
    Resolves: bz1644062
  - [Plugin] clean up Plugin.get_option()
    Resolves: bz1655984
  - [ovirt_node] New plugin for oVirt Node
    Resolves: bz1658937
  - [podman] Add support for gathering information on podman
    Resolves: bz1658938
  - [postgresql] Do not limit dump size
    Resolves: bz1658939


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-9
changelog:
  - [block] proper parsing of luks partition on self device
    Resolves: bz1638855
  - [networking] Collect NUMA Node of each NIC
    Resolves: bz1645085
  - [composer] add missing commas in list in add_copy_spec
    Resolves: bz1644062
  - [opendaylight] Update directory for openDaylight logs
    Resolves: bz1642377


author: Livy Ge <livy.ge@oracle.com> = 3.6-10.0.1
changelog:
  - Fix os detect string for Oralce Linux [Orabug: 28674897]
  - Added sos-oraclelinux-vendor-vendorurl.patch


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-1
changelog:
  - Rebase on upstream 3.7
    Resolves: bz1684400
  - [buildah] parse container list properly even for scratch ones
    Resolves: bz1687954
  - [PATCH] [maas,mysql,npm,pacemaker,postgresql] fix plugopts data types
    Resolves: bz1695583
  - [plugins] add vdsm plugin
    Resolves: bz1700780
  - [openstack_instack] add ansible.log
    Resolves: bz1702806
  - [pcp] collect pmlogger without a sizelimit
    Resolves: bz1719884
  - [foreman,satellite] increase plugin default timeouts
    Resolves: bz1719885
  - [sosreport] [sosreport] initialize disabled plugins properly
    Resolves: bz1719886
  - [katello] support both locations of qpid SSL certs
    Resolves: bz1719887


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-2
changelog:
  - [sar] collect whole sar log dir
    Resolves: bz1714243
  - [archive] convert absolute symlink targets to relative
    Resolves: bz1702806
  - [archive] Handle checking container sysroot in _make_leading_paths
    Resolves: bz1728214
  - [frr] FRR plugin
    Resolves: bz1709906
  - [policies] redhat policy to use hostname instead of rhn id
    Resolves: bz1718087
  - Updates to vdsm plugin
    Resolves: bz1700780


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-3
changelog:
  - [openstack] Extract Placement plugin from Nova
    Resolves: bz1717882
  - [utilities] Fix high CPU usage and slow command collection
    Resolves: bz1733352
  - [peripety] collect proper config file
    Resolves: bz1665981
  - [sosreport,plugins] Stop plugin execution after timeout hit
    Resolves: bz1733469
  - [nvme] collect config file everytime
    Resolves: bz1665929


author: Natalya Naumova <natalya.naumova@oracle.com> - 3.7-4.0.1
changelog:
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-7
changelog:
  - [ovirt_hosted_engine] Add gluster deployment and cleanup log
    Resolves: bz1767361
  - [vdsm]: Fix executing shell commands
    Resolves: bz1751171
  - [ovn_*] Add support to containerized setups
    Resolves: bz1767359
  - [ipa] collect ipa-healthcheck logs, kdcproxy configs, httpd cert
    Resolves: bz1767360


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-6
changelog:
  - [ovirt_hosted_engine] Add gluster deployment and cleanup log
    Resolves: bz1744086
  - [vdsm]: Fix executing shell commands
    Resolves: bz1744110
  - [ovn_*] Add support to containerized setups
    Resolves: bz1744553
  - [ipa] collect ipa-healthcheck logs, kdcproxy configs, httpd cert
    Resolves: bz1688764


author: Pavel Moravec <pmoravec@redhat.com> = 3.8-2
changelog:
  - [plugins] improve heuristic for applying --since
    Resolves: bz1789049
  - [Predicate] Override __bool__ to allow py3 evaluation
    Resolves: bz1789018
  - [ceph] Add 'ceph insights' command output
    Resolves: bz1783034
  - [dnf] Collect dnf module list
    Resolves: bz1781819
  - [kernel,networking] collect bpftool net list for each
    Resolves: bz1768956
  - [libreswan] New plugin for "libreswan" IPsec
    Resolves: bz1741330
  - [kernel] collect "bpftool net list"
    Resolves: bz1721779
  - [grub2] call grub2-config with --no-grubenv-update
    Resolves: bz1709682


author: EL Errata <el-errata_ww@oracle.com> - 3.8-2.0.1.el8
changelog:
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: EL Errata <el-errata_ww@oracle.com> - 3.8-6.0.1.el8_2
changelog:
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Pavel Moravec <pmoravec@redhat.com> = 3.8-7
changelog:
  - [selinux] collect /var/lib/selinux
    Resolves: bz1861710
  - [gluster] remove only dump files
    Resolves: bz1861711


author: Pavel Moravec <pmoravec@redhat.com> = 3.9.1-2
changelog:
  - Rebase on upstream 3.9
    Resolves: bz1826656
  - [redhat] fix RH containers without sysroot Attempting to run
    Resolves: bz1825283
  - [containers_common] Add plugin for common containers configs
    Resolves: bz1823488
  - [rabbitmq] Call containerised rabbitmqctl report on
    Resolves: bz1819662
  - [insights] collect insights-client dump
    Resolves: bz1814867
  - [nvmetcli] Add new plugin for NVMe Target CLI
    Resolves: bz1785546
  - [containers_common] collect rootless containers info
    Resolves: bz1776549
  - [networking] collect iptables when proper kernel modules
    Resolves: bz1633006
  - [navicli] replace interactive prompt by plugin option
    Resolves: bz1457191
  - [xdp] Add XDP plugin
    Resolves: bz1838123


author: Pavel Moravec <pmoravec@redhat.com> = 3.9.1-4
changelog:
  - [gluster] fix gluster volume splitlines iteration
    Resolves: bz1843562
  - [nfs] merge nfsserver plugin into nfs one
    Resolves: bz1844853
  - [pacemaker] Fix scrubbing when password contains an equa
    Resolves: bz1845386
  - [powerpc] Add support to collect component logs
    Resolves: bz1843754


author: Pavel Moravec <pmoravec@redhat.com> = 3.9.1-5
changelog:
  - [logs] collect also non-persistent journal logs
    Resolves: bz1850926
  - [block] Fix typo in LUKS detection
    Resolves: bz1850554
  - [powerpc] Fix enablement triggers
    Resolves: bz1851923
  - [pci] Update gating for lspci commands
    Resolves: bz1853700
  - [containers_common] collect user-related commands outputs
    Resolves: bz1776549
  - [gluster] remove only dump files + generated state files
    Resolves: bz1857590
  - [kubernetes] ignore blank+empty lines in "kubectl get nodes"
    Resolves: bz1859888


author: EL Errata <el-errata_ww@oracle.com> - 3.9.1-6.0.1
changelog:
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 3.9.1-7.0.1
changelog:
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Cesar Roque <cesar.roque@oracle.com> - 3.9.1-7.0.3
changelog:
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-3
changelog:
  - [ovirt] collect /etc/pki/ovirt-engine/.truststore
    Resolves: bz1848095
  - [collector] allow overriding plain --cluster-type
    Resolves: bz1895316
  - [component] Add log verbosity from presets
    Resolves: bz1904045
  - [options] Fix --log-size=0 being ignored and unreported
    Resolves: bz1905657
  - [report] collect broken symlinks
    Resolves: bz1906598


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-5
changelog:
  - [component] honour plugopts from config file
    Resolves: bz1912889
  - [collector] declare sysroot for each component
    Resolves: bz1912821
  - [plugins] Dont stop collecting by empty specfile when sizelimit=0
    Resolves: bz1912910


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-7
changelog:
  - [kdump] Gather the file kexec-dmesg.log
    Resolves: bz1887402
  - [Policy] Handle additional FTP authentication issues
    Resolves: bz1916729


author: EL Errata <el-errata_ww@oracle.com> - 4.0-11.0.1
changelog:
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-2
changelog:
  - Load maps from all archives before obfuscation
    Resolves: bz1930181
  - Multiple fixes in man pages
    Resolves: bz1935603
  - [ds] Mask password and encryption keys in ldif files
    Resolves: bz1937298
  - [report] add --cmd-timeout option
    Resolves: bz1937418
  - [cups] Add gathering cups-browsed logs
    Resolves: bz1939963
  - [sssd] Collect memory cache / individual logfiles
    Resolves: bz1940502
  - Collect ibmvNIC dynamic_debugs
    Resolves: bz1942276
  - [pulpcore] add plugin for pulp-3
    Resolves: bz1956673
  - [saphana] remove redundant unused argument of get_inst_info
    Resolves: bz1959413
  - [networking] Add nstat command support
    Resolves: bz1961458
  - [snapper] add a new plugin
    Resolves: bz1961229


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-3
changelog:
  - [gluster] collect public keys from the right dir
    Resolves: bz1925419
  - [cleaner] Only skip packaging-based files for the IP parse
    Resolves: bz1964499
  - [networking] collect also tc filter show ingress
    Resolves: bz1886711
  - [archive] skip copying SELinux context for /proc and /sys
    Resolves: bz1965001
  - [sssd] sssd plugin when sssd-common
    Resolves: bz1967613
  - Various OCP/cluster/cleanup enhancements
    Resolves: bz1973675


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-4
changelog:
  - [options] allow variant option names in config file
    Resolves: bz1923938
  - [plugins] Set default predicate instead of None
    Resolves: bz1985986
  - [MigrationResults] collect info about conversions
    Resolves: bz1959598


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-5
changelog:
  - [report,collect] unify --map-file arguments
    Resolves: bz1923938
  - [rhui] add new plugin for RHUI 4
    Resolves: bz1665947
  - [username parser] Load usernames from `last` for LDAP users
    Resolves: bz1985037


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-8
changelog:
  - [rhui] New log folder
    Resolves: bz2030741
  - nvidia]:Patch to update nvidia plugin for GPU info
    Resolves: bz2025403
  - [hostname] Fix edge case for new hosts in a known subdomain
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-9
changelog:
  - add oc transport, backport various PRs for OCP
    Resolves: bz2036697
  - [report] Provide better warning about estimate-mode
    Resolves: bz1873185
  - [hostname] Fix loading and detection of long base domains
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-12
changelog:
  - [foreman] Use psql-msgpack-decode wrapper for dynflow >= 1.6
    Resolves: bz2043102
  - [virsh] Call virsh commands in the foreground / with a TTY
    Resolves: bz2041488
  - [ovn_central] Account for Red Hat ovn package naming
    Resolves: bz2042966
  - [clean,parsers] Build regex lists for static items only once
    Resolves: bz2036697


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-15
changelog:
  - [sosnode] Handle downstream versioning for runtime option
    Resolves: bz2036697
  - [options] Fix logging on plugopts in effective sos command
    Resolves: bz2054882
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2055547
  - [policies] Set fallback to None sysroot, don't chroot to '/'
    Resolves: bz1873185
  - [ovn_central] Rename container responsable of Red Hat
    Resolves: bz2042966


author: Jan Jansky <jjansky@redhat.com> = 4.2-16
changelog:
  - OCP backport
    Resolves: bz2071824
  - [pacemaker] Update collect cluster profile for pacemaker
    Resolves: bz2071695
  - [Plugin] oom excessive memory usage
    Resolves: bz2071825


author: EL Errata <el-errata_ww@oracle.com> - 4.2-19.0.1
changelog:
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Jan Jansky <jjansky@redhat.com> = 4.2-20
changelog:
  - [ovirt] obfuscate answer file
    Resolves: bz2098639
  - [crio] from output to json
    Resolves: bz2098643


author: EL Errata <el-errata_ww@oracle.com> - 4.2-20.0.1
changelog:
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Jan Jansky <jjansky@redhat.com> = 4.2-21
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2121774
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2125656


author: Jan Jansky <jjansky@redhat.com> = 4.2-22
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2121774
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2125656
  - [convert2rhel] Add archived log collection
    Resolves: bz2129105


author: EL Errata <el-errata_ww@oracle.com> - 4.2-22.0.1
changelog:
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-1
changelog:
  - Rebase on upstream 4.3
    Resolves: bz2055002
  - [sapnw] Fix IndexError exception
    Resolves: bz1992938
  - [Plugin, utilities] Allow writing command output directly to disk
    Resolves: bz1726023
  - [Ceph] Add support for containerized Ceph setup
    Resolves: bz1882544
  - [unbound] Add new plugin for Unbound DNS resolver
    Resolves: bz2018228
  - [discovery] Add new discovery plugin
    Resolves: bz2018549
  - [vdsm] Exclude /var/lib/vdsm/storage/transient_disks
    Resolves: bz2029154


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-2
changelog:
  - [ovirt] answer files: Filter out all password keys
    Resolves: bz2095263
  - [plugins] Allow 'str' PlugOpt type to accept any value
    Resolves: bz2079485
  - [tigervnc] Update collections for newer versions of TigerVNC
    Resolves: bz2062908
  - [pacemaker] Redesign node enumeration logic
    Resolves: bz2065805
  - crio: switch from parsing output in table format to json
    Resolves: bz2092969
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2079187
  - [report] --list-plugins should report used, not default,
    Resolves: bz2079484
  - [utilities] Close file only when storing to file
    Resolves: bz2079486
  - [presets] Adjust OCP preset options, more OCP backports
    Resolves: bz2058279


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-3
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2093993
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2099598


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-5
changelog:
  - [ovn_central] Rename container responsable of Red Hat
    Resolves: bz2042966
  - [PATCH] [host] Skip entire /etc/sos/cleaner directory
    Resolves: bz2023867


author: Anil Lal <anil.palakunnathu.kunnengeri@oracle.com> - 4.3-5.0.2
changelog:
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-1
changelog:
  - Rebase on upstream 4.4
    Resolves: bz2082614
  - [redhat] Honour credential-less --upload-url on RedHat distro properly
    Resolves: bz2059572
  - [sos] Fix unhandled exception when concurrently removing temp dir
    Resolves: bz2088439
  - [specfile] drop python3-libxml2 dependency
    Resolves: bz2125486
  - [md] Restrict data capture to raid members
    Resolves: bz2125485
  - [cleaner] Use compiled regex lists for parsers by default
    Resolves: bz2043233
  - [cgroups] not collect memory.kmem.slabinfo
    Resolves: bz1995120
  - [report] Fix loop devices data gathering
    Resolves: bz2010735
  - [insights] Collect /var/lib/insights
    Resolves: bz2103233
  - [candlepin] collect information about SCA
    Resolves: bz2060925
  - [manpages] Clarify --upload-directory applicable to FTP protocol only
    Resolves: bz2063259
  - [cleaner] Dont obfuscate tmpdir path of local private_map
    Resolves: bz2064815
  - [fibrechannel] collect Cisco fnic statistics
    Resolves: bz2074715
  - [pulpcore] Collect db_tables_sizes
    Resolves: bz2081433
  - [fibrechannel]: Update fibrechannel plugin to collect HBA logs
    Resolves: bz2089591
  - [arcconf]: Update arcconf plugin to collect UART logs
    Resolves: bz2090283
  - [pulpcore] Stop collecting commands relevant to old taskig system
    Resolves: bz2093191
  - [dnf,yum] Merge plugins into dnf, remove yum plugin
    Resolves: bz2100154
  - [policies] Simplify flow in _container_init()
    Resolves: bz2100480
  - [pacemaker] Update collect cluster profile for pacemaker
    Resolves: bz2065821


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-2
changelog:
  - [utilities] Relax from hard dependency of python3-magic
    Resolves: bz2129038
  - [dnf] Collect legacy yum config symlinks, properly obfuscate pwds
    Resolves: bz2100154


author: EL Errata <el-errata_ww@oracle.com> - 4.5.0-1.0.1
changelog:
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.1-3
changelog:
  - Rebase on upstream 4.5.1
    Resolves: bz2175806
  - [composer] Capure /etc/osbuild-composer file
    Resolves: bz2169776
  - [ostree] Collect "ostree fsck" under plugin specific opt
    Resolves: bz2161533
  - [iprconfig] guard whole plugin by sg kmod predicate
    Resolves: bz2176086
  - [cleaner] dont clean sys_tmp from final_path
    Resolves: bz2176218


author: Jan Jansky <jjansky@redhat.com> = 4.5.3-1
changelog:
  - [report] Ignore case when scrubbing via do_file_sub
    Resolves: bz2143272
  - [subscription_manager] Scrub proxy passwords from repo_server_val
    Resolves: bz2177282
  - [virsh] Scrub passwords in virt-manager logs
    Resolves: bz2184062


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.4-1
changelog:
  - [plugins] collect strings before commands
    Resolves: bz2203141
  - [collector] collect report from primary node if in node_list
    Resolves: bz2186460
  - [powerpc] collect invscout logs
    Resolves: bz2210543
  - [rhc] New plugin for RHC
    Resolves: bz2196649


author: Alan Steinberg <alan.steinberg@oracle.com> - 4.5.4-1.0.1
changelog:
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-1
changelog:
  - [clean] Respect permissions of sanitised files
    Resolves: bz2218279
  - [plugin] Fix exception when calling os.makedirs
    Resolves: bz2216608
  - [cleaner] Enhance trailing characters list after AMC address
    Resolves: bz2207562


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-2
changelog:
  - Adding patch for mac obfuscation
    Resolves: bz2218279
    Resolves: bz2216608
    Resolves: bz2207562


author: Darren Archibald <darren.archibald@oracle.com> - 4.6.0-2.0.1
changelog:
  - Rebase sos to 4.6.0
    Resolves: bz2187407
    Resolves: bz2217906
    Resolves: bz2218873
    Resolves: bz2222134


author: Teo Gonzalez <teo.g.gonzalez@oracle.com> = 4.6.1-1.0.1
changelog:
  - rebase to upstream 4.6.1
    Resolves: RHEL-21173
  - [redhat] Change authentication method for RHEL
    Resolves: RHEL-21177


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 4.6.1-1.0.4
changelog:
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808] 
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 4.7.0-1.0.1
changelog:
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 4.7.1-2.0.1
changelog:
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808] 
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: EL Errata <el-errata_ww@oracle.com> - 4.7.1-3.0.1
changelog:
  - Append .txt extension to files rejected by MOS policy [Orabug: 35801795]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: EL Errata <el-errata_ww@oracle.com> - 4.7.2-2.0.1
changelog:
  - Modify sos.spec to make python3-magic as dependency for sos package [Orabug: 36826342]
  - Add exadata plugin to collect exadata specific info [Orabug: 35312548]
  - Append .txt extension to files rejected by MOS policy [Orabug: 35801795]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Anil Lal <anil.palakunnathu.kunnengeri@oracle.com> - 4.7.2-2.0.2
changelog:
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37097463]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37050543]


author: EL Errata <el-errata_ww@oracle.com> - 4.8.1-1.0.1
changelog:
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37097463]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37050543]
  - Modify sos.spec to make python3-magic as dependency for sos package [Orabug: 36826342]
  - Add exadata plugin to collect exadata specific info [Orabug: 35312548]
  - Append .txt extension to files rejected by MOS policy [Orabug: 35801795]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Anil Lal <anil.palakunnathu.kunnengeri@oracle.com> - 4.8.1-1.0.2
changelog:
  - Disable upload options [Orabug: 31969352]  
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Added os detect string [Orabug: 28674897]                    
  - Added sos-oraclelinux-vendor-vendorurl.patch


author: Ryan McCabe <ryan.m.mccabe@oracle.com> - 4.8.1-1.0.3
changelog:
  - Update the enabled and skipped plugins lists to match ExaData's
    requirements. [Orabug: 37440315]


author: EL Errata <el-errata_ww@oracle.com> - 4.8.2-1.0.1
changelog:
  - Update the enabled and skipped plugins lists to match ExaData's
    requirements. [Orabug: 37440315]
  - Disable upload options [Orabug: 31969352]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Added os detect string [Orabug: 28674897]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37097463]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37050543]
  - Modify sos.spec to make python3-magic as dependency for sos package [Orabug: 36826342]
  - Add exadata plugin to collect exadata specific info [Orabug: 35312548]
  - Append .txt extension to files rejected by MOS policy [Orabug: 35801795]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: EL Errata <el-errata_ww@oracle.com> - 4.9.1-2.0.1
changelog:
  - Add Keyboard exception handler to collector [Orabug: 37874482]
  - Print stack of all un-interrupted processes [Orabug: 37630111]
  - Update the enabled and skipped plugins lists to match ExaData's
    requirements. [Orabug: 37440315]
  - Disable upload options [Orabug: 31969352]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Added os detect string [Orabug: 28674897]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Remove rpc_clnt directory from sunrpc debugfs [Orabug: 37097463]
  - Disable ethtool EEPROM dump for link down interfaces [Orabug: 37050543]
  - Modify sos.spec to make python3-magic as dependency for sos package [Orabug: 36826342]
  - Add exadata plugin to collect exadata specific info [Orabug: 35312548]
  - Append .txt extension to files rejected by MOS policy [Orabug: 35801795]
  - Collecting last 50k lines of ftrace file trace [Orabug: 36448808]
  - Adding socket statistics command output [Orabug: 36491747]
  - Add IO queue depth of all the devices on node [Orabug: 35849258]
  - Disable upload option to sos report collector [Orabug: 36069764]
  - Add irq debugfs to sosreport [Orabug: 36511145]
  - Collect all rsyslogs files for all-logs option [Orabug: 36264341]
  - Set SIGPIPE to default action for BrokenPipeError [Orabug: 36016241]
  - Modifying dnf history info remove empty files [Orabug: 35350237]
  - Modifying dnf history info transaction index [Orabug: 35350237]
  - Adding virsh guest cgroup configuration [Orabug: 35088964]
  - Adding PluginOpt support for ksplice and btrfs  [Orabug: 34993258]
  - Adding virsh qemu-monitor info-tree command [Orabug: 34650374]
  - append .txt to .com domain named files [Orabug: 34523347]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Fix ksplice plugin does not show description [Orabug: 32886513]
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-5
changelog:
  - Fixed CVE-2019-13752 (#1786529) 
  - Fixed CVE-2019-13753 (#1786535) 
  - Fixed CVE-2019-13734 (#1786509) 
  - Fixed CVE-2019-19924 (#1789776)
  - Fixed CVE-2019-19923 (#1789812)
  - Fixed CVE-2019-19925 (#1789808)
  - Fixed CVE-2019-19959 (#1789823)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Petr Kubat <pkubat@redhat.com> - 3.26.0-1
changelog:
  - Updated to version 3.26.0 (https://sqlite.org/releaselog/3_26_0.html)
    Fixes fts3/4 corrupt database exploit (#1659684)


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Abhi Das <adas@redhat.com> - 4.3-21
changelog:
  - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
    CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
    Resolves: rhbz#2007303 rhbz#2000637


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.23-4
changelog:
  - Fix tests build with fresh glibc that now provides struct statx in sys/stat.h.
  - Resolves #1611749.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
  - Add transition for strace32 package pn those architectures that
    provided it in RHEL 7 (ppc64 and s390x).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Sync up thread handling unfairness fix with the upstream version.
  - Fix "xlat_idx: Unexpected xlat value 0 at index ..." messages (#1660759).
  - Remove "ptrace(SYSCALL): No such process" messages (#1662936).
  - Wire up rseq and kexec_file_load on aarch64 (#1676045).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Pull upstream fix for ioctl evdev bitset decoding, fix the tests (#1747214).
  - Include commit v4.26~65 "s390x: beautify sthyi data tail prints" (#1747514).
  - Include upstream patches that fix issues reported by covscan (#1747526):
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing",
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register", and
    2b64854e "xlat: use unsgined type for mount_flags fallback values".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790053):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Properly decode struct sockaddr_hci without hci_channel field.
  - Update tests-m32/ioctl_evdev.c and tests-mx32/ioctl_evdev.c
    in 0002-evdev-fix-decoding-of-EVIOCGBIT-0.patch.
  - Update tests-m32/Makefile.in and tests-mx32/Makefile.in
    in 0032-tests-check-decoding-of-successful-evdev-ioctl.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-8
changelog:
  - Fix expected alignment for IPC tests (#1795251):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".
  - Update tests-m32/looping_threads.test and tests-mx32/looping_threads.test
    in 0025-tests-check-tracing-of-looping-threads.patch.
  - Update the bpf syscall decoder:
    d6c71dd0 "Fix preprocessor indentation",
    cabd6955 "bpf: print struct bpf_prog_info.gpl_compatible",
    14a9b6ca "bpf: add support for btf_* fields in BPF_MAP_CREATE",
    27bd13d3 "bpf: add support for btf_* fields in struct bpf_map_info",
    d1f90bcd "bpf: add support for *jited_ksyms and *jited_func_lens fields
             in struct bpf_prog_info", and
    940fe50f "bpf: add support for new twelve fields in struct bpf_prog_info".
    c661605b "tests: robustify bpf-obj_get_info_by_fd test against future kernels"


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-9
changelog:
  - Fix the "extra tokens at end of #ifdef directive" warning:
    579f2702 "bpf: exclude bit fields from the check".


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2.1
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-8570).
  - Update net-yy-inet*, linkat--secontext_mismatch, and prctl-sve tests.


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fixes CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Clemens Lang <cllang@redhat.com> - 5.71-1
changelog:
  - New upstream release 5.71
    Resolves: RHEL-2340
  - Enable socket activation support
  - verify upstream source in %prep
  - clean up stale conditionals


author: Clemens Lang <cllang@redhat.com> - 5.71-2
changelog:
  - Speed up loading client CA list from CAfile
    Resolves: RHEL-46411
  - Do not load all CAs in client mode to allow continued use of BEGIN TRUSTED CERTIFICATE format
    Resolves: RHEL-50154


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-1
changelog:
  - rebase to the new upstream version 1.8.25p1
  - sync patches with rhel-7.6
  - sync sudoers with rhel-7.6
    resolves: rhbz#1633144


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.25-2
changelog:
  - Depend explicitly on /usr/sbin/sendmail instead of sendmail (rhel-7 sync)
  - Simplified pam configuration file by removing duplicate pam stack entries
  Resolves: rhbz#1633144


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-4.el8.1
changelog:
  - RHEL 8.0.0z ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1743168


author: Keshav Sharma <keshav.sharma@oracle.com> 1.8.25-4.0.1.el8.1
changelog:
  - Treat an ID of -1 as invalid since that means "no change" [Orabug: 30421281] {CVE-2019-14287}
  - Add sudo_strtoid() tests for -1 and range errors. [Orabug: 30421281]


author: Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
changelog:
  - replace file-based requirements with package-level ones:
  - /etc/pam.d/system-auth to 'pam'
  - /bin/chmod to 'coreutils' (bug #1488934)
  - /usr/bin/vi to vim-minimal
  - ... and make vim-minimal "recommends" instead of "requires", because
    other editors can be configured.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-5
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed problem with sudo-1.8.23 and 'who am i'
  Resolves: rhbz#1673886
  - Backporting sudo bug with expired passwords
  Resolves: rhbz#1676819


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Natalya Naumova <natalya.naumova@oracle.com> 1.8.25-7.0.1
changelog:
  - Treat an ID of -1 as invalid since that means "no change" [Orabug: 30421281] {CVE-2019-14287} (Keshav Sharma)
  - Add sudo_strtoid() tests for -1 and range errors. [Orabug: 30421281] (Keshav Sharma)


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.9
changelog:
  RHEL 8.8.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161221
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2114576


author: RAdovan Sroka <rsroka@redhat.com> - 1.8.29-7.1
changelog:
  RHEL 8.4.0 ZSTREAM ERRATUM
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#2015136


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.8.1
changelog:
  RHEL 8.7.0.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161220


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-1
changelog:
  RHEL 8.9.0.Z ERRATUM
  - Rebase to 1.9.5p2
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21825
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21831
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21820


author: Alejandro López <allopez@redhat.com> - 1.9.5p2-10.2
changelog:
  RHEL 8.10.0.Z ERRATUM
  - Reintroduce cmnd_no_wait
  Resolves: RHEL-51956
  - Missing separator in the log
  Resolves: RHEL-71913


author: Robert Scheck <robert@fedoraproject.org> - 6.04-0.3
changelog:
  - Own %{_datadir}/syslinux/diag directory (#894529)
  - Allow rebuilding on RHEL/CentOS 6 and 7 (#1291428)


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: Michal Sekletár <msekleta@redhat.com> - 239-7
changelog:
  - change default cgroup hierarchy to "legacy" (#1638650)
  - we never added mymachines module to passwd: or group: in RHEL8, hence don't try to remove it (#1638450)
  - bump minimal size of random pool to 1024 bytes (#1619268)
  - install RHEL-7 compatible rc.local (#1625209)
  - backport support for sector-size crypttab option (#1572563)
  - units: don't enable per-service IP firewall by default (#1630219)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - bus-message: do not crash on message with a string of zero length (#1635439)
  - bus-message: stack based buffer overflow in free_and_strdup (#1635428)
  - journal: change support URL shown in the catalog entries (#1550548)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-9
changelog:
  - dissect-image: use right comparison function (#1602706)
  - login: avoid leak of name returned by uid_to_name() (#1602706)
  - firewall-util: add an assert that we're not overwriting a buffer (#1602706)
  - journal-file: avoid calling ftruncate with invalid fd (#1602706)
  - dhcp6: make sure we have enough space for the DHCP6 option header (#1643363)
  - core: rename queued_message → pending_reload_message (#1647359)
  - core: when we can't send the pending reload message, say we ignore it in the warning we log (#1647359)
  - core: make sure we don't throttle change signal generator when a reload is pending (#1647359)
  - proc-cmdline: introduce PROC_CMDLINE_RD_STRICT (#1643429)
  - debug-generator: introduce rd.* version of all options (#1643429)
  - chown-recursive: let's rework the recursive logic to use O_PATH (#1643368)
  - chown-recursive: also drop ACLs when recursively chown()ing (#1643368)
  - chown-recursive: TAKE_FD() is your friend (#1643368)
  - test: add test case for recursive chown()ing (#1643368)
  - Revert "sysctl.d: request ECN on both in and outgoing connections" (#1619790)
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631532)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - sd-bus: properly initialize containers (#1635435)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-10
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1656869)
  - cryptsetup: don't use %m if there's no error to show (#1656869)
  - cryptsetup-generator: don't return error if target directory already exists (#1656869)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1656869)
  - rules: watch metadata changes on DASD devices (#1638676)
  - sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2 (#1653824)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-12
changelog:
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - coredump: remove duplicate MESSAGE= prefix from message (#1664976)
  - journald: remove unnecessary {} (#1664976)
  - journald: do not store the iovec entry for process commandline on stack (#1664976)
  - basic/process-util: limit command line lengths to _SC_ARG_MAX (#1664976)
  - coredump: fix message when we fail to save a journald coredump (#1664976)
  - procfs-util: expose functionality to query total memory (#1664976)
  - basic/prioq: add prioq_peek_item() (#1664976)
  - journal: limit the number of entries in the cache based on available memory (#1664976)
  - journald: periodically drop cache for all dead PIDs (#1664976)
  - process-util: don't use overly large buffer to store process command line (#1664976)
  - Revert "sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2" (#1653824)
  - journal: fix syslog_parse_identifier() (#1664978)
  - journald: set a limit on the number of fields (1k) (#1664977)
  - journald: when processing a native message, bail more quickly on overbig messages (#1664977)
  - journald: lower the maximum entry size limit to ½ for non-sealed fds (#1664977)
  - µhttpd: use a cleanup function to call MHD_destroy_response (#1664977)
  - journal-remote: verify entry length from header (#1664977)
  - journal-remote: set a limit on the number of fields in a message (#1664977)
  - journald: correctly attribute log messages also with cgroupsv1 (#1658115)
  - rules: add elevator= kernel command line parameter (#1670126)


author: Livy Ge <livy.ge@oracle.com> - 239-13.0.1
changelog:
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: Lukas Nykryn <lnykryn@redhat.com> - 239-13.2
changelog:
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
  - Allocate temporary strings to hold dbus paths on the heap (#1678641)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-13.4
changelog:
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1705379)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-14
changelog:
  - rules: implement new memory hotplug policy (#1670728)
  - rules: add the rule that adds elevator= kernel command line parameter (#1670126)
  - bus-socket: Fix line_begins() to accept word matching full string (#1692991)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
  - Allocate temporary strings to hold dbus paths on the heap (#1678641)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1703485)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-15
changelog:
  - tree-wide: shorten error logging a bit (#1697893)
  - nspawn: simplify machine terminate bus call (#1697893)
  - nspawn: merge two variable declaration lines (#1697893)
  - nspawn: rework how we allocate/kill scopes (#1697893)
  - unit: enqueue cgroup empty check event if the last ref on a unit is dropped (#1697893)
  - Revert "journal: remove journal audit socket" (#1699287)
  - journal: don't enable systemd-journald-audit.socket by default (#1699287)
  - logs-show: use grey color for de-emphasizing journal log output (#1695601)
  - units: add [Install] section to tmp.mount (#1667065)
  - nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESS (#1691691)
  - util.h: add new UNPROTECT_ERRNO macro (#1691691)
  - nss: unportect errno before writing to NSS' *errnop (#1691691)
  - seccomp: reduce logging about failure to add syscall to seccomp (#1658691)
  - format-table: when duplicating a cell, also copy the color (#1689832)
  - format-table: optionally make specific cells clickable links (#1689832)
  - format-table: before outputting a color, check if colors are available (#1689832)
  - format-table: add option to store/format percent and uint64_t values in cells (#1689832)
  - format-table: optionally allow reversing the sort order for a column (#1689832)
  - format-table: add table_update() to update existing entries (#1689832)
  - format-table: add an API for getting the cell at a specific row/column (#1689832)
  - format-table: always underline header line (#1689832)
  - format-table: add calls to query the data in a specific cell (#1689832)
  - format-table: make sure we never call memcmp() with NULL parameters (#1689832)
  - format-table: use right field for display (#1689832)
  - format-table: add option to uppercase cells on display (#1689832)
  - format-table: never try to reuse cells that have color/url/uppercase set (#1689832)
  - locale-util: add logic to output smiley emojis at various happiness levels (#1689832)
  - analyze: add new security verb (#1689832)
  - tests: add a rudimentary fuzzer for server_process_syslog_message (#9979) (#1696224)
  - journald: make it clear that dev_kmsg_record modifies the string passed to it (#1696224)
  - journald: free the allocated memory before returning from dev_kmsg_record (#1696224)
  - tests: rework the code fuzzing journald (#1696224)
  - journald: make server_process_native_message compatible with fuzz_journald_processing_function (#1696224)
  - tests: add a fuzzer for server_process_native_message (#1696224)
  - tests: add a fuzzer for sd-ndisc (#1696224)
  - ndisc: fix two infinite loops (#1696224)
  - tests: add reproducers for several issues uncovered with fuzz-journald-syslog (#1696224)
  - tests: add a reproducer for an infinite loop in ndisc_handle_datagram (#1696224)
  - tests: add a reproducer for another infinite loop in ndisc_handle_datagram (#1696224)
  - fuzz: rename "fuzz-corpus" directory to just "fuzz" (#1696224)
  - test: add testcase for issue 10007 by oss-fuzz (#1696224)
  - fuzz: unify the "fuzz-regressions" directory with the main corpus (#1696224)
  - test-bus-marshal: use cescaping instead of hexmem (#1696224)
  - meson: add -Dlog-trace to set LOG_TRACE (#1696224)
  - meson: allow building resolved and machined without nss modules (#1696224)
  - meson: drop duplicated condition (#1696224)
  - meson: use .source_root() in more places (#1696224)
  - meson: treat all fuzz cases as unit tests (#1696224)
  - fuzz-bus-message: add fuzzer for message parsing (#1696224)
  - bus-message: use structured initialization to avoid use of unitialized memory (#1696224)
  - bus-message: avoid an infinite loop on empty structures (#1696224)
  - bus-message: let's always use -EBADMSG when the message is bad (#1696224)
  - bus-message: rename function for clarity (#1696224)
  - bus-message: use define (#1696224)
  - bus: do not print (null) if the message has unknown type (#1696224)
  - bus-message: fix calculation of offsets table (#1696224)
  - bus-message: remove duplicate assignment (#1696224)
  - bus-message: fix calculation of offsets table for arrays (#1696224)
  - bus-message: drop asserts in functions which are wrappers for varargs version (#1696224)
  - bus-message: output debug information about offset troubles (#1696224)
  - bus-message: fix skipping of array fields in !gvariant messages (#1696224)
  - bus-message: also properly copy struct signature when skipping (#1696224)
  - fuzz-bus-message: add two test cases that pass now (#1696224)
  - bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messages (#1696224)
  - bus-message: avoid wrap-around when using length read from message (#1696224)
  - util: do not use stack frame for parsing arbitrary inputs (#1696224)
  - travis: enable ASan and UBSan on RHEL8 (#1683319)
  - tests: keep SYS_PTRACE when running under ASan (#1683319)
  - tree-wide: various ubsan zero size memory fixes (#1683319)
  - util: introduce memcmp_safe() (#1683319)
  - test-socket-util: avoid "memleak" reported by valgrind (#1683319)
  - sd-journal: escape binary data in match_make_string() (#1683319)
  - capability: introduce CAP_TO_MASK_CORRECTED() macro replacing CAP_TO_MASK() (#1683319)
  - sd-bus: use size_t when dealing with memory offsets (#1683319)
  - sd-bus: call cap_last_cap() only once in has_cap() (#1683319)
  - mount-point: honour AT_SYMLINK_FOLLOW correctly (#1683319)
  - travis: switch from trusty to xenial (#1683319)
  - test-socket-util: Add tests for receive_fd_iov() and friends. (#1683319)
  - socket-util: Introduce send_one_fd_iov() and receive_one_fd_iov() (#1683319)
  - core: swap order of "n_storage_fds" and "n_socket_fds" parameters (#1683334)
  - execute: use our usual syntax for defining bit masks (#1683334)
  - core: introduce new Type=exec service type (#1683334)
  - man: document the new Type=exec type (#1683334)
  - sd-bus: allow connecting to the pseudo-container ".host" (#1683334)
  - sd-login: let's also make sd-login understand ".host" (#1683334)
  - test: add test for Type=exec (#1683334)
  - journal-gateway: explicitly declare local variables (#1705971)
  - tools: drop unused variable (#1705971)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1705971)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-16
changelog:
  - sd-bus: deal with cookie overruns (#1694999)
  - journal-remote: do not request Content-Length if Transfer-Encoding is chunked (#1708849)
  - journal: do not remove multiple spaces after identifier in syslog message (#1691817)
  - cryptsetup: Do not fallback to PLAIN mapping if LUKS data device set fails. (#1719153)
  - cryptsetup: call crypt_load() for LUKS only once (#1719153)
  - cryptsetup: Add LUKS2 token support. (#1719153)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1713227)
  - Change job mode of manager triggered restarts to JOB_REPLACE (#11456
  - bash-completion: analyze: support 'security' (#1733395)
  - man: note that journal does not validate syslog fields (#1707175)
  - rules: skip memory hotplug on ppc64 (#1713159)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-17
changelog:
  - mount: simplify /proc/self/mountinfo handler (#1696178)
  - mount: rescan /proc/self/mountinfo before processing waitid() results (#1696178)
  - swap: scan /proc/swaps before processing waitid() results (#1696178)
  - analyze-security: fix potential division by zero (#1734400)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18
changelog:
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: Tianyue Lan <tianyue.lan@oracle.com> - 239-18.0.1
changelog:
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18.1
changelog:
  - journal: rely on _cleanup_free_ to free a temporary string used in client_context_read_cgroup (#1767716)


author: EL Errata <el-errata_ww@oracle.com> - 239-18.0.2.el8_1.1
changelog:
  - fix to generate systemd-pstore.service file [Orabug: 30230056]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-18.3
changelog:
  - core, job: fix breakage of ordering dependencies by systemctl reload command (#1781712)
  - syslog: fix segfault in syslog_parse_priority() (#1781712)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1781712)
  - test: use PBKDF2 instead of Argon2 in cryptsetup... (#1781712)
  - test: mask several unnecessary services (#1781712)
  - test: bump the second partition's size to 50M (#1781712)
  - sd-bus: make rqueue/wqueue sizes of type size_t (#20201712)
  - sd-bus: reorder bus ref and bus message ref handling (#20201712)
  - sd-bus: make sure dispatch_rqueue() initializes return parameter on all types of success (#20201712)
  - sd-bus: drop two inappropriate empty lines (#20201712)
  - sd-bus: initialize mutex after we allocated the wqueue (#20201712)
  - sd-bus: always go through sd_bus_unref() to free messages (#20201712)
  - bus-message: introduce two kinds of references to bus messages (#20201712)
  - sd-bus: introduce API for re-enqueuing incoming messages (#20201712)
  - sd-event: add sd_event_source_disable_unref() helper (#20201712)
  - polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it (#20201712)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-18.4
changelog:
  - sd-bus: use "queue" message references for managing r/w message queues in connection objects (CVE-2020-1712)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-18.5
changelog:
  - journal: do not trigger assertion when journal_file_close() get NULL (#1807350)
  - journal: use cleanup attribute at one more place (#1807350)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-21
changelog:
  - test-cpu-set-util: fix comparison for allocation size (#1734787)
  - test-cpu-set-util: fix allocation size check on i386 (#1734787)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-23
changelog:
  - catalog: fix name of variable (#1677768)
  - cryptsetup: add keyfile-timeout to allow a keydev timeout and allow to fallback to a password if it fails. (#1763155)
  - cryptsetup: add documentation for keyfile-timeout (#1763155)
  - cryptsetup: use unabbrieviated variable names (#1763155)
  - cryptsetup: don't assert on variable which is optional (#1763155)
  - cryptsetup-generator: guess whether the keyfile argument is two items or one (#1763155)
  - crypt-util: Translate libcryptsetup log level instead of using log_debug() (#1776408)
  - cryptsetup: add some commenting about EAGAIN generation (#1776408)
  - cryptsetup: downgrade a log message we ignore (#1776408)
  - cryptsetup: rework how we log about activation failures (#1776408)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-24
changelog:
  - rules: reintroduce 60-alias-kmsg.rules (#1739353)
  - sd-bus: make rqueue/wqueue sizes of type size_t (CVE-2020-1712)
  - sd-bus: reorder bus ref and bus message ref handling (CVE-2020-1712)
  - sd-bus: make sure dispatch_rqueue() initializes return parameter on all types of success (CVE-2020-1712)
  - sd-bus: drop two inappropriate empty lines (CVE-2020-1712)
  - sd-bus: initialize mutex after we allocated the wqueue (CVE-2020-1712)
  - sd-bus: always go through sd_bus_unref() to free messages (CVE-2020-1712)
  - bus-message: introduce two kinds of references to bus messages (CVE-2020-1712)
  - sd-bus: introduce API for re-enqueuing incoming messages (CVE-2020-1712)
  - sd-event: add sd_event_source_disable_unref() helper (CVE-2020-1712)
  - polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it (CVE-2020-1712)
  - sysctl: let's by default increase the numeric PID range from 2^16 to 2^22 (#1744214)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1788085)
  - journal: use cleanup attribute at one more place (#1788085)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-25
changelog:
  - sd-bus: use "queue" message references for managing r/w message queues in connection objects (CVE-2020-1712)
  - pid1: make sure to restore correct default values for some rlimits (#1789930)
  - main: introduce a define HIGH_RLIMIT_MEMLOCK similar to HIGH_RLIMIT_NOFILE (#1789930)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-26
changelog:
  - seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files (#1687512)
  - test: add test case for restrict_suid_sgid() (#1687512)
  - core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= (#1687512)
  - analyze: check for RestrictSUIDSGID= in "systemd-analyze security" (#1687512)
  - man: document the new RestrictSUIDSGID= setting (#1687512)
  - units: turn on RestrictSUIDSGID= in most of our long-running daemons (#1687512)
  - core: imply NNP and SUID/SGID restriction for DynamicUser=yes service (#1687512)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-28
changelog:
  - pid1: fix DefaultTasksMax initialization (#1809037)
  - cgroup: make sure that cpuset is supported on cgroup  v2 and disabled with v1 (#1808940)
  - test: introduce TEST-36-NUMAPOLICY (#1808940)
  - test: replace `tail -f` with journal cursor which  should be more reliable (#1808940)
  - test: support MPOL_LOCAL matching in unpatched strace  versions (#1808940)
  - test: make sure the strace process is indeed dead (#1808940)
  - test: skip the test on systems without NUMA support (#1808940)
  - test: give strace some time to initialize (#1808940)
  - test: add a simple sanity check for systems without  NUMA support (#1808940)
  - test: drop the missed || exit 1 expression (#1808940)
  - test: replace cursor file with a plain cursor (#1808940)


author: EL Errata <el-errata_ww@oracle.com> - 239-29.0.1.el8
changelog:
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix to generate systemd-pstore.service file [Orabug: 30230056]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-30
changelog:
  - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1824129)
  - core: fix re-realization of cgroup siblings (#1824129)
  - basic: use comma as separator in cpuset cgroup cpu ranges (#1824129)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-31
changelog:
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1821372)
  - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1827621)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-31.1
changelog:
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1826217)
  - sd-journal: remove the dead code and actually fix #14695 (#1826217)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-31.2
changelog:
  - test: do not use global variable to pass error (#1836979)
  - test: install libraries required by tests (#1836979)
  - test: introduce install_zoneinfo() (#1836979)
  - test: replace duplicated Makefile by symbolic link (#1836979)
  - test: add paths of keymaps in install_keymaps() (#1836979)
  - test: make install_keymaps() optionally install more keymaps (#1836979)
  - test-fs-util: skip some tests when running in unprivileged container (#1836979)
  - test-process-util: skip several verifications when running in unprivileged container (#1836979)
  - test-execute: also check python3 is installed or not (#1836979)
  - test-execute: skip several tests when running in container (#1836979)
  - test: introduce test_is_running_from_builddir() (#1836979)
  - test: make test-catalog relocatable (#1836979)
  - test: parallelize tasks in TEST-24-UNIT-TESTS (#1836979)
  - test: try to determine QEMU_SMP dynamically (#1836979)
  - test: store coredumps in journal (#1836979)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1836981)
  - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837423)
  - nspawn: chown() the legacy hierarchy when it's used in a container (#1837423)


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 239-31.0.1.el8_2.2
changelog:
  - backport upstream pstore tmpfiles patch [Orabug: 31420486]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix to generate systemd-pstore.service file [Orabug: 30230056]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-32
changelog:
  - pid1: fix DefaultTasksMax initialization (#1809037)
  - cgroup: make sure that cpuset is supported on cgroup v2 and disabled with v1 (#1808940)
  - test: introduce TEST-36-NUMAPOLICY (#1808940)
  - test: replace `tail -f` with journal cursor which should be... (#1808940)
  - test: support MPOL_LOCAL matching in unpatched strace versions (#1808940)
  - test: make sure the strace process is indeed dead (#1808940)
  - test: skip the test on systems without NUMA support (#1808940)
  - test: give strace some time to initialize (#1808940)
  - test: add a simple sanity check for systems without NUMA support (#1808940)
  - test: drop the missed || exit 1 expression (#1808940)
  - test: replace cursor file with a plain cursor (#1808940)
  - cryptsetup: Treat key file errors as a failed password attempt (#1763155)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749622)
  - resolved: Recover missing PrivateTmp=yes and ProtectSystem=strict (#1810869)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798504)
  - core: rework StopWhenUnneeded= logic (#1798046)
  - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1818054)
  - core: fix re-realization of cgroup siblings (#1818054)
  - basic: use comma as separator in cpuset cgroup cpu ranges (#1818054)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766479)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1796128)
  - sd-journal: remove the dead code and actually fix #14695 (#1796128)
  - udev: downgrade message when we fail to set inotify watch up (#1808051)
  - logind: check PolicyKit before allowing VT switch (#1797679)
  - test: do not use global variable to pass error (#1823767)
  - test: install libraries required by tests (#1823767)
  - test: introduce install_zoneinfo() (#1823767)
  - test: replace duplicated Makefile by symbolic link (#1823767)
  - test: add paths of keymaps in install_keymaps() (#1823767)
  - test: make install_keymaps() optionally install more keymaps (#1823767)
  - test-fs-util: skip some tests when running in unprivileged container (#1823767)
  - test-process-util: skip several verifications when running in unprivileged container (#1823767)
  - test-execute: also check python3 is installed or not (#1823767)
  - test-execute: skip several tests when running in container (#1823767)
  - test: introduce test_is_running_from_builddir() (#1823767)
  - test: make test-catalog relocatable (#1823767)
  - test: parallelize tasks in TEST-24-UNIT-TESTS (#1823767)
  - test: try to determine QEMU_SMP dynamically (#1823767)
  - test: store coredumps in journal (#1823767)
  - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1812894)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1820112)
  - man: be clearer that .timer time expressions need to be reset to override them (#1816908)
  - Add support for opening files for appending (#1809175)
  - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837094)
  - core: move unit_status_emit_starting_stopping_reloading() and related calls to job.c (#1737283)
  - job: when a job was skipped due to a failed condition, log about it (#1737283)
  - core: split out all logic that updates a Job on a unit's unit_notify() invocation (#1737283)
  - core: make log messages about units entering a 'failed' state recognizable (#1737283)
  - core: log a recognizable message when a unit succeeds, too (#1737283)
  - tests: always use the right vtable wrapper calls (#1737283)
  - test-execute: allow filtering test cases by pattern (#1737283)
  - test-execute: provide custom failure message (#1737283)
  - core: ExecCondition= for services (#1737283)
  - Drop support for lz4 < 1.3.0 (#1843871)
  - test-compress: add test for short decompress_startswith calls (#1843871)
  - journal: adapt for new improved LZ4_decompress_safe_partial() (#1843871)
  - fuzz-compress: add fuzzer for compression and decompression (#1843871)
  - seccomp: fix __NR__sysctl usage (#1843871)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-33
changelog:
  - tmpfiles: fix crash with NULL in arg_root and other fixes and tests (#1836024)
  - sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set (#1625929)
  - resolvconf: fixes for the compatibility interface (#1835594)
  - mount: don't add Requires for tmp.mount (#1748840)
  - core: coldplug possible nop_job (#1829798)
  - core: add IODeviceLatencyTargetSec (#1831519)
  - time-util: Introduce parse_sec_def_infinity (#1770379)
  - cgroup: use structured initialization (#1770379)
  - core: add CPUQuotaPeriodSec= (#1770379)
  - core: downgrade CPUQuotaPeriodSec= clamping logs to debug (#1770379)
  - sd-bus: avoid magic number in SASL length calculation (#1838081)
  - sd-bus: fix SASL reply to empty AUTH (#1838081)
  - sd-bus: skip sending formatted UIDs via SASL (#1838081)
  - core: add MemoryMin (#1763435)
  - core: introduce cgroup_add_device_allow() (#1763435)
  - test: remove support for suffix in get_testdata_dir() (#1763435)
  - cgroup: Implement default propagation of MemoryLow with DefaultMemoryLow (#1763435)
  - cgroup: Create UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP (#1763435)
  - unit: Add DefaultMemoryMin (#1763435)
  - cgroup: Polish hierarchically aware protection docs a bit (#1763435)
  - cgroup: Readd some plumbing for DefaultMemoryMin (#1763435)
  - cgroup: Support 0-value for memory protection directives (#1763435)
  - cgroup: Test that it's possible to set memory protection to 0 again (#1763435)
  - cgroup: Check ancestor memory min for unified memory config (#1763435)
  - cgroup: Respect DefaultMemoryMin when setting memory.min (#1763435)
  - cgroup: Mark memory protections as explicitly set in transient units (#1763435)
  - meson: allow setting the version string during configuration (#1804252)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-36
changelog:
  - core: don't consider SERVICE_SKIP_CONDITION for abnormal or failure restarts (#1737283)
  - selinux: do preprocessor check only in selinux-access.c (#1830861)
  - basic/cgroup-util: introduce cg_get_keyed_attribute_full() (#1830861)
  - shared: add generic logic for waiting for a unit to enter some state (#1830861)
  - shared: fix assert call (#1830861)
  - shared: Don't try calling NULL callback in bus_wait_for_units_clear (#1830861)
  - shared: add NULL callback check in one more place (#1830861)
  - core: introduce support for cgroup freezer (#1830861)
  - core/cgroup: fix return value of unit_cgorup_freezer_action() (#1830861)
  - core: fix the return value in order to make sure we don't dipatch method return too early (#1830861)
  - test: add test for cgroup v2 freezer support (#1830861)
  - fix mis-merge (#1848421)
  - tests: sleep a bit and give kernel time to perform the action after manual freeze/thaw (#1848421)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1931947)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1931947)
  - sd-event: split out helper functions for reshuffling prioqs (#1819868)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1819868)
  - sd-event: mention that two debug logged events are ignored (#1819868)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1819868)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1819868)
  - sd-event: fix delays assert brain-o (#17790) (#1819868)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1819868)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1819868)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1819868)
  - sd-event: follow coding style with naming return parameter (#1819868)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1819868)
  - sd-event: update state at the end in event_source_enable (#1819868)
  - sd-event: increase n_enabled_child_sources just once (#1819868)
  - sd-event: add ability to ratelimit event sources (#1819868)
  - test: add ratelimiting test (#1819868)
  - core: prevent excessive /proc/self/mountinfo parsing (#1819868)
  - udev: run link_update() with increased retry count in second invocation (#1931947)
  - pam-systemd: use secure_getenv() rather than getenv() (#1687514)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.1
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1963980)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1963980)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1963980)


author: EL Errata <el-errata_ww@oracle.com> - 239-45.0.2
changelog:
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - backport upstream pstore tmpfiles patch [Orabug: 31420486]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix to generate systemd-pstore.service file [Orabug: 30230056]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.3
changelog:
  - sd-event: change ordering of pending/ratelimited events (#1984406)
  - sd-event: drop unnecessary "else" (#1984406)
  - sd-event: use CMP() macro (#1984406)
  - sd-event: use usec_add() (#1984406)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1984406)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1984406)
  - meson: remove strange dep that causes meson to enter infinite loop (#1984406)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1984406)
  - ci: run unit tests on z-stream branches as well (#1984406)
  - remove a left-over break (#1984406)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1935124)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1935124)
  - sd-event: split out helper functions for reshuffling prioqs (#1937315)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1937315)
  - sd-event: mention that two debug logged events are ignored (#1937315)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1937315)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1937315)
  - sd-event: fix delays assert brain-o (#17790) (#1937315)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1937315)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1937315)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1937315)
  - sd-event: follow coding style with naming return parameter (#1937315)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1937315)
  - sd-event: update state at the end in event_source_enable (#1937315)
  - sd-event: increase n_enabled_child_sources just once (#1937315)
  - sd-event: add ability to ratelimit event sources (#1937315)
  - test: add ratelimiting test (#1937315)
  - core: prevent excessive /proc/self/mountinfo parsing (#1937315)
  - udev: run link_update() with increased retry count in second invocation (#1935124)
  - pam-systemd: use secure_getenv() rather than getenv() (#1936866)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-46
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1942299)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1942299)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1942299)


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-50
changelog:
  - Added option --check-inhibitors for non-tty usage (#1269726)
  - logind: Introduce RebootWithFlags and others (#1269726)
  - logind: add …WithFlags methods to policy (#1269726)
  - logind: simplify flags handling a bit (#1269726)
  - Update link to RHEL documentation (#1982584)
  - Set default core ulimit to 0, but keep the hard limit ulimited (#1905582)
  - shared/seccomp-util: address family filtering is broken on ppc (#1982650)
  - logind: rework Seat/Session/User object allocation and freeing a bit (#1642460)
  - logind: fix serialization/deserialization of user's "display session" (#1642460)
  - logind: turn of stdio locking when writing session files too (#1642460)
  - units: set StopWhenUnneeded= for the user slice units too (#1642460)
  - units: improve Description= string a bit (#1642460)
  - logind: improve logging in manager_connect_console() (#1642460)
  - logind: save/restore User object's "stopping" field during restarts (#1642460)
  - logind: correct bad clean-up path (#1642460)
  - logind: fix bad error propagation (#1642460)
  - logind: never elect a session that is stopping as display (#1642460)
  - logind: introduce little helper that checks whether a session is ready (#1642460)
  - logind: propagate session stop errors (#1642460)
  - logind: rework how we manage the slice and user-runtime-dir@.service unit for each user (#1642460)
  - logind: optionally, keep the user@.service instance for eached logged in user around for a while (#1642460)
  - logind: add a RequiresMountsFor= dependency from the session scope unit to the home directory of the user (#1642460)
  - logind: improve error propagation of user_check_linger_file() (#1642460)
  - logind: automatically GC lingering users for who now user@.service (nor slice, not runtime dir service) is running anymore (#1642460)
  - pam_systemd: simplify code which with we set environment variables (#1642460)
  - logind: validate /run/user/1000 before we set it (#1642460)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51
changelog:
  - define newly needed constants (#1850986)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#1850986)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#1850986)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#1850986)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#1850986)
  - util: introduce ifname_valid_full() (#1850986)
  - rename function (#1850986)
  - udev: support AlternativeName= setting in .link file (#1850986)
  - network: make Name= in [Match] support alternative names of interfaces (#1850986)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#1850986)
  - udev: do not fail if kernel does not support alternative names (#1850986)
  - udev: introduce AlternativeNamesPolicy= setting (#1850986)
  - network: set AlternativeNamesPolicy= in 99-default.link (#1850986)
  - random-util: call initialize_srand() after fork() (#1850986)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#1850986)
  - udev: sort alternative names (#1850986)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#1850986)
  - netlink: do not fail when new interface name is already used as an alternative name (#1850986)
  - udev: do not try to reassign alternative names (#1850986)
  - Fix LGTM build (#1850986)
  - sd-hwdb: allow empty properties (#1930568)
  - Update hwdb (#1930568)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.1
changelog:
  - sd-event: take ref on event loop object before dispatching event sources (#2024903)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#2024903)
  - Disable iptables for CI (#2024903)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2024903)
  - Disable libpitc to fix CentOS Stream CI (#2024903)
  - test: accept that char device 0/0 can now be created witout privileges (#2024903)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.3
changelog:
  - Do not fail if the same alt. name is set again (#2030027)
  - meson: avoid bogus meson warning (#2030027)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2030027)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.4
changelog:
  - mount: don't propagate errors from mount_setup_unit() further up (#2039327)
  - test: make TEST-47 less racy (#2039327)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2039327)
  - tests: add helper function to autodetect CI environments (#2039327)
  - strv: rework FOREACH_STRING() macro (#2039327)
  - test,systemctl: use "const char*" instead of "char*" (#2039327)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2039327)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2037395)
  - core: Check unit start rate limiting earlier (#2037395)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2037395)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2037395)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2037395)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2037395)
  - pid1: add a manager_trigger_run_queue() helper (#2037395)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2037395)
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2040244)
  - udev/net_id: remove extraneous bracket (#2040244)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.5
changelog:
  - mount: do not update exec deps on mountinfo changes (#2038878)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2038878)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in /usr/lib/environment.d (#2018024)
  - rpm: Add misspelled /usr/lib/environment.d macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-54
changelog:
  - core: consider service with no start command immediately started (#1860899)
  - man: move description of *Action= modes to FailureAction=/SuccessAction= (#1860899)
  - core: define "exit" and "exit-force" actions for user units and only accept that (#1860899)
  - core: accept system mode emergency action specifiers with a warning (#1860899)
  - core: allow services with no commands but SuccessAction set (#1860899)
  - core: limit service-watchdogs=no to actual "watchdog" commands (#1860899)
  - units: use SuccessAction=exit-force in systemd-exit.service (#1860899)
  - units: use SuccessAction=reboot-force in systemd-reboot.service (#1860899)
  - units: use SuccessAction=poweroff-force in systemd-poweroff.service (#1860899)
  - units: allow and use SuccessAction=exit-force in system systemd-exit.service (#1860899)
  - core: do not "warn" about mundane emergency actions (#1860899)
  - core: return true from cg_is_empty* on ENOENT (#1860899)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2017033)
  - tests: add helper function to autodetect CI environments (#2017033)
  - strv: rework FOREACH_STRING() macro (#2017033)
  - test,systemctl: use "const char*" instead of "char*" (#2017033)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-55
changelog:
  - lgtm: detect uninitialized variables using the __cleanup__ attribute (#2017033)
  - lgtm: replace the query used for looking for fgets with a more general query (#2017033)
  - lgtm: beef up list of dangerous/questionnable API calls not to make (#2017033)
  - lgtm: warn about strerror() use (#2017033)
  - lgtm: complain about accept() [people should use accept4() instead, due to O_CLOEXEC] (#2017033)
  - lgtm: don't treat the custom note as a list of tags (#2017033)
  - lgtm: ignore certain cleanup functions (#2017033)
  - lgtm: detect more possible problematic scenarios (#2017033)
  - lgtm: enable more (and potentially useful) queries (#2017033)
  - test: make TEST-47 less racy (#2017033)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2036608)
  - core: Check unit start rate limiting earlier (#2036608)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2036608)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2036608)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2036608)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2036608)
  - pid1: add a manager_trigger_run_queue() helper (#2036608)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2036608)
  - Revert "Revert "sysctl: Enable ping(8) inside rootless Podman containers"" (#2037807)
  - sysctl: prefix ping port range setting with a dash (#2037807)
  - mount: don't propagate errors from mount_setup_unit() further up (#2036853)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-57
changelog:
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2039797)
  - udev/net_id: remove extraneous bracket (#2039797)
  - udev/net_id: introduce naming scheme for RHEL-8.6 (#2039797)
  - define newly needed constants (#2005008)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#2005008)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#2005008)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#2005008)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#2005008)
  - util: introduce ifname_valid_full() (#2005008)
  - rename function (#2005008)
  - udev: support AlternativeName= setting in .link file (#2005008)
  - network: make Name= in [Match] support alternative names of interfaces (#2005008)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#2005008)
  - udev: do not fail if kernel does not support alternative names (#2005008)
  - udev: introduce AlternativeNamesPolicy= setting (#2005008)
  - network: set AlternativeNamesPolicy= in 99-default.link (#2005008)
  - random-util: call initialize_srand() after fork() (#2005008)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#2005008)
  - udev: sort alternative names (#2005008)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#2005008)
  - netlink: do not fail when new interface name is already used as an alternative name (#2005008)
  - udev: do not try to reassign alternative names (#2005008)
  - Do not fail if the same alt. name is set again (#2005008)
  - mount: do not update exec deps on mountinfo changes (#2008825)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2008825)
  - core: fix unfortunate typo in unit_is_unneeded() (#2040147)
  - core: make destructive transaction error a bit more useful (#2040147)
  - tmpfiles: use a entry in hashmap as ItemArray in read_config_file() (#1944468)
  - tmpfiles: rework condition check (#1944468)
  - TEST-22-TMPFILES: add reproducer for bug with X (#1944468)
  - core: make sure we don't get confused when setting TERM for a tty fd (#2045307)
  - hash-funcs: introduce macro to create typesafe hash_ops (#2037807)
  - hash-func: add destructors for key and value (#2037807)
  - util: define free_func_t (#2037807)
  - hash-funcs: make basic hash_ops typesafe (#2037807)
  - test: add tests for destructors of hashmap or set (#2037807)
  - man: document the new sysctl.d/ - prefix (#2037807)
  - sysctl: if options are prefixed with "-" ignore write errors (#2037807)
  - sysctl: fix segfault (#2037807)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58
changelog:
  - ci: drop CentOS 8 CI (#2017033)
  - test: adapt to the new capsh format (#2017033)
  - test: ignore IAB capabilities in `test-execute` (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.1
changelog:
  - acpi-fpdt: mark structures as packed (#2084052)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2084052)
  - core/unit: fix use-after-free (#2084052)
  - sd-bus: fix reference counter to be incremented (#2084052)
  - sd-bus: do not read unused value (#2084052)
  - sd-bus: do not return negative errno when unknown name is specified (#2084052)
  - sd-bus: switch to a manual overflow check in sd_bus_track_add_name() (#2084052)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.2
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#2091590)
  - core: propagate triggered unit in more load states (#2086553)
  - core: propagate unit start limit hit state to triggering path unit (#2086553)
  - core: Move 'r' variable declaration to start of unit_start() (#2086553)
  - core: Delay start rate limit check when starting a unit (#2086553)
  - core: Propagate condition failed state to triggering units. (#2086553)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in %_environmentdir (#2018024)
  - rpm: Add misspelled %_environmentdir macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.7
changelog:
  - sd-event: don't invalidate source type on disconnect (#2116892)
  - test-procfs-util: skip test on certain errors (#2087152)
  - Try stopping MD RAID devices in shutdown too (#2120608)
  - shutdown: get only active md arrays. (#2120608)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.8
changelog:
  - unit-name: tighten checks for building valid unit names (#2094712)
  - core: shorten long unit names that are based on paths and append path hash at the end (#2094712)
  - test: add extended test for triggering mount rate limit (#2094712)
  - tests: add test case for long unit names (#2094712)
  - Revert "core: Propagate condition failed state to triggering units." (#2123801)
  - core: Check unit start rate limiting earlier (#2123801)
  - core: Add trigger limit for path units (#2123801)
  - resolved: pin stream while calling callbacks for it (#2110548)
  - core: move reset_arguments() to the end of main's finish (#2127171)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-60
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1948480)
  - tests: make inverted tests actually count (#2087152)
  - TEST-*: make failure tests actually fail on failure (#2087152)
  - ci(Mergify): configuration update (#2087152)
  - core: propagate triggered unit in more load states (#2065322)
  - core: propagate unit start limit hit state to triggering path unit (#2065322)
  - core: Move 'r' variable declaration to start of unit_start() (#2065322)
  - core: Delay start rate limit check when starting a unit (#2065322)
  - core: Propagate condition failed state to triggering units. (#2065322)
  - unit: check for mount rate limiting before checking active state (#2095744)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-61
changelog:
  - mkosi: Add gnutls package (#2101227)
  - unit-name: tighten checks for building valid unit names (#1940973)
  - core: shorten long unit names that are based on paths and append path hash at the end (#1940973)
  - test: add extended test for triggering mount rate limit (#1940973)
  - tests: add test case for long unit names (#1940973)
  - core: unset HOME=/ that the kernel gives us (#2056527)
  - journal-remote: check return value from MHD_add_response_header (#2051981)
  - journalctl: in --follow mode watch stdout for POLLHUP/POLLERR and exit (#2003236)
  - sd-bus: make BUS_DEFAULT_TIMEOUT configurable (#2039461)
  - fstab-generator: fix debug log (#2101433)
  - logind-session-dbus: allow to set display name via dbus (#1857969)
  - Allow restart for oneshot units (#2042896)
  - test: correct TEST-41 StartLimitBurst test (#2042896)
  - core: fix assert() about number of built environment variables (#2049788)
  - core: add one more assert() (#2049788)
  - strv: introduce strv_join_prefix() (#2049788)
  - test: add tests for strv_join_prefix() (#2049788)
  - test: replace swear words by 'hoge' (#2049788)
  - core: add new environment variable $RUNTIME_DIRECTORY= or friends (#2049788)
  - test-execute: add tests for $RUNTIME_DIRECTORY= or friends (#2049788)
  - man: document RUNTIME_DIRECTORY= or friends (#2049788)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-64
changelog:
  - ci: bump the worker Ubuntu version to Jammy (#2087152)
  - test: make test-execute pass on Linux 5.15 (#2087152)
  - ci: install iputils (#2087152)
  - ci(Mergify): Add `ci-waived` logic (#2087152)
  - sd-event: don't invalidate source type on disconnect (#2115396)
  - tests: make sure we delay running mount start jobs when /p/s/mountinfo is rate limited (#2095744)
  - core: drop references to 'StandardOutputFileToCreate' (#2093479)
  - dbus-execute: fix indentation (#2093479)
  - dbus-execute: generate the correct transient unit setting (#2093479)
  - bus-unit-util: properly accept StandardOutput=append:… settings (#2093479)
  - core: be more careful when inheriting stdout fds to stderr (#2093479)
  - test: add a test for StandardError=file:… (#2093479)
  - tree-wide: allow ASCII fallback for → in logs (#2093479)
  - tree-wide: allow ASCII fallback for … in logs (#2093479)
  - core: allow to set default timeout for devices (#1967245)
  - man: document DefaultDeviceTimeoutSec= (#1967245)
  - Revert "core: Propagate condition failed state to triggering units." (#2114005)
  - core: Check unit start rate limiting earlier (#2114005)
  - core: Add trigger limit for path units (#2114005)
  - meson: add syscall-names-update target (#2040247)
  - syscall-names: add process_madvise which is planned for 5.10 (#2040247)
  - shared: add @known syscall list (#2040247)
  - generate-syscall-list: require python3 (#2040247)
  - shared/seccomp: reduce scope of indexing variables (#2040247)
  - shared/syscall-list: filter out some obviously platform-specific syscalls (#2040247)
  - seccomp: tighten checking of seccomp filter creation (#2040247)
  - shared/seccomp-util: added functionality to make list of filtred syscalls (#2040247)
  - nspawn: return ENOSYS by default, EPERM for "known" calls (#2040247)
  - revert: resolved: pin stream while calling callbacks for it (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-66
changelog:
  - Try stopping MD RAID devices in shutdown too (#1817706)
  - shutdown: get only active md arrays. (#1817706)
  - scope: allow unprivileged delegation on scopes (#2068575)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-67
changelog:
  - resolved: pin stream while calling callbacks for it (#2110549)
  - ci(functions): Add `useradd` and `userdel` (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)


author: EL Errata <el-errata_ww@oracle.com> - 239-68.0.1
changelog:
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - backport upstream pstore tmpfiles patch [Orabug: 31420486]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix to generate systemd-pstore.service file [Orabug: 30230056]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68.1
changelog:
  - time-util: fix buffer-over-run (#2139390)
  - core: move reset_arguments() to the end of main's finish (#2127170)


author: EL Errata <el-errata_ww@oracle.com> - 239-68.0.2.1
changelog:
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - backport upstream pstore tmpfiles patch [Orabug: 31420486]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix to generate systemd-pstore.service file [Orabug: 30230056]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-68.4
changelog:
  - basic: add STRERROR() wrapper for strerror_r() (#2155519)
  - coredump: put context array into a struct (#2155519)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155519)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 239-74.0.1
changelog:
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - backport upstream pstore tmpfiles patch [Orabug: 31420486]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]


author: Shaleen Bathla <shaleen.bathla@oracle.com> - 239-74.0.3
changelog:
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 239-74.0.4.2
changelog:
  - Fix CVE-2023-26604
  - pager: set $LESSSECURE whenver we invoke a pager (lukas.lipinsky@oracle.com)  (#2175624)
  - pager: make pager secure when under euid is changed or explicitly requested (lukas.lipinsky@oracle.com) (#2175624)
  - pager: lets check SYSTEMD_PAGERSECURE with secure_getenv() (lukas.lipinsky@oracle.com) (#2175624)
  - pstore: fix crash and forward dummy arguments instead of NULL (lukas.lipinsky@oracle.com) (#2190151)


author: Darren Archibald <darren.archibald@oracle.com> - 239-74.0.4.3
changelog:
  - login: add a missing error check for session_set_leader() (#2158167)
  - logind: reset session leader if we know for a fact that it is gone (#2158167)


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 239-74.0.5.5
changelog:
  - sulogin: fix control lost of the current terminal when default.target is rescue.target (#2227769)
  - systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761)
  - A) Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)


author: Alex Burmashev <alexander.burmashev@oracle.com> - 239-74.0.6.5
changelog:
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-75
changelog:
  - journald-server: always create state file in signal handler (#2176892)
  - journald-server: move relinquish code into function (#2176892)
  - journald-server: always touch state file in signal handler (#2176892)
  - test: make TEST-35-LOGIN stable again (#2179309)
  - pager: set $LESSSECURE whenver we invoke a pager (#2175624)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175624)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175624)
  - ci: trigger differential-shellcheck workflow on push (#2179309)
  - ci: codeql `master` -> `main` (#2179309)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175622)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-76
changelog:
  - ci(Mergify): drop requirements on linting workflows (#2179309)
  - ci: workflow for gathering metadata for source-git automation (#2179309)
  - ci: first part of the source-git automation - commit linter (#2179309)
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190151)
  - test: Disable LUKS devices from initramfs in QEMU tests (#2190151)
  - pstore: explicitly set the base when converting record ID (#2190151)
  - pstore: avoid opening the dmesg.txt file if not requested (#2190151)
  - test: add a couple of tests for systemd-pstore (#2190151)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-77
changelog:
  - ci: update permissions for source-git automation workflows (#2179309)
  - sulogin: fix control lost of the current terminal when default.target is rescue.target (#2169932)
  - parse-util: in parse_permille() check negative earlier (#2178179)
  - tree-wide: increase granularity of percent specifications all over the place to permille (#2178179)
  - errno-util: introduce ERRNO_IS_TRANSIENT() (#2172846)
  - tree-wide: use ERRNO_IS_TRANSIENT() (#2172846)
  - libsystemd: ignore both EINTR and EAGAIN (#2172846)
  - sd-bus: handle -EINTR return from bus_poll() (#2172846)
  - stdio-bridge: don't be bothered with EINTR (#2172846)
  - sd-netlink: handle EINTR from poll() gracefully, as success (#2172846)
  - resolved: handle -EINTR returned from fd_wait_for_event() better (#2172846)
  - utmp-wtmp: fix error in case isatty() fails (#2172846)
  - utmp-wtmp: handle EINTR gracefully when waiting to write to tty (#2172846)
  - journal-vacuum: count size of all journal files (#2180380)
  - resolved: instead of closing DNS UDP transaction fds right-away, add them to a socket "graveyard" (#2156751)
  - resolved: close UDP socket when we received a network error on it (#2156751)
  - ci: allow RHEL-only labels to mark downstream-only commits (#2179309)
  - man: tweak markup in systemd-pstore.service(8) (#2217786)
  - man: add .service suffix to systemd-pstore(8) (#2217786)
  - presets: enable systemd-pstore.service by default (#2217786)
  - logind: simplify code (#2209328)
  - format-table: add TABLE_TIMESTAMP_UTC and _RELATIVE (#2156786)
  - loginctl: shorten variable name (#2156786)
  - loginctl: use bus_map_all_properties (#2156786)
  - loginctl: show session idle status in list-sessions (#2156786)
  - loginctl: list-sessions: fix timestamp for idle hint (#2156786)
  - loginctl: also show idle hint in session-status (#2156786)
  - core/timer: Always use inactive_exit_timestamp if it is set (#1719364)
  - timer: Use dual_timestamp_is_set() in one more place (#1719364)
  - ci: drop systemd-stable from advanced-commit-linter config (#2179309)
  - core/mount: escape invalid UTF8 char in dbus reply (#2158724)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-78
changelog:
  - login: add a missing error check for session_set_leader() (#2158167)
  - logind: reset session leader if we know for a fact that it is gone (#2158167)
  - test-login: skip consistency checks when logind is not active (#2223582)
  - sd-event: remove dead code and use _cleanup_ (#2211358)
  - sd-event: don't destroy inotify data structures from inotify event handler (#2211358)
  - sd-event: add sd_event_add_inotify_fd() call (#2211358)
  - test: add test case for self-destroy inotify handler (#2211358)
  - doc: add downstream CONTRIBUTING document (#2179309)
  - doc: use link with prefilled Jira issue (#2179309)
  - docs: link downstream CONTRIBUTING in README (#2179309)
  - unit drop-in: Fix ordering of special type.d drop-ins (#2156620)
  - Add failing test to show service.d global drop-in does not get overridden by more specific dropins (#2156620)
  - test: set indentation to 4 spaces (#2156620)
  - test/TEST-15: remove all created unit files (#2156620)
  - test: use quotes where necessary (#2156620)
  - tree-wide: drop manually-crafted message for missing variables (#2156620)
  - manager: reformat boolean expression in unit_is_pristine() (#2156620)
  - manager: allow transient units to have drop-ins (#2156620)
  - TEST-15: allow helper functions to accept other unit types (#2156620)
  - TEST-15: also test hierarchical drop-ins for slices (#2156620)
  - TEST-15: add test for transient units with drop-ins (#2156620)
  - TEST-15: add one more test for drop-in precedence (#2156620)
  - udev/net_id: introduce naming scheme for RHEL-8.9 (#2231846)
  - meson: remove libdw dependency from pstore (#2211416)
  - pstore: introduce tmpfiles.d/systemd-pstore.conf (#2211416)
  - tmpfiles: don't complain if we can't enable pstore in containers (#2211416)
  - pstore: don't enable crash_kexec_post_notifiers by default (#2211416)
  - core: when Delegate=yes is set for a unit, run ExecStartPre= and friends in a subcgroup of the unit (#2215925)
  - man: link Delegate= documentation up with the markdown docs (#2215925)


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 239-78.0.1
changelog:
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace exsisting one in udev [Orabug: 34898273]
  - Oracle-Redhat Errata ELSA-2023:3837 CVE-2023-26604 OLERRATA-43629
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace existing one in udev [Orabug: 34898273]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]
  - Removed unneeded patches (Already provided upstream)
  - A) 1800-pager-set-LESSSECURE-whenver-we-invoke-a-pager.patch (#2175624)
  - B) 1801-pager-make-pager-secure-when-under-euid-is-changed-o.patch (#2175624)
  - C) 1802-pstore-fix-crash-and-forward-dummy-arguments-instead.patch (#2190151)
  - D) 2002-orabug31420486-pstore-introduce-tmpfiles.d-systemd-pstore.conf.patch [Orabug: 31420486]
  - E) 2009-login-add-a-missing-error-check-for-session_set_lead.patch (#2158167)
  - F) 2010-logind-reset-session-leader-if-we-know-for-a-fact-th.patch (#2158167)
  - G) 2011-sulogin-fix-control-lost-of-the-current-terminal-whe.patch (#2227769)
  - H) systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761) (#2227769)
  - H1) Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - H2) systemd.spec: mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 239-78.0.1
changelog:
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace exsisting one in udev [Orabug: 34898273]
  - Oracle-Redhat Errata ELSA-2023:3837 CVE-2023-26604 OLERRATA-43629
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace existing one in udev [Orabug: 34898273]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]
  - Removed unneeded patches (Already provided upstream)
  - A) 1800-pager-set-LESSSECURE-whenver-we-invoke-a-pager.patch (#2175624)
  - B) 1801-pager-make-pager-secure-when-under-euid-is-changed-o.patch (#2175624)
  - C) 1802-pstore-fix-crash-and-forward-dummy-arguments-instead.patch (#2190151)
  - D) 2002-orabug31420486-pstore-introduce-tmpfiles.d-systemd-pstore.conf.patch [Orabug: 31420486]
  - E) 2009-login-add-a-missing-error-check-for-session_set_lead.patch (#2158167)
  - F) 2010-logind-reset-session-leader-if-we-know-for-a-fact-th.patch (#2158167)
  - G) 2011-sulogin-fix-control-lost-of-the-current-terminal-whe.patch (#2227769)
  - H) systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761) (#2227769)
  - H1) Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - H2) systemd.spec: mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - I) 1902-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 239-78.0.3
changelog:
  - 1A) Update Requires section: for correct minimal kickstart processing within systemd.spec (Tony Rodriguez) [Orabug: 35871376]
  - 1B) Add "systemd-fstab-generator-reload-targets.service" file (Tony Rodriguez) [Orabug: 35871376]
  - 1C) Add "systemd-fstab-generator-reload-targets.service" within Source14 of systemd.spec (Tony Rodriguez) [Orabug: 35871376]
  - 1D) Add "systemd-fstab-generator-reload-targets.service" within install section of systemd.spec (Tony Rodriguez) [Orabug: 35871376]
  - 1E) Add "systemctl enable/start for systemd-fstab-generator-reload-targets.service" within %posttrans section of systemd.spec (Tony Rodriguez) [Orabug: 35871376]
  - 1F) Add "systemctl disable/stop for systemd-fstab-generator-reload-targets.service" within %preun section of systemd.spec (Tony Rodriguez) [Orabug: 35871376]
  - 1G) Fix local-fs and remote-fs target issue during system boot (Tony Rodriguez) [Orabug: 35871376]
  - Removed unneeded patch:
  - 1902-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-79
changelog:
  - ci: Extend source-git-automation (RHEL-1087)
  - ci: add missing configuration for commit linter (RHEL-1087)
  - ci: add `Red Hat Enterprise Linux 8` to the list of supported products (RHEL-1087)
  - ci: enable source-git automation to validate reviews and ci results (RHEL-1087)
  - ci: remove Mergify config - replaced by Pull Request Validator (RHEL-1087)
  - ci: enable auto-merge GH Action (RHEL-1087)
  - fstab-generator: allow overriding /etc/fstab with $SYSTEMD_FSTAB (RHEL-1087)
  - fstab-generator: allow overriding path to /sysroot/etc/fstab too (RHEL-1087)
  - test: backport TEST-81-GENERATORS (fstab-generator only) (RHEL-1087)
  - resolved: actually check authenticated flag of SOA transaction (RHEL-6213)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-80
changelog:
  - fd-util: rework how we determine highest possible fd (RHEL-18302)
  - basic/fd-util: refuse "infinite" loop in close_all_fds() (RHEL-18302)
  - fd-util: split out inner fallback loop of close_all_fds() as close_all_fds_without_malloc() (RHEL-18302)
  - exec-util: use close_all_fds_without_malloc() from freeze() (RHEL-18302)
  - ci: use source-git-automation composite Action (RHEL-1087)
  - ci: increase the cron interval to 45 minutes (RHEL-1087)
  - ci: add all Z-Stream versions to array of allowed versions (RHEL-1087)
  - tree-wide: always declare bitflag enums the same way (RHEL-2857)
  - login: Add KEY_RESTART handling (RHEL-2857)
  - analyze security: fix recursive call of syscall_names_in_filter() (RHEL-5991)
  - analyze-security: do not assign badness to filtered-out syscalls (RHEL-5991)
  - analyze-security: include an actual syscall name in the message (RHEL-5991)
  - udev/net_id: introduce naming scheme for RHEL-8.10 (RHEL-22426)
  - doc: add missing `<listitem>` to `systemd.net-naming-scheme.xml` (RHEL-22426)
  - service: schedule cleanup of PID hashmaps when we now longer have main_pid and we are in container (RHEL-5863)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82
changelog:
  - ci: add configuration for regression sniffer GA (RHEL-1087)
  - coredump: actually store parsed unit in the context (RHEL-18302)
  - resolved: limit the number of signature validations in a transaction (RHEL-26644)
  - resolved: reduce the maximum nsec3 iterations to 100 (RHEL-26644)


author: Darren Archibald <darren.archibald@oracle.com> - 239-82.0.1
changelog:
  - Fixed deletion issue for symlink when device is opened [Orabug: 36228608]
  - Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 35871376]
  - 1A) Add "systemd-fstab-generator-reload-targets.service" file [Orabug: 35871376]
  - 1B) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 35871376]
  - 1C) Important: Review 1902-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 35871376]
  - Prevent duplicate uuid device to replace existing one in udev [Orabug: 35987487]
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace exsisting one in udev [Orabug: 34898273]
  - Oracle-Redhat Errata ELSA-2023:3837 CVE-2023-26604 OLERRATA-43629
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace existing one in udev [Orabug: 34898273]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]
  - Removed unneeded patches (Already provided upstream or not required)
  - 1902-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]
  - 1800-pager-set-LESSSECURE-whenver-we-invoke-a-pager.patch (#2175624)
  - 1801-pager-make-pager-secure-when-under-euid-is-changed-o.patch (#2175624)
  - 1802-pstore-fix-crash-and-forward-dummy-arguments-instead.patch (#2190151)
  - 2002-orabug31420486-pstore-introduce-tmpfiles.d-systemd-pstore.conf.patch [Orabug: 31420486]
  - 2009-login-add-a-missing-error-check-for-session_set_lead.patch (#2158167)
  - 2010-logind-reset-session-leader-if-we-know-for-a-fact-th.patch (#2158167)
  - 2011-sulogin-fix-control-lost-of-the-current-terminal-whe.patch (#2227769)
  - systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761) (#2227769)
  - Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - systemd.spec: mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.1
changelog:
  - pid1: by default make user units inherit their umask from the user manager (RHEL-28048)
  - pam: add call to pam_umask (RHEL-28048)
  - ci: deploy systemd man to GitHub Pages (RHEL-32494)
  - ci(src-git): update list of supported products (RHEL-32494)


author: EL Errata <el-errata_ww@oracle.com> - 239-82.0.1.1
changelog:
  - Udevd: add an extra configurable timeout before udevd kills workers [Orabug: 36424686]
  - Fixed deletion issue for symlink when device is opened [Orabug: 36228608]
  - Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 35871376]
  - 1A) Add "systemd-fstab-generator-reload-targets.service" file [Orabug: 35871376]
  - 1B) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 35871376]
  - 1C) Important: Review 1902-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 35871376]
  - Prevent duplicate uuid device to replace existing one in udev [Orabug: 35987487]
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace exsisting one in udev [Orabug: 34898273]
  - Oracle-Redhat Errata ELSA-2023:3837 CVE-2023-26604 OLERRATA-43629
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace existing one in udev [Orabug: 34898273]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]
  - Removed unneeded patches (Already provided upstream or not required)
  - 1902-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]
  - 1800-pager-set-LESSSECURE-whenver-we-invoke-a-pager.patch (#2175624)
  - 1801-pager-make-pager-secure-when-under-euid-is-changed-o.patch (#2175624)
  - 1802-pstore-fix-crash-and-forward-dummy-arguments-instead.patch (#2190151)
  - 2002-orabug31420486-pstore-introduce-tmpfiles.d-systemd-pstore.conf.patch [Orabug: 31420486]
  - 2009-login-add-a-missing-error-check-for-session_set_lead.patch (#2158167)
  - 2010-logind-reset-session-leader-if-we-know-for-a-fact-th.patch (#2158167)
  - 2011-sulogin-fix-control-lost-of-the-current-terminal-whe.patch (#2227769)
  - systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761) (#2227769)
  - Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - systemd.spec: mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)


author: Ronan Pigott <ronan.pigott@oracle.com> - 239-82.0.2.2
changelog:
  - drop IN_ATTRIB from parent directory inotify watches [Orabug: 36780432]
  - Udevd: add an extra configurable timeout before udevd kills workers [Orabug: 36424686]
  - Fixed deletion issue for symlink when device is opened [Orabug: 36228608]
  - Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 35871376]
  - 1A) Add "systemd-fstab-generator-reload-targets.service" file [Orabug: 35871376]
  - 1B) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 35871376]
  - 1C) Important: Review 1902-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 35871376]
  - Prevent duplicate uuid device to replace existing one in udev [Orabug: 35987487]
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace exsisting one in udev [Orabug: 34898273]
  - Oracle-Redhat Errata ELSA-2023:3837 CVE-2023-26604 OLERRATA-43629
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace existing one in udev [Orabug: 34898273]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]
  - Removed unneeded patches (Already provided upstream or not required)
  - 1902-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]
  - 2002-orabug31420486-pstore-introduce-tmpfiles.d-systemd-pstore.conf.patch [Orabug: 31420486]
  - 2009-login-add-a-missing-error-check-for-session_set_lead.patch (#2158167)
  - 2010-logind-reset-session-leader-if-we-know-for-a-fact-th.patch (#2158167)
  - 2011-sulogin-fix-control-lost-of-the-current-terminal-whe.patch (#2227769)
  - systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761) (#2227769)
  - Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - systemd.spec: mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.3
changelog:
  - ci: update actions/upload-artifact to `v4` (RHEL-32494)
  - ci: drop unused variable (RHEL-32494)
  - core: add possibility to not track certain unit types (RHEL-5877)
  - logind: don't setup idle session watch for lock-screen and greeter (RHEL-19215)
  - logind: tighten for which classes of sessions we do stop-on-idle (RHEL-19215)
  - ci: point C8S containers to the Vault (RHEL-1087)


author: Sourav Sharma <sourav.ss.sharma@oracle.com> - 239-82.0.3.3
changelog:
  - Fixes podman quadlet doesn't work in rootless mode [Orabug: 36076771]
  - Drastically simplify caching of cgroups members mask


author: EL Errata <el-errata_ww@oracle.com> - 239-82.0.3.4
changelog:
  - Fixes podman quadlet doesn't work in rootless mode [Orabug: 36076771]
  - Drastically simplify caching of cgroups members mask
  - drop IN_ATTRIB from parent directory inotify watches [Orabug: 36780432]
  - Udevd: add an extra configurable timeout before udevd kills workers [Orabug: 36424686]
  - Fixed deletion issue for symlink when device is opened [Orabug: 36228608]
  - Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 35871376]
  - 1A) Add "systemd-fstab-generator-reload-targets.service" file [Orabug: 35871376]
  - 1B) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 35871376]
  - 1C) Important: Review 1902-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 35871376]
  - Prevent duplicate uuid device to replace existing one in udev [Orabug: 35987487]
  - Backport upstream pstore dmesg fix [Orabug: 34850699]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace exsisting one in udev [Orabug: 34898273]
  - Oracle-Redhat Errata ELSA-2023:3837 CVE-2023-26604 OLERRATA-43629
  - Detect podman as separate container type [Orabug: 31922204]
  - improve container detection logic [Orabug: 31922204]
  - mount: flush out cycle state on DEAD->MOUNTED only, not the other way round [Orabug: 35454661]
  - core/mount: adjust deserialized state based on /proc/self/mountinfo [Orabug: 35454661]
  - Prevent duplicate label to replace existing one in udev [Orabug: 34898273]
  - Standardize ioctl (BTRFS_IOC_QGROUP_CREATE) check and return -ENOTCONN, if quota is not enabled [Orabug: 34694253]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - fix to enable systemd-pstore.service [Orabug: 30951066]
  - journal: change support URL shown in the catalog entries [Orabug: 30853009]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]
  - Removed unneeded patches (Already provided upstream or not required)
  - 1902-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]
  - 2002-orabug31420486-pstore-introduce-tmpfiles.d-systemd-pstore.conf.patch [Orabug: 31420486]
  - 2009-login-add-a-missing-error-check-for-session_set_lead.patch (#2158167)
  - 2010-logind-reset-session-leader-if-we-know-for-a-fact-th.patch (#2158167)
  - 2011-sulogin-fix-control-lost-of-the-current-terminal-whe.patch (#2227769)
  - systemd.spec: prevent 'myhostname' from being appended on upgrade (#2187761) (#2227769)
  - Updated mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)
  - systemd.spec: mod_nss() and readlink /etc/nsswitch.conf sections (#2187761)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.5
changelog:
  - man: be even clearer that tmpfiles user/group/mode are applied on existing inodes (RHEL-77145)
  - Revert "man: fix description of --force in halt(8) (#7392)" (RHEL-81056)
  - man: explicitly document that "reboot -f" is different from "systemctl reboot -f" (RHEL-81056)


author: Ronan Pigott <ronan.pigott@oracle.com> - 239-82.0.5.5
changelog:
  - Stash the dbus subscriber list when we disconnect from the bus [Orabug: 38028720]
  - Drop systemd-nspawn delay on failing to reset loginuid [Orabug: 37782633]


author: Ondrej Dubaj <odubaj@redhat.com> - 1.30-6
changelog:
  - added "padding with zeros" info message (#1913566)
  - do not report disk error as file shrank (#1913569)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.30-10
changelog:
  - Warn “file changed as we read it” less often
  - Add downstream patch to fix related failure in filerem01 test


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.30-11
changelog:
  - Backport fix for regression in the --no-overwrite-dir option fix (1.30-7)
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: Pavel Raiskup <praiskup@redhat.com> - 1.29-3
changelog:
  - revert back some docs
  - fix --create to use --xattrs-include/exclude (rhbz#1341787)
  - don't hang with '-x --skip-old-files --xattrs' (rhbz#1399036)


author: Pavel Raiskup <praiskup@redhat.com> - 1.30-1
changelog:
  - rebase to latest upstream release, per release notes
    http://lists.gnu.org/archive/html/info-gnu/2017-12/msg00011.html


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.6-3
changelog:
  - Incorporate latest upstream patches, including a newer version
    of the OpenSSL patch in 1.9.6-2
    Resolves: rhbz#1492771
    Resolves: rhbz#1499435


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.7-1
changelog:
  - Rebase to the latest upstream version.
    Resolves: rhbz#1511799
  - Do not override OPTFLAGS in the make
    Resolves: rhbz#1620070


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-1
changelog:
  - Add patch to revert "Disable GCC9 address-of-packed-member warning"
    While it was able to build locally with 'rhpkg local', the brew
    build failed, because the compiler on the brew systems did not
    recognized the new GCC9 command line flag:
    -Wno-address-of-packed-member


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-2
changelog:
  - Fix build issues with one upstream patch.
    This patch also reverts the previous patch concerning the
    -Wno-address-of-packed-member cflag.
    Resolves: rhbz#1847938


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-0
changelog:
  Upgrade to latest upstream version
    Added upstream patch to remove deprecated man pages
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-1
changelog:
  Build problem creating directory for grub modules. We can't
    know if the modules are there, so it's up to the end user to
    find the modules and copy them to the correct location.
    Specifically, for systems booting from EFI, the
    /boot/efi/EFI/redhat/x86_64-efi/multiboot2.mod file, if it
    exists, must be copied to the /boot/efi/EFI/redhat/x86_64-efi/
    directory. If that file does not exist, then the system has
    the wrong version of grub for using tboot in an EFI system.
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-1
changelog:
  Need to add BuildRequires: perl, since it has beem moved
    from BuildRoot.
    See: https://fedoraproject.org/wiki/Packaging:Perl#Build_Dependencies
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.1-1
changelog:
  Upgrade to tboot-1.10.2-1 provides some bug fixes and updates.
    Remove 0001-Do-not-install-man-pages-for-deprecated-tools.patch
    from the git repo, since it is no longer needed.
    Resolves: rhbz#1857068
    Resolves: rhbz#1873296
    Resolves: rhbz#1920386


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.5-1
changelog:
  Upgrade to tboot-1.10.5-1 for fixes and updates.
    Added a scriptlet to the tboot.spec file to automatically install
    grub2-efi-x64-modules and move them to the correct directory.
    Resolves: rhbz#2040082
    Resolves: rhbz#2041759


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.5-2
changelog:
  - The install scriptlet in %post was not choosing the correct
    grubenv directory. In RHEL8, the efi and legacy bios grubenv
    directories are different. This change assures that the
    correct directory is used for grub.cfg and related modules.
    Added a %postun section to cleanup when removing tboot with
    dnf erase.
    Resolves: rhbz#2121836


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Petr Pisar <ppisar@redhat.com> - 1.8-1
changelog:
  - 1.8 bump
  - License changed from GPLv2+ to (GPLv3+ and GFDL)
  - Disable printing command failure in POSIX mode


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-1
changelog:
  - New upstream release 2.5 - fixes rhbz #1449666
  - https://raw.githubusercontent.com/tmux/tmux/2.5/CHANGES


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-4
changelog:
  - Fixes rhbz #1476851 tmux bell-action other not working
  - Fixes rhbz #1476892 tmux update in F26 broke tmuxinator


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.8-6
changelog:
  - Fix FTBFS with current autotools (#1083627)
  - Drop tpm-tools-1.3.7-build.patch, the package builds without it (#952372)


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.9-1
changelog:
  - Upstream release 1.3.9.
  - Add fixes for build errors with OpenSSL 1.1.
  - Add fixes for NULL cipher context use in seal/unseal.
  - spec file modernization.


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-6
changelog:
  - Add tss user if doesn't currently exist - PR#1 from Jerry Snitselaar
  - Removed source tarball and cleared it from .gitignore


author: Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
changelog:
  - Download the distributed tarball instead of the source code tarball
  - Update URLs to point to the new project location
  - Update to 2.0.0 release


author: Yunying Sun <yunying.sun@intel.com> - 3.1.0-1
changelog:
  - Update Requires version of tpm2-tss to 2.0.0
  - Remove BuildRequires for tcti-abrmd since it is optional
  - Remove BuildRequires for tcti-{device,mssim} as it is now dynamically loaded
  - Update to 3.1.0 release


author: Jerry Snitselaar <jsnitsel@redhat.com> - 3.1.1-4
changelog:
  - lib/tpm2_options: restore TCTI configuration environment variables
  - tpm2_getcap: restore tool output to print properties with TPM_PT prefix
  resolves: rhbz#1648001


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-3
changelog:
  - Fix resource leak.
  - Fix to restrict policy digest size.
  - Fix incompatible pointer cast.
  - Fix error message in files_load_##name
  - Fix issue where execution couldn't reach function return.
  resolves: rhbz#1920821


author: Javier Martinez Canillas <javierm@redhat.com> - 1.3.0-0.1.rc2
changelog:
  - Update to 1.3.0 release candidate 2 (RHBZ#1508870)
  - Remove global pkg_prefix since now the upstream repo and package names match
  - Update URLs to point to the new project location
  - Remove -Wno-int-in-bool-context compiler flag since now upstream takes care
  - Remove %doc directive since README.md and CHANGELOG.md are not in the tarball
  - Add patch to include a LICENSE since the generated tarball does not have it


author: Javier Martinez Canillas <javierm@redhat.com> - 1.4.0-1
changelog:
  - Update URLs to point to the new project location
  - Add README.md CHANGELOG.md to %files directive
  - Update to 1.4.0 release (RHBZ#1508870)


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-1
changelog:
  - Update to 2.0.0 release (RHBZ#1508870)
  - Remove patch file 60-tpm-udev.rules, use upstream tpm-udev.rules instead
  - Disable ESAPI to fix build errors caused by dependency to libgcrypt 1.6.0
  - Add scriptlet to fix Rpath errors
  - Update file installation paths and names accordingly


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-2
changelog:
  - Re-enable ESAPI since gcrypt dependency is not an issue for Fedora
  - Bump release version to 2.0.0-2


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
changelog:
  - Fix hmac calculation for tpm2_clear command.
  - Remove private implementation of strndup.
  resolves: rhbz#1920825 rhbz#1940861


author: John Kacur <jkacur@redhat.com> - 2.7-8
changelog:
  - Install kernelshark manpage with kernelshark subpackage, not with trace-cmd
  Resolves: rhbz#1678252


author: Kamil Dudka <kdudka@redhat.com> - 1.7.0-11
changelog:
  - do not escape UTF-8 chars in file names by default in UTF-8 locale (#1480778)
  - modernize spec file (Group, BuildRoot, autosetup, clean, defattr)


author: Tomáš Mráz <tmraz@redhat.com> 0.3.13-4
changelog:
  - Split libtspi to a trousers-lib subpackage (#1225062)
  - Fix FTBFS with current gcc (drop inline keyword when bogus)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Merlin Mathesius <mmathesi@redhat.com> - 1027-1
changelog:
  - Version bump. Now supported for all architectures.
  - Generate man pages since they are no longer included in source archive.


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1234-5
changelog:
  - Move header files to ibmtss directory.
  - Check return value of TSS_Hash_Generate.
  resolves: rhbz#1636245


author: John Kacur <jkacur@redhat.com> - 0.14-2
changelog:
  - Add method to compare class cpu for sorting
  - Use args attributes for exceptions for python3
  Resolves: rhbz#1651465


author: John Kacur <jkacur@redhat.com> - 0.15-1
changelog:
  - Upgrade to latest upstream code
  - Upstream drops python-schedutils and uses built-in schedutils
  Resolves: rhbz#1890558


author: John Kacur <jkacur@redhat.com> - 0.16-4
changelog:
  - Make it clear in online help and man pages that --include and --isolate
    affect IRQs as well as threads
  Resolves: rhbz#1886804


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.17-2
changelog:
  - Fix typo for variable parm
  - Handle get_policy_and_rtprio exceptions
  - Remove finally block in get_policy_and_rtprio
  Resolves: rhbz#2049746


author: John Kacur <jkacur@redhat.com> - 0.18-8
changelog:
  - Remove deprecated distutils from setup
  - Adjust SPDX patch to accomdate the removed distutils
  Resolves: RHEL-19037


author: John Kacur <jkacur@redhat.com> - 0.18-9
changelog:
  - Don't start the gui if a display is not available
  - Revert removing distutils for rhel8
  - Update the License tag in the specfile to the spdx version
  Resolves: RHEL-19179


author: James Cheng <james.cheng@oracle.com> - 2.10.0-15.0.1
changelog:
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Masud Khandker <masud.khandker@oracle.com> - 2.10.0-15.0.2
changelog:
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)


author: Tianyue Lan <tianyue.lan@oracle.com> - 2.10.0-15.0.3
changelog:
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.


author: James Cheng <james.cheng@oracle.com> - 2.10.0-15.0.5
changelog:
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM


author: Frank Deng <frank.deng@oracle.com> - 2.10.0-15.0.7
changelog:
  - Differ archs and x86 CPU vendors in plugin cpu
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.12.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1685585
    - sap-netweaver: changed values of kernel.shmall and kernel.shmmax to RHEL-8 defaults
      resolves: rhbz#1708418
    - sap-netweaver: changed value of kernel.sem to RHEL-8 default
      resolves: rhbz#1701394
    - sap-hana-vmware: dropped profile
      resolves: rhbz#1715541
    - s2kb function: fixed to be compatible with python3
      resolves: rhbz#1684122
    - do fallback to the powersave governor (balanced and powersave profiles)
      resolves: rhbz#1679205
    - added support for negation of CPU list
      resolves: rhbz#1676588
    - switched from sysctl tool to own implementation
      resolves: rhbz#1666678
    - realtime-virtual-host: added tsc-deadline=on to qemu cmdline
      resolves: rhbz#1554458
    - fixed handling of devices that have been removed and re-attached
      resolves: rhbz#1677730


author: Tianyue Lan <tianyue.lan@oracle.com> - 2.12.0-3.0.1
changelog:
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1738250
    - cpu: fixed checking if EPB is supported
      resolves: rhbz#1690929
    - scheduler: fixed IRQ SMP affinity verification to respect ignore_missing
      resolves: rhbz#1729936
    - realtime: enabled ktimer_lockless_check
      resolves: rhbz#1734096
    - plugins: support cpuinfo_regex and uname_regex matching
      resolves: rhbz#1748965
    - sysctl: made reapply_sysctl ignore configs from /usr
      resolves: rhbz#1759597
    - added support for multiple include directives
      resolves: rhbz#1760390
    - realtime: added nowatchdog kernel command line option
      resolves: rhbz#1767614


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1738250
    - sap-hana: updated tuning
      resolves: rhbz#1779821
    - latency-performance: updated tuning
      resolves: rhbz#1779759


author: EL Errata <el-errata_ww@oracle.com> - 2.13.0-6.0.1.el8
changelog:
  - Do not use python-dmidecode [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1792264
    - oracle: turned off NUMA balancing
      resolves: rhbz#1782233
    - man: documented the possibility to apply multiple profiles
      resolves: rhbz#1794337
    - cpu-partitioning: disabled kernel.timer_migration
      resolves: rhbz#1797629
    - profiles: new profile optimize-serial-console
      resolves: rhbz#1840689
    - added support for a post-loaded profile
      resolves: rhbz#1798183
    - plugins: new irqbalance plugin
      resolves: rhbz#1784645
    - throughput-performance: added architecture specific tuning for Marvell ThunderX
      resolves: rhbz#1746961
    - throughput-performance: added architecture specific tuning for AMD
      resolves: rhbz#1746957
    - scheduler: added support for cgroups
      resolves: rhbz#1784648


author: EL Errata <el-errata_ww@oracle.com> - 2.14.0-3.0.1
changelog:
  - Updated patch with the more recent version [Orabug: 30730976]
  - Do not use python-dmidecode [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-3.1
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1884544


author: Jing-Yao Chen <jing-yao.chen@oracle.com> - 2.14.0-3.0.2.el8_3.2
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-4
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1845717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.15.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1874052
    - added plugin service for linux services control
      resolves: rhbz#1869991
    - scheduler: added default_irq_smp_affinity option
      resolves: rhbz#1896348
    - bootloader: skip boom managed BLS snippets
      resolves: rhbz#1901532
    - scheduler: added perf_process_fork option to enable processing of fork
      resolves: rhbz#1894610
    - scheduler: added perf_mmap_pages option to set perf buffer size
      resolves: rhbz#1890219
    - bootloader: fixed cmdline duplication with BLS and grub2-mkconfig
      resolves: rhbz#1777874


author: EL Errata <el-errata_ww@oracle.com> - 2.15.0-2.0.1
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]
  - Updated patch with the more recent version [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.16.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1936426
    - realtime: "isolate_managed_irq=Y" should be mentioned in
      "/etc/tuned/realtime-virtual-*-variables.conf"
      resolves: rhbz#1817827
    - realtime: changed tuned default to "isolcpus=domain,managed_irq,X-Y"
      resolves: rhbz#1820626
    - applying a profile with multiple inheritance where parents include a common
      ancestor fails
      resolves: rhbz#1825882
    - failure in moving i40e IRQ threads to housekeeping CPUs from isolated CPUs
      resolves: rhbz#1933069
    - sort network devices before matching by regex
      resolves: rhbz#1939970
    - net: fixed traceback while adjusting the netdev queue count
      resolves: rhbz#1943291
    - net: fixed traceback if the first listed device returns netlink error
      resolves: rhbz#1944686
    - realtime: improve verification
      resolves: rhbz#1947858
    - bootloader: add support for the rpm-ostree
      resolves: rhbz#1950164
    - net: fixed traceback if a device channel contains n/a
      resolves: rhbz#1974071
    - mssql: updated the profile
      resolves: rhbz#1942733


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2003833
    - profiles: fix improper parsing of include directive
      resolves: rhbz#2017924
    - disk: added support for the nvme
      resolves: rhbz#1854816
    - cpu: extended cstate force_latency syntax to allow skipping zero latency
      resolves: rhbz#2002744
    - net: added support for the txqueuelen
      resolves: rhbz#2015044
    - bootloader: on s390(x) remove TuneD variables from the BLS
      resolves: rhbz#1978786
    - daemon: don't do full rollback on systemd failure
      resolves: rhbz#2011459


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#2003833
    - tuned-gui: fixed creation of new profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


