# changelog

author: Jaroslav Rohel <jrohel@redhat.com> - 3.9.0-1
changelog:
  - Update to 3.9.0
  - Add leaves command - List installed packages not required by other installed packages


author: Evan Goode <egoode@redhat.com> - 3.10.1-1
changelog:
  - Update to 3.10.1
  - Correct spelling of summary
  - Print more helpful error message when reinstalling non-installed pkg
    Resolves: RHEL-53430


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-6
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-11
changelog:
  - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library
  Resolves: RHEL-33509


author: Lukáš Zaoral <lzaoral@redhat.com> - 7.2-1
changelog:
  - Update to 7.2 (rhbz#2161916)
  - Do not use %{_bindir}/* and %{_mandir}/* as suggested by the packaging
    guidelines.


author: Lukáš Zaoral <lzaoral@redhat.com> - 8.0-1
changelog:
  - rebase to latest upstream version (RHEL-35944)
  - remove `nano-default-editor` from the specfile (RHEL-30790)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.63.20160912git
changelog:
  - Resolves: #2114821 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.64.20160912git
changelog:
  - Resolves: #2077846 - net-tools utilities display incorrect statistics for interfaces with 15-character names


author: Vit Mojzis <vmojzis@redhat.com> - 0.30.0-21
changelog:
  - Improve "help/usage" message (RHEL-38477)
  - libnetlabel: fix a header file guard typo
  - netlabel-config: Fix IPv4/IPv6 addresses parsing in nlbl_reset_unlbl()
  - netlabel: Update man page to clarify SELinux labeling
  - tests: add a basic CALIPSO pass through test
  - doc: fix a typo in the netlabel-config man page


author: Pavel Reichl <preichl@redhat.com> - 0.4.2-3
changelog:
  - Actually change License from BSD to LGPL, based on content of COPYING file
  - Convert License tag to SPDX format


author: Kevin Fenzi <kevin@scrye.com> - 1.0.7-1
changelog:
  - Update to 1.0.7. Fixes rhbz#2155658
  - Build the package with setuptools instead of distutils. Fixes: rhbz#2154872


author: Phil Sutter <psutter@redhat.com> - 1:1.0.9-1
changelog:
  - Fix devel sub-package description
  - Utilize pyproject-rpm-macros for the python sub-package
  - new version 1.0.9


author: Phil Sutter <psutter@redhat.com> [1.1.1-1.el10]
changelog:
  - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-65346]
  - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-65346]
  - json: Support typeof in set and map types (Phil Sutter) [RHEL-65346]
  - json: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - doc: extend description of fib expression (Phil Sutter) [RHEL-65346]
  - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-65346]
  - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-65346]
  - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-65346]
  - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-65346]
  - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-65346]
  - src: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-65346]
  - tests: shell: fix spurious dump failure in vmap timeout test (Phil Sutter) [RHEL-65346]
  - Rebase onto version 1.1.1 (Phil Sutter) [RHEL-65346]


author: Phil Sutter <psutter@redhat.com> [1.1.1-5.el10]
changelog:
  - src: add conntrack information to trace monitor mode (Phil Sutter) [RHEL-102994]
  - src: split monitor trace code into new trace.c (Phil Sutter) [RHEL-102994]


author: Phil Sutter <psutter@redhat.com> [1.1.1-6.el10]
changelog:
  - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851]
  - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851]
  - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743]
  - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205]


author: Phil Sutter <psutter@redhat.com> [1.1.5-1.el10]
changelog:
  - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-121194]
  - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-121194]
  - build: don't install ancillary files without systemd service file (Phil Sutter) [RHEL-121194]
  - tests: shell: fix typo in vmap_timeout test script (Phil Sutter) [RHEL-121194]
  - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-121194]
  - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-121194]
  - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-121194]
  - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-121194]
  - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-121194]
  - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-121194]
  - doc: fix tcpdump example (Phil Sutter) [RHEL-121194]
  - libnftables: do not re-add default include directory in include search path (Phil Sutter) [RHEL-121194]
  - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-121194]
  - tests: shell: skip two bitwise tests if multi-register support isn't available (Phil Sutter) [RHEL-121194]
  - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-121194]
  - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-121194]
  - tools: gitignore nftables.service file (Phil Sutter) [RHEL-121194]
  - parser_bison: remove leftover utf-8 character in error (Phil Sutter) [RHEL-121194]
  - Rebase onto version 1.1.5 (Phil Sutter) [RHEL-121194]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el10]
changelog:
  - spec: Require libnftnl >= 1.3.0-2 for NFTA_DEVICE_PREFIX handling (Phil Sutter) [RHEL-108861]
  - mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108861]
  - tests: shell: Test ifname-based hooks (Phil Sutter) [RHEL-108861]
  - parser_bison: Accept ASTERISK_STRING in flowtable_expr_member (Phil Sutter) [RHEL-108861]
  - mnl: Support simple wildcards in netdev hooks (Phil Sutter) [RHEL-108861]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el10]
changelog:
  - Update expected test suite results (Phil Sutter) [RHEL-121194]
  - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-121194]


author: Lukáš Zaoral <lzaoral@redhat.com> - 0.5-42.20150602git
changelog:
  - recognize the -m option
  - modernize the specfile
      - use recommended systemd macros
      - fix manual pages installation
      - sort file list and BuildRequires
      - use modern make macros
      - simplify %install section


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.1-4
changelog:
  - Install NetworkManager override for nbft interfaces
  - Rename reconnect NetworkManager hook to 99-nvme-nbft-connect.sh


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.8-2.D20220919gitb041f6d
changelog:
  - Update to the latest git, expecially:
    - Update to Unicode 15.0 (upstream #272)
    - [[:punct:]] behavoir change (upsteam #268)


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - 3.23.0
     * EP11: Add support for FIPS-session mode
     * Updates to harden against RSA timing attacks
     * Bug fixes


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-58996, update to 3.24.0
  - Resolves: RHEL-39004, provide opencryptoki CCA Token also on x86_64 and ppc64le
  - Resolves: RHEL-43675, openCryptoki cca token RSA OAEP v2.1 support
  - Resolves: RHEL-43674, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-43676, openCryptoki cca token SHA3 support
  - Resolves: RHEL-24036, support protected keys for extractable keys


author: Than Ngo <than@redhat.com> - 3.24.0-5
changelog:
  - Use systemd-sysusers
  - Modifie the unit file to change file ownership
  - opencryptoki doesn't work in image mode
    Resolves: RHEL-77146


author: Than Ngo <than@redhat.com> - 3.24.0-7
changelog:
  - Resolves: RHEL-80632, tokens are deleted on reboot
  - Related: RHEL-77146, opencryptoki doesn't work in image mode


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-85376, ep11 token: PKCS #11 3.0 - support SHA3
  - Resolves: RHEL-90589, CCA token: basic support of AES-GCM
  - Resolves: RHEL-72964, cca token support cipher keys
  - Resolves: RHEL-72968, Support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-73343, Upgrade openCryptoki to latest version
  - Resolves: RHEL-75144, p11kmip: a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75761, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85374, cca token: Support ECDH to derive AES keys


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73343, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77146, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104598


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75138, ep11 token BLS support
  - Resolves: RHEL-85380, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85383, cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100058, openCryptoki 3.26.0


author: Simon Pichugin <spichugi@redhat.com> - 2.6.8-1
changelog:
  - Rebase to version 2.6.8 (RHEL-71052)
  - Avoid SSL context cleanup during library destruction (RHEL-68424)


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-1
changelog:
  - Rebase to version 2.6.7 (rhbz#2261163)
  - Use systemd-sysusers for ldap user and group (rhbz#2173965)
  - Fix compiler errors (rhbz#2261427)
  - Replace License with SPDX identifier


author: Simon Pichugin <spichugi@redhat.com> - 2.6.7-2
changelog:
  - Remove libslapi from the main package (RHEL-35581)
  - Add "servers" conditional which includes libslapi


author: Veronika Hanulikova <vhanulik@redhat.com> - 0.26.1-1
changelog:
  - Rebase to new upstream release (RHEL-71523)
  - Separate OpenSC into libraries and binaries (RHEL-73314)


author: Zoltan Fridrich <zfridric@redhat.com> - 9.6p1-1.3
changelog:
  - Correctly audit hostname and IP address (RHEL-22316)
  - Make default key sizes configurable in sshd-keygen (RHEL-26454)


author: Zoltan Fridrich <zfridric@redhat.com> - 9.6p1-1.5
changelog:
  - Build OpenSSH without ENGINE API
    Resolves: RHEL-45507
  - Remove pam_ssh_agent_auth subpackage
    Resolves: RHEL-45002


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-2.0
changelog:
  - Temporary disabling self-test
    Related: RHEL-42635
  - Change ssh-keygen defaults in FIPS mode
    Resolves: RHEL-37324
  - Use FIPS-compatible API for key derivation RHEL-10
    Resolves: RHEL-43592


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-3
changelog:
  - sshd doesn't propose to enter password again when a non-existing user is specified
    Resolves: RHEL-11981
  - Reenabling self-test on rpm build
    Related: RHEL-42635


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.8p1-5
changelog:
  - Restore GSS connectivity when no hostkeys are present
    Related: RHEL-42635
  - Add missing gsskeyex authentication method
    Related: RHEL-42635
  - "publickey-hostbound@openssh.com" extension makes no sense with GSS
    Related: RHEL-42635


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-5
changelog:
  - Fix regression of Match directive processing
    Resolves: RHEL-76317
  - Avoid linking issues for openssl logging
    Related: RHEL-63190


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-6
changelog:
  - Fix regression of Match directive processing
    Related: RHEL-76317
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465, CVE-2025-26466).
    Resolves: RHEL-78699
    Resolves: RHEL-78943


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-8
changelog:
  - OpenSSH should not use its own implementation of MLKEM
    Resolves: RHEL-58252
  - Correct processing of Compression directive
    Resolves: RHEL-68346
  - Supress systemd warning
    Resolves: RHEL-84816


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
changelog:
  - CVE-2025-32728: Fix logic error in DisableForwarding option
    Resolves: RHEL-86819
  - Provide better error for non-supported private keys
    Resolves: RHEL-68124
  - Ignore bad hostkeys in known_hosts file
    Resolves: RHEL-83644


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-15
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-118406
  - Canonicalize username when matching a user
    Resolves: RHEL-101440


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-17
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-128399
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-128388


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-1
changelog:
  - Update to OpenSSH 9.9p1
    Resolves: RHEL-60564
  - Separate ssh-keysign to a dedicated package
    Resolves: RHEL-62112
  - Use FIPS KEX defaults in FIPS mode
    Resolves: RHEL-58986


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-2
changelog:
  - Resolve memory management issues after rebase
    Related: RHEL-60564
  - Add extra help information on ssh early failure
    Resolves: RHEL-62718


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-3
changelog:
  - Extra help information should not be printed if stderr is not a TTY
    Resolves: RHEL-63061
  - Provide details on crypto error instead of "error in libcrypto"
    Resolves: RHEL-63190


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-7
changelog:
  - Disallow SHA1 at SECLEVEL2 in OpenSSL
    Resolves: RHEL-39962
  - SHA-1 signature shouldn't work in normal mode
    Resolves: RHEL-36677


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-10
changelog:
  - Use PBMAC1 by default when creating PKCS#12 files in FIPS mode
    Related: RHEL-36659
  - Support key encapsulation/decapsulation in openssl pkeyutl command
    Resolves: RHEL-54156
  - Fix typo in the patch numeration
    Related: RHEL-41261
  - Enable KTLS, temporary disable KTLS tests
    Related: RHEL-47335
  - Speedup SSL_add_{file,dir}_cert_subjects_to_stack
    Resolves: RHEL-54232
  - Resolve SAST package scan results
    Resolves: RHEL-37561


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-15
changelog:
  - Fix providers no_cache behavior
    Resolves: RHEL-71903
  - Fix pkcs12 command line segfault
    Resolves: RHEL-70878
  - Print key exchange group for hybrid PQC
    Resolves: RHEL-66163
  - Ensure correct fips.so checksum calculation
    Resolves: RHEL-73170
  - Locally configured providers should not interfere with openssl build-time tests
    Resolves: RHEL-76182
  - Load system default cipher string from crypto-policies configuration file
    include /etc/crypto-policies/back-ends/opensslcnf.config and remove
    /etc/crypto-policies/back-ends/openssl.config.
    Resolves: RHEL-71132


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-16
changelog:
  - Fix timing side-channel in ECDSA signature computation (CVE-2024-13176)
    Resolves: RHEL-70879
  - Load system default cipher string from crypto-policies configuration file
    should ignore errors.
    Related: RHEL-71132
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76754
  - Fix segfault on printing the temp key from s_client when connection is not established
    Resolves: RHEL-79045


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-1
changelog:
  - Rebasing OpenSSL to 3.5
    Resolves: RHEL-80811
    Resolves: RHEL-57022
    Resolves: RHEL-24098
    Resolves: RHEL-24097
    Resolves: RHEL-86865


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-3
changelog:
  - Fix `openssl speed` running in FIPS mode
    Resolves: RHEL-88908
  - pkeyutl ecdsa signature with sha1 shouldn't work by default
    Resolves: RHEL-88911
  - Expose settable params for EVP_SKEY
    Resolves: RHEL-88913
  - Restore RHEL9-style indicators defines
    Resolves: RHEL-88906
  - Enable sslkeylog support
    Resolves: RHEL-90853
  - Fix UEFI builds
    Resolves: RHEL-89137


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-4
changelog:
  - Fix regressions caused by rebase to OpenSSL 3.5
    Related: RHEL-80811
  - Fix UEFI builds on double function definitions
    Resolves: RHEL-93168


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-5
changelog:
  - Compact patches for better maintainability
    Related: RHEL-80811
  - Make hybrid MLKEM work with our FIPS provider (3.0.7)
    Resolves: RHEL-94614


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-1
changelog:
  - Rebasing to OpenSSL 3.5.1
    Resolves: RHEL-90350
    Resolves: RHEL-95613
    Resolves: RHEL-97796
    Resolves: RHEL-99353
    Resolves: RHEL-100168


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80811


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-101548
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-105010


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95182
  - Build tests in check and without LTO
    Resolves: RHEL-111634


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-5
changelog:
  - Fix globally disabled LTO
    Related: RHEL-111634
  - Initialize reserved and unused memory in aes-s390x.pl
    Resolves: RHEL-107479


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-122599
    Resolves: RHEL-141987
    Resolves: RHEL-142009
    Resolves: RHEL-142022
    Resolves: RHEL-142026
    Resolves: RHEL-142030
    Resolves: RHEL-142034
    Resolves: RHEL-142038
    Resolves: RHEL-142042
    Resolves: RHEL-142046
    Resolves: RHEL-142050
    Resolves: RHEL-142054


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-2
changelog:
  - Fix static analyzer detected issues. Resolves: RHEL-36475
  - pam_env: fixes for NULL environment variables


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.6.1-6
changelog:
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-65223


author: Brian C. Lane <bcl@redhat.com> - 3.5-11
changelog:
  - parted: Fix ending sector location when using kibi IEC suffix (bcl)
  - tests: Fix formatting and snprintf warnings in tests. (bcl)
  - ui: Add checks for prompt being NULL (bcl)
  - strlist: Handle realloc error in wchar_to_str (bcl)
  - libparted: Fix potential NULL dereference in ped_disk_next_partition (bcl)
  - filesys: Check for null from close_fn (bcl)


author: Brian C. Lane <bcl@redhat.com> - 3.5.28-1
changelog:
  - Upstream 3.5.28 Alpha release
  - Dropped all patches included in new upstream release
  - Bumped minor version on libparted.so and libparted-fs-resize.so


author: Brian C. Lane <bcl@redhat.com> - 3.6-7
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73220
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73220
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73220
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73220


author: Michal Hlavinka <mhlavink@redhat.com> - 3.9.0-4
changelog:
  - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1


author: Michal Hlavinka <mhlavink@redhat.com> - 3.13.0-1
changelog:
  - updated to 3.13, adds support for cxl1.1 device link status information (#RHEL-29153)
  - add riscv64 build support (#RHEL-40383)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.38.2-503
changelog:
  - 5.38.2 bump (see <https://metacpan.org/release/PEVANS/perl-5.38.2/view/pod/perldelta.pod>
    or release notes


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-509
changelog:
  - 5.40.0 bump (see <https://metacpan.org/release/HAARG/perl-5.40.0/view/pod/perldelta.pod)
  - Subpackage Term-Table
  - Subpackage Test-Suite2


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.0-512
changelog:
  - Resolves: RHEL-75798
  - 5.40.1 bump (see <https://metacpan.org/release/SHAY/perl-5.40.1/view/pod/perldelta.pod>)
  - Add config.over to make build od perl reproducible
  - Removed unnecessary conversion
  - Add new systemtap-sdt-dtrace to build deps


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.2-513
changelog:
  - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>)
  - Resolves: RHEL-87186


author: Paul Howarth <paul@city-fan.org> - 2.081-1
changelog:
  - Update to 2.081
    - New function set_msg_callback for user defined callback on each SSL message
    - Showcase function in example/ssl_client.pl and example/ssl_server.pl for
      computing JA3S/JA3 fingerprints
    - Fix tracing added in 2.076 to no longer include SSL3_RT_HEADER (noise)


author: Paul Howarth <paul@city-fan.org> - 2.082-1
changelog:
  - Update to 2.082
    - SSL_version default now TLS 1.2+ since TLS 1.1 and lower are deprecated
      (GH#122)
    - Fix output of alert string when debugging (GH#132)
    - Improve regex for hostname validation (GH#130, GH#126)
    - Add can_ciphersuites subroutine for feature checking (GH#127)
    - Utils::CERT_create - die if unexpected arguments are given instead of
      ignoring these
  - Avoid use of deprecated patch syntax


author: Paul Howarth <paul@city-fan.org> - 2.083-1
changelog:
  - Update to 2.083
    - Fix t/protocol_version.t for OpenSSL versions that don't support SECLEVEL
      (regression from GH#122)


author: Paul Howarth <paul@city-fan.org> - 2.084-1
changelog:
  - Update to 2.084
    - Various fixes for edge cases and build: GH#136, GH#141, GH#142, GH#143,
      GH#145
    - Update documentation to reflect default SSL_version


author: Paul Howarth <paul@city-fan.org> - 2.085-1
changelog:
  - Update to 2.085
    - Fix test that failed due to behavior changes in OpenSSL 3.2 (GH#147)
    - Update PublicSuffix
    - Add examples for TLS JA3/JA4 fingerprinting to tls_fingerprint/


author: Paul Howarth <paul@city-fan.org> - 1.92-7
changelog:
  - Update test suite to handle potential unavailability of sha1 algorithm
    https://github.com/radiator-software/p5-net-ssleay/pull/433
  - Avoid deprecated patch syntax


author: Paul Howarth <paul@city-fan.org> - 1.94-1
changelog:
  - Update to 1.94
    - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and
      3.2, and LibreSSL 3.5-3.8
    - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to
      compile, it should now be much easier to identify the cause
    - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl()
      function are now exposed, enabling fine-grained control over the
      initialisation and configuration of both libraries
    - libssl functions implementing TLS 1.3 PSK authentication are now exposed,
      in particular SSL_CTX_set_psk_find_session_callback() (on the server side)
      and SSL_CTX_set_psk_use_session_callback() (on the client side)
    - libssl functions implementing server-side TLS 1.2 PSK authentication are
      now exposed, in particular SSL_CTX_set_psk_server_callback()
    - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a
      TLS server to set a callback function that is executed when the server
      processes a ClientHello message
    - Many more libcrypto/libssl constants and functions are now exposed; see the
      release notes for the 1.93 developer releases for a full list


author: Paul Howarth <paul@city-fan.org> - 1:0.240-1
changelog:
  - Update to 0.240
    - Use Test::More::isnt() instead of Test::More::isn't in tests, which is
      deprecated, as ' isn't allowed as package separator in an upcoming version
      of Perl (GH#13)


author: Vit Mojzis <vmojzis@redhat.com> - 3.9-2
changelog:
  - semanage: Reset active value when deleting boolean customizations (RHEL-111421)
  - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505)


author: Christian Glombek <cglombek@redhat.com> - 123-2
changelog:
  - Provide a sysusers.d file to get user() and group() provides
    (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format).


author: Jan Rybar <jrybar@redhat.com> - 125-4
changelog:
  - changing log level via dbus is now restricted to root
  - backport of https://github.com/polkit-org/polkit/commit/5a4ba7dfdcc3f
  - Resolves: RHEL-90807


author: Jan Rybar <jrybar@redhat.com> - 0.1-26
changelog:
  - use build macros, on behalf of original author Tom Stellard (tstellar)
  - Pagure doesn't allow one-click rebase, AFAIK


author: Jan Rybar <jrybar@redhat.com> - 6.6.4-17
changelog:
  - migrate to autosetup; convert specfile script to a patch
  - FORTIFY_SOURCE_3 detected a buffer overflow
  - Resolves: bz#2190057


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Security fix for CVE-2024-9287 and CVE-2024-12254
  Resolves: RHEL-64877, RHEL-70450


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-90555


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98060, RHEL-98047, RHEL-97813, RHEL-98062, RHEL-98180


author: John Kacur <jkacur@redhat.com> - 0.7.4-1
changelog:
  - Rebase to upstream version 0.7.4
  - Convert to pyproject-based build using pyproject.toml
  - Remove python3-six dependency (no longer needed)
  - Remove distutils patch (no longer needed with pyproject build)
  Resolves: RHEL-114904


author: Miro Hrončok <mhroncok@redhat.com> - 23.3.1-5
changelog:
  - Switched to autogenerated BuildRequires for test dependencies,
    which removed some that were no longer necessary


author: Charalampos Stratakis <cstratak@redhat.com> - 23.3.2-2
changelog:
  - Use tarfile.data_filter for extracting (CVE-2007-4559, PEP-721, PEP-706)
  - Require Python with tarfile filters
  - Resolves: RHEL-25820


author: Miro Hrončok <mhroncok@redhat.com> - 2.28.2-7
changelog:
  - Do not package requests[security] and requests[socks] on RHEL
  - Make the package build even when urllib3 won't pull in pysocks


author: Lumír Balhar <lbalhar@redhat.com> - 2.32.3-1
changelog:
  - Update to 2.32.3
  - Fix for CVE-2024-35195
  Resolves: RHEL-37604
  - Add support for IPv6 CIDR in no_proxy setting
  Resolves: RHEL-32523


author: Miro Hrončok <mhroncok@redhat.com> - 2.32.4-1
changelog:
  - Update to 2.32.4
  - Security fix for CVE-2024-47081: .netrc credentials leak via malicious URLs
  Resolves: RHEL-105460


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-3
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-54012)
  - Fix potential use of uninitialized pgp struct (RHEL-54013)
  - Fix memory leak in rpmsign(8) (RHEL-37564)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-4
changelog:
  - Remove hardcoded GPG references from signing error messages
  - Support switching between GnuPG and Sequoia for package signing (RHEL-56363)


author: Panu Matilainen <pmatilai@redhat.com> - 4.19.1.1-9
changelog:
  - Revert the gnupg/sequoia sub-packages, too much headache
  - Ship sequoia-signing enablement macros as documentation instead
  - Generate binary signatures with Sequoia too


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-10
changelog:
  - Report unsafe symlinks during installation as a specific case (RHEL-73186)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-54386)
  - Rebuild for ima-evm-utils 1.6 soname bump (RHEL-65378)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-11
changelog:
  - Fix possible package corruption on --delsign/resign/addsign (RHEL-69518)
  - Fix regression on build-id generation from compressed ELF (RHEL-54000)
  - Fix root relocation regression (RHEL-56613)
  - Update sequoia macros for sq 1.0 (RHEL-56363)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-13
changelog:
  - Make %_passwd_path and %_group_path into lists (RHEL-78693)
  - Fix memory leak in rpmspec --shell (RHEL-55284)
  - Fix memory leak in rpmsign (RHEL-82284)
  - Fix command references in rpmsign(8) man page (RHEL-73173)
  - Fix exit code regression on update failure (RHEL-87384)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-14
changelog:
  - Store configurable digest(s) on packages in rpmdb (RHEL-84062)
  - Fix command references in rpmsign(8) man page, take II (RHEL-73173)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-15
changelog:
  - Add support for spec local file attributes and generators (RHEL-84057)
  - Ensure binary and source headers are identified as such (RHEL-87383)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-18
changelog:
  - Add support for multiple OpenPGP signatures per package (RHEL-100571)
  - Add support for OpenPGP v6 signature pre-salting (RHEL-100571)
  - Add support for PQC algorithms from RFC-9580 (RHEL-100571)
  - Add --list and --erase commands to rpmkeys(8) (RHEL-105421)
  - Fix regression on dynamic subpackage RPMTAG_SOURCERPM missing (RHEL-102023)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-21
changelog:
  - Fix pre/post/meta/etc. qualifiers for weak dependencies (RHEL-101936)
  - Fix redundant rpmdb-migrate.service runs (RHEL-96510)


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.2-4
changelog:
  - Disable/remove neverallow options in sediff.
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Miro Hrončok <mhroncok@redhat.com> - 1.26.19-3
changelog:
  - Security fix for CVE-2025-66471
  - Security fix for CVE-2025-66418
  - Security fix for CVE-2026-21441
  Resolves: RHEL-142737, RHEL-137215, RHEL-142755


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-5
changelog:
  - Split packages for variable fonts.
  - Drop unnecessary/duplicate fonts from packages.
  - Worked around broken family name in variable fonts.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-8
changelog:
  - Use no VF in family name version of ttf for -vf packages.
  - Adjust properties in VF to avoid confusion.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-11
changelog:
  - Add a provide line of font(redhatdisplayvf), font(redhattextvf),
    and font(redhatmonovf) to each sub-packages for backward compatibility.
  - Fix invalid License field.


author: Akira TAGOH <tagoh@redhat.com> - 4.0.3-14
changelog:
  - Remove Italic variable fonts to workaround a crash issue
    and unexpected italic rendering.
    Resolves: RHEL-69430


author: Stephen Gallagher <sgallagh@redhat.com> - 1:0.4-0.54.b47
changelog:
  - Fixes for -WError=implicit-function-declaration on RHEL
  - Reinstates the dump headers without compiling the implementations


author: Vladis Dronov <vdronov@redhat.com> - 6.17-2
changelog:
  - Add Intel CET IBT instrumentation to assembly code
  - Update to the upstream v6.17 @ ac43f912 (RHEL-36771)


author: Jonathan Wright <jonathan@almalinux.org> - 3.3.0-6.alma.1
changelog:
  - Fix for CVE-2024-12084
  - Fix for CVE-2024-12085
  - Fix for CVE-2024-12086
  - Fix for CVE-2024-12087
  - Fix for CVE-2024-12088
  - Fix for CVE-2024-12747


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-1
changelog:
  - New version 3.4.1
  - Resolves: RHEL-70151 - Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
  - Resolves: RHEL-70159 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70203 - rsync server leaks arbitrary client files
  - Resolves: RHEL-72500 - Path traversal vulnerability in rsync
  - Resolves: RHEL-72501 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71658 - Race Condition in rsync Handling Symbolic Links
  - Resolves: RHEL-71293 - Build rsync with --with-rrsync


author: Dan Horák <dhorak@redhat.com> - 2:2.35.0-1
changelog:
  - rebased to 2.35.0 (RHEL-59086)
  - cpacfstats: support MSA 10 and MSA 11 (RHEL-23873)
  - Resolves: RHEL-59086 RHEL-23873


author: Dan Horák <dhorak@redhat.com> - 2:2.36.0-1
changelog:
  - rebased to 2.36.0 (RHEL-59086)
  - cpacfinfo: new tool to provide CPACF information (RHEL-23869)
  - chpstat: Additional Channel Measurements (RHEL-23875)
  - zPCI: Optics Monitoring for PF Access Mode (RHEL-24153)
  - KVM: Support extended attestation for Secure Execution (RHEL-27472)
  - KVM: genprotimg: validate if SE image can run on particular host(s) (RHEL-47108)
  - Vertical CPU Polarization Support Stage 2 (RHEL-64704)
  - KVM: Support unencrypted SE images by exposing resp. SE header flag (RHEL-70851)
  - KVM: Rewrite genprotimg in Rust (RHEL-72022)
  - Provide genprotimg / pvimg info command to display encrypted & unencrypted SE image information (RHEL-71821)
  - KVM: Support retrievable secrets in Secure Execution guests (RHEL-46894)
  - zkey key support for dm-crypt with XTS keys (RHEL-23870)
  - Resolves: RHEL-59086 RHEL-23869 RHEL-23875 RHEL-24153 RHEL-27472 RHEL-47108 RHEL-64704 RHEL-70851 RHEL-72022 RHEL-71821 RHEL-46894 RHEL-23870


author: Dan Horák <dhorak@redhat.com> - 2:2.38.0-1
changelog:
  - rebased to 2.38.0 (RHEL-73341)
  - LPAR level power consumption reporting (RHEL-72677)
  - Provide Topology-Map information to userspace (RHEL-72680)
  - Add CCK secret type for updating the Customer Communication Key (RHEL-73023)
  - Convert LUKS2 volume from AES keys to retrievable PAES keys (RHEL-85389)
  - Resolves: RHEL-73341 RHEL-72677 RHEL-72680 RHEL-73023 RHEL-85389


author: Dan Horák <dhorak@redhat.com> - 2:2.39.0-1
changelog:
  - rebased to 2.39.0 (RHEL-100438)
  - udev/rules.d: Set default io scheduler to 'none' for virtio-blk (RHEL-126748)
  - udev/rules.d: make virtio-blk devices non-rotational (RHEL-126744)
  - zipl: makedumpfile is required for ngdump support (RHEL-114661)
  - libekmfweb: Fix gen of cert or CSR to use RSA not RSA-PSS (RHEL-114884)
  - chpstat: Fix DPU utilization scaling in reports (RHEL-109214)
  - Resolves: RHEL-100438 RHEL-126748 RHEL-126744 RHEL-114661 RHEL-114884 RHEL-109214


author: Paolo Bonzini <pbonzini@redhat.com> - 4.9-1
changelog:
  - Rebase to 4.9
  - Update downstream patches
  - Resolves: rhbz#2140486
  - Remove change to gnulib tests, they pass anyway
  - Install valgrind and langpacks to increase test coverage


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.2-1
changelog:
  - Allow all domains read and write z90crypt device
  Resolves: RHEL-28539
  - Allow dhcpc read /run/netns files
  Resolves: RHEL-39510
  - Allow bootupd search efivarfs dirs
  Resolves: RHEL-39514


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.3-1
changelog:
  - Allow virtqemud manage nfs files when virt_use_nfs boolean is on
  Resolves: RHEL-40205
  - Allow virt_driver_domain read files labeled unconfined_t
  Resolves: RHEL-40262
  - Allow virt_driver_domain dbus chat with policykit
  Resolves: RHEL-40346
  - Escape "interface" as a file name in a virt filetrans pattern
  Resolves: RHEL-34769
  - Allow setroubleshootd get attributes of all sysctls
  Resolves: RHEL-40923
  - Allow qemu-ga read vm sysctls
  Resolves: RHEL-40829
  - Allow sbd to trace processes in user namespace
  Resolves: RHEL-39989
  - Allow request-key execute scripts
  Resolves: RHEL-38920
  - Update policy for haproxyd
  Resolves: RHEL-40877


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.4-1
changelog:
  - Confine libvirt-dbus
  Resolves: RHEL-37822
  - Allow sssd create and use io_uring
  Resolves: RHEL-43448
  - Allow virtqemud the kill capability in user namespace
  Resolves: RHEL-44996
  - Allow login_userdomain execute systemd-tmpfiles in the caller domain
  Resolves: RHEL-44191
  - Allow virtqemud read vm sysctls
  Resolves: RHEL-40938
  - Allow svirt_t read vm sysctls
  Resolves: RHEL-40938
  - Allow rshim get options of the netlink class for KOBJECT_UEVENT family
  Resolves: RHEL-40859
  - Allow systemd-hostnamed read the vsock device
  Resolves: RHEL-45309
  - Allow systemd (PID 1) manage systemd conf files
  Resolves: RHEL-45304
  - Allow journald read systemd config files and directories
  Resolves: RHEL-45304
  - Allow systemd_domain read systemd_conf_t dirs
  Resolves: RHEL-45304
  - Label systemd configuration files with systemd_conf_t
  Resolves: RHEL-45304
  - Allow dhcpcd the kill capability
  Resolves: RHEL-43417
  - Add support for libvirt hooks
  Resolves: RHEL-41168


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.5-1
changelog:
  - Allow to create and delete socket files created by rhsm.service
  Resolves: RHEL-40857
  - Allow svirt read virtqemud fifo files
  Resolves: RHEL-40350
  - Allow virt_dbus_t connect to virtqemud_t over a unix stream socket
  Resolves: RHEL-37822
  - Allow virtqemud read virt-dbus process state
  Resolves: RHEL-37822
  - Allow virtqemud run ssh client with a transition
  Resolves: RHEL-43215
  - Allow virtnetworkd exec shell when virt_hooks_unconfined is on
  Resolves: RHEL-41168
  - Allow NetworkManager the sys_ptrace capability in user namespace
  Resolves: RHEL-46717
  - Update keyutils policy
  Resolves: RHEL-38920
  - Allow ip the setexec permission
  Resolves: RHEL-41182


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.6-1
changelog:
  - Allow virtnodedevd run udev with a domain transition
  Resolves: RHEL-39890
  - Allow virtnodedev_t create and use virtnodedev_lock_t
  Resolves: RHEL-39890
  - Allow svirt attach_queue to a virtqemud tun_socket
  Resolves: RHEL-44312
  - Label /run/systemd/machine with systemd_machined_var_run_t
  Resolves: RHEL-49567
  - Allow to create and delete socket files created by rhsm.service


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.7-1
changelog:
  - Add the swtpm.if interface file for interactions with other domains
  Resolves: RHEL-47274
  - Allow virtproxyd create and use its private tmp files
  Resolves: RHEL-40499
  - Allow virtproxyd read network state
  Resolves: RHEL-40499
  - Allow virtqemud domain transition on swtpm execution
  Resolves: RHEL-47274
  Resolves: RHEL-49763
  - Allow virtqemud relabel virt_var_run_t directories
  Resolves: RHEL-47274
  Resolves: RHEL-45464
  Resolves: RHEL-49763
  - Allow virtqemud domain transition on passt execution
  Resolves: RHEL-45464
  - Allow virt_driver_domain create and use log files in /var/log
  Resolves: RHEL-40239
  - Allow virt_driver_domain connect to systemd-userdbd over a unix socket
  Resolves: RHEL-44932
  Resolves: RHEL-44898
  - Update stalld policy for bpf usage
  Resolves: RHEL-50356
  - Allow boothd connect to systemd-userdbd over a unix socket
  Resolves: RHEL-45907
  - Allow linuxptp configure phc2sys and chronyd over a unix domain socket
  Resolves: RHEL-46011
  - Allow systemd-machined manage runtime sockets
  Resolves: RHEL-49567
  - Allow ip command write to ipsec's logs
  Resolves: RHEL-41222
  - Allow init_t nnp domain transition to firewalld_t
  Resolves: RHEL-52481
  - Update qatlib policy for v24.02 with new features
  Resolves: RHEL-50377
  - Allow postfix_domain map postfix_etc_t files
  Resolves: RHEL-46327


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.8-1
changelog:
  - Add virt_create_log() and virt_write_log() interfaces
  Resolves: RHEL-47274
  - Update libvirt policy
  Resolves: RHEL-45464
  Resolves: RHEL-49763
  - Allow svirt_tcg_t map svirt_image_t files
  Resolves: RHEL-47274
  - Allow svirt_tcg_t read vm sysctls
  Resolves: RHEL-47274
  - Additional updates stalld policy for bpf usage
  Resolves: RHEL-50356


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.9-1
changelog:
  - Allow virtqemud relabelfrom also for file and sock_file
  Resolves: RHEL-49763
  - Allow virtqemud relabel user tmp files and socket files
  Resolves: RHEL-49763
  - Update virtqemud policy for libguestfs usage
  Resolves: RHEL-49763
  - Label /run/libvirt/qemu/channel with virtqemud_var_run_t
  Resolves: RHEL-47274


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.10-1
changelog:
  - Confine gnome-remote-desktop
  Resolves: RHEL-35877
  - Allow virtqemud get attributes of a tmpfs filesystem
  Resolves: RHEL-40855
  - Allow virtqemud get attributes of cifs files
  Resolves: RHEL-40855
  - Allow virtqemud get attributes of filesystems with extended attributes
  Resolves: RHEL-39668
  - Allow virtqemud get attributes of NFS filesystems
  Resolves: RHEL-40855
  - Add support for secretmem anon inode
  Resolves: RHEL-40953
  - Allow systemd-sleep read raw disk data
  Resolves: RHEL-49600
  - Allow systemd-hwdb send messages to kernel unix datagram sockets
  Resolves: RHEL-50810
  - Label /run/modprobe.d with modules_conf_t
  Resolves: RHEL-54591
  - Allow setsebool_t relabel selinux data files
  Resolves: RHEL-55412
  - Don't audit crontab_domain write attempts to user home
  Resolves: RHEL-56349
  - Differentiate between staff and sysadm when executing crontab with sudo
  Resolves: RHEL-56349
  - Add crontab_admin_domtrans interface
  Resolves: RHEL-56349
  - Add crontab_domtrans interface
  Resolves: RHEL-56349
  - Allow boothd connect to kernel over a unix socket
  Resolves: RHEL-58060
  - Fix label of pseudoterminals created from sudodomain
  Resolves: RHEL-58068
  - systemd: allow systemd_notify_t to send data to kernel_t datagram sockets
  Resolves: RHEL-58072
  - Allow rsyslog read systemd-logind session files
  Resolves: RHEL-40961
  - Label /dev/mmcblk0rpmb character device with removable_device_t
  Resolves: RHEL-55265
  - Label /dev/hfi1_[0-9]+ devices
  Resolves: RHEL-62836
  - Label /dev/papr-sysparm and /dev/papr-vpd
  Resolves: RHEL-56908
  - Support SGX devices
  Resolves: RHEL-62354
  - Suppress semodule's stderr
  Resolves: RHEL-59192


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.11-1
changelog:
  - Allow ping_t read network sysctls
  Resolves: RHEL-54299
  - Label /usr/lib/node_modules/npm/bin with bin_t
  Resolves: RHEL-56350
  - Label /run/sssd with sssd_var_run_t
  Resolves: RHEL-57065
  - Allow virtqemud read virtd_t files
  Resolves: RHEL-57713
  - Allow wdmd read hardware state information
  Resolves: RHEL-57982
  - Allow wdmd list the contents of the sysfs directories
  Resolves: RHEL-57982
  - Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  Resolves: RHEL-58380
  - Allow dirsrv read network sysctls
  Resolves: RHEL-58381
  - Allow lldpad create and use netlink_generic_socket
  Resolves: RHEL-61634
  - Allow unconfined_t execute kmod in the kmod domain
  Resolves: RHEL-61755
  - Confine the pcm service
  Resolves: RHEL-52838
  - Allow iio-sensor-proxy the bpf capability
  Resolves: RHEL-62355
  - Confine iio-sensor-proxy
  Resolves: RHEL-62355


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.12-1
changelog:
  - Dontaudit subscription manager setfscreate and read file contexts
  Resolves: RHEL-58009
  - Allow the sysadm user use the secretmem API
  Resolves: RHEL-40953
  - Allow sudodomain list files in /var
  Resolves: RHEL-58068
  - Allow gnome-remote-desktop watch /etc directory
  Resolves: RHEL-35877
  - Allow journalctl connect to systemd-userdbd over a unix socket
  Resolves: RHEL-58072
  - systemd: allow sys_admin capability for systemd_notify_t
  Resolves: RHEL-58072
  - Allow some confined users send to lldpad over a unix dgram socket
  Resolves: RHEL-61634
  - Allow lldpad send to sysadm_t over a unix dgram socket
  Resolves: RHEL-61634
  - Allow lldpd connect to systemd-machined over a unix socket
  Resolves: RHEL-61634


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.13-1
changelog:
  - Revert "Allow unconfined_t execute kmod in the kmod domain"
  Resolves: RHEL-65190
  - Add policy for /usr/libexec/samba/samba-bgqd
  Resolves: RHEL-64908
  - Label samba certificates with samba_cert_t
  Resolves: RHEL-64908
  - Label /usr/bin/samba-gpupdate with samba_gpupdate_exec_t
  Resolves: RHEL-64908
  - Allow rpcd read network sysctls
  Resolves: RHEL-64737
  - Label all semanage store files in /etc as semanage_store_t
  Resolves: RHEL-65864


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.14-1
changelog:
  - mls/modules.conf - fix typo
  - Use dist/targeted/modules.conf in build workflow
  - Fix default and dist config files
  - CI: update to actions/checkout@v4
  - Clean up and sync securetty_types
  - Bring config files from dist-git into the source repo
  - Sync users with Fedora targeted users


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.15-1
changelog:
  - Allow qatlib search the content of the kernel debugging filesystem
  Resolves: RHEL-66334
  - Allow qatlib connect to systemd-machined over a unix socket
  Resolves: RHEL-66334
  - Update policy for samba-bgqd
  Resolves: RHEL-64908
  - Allow httpd get attributes of dirsrv unit files
  Resolves: RHEL-62706
  - Allow virtstoraged read vm sysctls
  Resolves: RHEL-61742
  - Allow virtstoraged execute mount programs in the mount domain
  Resolves: RHEL-61742
  - Update policy for rpc-virtstorage
  Resolves: RHEL-61742
  - Allow virtstoraged get attributes of configfs dirs
  Resolves: RHEL-61742
  - Allow virt_driver_domain read virtd-lxc files in /proc
  Resolves: RHEL-61742
  - Allow virtstoraged manage files with virt_content_t type
  Resolves: RHEL-61742
  - Allow virtstoraged use the io_uring API
  Resolves: RHEL-61742
  - Allow virtstoraged execute lvm programs in the lvm domain
  Resolves: RHEL-61742
  - Allow svirt_t connect to unconfined_t over a unix domain socket
  Resolves: RHEL-61246
  - Label /usr/lib/node_modules_22/npm/bin with bin_t
  Resolves: RHEL-56350
  - Allow bacula execute container in the container domain
  Resolves: RHEL-39529
  - Label /run/systemd/generator with systemd_unit_file_t
  Resolves: RHEL-68313


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.17-1
changelog:
  - Update samba-bgqd policy
  Resolves: RHEL-69512
  - Allow samba-bgqd read cups config files
  Resolves: RHEL-69512
  - Allow virtqemud additional permissions for tmpfs_t blk devices
  Resolves: RHEL-61235
  - Allow virtqemud rw access to svirt_image_t chr files
  Resolves: RHEL-61235
  - Allow virtqemud rw and setattr access to fixed block devices
  Resolves: RHEL-61235
  - Label /etc/mdevctl.d/scripts.d with bin_t
  Resolves: RHEL-39893
  - Fix the /etc/mdevctl\.d(/.*)? regexp
  Resolves: RHEL-39893
  - Allow virtnodedev watch mdevctl config dirs
  Resolves: RHEL-39893
  - Make mdevctl_conf_t member of the file_type attribute
  Resolves: RHEL-39893
  - Label /etc/mdevctl.d with mdevctl_conf_t
  Resolves: RHEL-39893
  - Allow virtqemud relabelfrom virt_log_t files
  Resolves: RHEL-48236
  - Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  Resolves: RHEL-48236
  - Allow virtqemud relabelfrom virtqemud_var_run_t dirs
  Resolves: RHEL-48236
  - Allow svirt_tcg_t read virtqemud_t fifo_files
  Resolves: RHEL-48236
  - Allow virtqemud rw and setattr access to sev devices
  Resolves: RHEL-69128
  - Allow virtqemud directly read and write to a fixed disk
  Resolves: RHEL-61235
  - Allow svirt_t the sys_rawio capability
  Resolves: RHEL-61235
  - Allow svirt_t the sys_rawio capability
  Resolves: RHEL-61235
  - Allow virtqemud connect to sanlock over a unix stream socket
  Resolves: RHEL-44352
  - allow gdm and iiosensorproxy talk to each other via D-bus
  Resolves: RHEL-70850
  - Allow sendmail to map mail server configuration files
  Related: RHEL-54014
  - Allow procmail to read mail aliases
  Resolves: RHEL-54014
  - Grant rhsmcertd chown capability & userdb access
  Resolves: RHEL-68481


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.18-1
changelog:
  - Sync dist/targeted/modules.conf with Fedora 42
  Resolves: RHEL-70850
  - Add support for sap
  Resolves: RHEL-70850
  - Allow sssd_selinux_manager_t the setcap process permission
  Resolves: RHEL-70822
  - Allow virtqemud open svirt_devpts_t char files
  Resolves: RHEL-43446
  - Fix the cups_read_pid_files() interface to use read_files_pattern
  Resolves: RHEL-69512


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.19-1
changelog:
  - Allow systemd-journald getattr nsfs files
  Resolves: RHEL-71803
  - Allow systemd-related domains getattr nsfs files
  Resolves: RHEL-71803


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.20-1
changelog:
  - Allow virtqemud domain transition on numad execution
  Resolves: RHEL-65789
  - Support virt live migration using ssh
  Resolves: RHEL-53972
  - Allow ssh_t read systemd config files
  Resolves: RHEL-53972
  - Allow virtqemud permissions needed for live migration
  Resolves: RHEL-43217
  - Allow virtqemud the getpgid process permission
  Resolves: RHEL-46357
  - Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  Resolves: RHEL-71068
  - Allow virtqemud relabelfrom virt_log_t files
  Resolves: RHEL-48236
  - Allow virtqemud relabel tun_socket
  Resolves: RHEL-71394
  - Allow gnome-remote-desktop dbus chat with policykit
  Resolves: RHEL-35877
  - Update ktlsh policy
  Resolves: RHEL-42672
  - Confine the ktls service
  Resolves: RHEL-42672
  - Allow request-key to read /etc/passwd
  Resolves: RHEL-71490
  - Allow request-key to manage all domains' keys
  Resolves: RHEL-71490


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.21-1
changelog:
  - Allow init create vsock socket for sshd
  Resolves: RHEL-72549
  - Support ssh connections via systemd-ssh-generator
  Resolves: RHEL-72549
  - Allow ssh generator work with systemd unit files
  Resolves: RHEL-72549
  - Confine systemd system-ssh-generator
  Resolves: RHEL-72549
  - Allow login_userdomain getattr nsfs files
  Resolves: RHEL-72549
  - Allow virtqemud send a generic signal to the ssh client domain
  Resolves: RHEL-53972
  - Add the auth_dontaudit_read_passwd_file() interface
  Resolves: RHEL-71490
  - Dontaudit request-key read /etc/passwd
  Resolves: RHEL-71490


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.22-1
changelog:
  - Allow staff user dbus chat with virt-dbus
  Resolves: RHEL-73914
  - Allow virtqemud domain transition to nbdkit
  Resolves: RHEL-69118
  - Add nbdkit interfaces defined conditionally
  Resolves: RHEL-69118
  - Allow svirt_t read sysfs files
  Resolves: RHEL-71270
  - Label /dev/pmem[0-9]+ with fixed_disk_device_t
  Resolves: RHEL-71656
  - Add support for the KVM guest memfd anon inodes
  Resolves: RHEL-69128
  - Allow sysadm user dbus chat with virt-dbus
  Resolves: RHEL-73914
  - Allow initrc_t transition to passwd_t
  Resolves: RHEL-71665
  - Allow unconfined_service_t transition to passwd_t
  Resolves: RHEL-71665


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.23-1
changelog:
  - Remove the lockdown class from the policy
  Resolves: RHEL-36741
  - Remove socket from unconfined_domain_type allow rule
  Resolves: RHEL-36741
  - Include key_socket in socket_class_set
  Resolves: RHEL-36741


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.24-1
changelog:
  - Allow systemd-generator connect to syslog over a unix datagram socket
  Resolves: RHEL-75879
  - Allow ssh_t to change role to system_r
  Resolves: RHEL-53972
  - Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  Resolves: RHEL-39893
  - Allow virtqemud manage fixed disk device nodes
  Resolves: RHEL-71656
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  Resolves: RHEL-72861
  - Allow systemd-machined read the vsock device
  Resolves: RHEL-74280
  - Allow pcmsensor write nmi_watchdog state information
  Resolves: RHEL-52838
  - Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  Resolves: RHEL-52838


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.25-1
changelog:
  - Update ktlshd policy to read /proc/keys and domain keyrings
  Resolves: RHEL-42672
  - Allow pcmsensor read nmi_watchdog state information
  Resolves: RHEL-52838
  - Support peer-to-peer migration of vms using ssh
  Resolves: RHEL-77351
  - Allow virt_domain read hardware state information unconditionally
  Resolves: RHEL-71270
  - Allow timemaster write to sysfs files
  Resolves: RHEL-44637
  - Allow virtqemud map svirt_image_t plain files
  Resolves: RHEL-40080
  - Allow virtqemud unmount a filesystem with extended attributes
  Resolves: RHEL-40080
  - Allow virtqemud work with nvdimm devices
  Resolves: RHEL-71656
  - Update virtqemud policy regarding the svirt_tcg_t domain
  Resolves: RHEL-71270
  - Allow virtqemud use hostdev usb devices conditionally
  Resolves: RHEL-74230
  - Support saving and restoring a VM to/from a block device
  Resolves: RHEL-76138
  - Allow virtnwfilterd dbus chat with firewalld
  Resolves: RHEL-76138
  - Allow virt_domain to use pulseaudio - conditional
  Resolves: RHEL-62763
  - Allow virtstoraged write to sysfs files
  Resolves: RHEL-44637
  - Allow irqbalance to run unconfined scripts conditionally
  Resolves: RHEL-54019
  - Allow rhsmcertd notify virt-who
  Resolves: RHEL-77114
  - Allow init mounton crypto sysctl files
  Resolves: RHEL-56250


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.26-1
changelog:
  - Rename winbind_rpcd_* types to samba_dcerpcd_*
  Resolves: RHEL-14759
  - Allow samba-dcerpcd work with ctdb cluster
  Resolves: RHEL-14759
  - Revert "Remove socket from unconfined_domain_type allow rule"
  Resolves: RHEL-77327
  - Dontaudit access of virt-related permissive domains
  Resolves: RHEL-77808
  - Add selinux_requires_min macro
  Resolves: RHEL-54715
  - Filter out EPEL related modules
  Resolves: RHEL-73505


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.27-1
changelog:
  - Allow afterburn to mount and read config drives
  Resolves: RHEL-82120
  - Update afterburn file transition policy
  Resolves: RHEL-82120
  - Label /run/metadata with afterburn_runtime_t
  Resolves: RHEL-82120
  - Allow afterburn list ssh home directory
  Resolves: RHEL-82120
  - Confine tuned-ppd
  Resolves: RHEL-69450
  - Update ktls policy
  Resolves: RHEL-74424
  - Add the switcheroo module
  Resolves: RHEL-83267
  - Update switcheroo policy
  Resolves: RHEL-83267
  - Confine the switcheroo-control service
  Resolves: RHEL-83267


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.28-1
changelog:
  - Change path of tuned and tuned-ppd to /usr/sbin
  Resolves: RHEL-69450
  - Update the pcmsensor policy
  Resolves: RHEL-80452
  - Allow dovecot-deliver read mail aliases
  Resolves: RHEL-80153
  - Allow boothd connect to systemd-machined over a unix socket
  Resolves: RHEL-75471
  - Allow chronyd-restricted sendto to chronyc
  Resolves: RHEL-82299
  - Allow chronyc sendto to chronyd-restricted
  Resolves: RHEL-82299
  - Allow cifs.idmap helper to set attributes on kernel keys
  Resolves: RHEL-83921
  - Remove ktls from modules-filtered.lst
  Resolves: RHEL-74424


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.29-1
changelog:
  - Revert "Dontaudit access of virt-related permissive domains"
  Resolves: RHEL-79833
  - Remove permissive domains
  Resolves: RHEL-82672


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.30-1
changelog:
  - Allow auditctl signal auditd
  Resolves: RHEL-87418
  - Update bootupd policy for the removing-state-file test
  Resolves: RHEL-87372
  - Allow systemd-user-runtime-dir get/set tmpfs quotas
  Resolves: RHEL-86789
  - Allow systemd-user-runtime-dir delete gnome homedir content
  Resolves: RHEL-86789
  - Confine /usr/lib/systemd/systemd-user-runtime-dir
  Resolves: RHEL-86789
  - Allow system-dbusd list systemd-machined directories
  Resolves: RHEL-86528
  - Allow NetworkManager create and use icmp_socket
  Resolves: RHEL-86258
  - Allow tuned-ppd dbus chat with xdm
  Resolves: RHEL-85849
  - Allow virt_domain write to virt_image_t files
  Resolves: RHEL-85319
  - Allow rhsmcertd connect to systemd-machined
  Resolves: RHEL-83925
  - Allow varnishd execute the prlimit64() syscall
  Resolves: RHEL-77779
  - Allow systemd-machined the kill user-namespace capability
  Resolves: RHEL-77087
  - Allow system_dbusd_t r/w unix stream sockets of unconfined_service_t
  Resolves: RHEL-62185
  - Allow tlshd read network sysctls
  Resolves: RHEL-74424


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.31-1
changelog:
  - Label /dev/diag as diagnostic_device_t
  Resolves: RHEL-89804
  - Label SetroubleshootPrivileged.py with setroubleshootd_exec_t
  Resolves: RHEL-87727
  - Allow syslogd watch syslog_conf_t directories
  Resolves: RHEL-87648
  - Allow networkmanager send a general signal to iptables
  Resolves: RHEL-86780
  - Define file equivalency for /var/etc
  Resolves: RHEL-86678
  - Update bootupd policy when ESP is not mounted
  Resolves: RHEL-86588
  - dontaudit execmem for modemmanager
  Resolves: RHEL-86176
  - Allow systemd create journal pid files
  Resolves: RHEL-72692
  - Allow virtqemud read/write/setattr input event devices
  Resolves: RHEL-46385


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.32-1
changelog:
  - Backport policy for additional systemd generators from rawhide
  Resolves: RHEL-36740
  - Allow login_userdomain create /run/tlog directory with user_tmp_t
  Resolves: RHEL-56344
  - Backport bootupd policy from current Fedora rawhide
  Resolves: RHEL-86588


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.33-1
changelog:
  - Allow systemd_generator read files in /proc and /sys
  Resolves: RHEL-36740
  - Update irqbalance policy for using unconfined scripts
  Resolves: RHEL-54019
  - Allow utempter use terminal multiplexor
  Resolves: RHEL-56344
  - Allow virtqemud execute ovs-vsctl with a domain transition
  Resolves: RHEL-65322
  - Allow mptcpd the net_admin capability
  Resolves: RHEL-70730
  - Allow tomcat execute cracklib-check with a domain transition
  Resolves: RHEL-82090
  - Update the files_search_mnt() interface
  Resolves: RHEL-85178
  - Allow key.dns_resolve set attributes on the kernel key ring
  Resolves: RHEL-91602
  - Allow switcheroo-control dbus chat with xdm
  Resolves: RHEL-93535
  - Revert "Allow virt_domain write to virt_image_t files"
  Resolves: RHEL-93773


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.34-1
changelog:
  - Allow systemd-coredump the sys_admin capability
  Resolves: RHEL-97586
  - Dontaudit systemd-coredump the sys_resource capability
  Resolves: RHEL-97586
  - Allow systemd-coredumpd sys_admin and sys_resource capabilities
  Resolves: RHEL-97586
  - Allow systemd-coredump read nsfs files
  Resolves: RHEL-97586
  - Dontaudit systemd-coredump sys_admin capability
  Resolves: RHEL-97586
  - Allow svirt-tcg read init state
  Resolves: RHEL-95725
  - Allow virtqemud create and unlink files in /etc/libvirt/
  Resolves: RHEL-95725
  - Allow virtqemud send a generic signal to passt
  Resolves: RHEL-44994
  - Allow openvswitch ioctl vduse devices
  Resolves: RHEL-93041
  - Label /dev/vduse/control and /dev/vduse/NAME devices
  Resolves: RHEL-93041
  - Allow virtstoraged the sys_rawio capability
  Resolves: RHEL-44639
  - Allow virtstoraged fsetid capability
  Resolves: RHEL-44639
  - Allow virtqemud additional permissions on scsi generic chr files
  Resolves: RHEL-44628
  - Allow irqbalance execute shell if irqbalance_run_unconfined is on
  Resolves: RHEL-54019
  - Fix files_dontaudit_delete_all_files()
  Resolves: RHEL-86789
  - Allow virtnodedev create mdevctl config dirs
  Resolves: RHEL-98559
  - Allow cryptsetup-generator manage systemd unit files
  Resolves: RHEL-98656


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.35-1
changelog:
  - Remove duplicate summary header
  Related: RHEL-87742
  - Allow irqbalance execute shell if irqbalance_run_unconfined is on
  Resolves: RHEL-54019
  - virt: allow QEMU use of the qgs daemon for attestation
  Resolves: RHEL-87742
  - qgs: add contrib module for TDX "qgs" daemon
  Resolves: RHEL-87742
  - kernel: add interfaces for using SGX enclaves
  Resolves: RHEL-87742


author: Zdenek Pytela <zpytela@redhat.com> - 40.13.1-1
changelog:
  - Allow logwatch read logind sessions files
  Resolves: RHEL-30441
  - Allow sulogin relabel tty1
  Resolves: RHEL-30440
  - Dontaudit sulogin the checkpoint_restore capability
  Resolves: RHEL-30440
  - Allow postfix smtpd map aliases file
  Resolves: RHEL-35544
  - Ensure dbus communication is allowed bidirectionally
  Resolves: RHEL-35783
  - Allow various services read and write z90crypt device
  Resolves: RHEL-28539
  - Allow dhcpcd use unix_stream_socket
  Resolves: RHEL-33081
  - Allow xdm_t to watch and watch_reads mount_var_run_t
  Resolves: RHEL-36073
  - Allow plymouthd log during shutdown
  Resolves: RHEL-30455
  - Update rpm configuration for the /var/run equivalency change
  Resolves: RHEL-36094


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.4-1
changelog:
  - Allow systemd-coredump the sys_chroot capability
  Resolves: RHEL-97586
  - Add the rhcd_rw_fifo_files() interface
  Related: RHEL-99318
  - Add insights_client_delete_lib_dirs() interface
  Related: RHEL-99318


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.5-1
changelog:
  - Confine nfs-server generator
  Resolves: RHEL-106119
  - Support virtqemud handle hotplug hostdev devices
  Resolves: RHEL-65266
  - Allow virtstoraged create qemu /var/run files
  Resolves: RHEL-104344
  - Allow virtqemud write to sysfs files
  Resolves: RHEL-104378
  - Allow unconfined_domain_type cap2_userns capabilities
  Resolves: RHEL-93656


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.6-1
changelog:
  - Apply generator template to selinux-autorelabel generator
  Resolves: RHEL-107516
  - Allow systemd-coredumpd capabilities in the user namespace
  Resolves: RHEL-97586
  - Allow virtqemud start a vm which uses nbdkit
  Resolves: RHEL-69118
  - Add nbdkit_signal() and nbdkit_signull() interfaces
  Resolves: RHEL-69118
  - Allow openvswitch read virtqemud process state
  Resolves: RHEL-65322
  - Add binsbin-convert.sh script
  Resolves: RHEL-69118


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.7-1
changelog:
  - Revert "Add policy for insights-core"
  Resolves: RHEL-110651
  - Revert "Add insights_core interfaces"
  Resolves: RHEL-110651


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.8-1
changelog:
  - Reapply "Add insights_core interfaces"
  Resolves: RHEL-112368
  - Reapply "Add policy for insights-core"
  Resolves: RHEL-112368


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.9-1
changelog:
  - Allow systemd-oomd watch tmpfs dirs
  Resolves: RHEL-106998
  - Allow systemd-oomd watch dbus pid sock files
  Resolves: RHEL-106998
  - Allow userdomain to connect to systemd-oomd over a unix socket
  Resolves: RHEL-106998
  - Allow 'oomctl dump' to interact with systemd-oomd
  Resolves: RHEL-106998
  - Basic functionality for systemd-oomd
  Resolves: RHEL-106998
  - Basic enablement for systemd-oomd
  Resolves: RHEL-106998
  - Remove permissive domains
  Resolves: RHEL-107038
  - Allow iptables manage its private fifo_files in /tmp
  Resolves: RHEL-83775
  - Allow ras-mc-ctl write to sysfs files
  Resolves: RHEL-86926
  - Allow nfs generator create and use netlink sockets
  Resolves: RHEL-111556
  - Revert "Allow virt_domain write to virt_image_t files"
  Resolves: RHEL-93773


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.10-1
changelog:
  - Allow sshd-auth read generic proc files
  Resolves: RHEL-107732
  - Allow sshd-auth read and write user domain ptys
  Resolves: RHEL-107732
  - Allow sshd-session get attributes of sshd vsock socket
  Resolves: RHEL-107732
  - Adjust guest and xguest users policy for sshd-session
  Resolves: RHEL-107732
  - Update files_search_base_file_types()
  Resolves: RHEL-107732
  - Allow sshd-session read cockpit pid files
  Resolves: RHEL-107732
  - Add default contexts for sshd-seesion
  Resolves: RHEL-107732
  - Define types for new openssh executables
  Resolves: RHEL-107732
  - Allow ras-mc-ctl get attributes of the kmod executable
  Resolves: RHEL-102535
  - Define file equivalency for /var/opt
  Resolves: RHEL-116512
  - Update specfile triggers for DSP modules
  Resolves: RHEL-116044


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.11-1
changelog:
  - Allow iotop stream connect to systemd-userdbd
  Resolves: RHEL-105481
  - Allow insights-client manage /etc symlinks
  Resolves: RHEL-107589
  - Allow insights-client get attributes of the rpm executable
  Resolves: RHEL-124855
  - Allow nfsidmapd search virt lib directories
  Resolves: RHEL-68722
  - Allow kdump search kdumpctl_tmp_t directories
  Resolves: RHEL-116041


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.12-1
changelog:
  - Update kernel_secretmem_use()
  Resolves: RHEL-116154
  - Allow system_mail_t read apache system content conditionally
  Resolves: RHEL-114970
  - Allow create kerberos files in postgresql db home
  Resolves: RHEL-119619
  - Update specfile trigger for smartmontools
  Resolves: RHEL-113167


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.13-1
changelog:
  - Add the rpm_signal() interface
  Related: RHEL-107589
  - Allow tuned_t use its private tmpfs files
  Related: RHEL-107589
  - Allow samba-bgqd send to smbd over a unix datagram socket
  Resolves: RHEL-93731
  - Allow kdump search kdumpctl_tmp_t directories
  Resolves: RHEL-116041
  - Confine redfish_finder - host api discovery service
  Resolves: RHEL-50299
  - Update policy for dhcpc_hook_t
  Resolves: RHEL-113937
  - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  Resolves: RHEL-113937
  - Allow systemd to map files under /sys
  Resolves: RHEL-132638


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.14-1
changelog:
  - Update ktls policy
  Resolves: RHEL-123737
  - Update policy for redfish-finder
  Resolves: RHEL-50299
  - Allow sshd-session read, write, and map ica tmpfs files
  Resolves: RHEL-138247
  - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  Resolves: RHEL-127721
  - Allow stalld map sysfs files
  Resolves: RHEL-135512
  - Allow aide get attributes of a filesystem with extended attributes
  Resolves: RHEL-121479
  - Label miscellaneous /dev/papr-* devices
  Resolves: RHEL-129839
  - Allow KDE Plasma Login Manager to function as a display manager
  Resolves: RHEL-135676
  - Update specfile trigger for openwsmand
  Resolves: RHEL-133024


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.15-1
changelog:
  - Allow hostapd write to socket files in /tmp
  Resolves: RHEL-77047
  - Allow stap server read virtual memory sysctls
  Resolves: RHEL-114104
  - Allow sshd-session inherit limits from its parent process
  Resolves: RHEL-136673
  - Allow sshd noatsecure on sshd-session execution
  Resolves: RHEL-138247
  - Allow sshd-net read and write to sshd vsock socket
  Related: RHEL-138247


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.3-1
changelog:
  - Allow svirt read virtqemud fifo files
  Resolves: RHEL-104069
  - Allow virtqemud handle virt_content_t chr files
  Resolves: RHEL-76104
  - Allow "hostapd_cli ping" run as a systemd service
  Resolves: RHEL-77047
  - All sblim-sfcbd the dac_read_search capability
  Resolves: RHEL-98287
  - Allow sblim domain read systemd session files
  Resolves: RHEL-98287
  - Allow sblim-sfcbd execute dnsdomainname
  Resolves: RHEL-98287
  - Allow systemd-importd create and unlink init pid socket
  Resolves: RHEL-98490


author: Martin Osvald <mosvald@redhat.com> - 2.14.2-1
changelog:
  - sysusers.d: add script and configuration fragments for groups
  - passwd: align 'nologin' shell path with systemd defaults
  - uidgid: assign GID 101 for 'ssh_keys' group
  - uidgid: assign UID/GID 114 for 'polkitd'
  - passwd: update GECOS field for 'root' user
  - services: remove commas from aliases for ircu-3
  - setup.spec: throw away newaliases output again


author: Martin Osvald <mosvald@redhat.com> - 2.14.3-1
changelog:
  - sysusers.d: add script and generate configuration fragment for users
  - Add fallback to hostname determination for csh.login (rhbz#2079768)
  - Remove ancient Conflicts
  - files: mark /run/motd as an ephemeral ghost entry


author: Martin Osvald <mosvald@redhat.com> - 2.14.4-1
changelog:
  - protocols: add mptcp (262)
  - setup.spec: make setup protected package (rhbz#2155547)
  - setup.spec: don't report rpm -Va error on /run/motd (rhbz#2160954)
  - services: replace hostmon with llmnr for port 5355 (rhbz#2216914)


author: Martin Osvald <mosvald@redhat.com> - 2.14.5-1
changelog:
  - bashrc: switch PROMPT_COMMAND to be an array (rhbz#2097525)
  - profile: don't overwrite the HISTSIZE environment variable
  - hosts: use "example.org" as example domain (rhbz#2246220)
  - csh.login: source csh.local (RHEL-17226)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.48-7
changelog:
  - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607)
  - Install missing 00-scsi-sg3_config.rules
  - Fix file references to other udev rules


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
changelog:
  - passwd: Provide binary from this package. Enable libpam and
    disable account-tools-setuid. Provide passwd PAM service file.
    Resolves: #2233275
  - passwd: provide --stdin option


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
changelog:
  - Rebase to version 4.15.0
  - getdef: avoid spurious error messages about unknown configuration options


author: Milan Crha <mcrha@redhat.com> - 2.3-6
changelog:
  - Co-own /usr/share/gettext and /usr/share/gettext/its
  - Related to rhbz#2280150
  - Resolves: RHEL-38682 (Backport Fedora 40 changes)


author: Zuzana Miklankova <zmiklank@redhat.com> - 3.45.0-1
changelog:
  - Updated to version 3.45.0 (https://sqlite.org/releaselog/3_45_0.html)
  - List versioned soname in files, preventing unnoticed soname bumps
  - Disable func4 tests for i686 arch due to failing float<->int conversions


author: Bruno Wolff III <bruno@wolff.to> - 4.6-1
changelog:
  - 4.6 release
  - PR #231 was merged
  - See https://github.com/plougher/squashfs-tools/blob/master/CHANGES


author: Bruno Wolff III <bruno@wolff.to> - 4.6.1-1
changelog:
  - Phillip is now doing two tags per release and we can
  - use the one that works better with forgemeta
  - There are a few fixes after the 4.6 release. I think only
  - one applies to Fedora because of the build options we use.
  - It was not something that affects image builds.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-5
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-65108).
  - Update net-yy-inet* and linkat--secontext_mismatch tests.


author: Eugene Syromiatnikov <esyr@redhat.com> - 6.7-6
changelog:
  - Avoid failures of creat.gen test on kernels that include commit
    v6.11-rc1~242^2~19 ("fs: don't block i_writecount during exec").


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.9.14-1.p3
changelog:
  - Rebase to 1.9.14p3
  - sudo-1_9_14p2 is available Resolves: rhbz#2175672
  - sudo fails to build with Python 3.12: FAILED: testcase
    check_example_group_plugin_is_able_to_debug() Resolves: rhbz#2186412


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-1.p5
changelog:
  - Rabase to 1.9.15p5
  - sudo-1_9_15p5 is available Resolves: rhbz#2248505
  - TRIAGE CVE-2023-42465 sudo: Targeted Corruption of Register and Stack
    Variables Resolves: rhbz#2255569


author: Radovan Sroka <rsroka@redhat.com> - 1.9.15-5.p5
changelog:
  - RHEL 10.0 ERRATUM
  - sudo-1.9.15-2.p5.el10: RHEL SAST Automation: address 4 High impact true
    positive(s) Resolves: RHEL-44436
  - sudo subpackage sudo-logsrvd should not be built Resolves: RHEL-52864


author: Alejandro López <allopez@redhat.com> - 1.9.15-9.p5
changelog:
  - RHEL 10.1 ERRATUM
  - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009
  - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022


author: Alejandro López <allopez@redhat.com> - 1.9.17-2.p2
changelog:
  - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to
    the shell being executed [rhel-10]
  - Resolves: RHEL-128212 - [RFE] request to backport support for regex in
    sudo [rhel-10]
  - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10]


author: systemd maintenance team <systemd-maint@redhat.com> - 256-6
changelog:
  - doc: add downstream CONTRIBUTING document (RHEL-40924)
  - ci: allow `policy` as rhel-only keyword (RHEL-40924)
  -  ci: run mkosi test only for Fedora and CentOS Stream (RHEL-40924)
  - taint: remove unused variable `usr_sbin` (RHEL-40924)
  - packit: drop the libarchive workaround (RHEL-40924)
  - packit: drop the dependency on python3-zstd (RHEL-40924)
  - coredump: by default process and store core files up to 1GiB (RHEL-46778)
  - don't ship systemd-ssh-generator harder (RHEL-40924)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-8
changelog:
  - Avoid /tmp being mounted as tmpfs without the user's will (RHEL-40924)
  - unit: don't add Requires for tmp.mount (RHEL-40924)
  - units: add [Install] section to tmp.mount (RHEL-40924)
  - units: don't enable tmp.mount statically in local-fs.target (RHEL-40924)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-12
changelog:
  - netif-naming-scheme: add rhel-9.5 scheme (RHEL-44416)
  - udev-builtin-net_id: use firmware_node/sun for ID_NET_NAME_SLOT (RHEL-44416)
  - man/net-naming-scheme: add missing period (RHEL-44416)
  - Revert "packit: drop the dependency on python3-zstd" (RHEL-36636)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-13
changelog:
  - systemctl: do not try to acquire triggering units for template units (RHEL-55132)
  - core/unit: add one assertion for u->manager (RHEL-55734)
  - core/service: destroy runtime data when Type=oneshot services exit (RHEL-55734)
  - cgroup-util: Ignore kernel threads in cg_kill_items() (RHEL-55746)
  - cgroup-util: Don't try to open pidfd for kernel threads (RHEL-55746)
  - cgroup-util: fix typo (RHEL-55746)
  - netif-naming-scheme: rename rhel-10.0 to rhel-10.0.beta (RHEL-55728)
  - net-naming-scheme: disable NAMING_FIRMWARE_NODE_SUN (RHEL-55728)
  - net-naming-scheme: remove NAMING_FIRMWARE_NODE_SUN from 9.5 (RHEL-55728)
  - make systemd-ukify subpackage arch dependent (RHEL-52634)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-14
changelog:
  - Revert "cgroup-util: Don't try to open pidfd for kernel threads" (RHEL-52634)
  - ukify: Skip test on architectures without UEFI (RHEL-52634)


author: systemd maintenance team <systemd-maint@redhat.com> - 256-15
changelog:
  - ci: rename beta branch to match dist-git name (RHEL-57603)
  - udev: Handle PTP device symlink properly on udev action 'change' (RHEL-59871)
  - Fix detection of TDX confidential VM on Azure platform (RHEL-56144)
  - confidential-virt: split caching of CVM detection into separate method (RHEL-56144)
  - confidential-virt: add detection for s390x target (RHEL-56144)
  - man/systemd-detect-virt: fix row spanning for VM header (RHEL-56144)
  - man/systemd-detect-virt: list known CVM technologies (RHEL-56144)


author: Jan Macku <jamacku@redhat.com> - 257-3
changelog:
  - udev/net_id: introduce naming scheme for RHEL-9.6 (RHEL-44417)
  - Rebase to new upstream stable release v257.2 (RHEL-71409)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-4
changelog:
  - ci: use ubuntu 22:04 for deploy of man pages (RHEL-57603)
  - tree-wide: Fix python formatting (RHEL-57603)
  - ci: fix Packit (RHEL-57603)
  - ci: drop testing farm test (RHEL-57603)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-73780)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-73780)
  - shared/bus-util: move bus_message_read_id128() to bus-message-util (RHEL-73780)
  - shared/bus-util: move bus_message_hash_ops to bus-message-util (RHEL-73780)
  - shared/bus-util: move string set append/get funcs to bus-message-util and bus-get-properties, respectively (RHEL-73780)
  - shared/serialize: make input params const (RHEL-73780)
  - shared/serialize: introduce serialize_id128() (RHEL-73780)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-73780)
  - core/manager: use FOREACH_ARRAY at one more place (RHEL-73780)
  - core/manager: drop duplicate bus track deserialization (RHEL-73780)
  - bus-util: introduce bus_get_instance_id() (RHEL-73780)
  - core: serialize API bus id and validate before deserializing bus tracks (RHEL-73780)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-73780)
  - shared/bus-util: add missing `set.h` include (RHEL-73780)
  - udevadm-test: add missing oom check (RHEL-75774)
  - udev-rules: replace 'type *func()' -> 'type* func()' (RHEL-75774)
  - udev-rules: do not change maximum log level when running in test mode (RHEL-75774)
  - udevadm-test: introduce -v/--verbose option to show verbose log messages (RHEL-75774)
  - udev-rules: show original token string in log_event_error() and friends (RHEL-75774)
  - udev-rules: logs result of format substitution (RHEL-75774)
  - udev-rules: add more trace logs for string match (RHEL-75774)
  - udev-rules: introduce udev_replace_chars_and_log() (RHEL-75774)
  - udev-rules: ignore whole command result if it is too long and does not contain newline (RHEL-75774)
  - udev-rules: update log messages (RHEL-75774)
  - udev-rules: add trace logs for GOTO and parent conditions (RHEL-75774)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-8
changelog:
  - Rebase to new upstream stable release v257.3 (RHEL-71409)
  - udev: introduce several features to make debugging rules easier (RHEL-75774)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-10
changelog:
  - resolved: pick up new DNSSEC KSC from 2024 (RHEL-77718)
  - test_ukify: Skip on riscv64 (RHEL-85854)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-11
changelog:
  - fuzz-journal-remote: use ASSERT_OK() and friends (RHEL-79976)
  - logs-show: skip journal entry with an invalid timestamp (RHEL-79976)
  - man: mention that rhel-9.0 net naming scheme is the same as v251 (RHEL-87179)
  - backlight: Drop support for actual_brightness (RHEL-86713)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-12
changelog:
  - mkosi: use C10S repo for building RPMs (RHEL-79976)
  - test: adapt TEST-22 to the downstream --purge behavior (RHEL-79976)
  - mkosi: reconfigure the CI for CentOS Stream 10 (RHEL-79976)
  - test: skip tests for components not shipped in RHEL 10 (RHEL-79976)
  - ci: add a unique identifier to each GH Actions job (RHEL-79976)
  - test: limit logging when running TEST-21-DFUZZER (RHEL-79976)
  - man: mention RHEL documentation in systemctl's man page (RHEL-97762)
  - ukify: switch from zstd to zstandard (RHEL-97625)
  - ukify: fix zboot parsing with zstd (RHEL-97625)
  - ukify: if the specified kernel is not a valid PE file try to decompress it (RHEL-97625)
  - ukify: fix version detection for aarch64 zboot kernels with gzip or lzma compression (RHEL-97625)
  - ukify: when decompressing kernel before signing, call verify on decompressed file (RHEL-97625)
  - udev/net_id: introduce naming scheme for RHEL-10.1 (RHEL-44419)
  - udev/net_id: introduce naming scheme for RHEL-9.7 (RHEL-44419)
  - sd-event: drop inotify event from buffer when no event source is triggered (RHEL-104555)
  - test: add test case for issue #38265 (RHEL-104555)
  - tree-wide: check more log message format in log_struct() and friends (RHEL-106260)
  - core: output log cycle path in one log message, not many (RHEL-106260)
  - core: make log cycle messages recognizable via message IDs (RHEL-106260)
  - core: change ordering cycle log message log levels (RHEL-106260)
  - core: cast log_oom() got void (RHEL-106260)
  - core: when removing a job from a transaction, include in structured log message which (RHEL-106260)
  - catalog: add entries for the order cycle log messages (RHEL-106260)
  - flush_ports: flush POSIX message queues properly (RHEL-100553)
  - Add --entry-type=type1|type2 option to kernel-install. (RHEL-103354)
  - kernel-install: regroup options in help meesage (RHEL-103354)
  - kernel-install: do not mix || and && (RHEL-103354)
  - man/kernel-install: mention --entry-type= option in the man page (RHEL-103354)
  - bootspec: rename boot_entry_type_to_string() to boot_entry_type_description_to_string() (RHEL-103354)
  - bootspec: include 'UKI' in descriptive name for type #2 (RHEL-103354)
  - bootspec: rename BootEntryType values (RHEL-103354)
  - bootspec: rename boot_entry_source_to_string() to boot_entry_source_description_to_string() (RHEL-103354)
  - bootspec: boot_entry_source_to_json_string() to boot_entry_source_to_string() (RHEL-103354)
  - 90-uki-copy.install: Skip removing UKI related when BOOT_ENTRY_TYPE=type1 (RHEL-103354)
  - hwdb: add front button support for MSI Claw 7 AI+ A2VM (RHEL-72701)
  - hwdb: add accel orientation and location for the BMAX Y14 (RHEL-72701)
  - hwdb.d: add support for Akoya P15645 (RHEL-72701)
  - hwdb.d: add ANP09 Intel n100 tablet sensor configuration (#36390) (RHEL-72701)
  - hwdb: add axis range corrections for the Lenovo Yoga Slim 7 14ARE05 (RHEL-72701)
  - hwdb: add GOLD WARRIOR SIM PhoenixRC 10411R (RHEL-72701)
  - hwdb: add Code Mercenaries Hard- und Software GmbH Virtual RC USB (RHEL-72701)
  - hwdb: Add accel orientation quirk for the GPD Pocket 4 (RHEL-72701)
  - hwdb: add rotation profile matrix for Rog Ally X (2024) (#36591) (RHEL-72701)
  - hwdb: fix backspace not working on HP Pavilion laptop (#36777) (RHEL-72701)
  - hwdb/keyboard: Map FN key on TUXEDO NB02 devices (RHEL-72701)
  - hwdb/keyboard: Map FN key on TUXEDO InfinityFlex 14 Gen1 (RHEL-72701)
  - hwdb: add G-Mode key support (#37175) (RHEL-72701)
  - Add emulated release to G-Mode key (RHEL-72701)
  - hwdb: keyboard: Add Alienware special keys (RHEL-72701)
  - hwdb: add bladeRF SDR devices (RHEL-72701)
  - hwdb: append ID_SOFTWARE_RADIO to hwdb parser (RHEL-72701)
  - hwdb.d: reword and simplify boilerplate texts (RHEL-72701)
  - hwdb.d: update/expand boilerplate on various hwdb files (RHEL-72701)
  - hwdb: say that settings can be also set to 0 (RHEL-72701)
  - hwdb: add Analog Devices PLUTO SDR (RHEL-72701)
  -  hwdb: append ID_MM_DEVICE_IGNORE to hwdb parser (RHEL-72701)
  - hwdb: run "update-hwdb" (RHEL-72701)
  - hwdb: run "update-hwdb-autosuspend" (RHEL-72701)
  - hwdb: add missing PLUTO SDR vendor name (RHEL-72701)
  - hwdb: add Ettus Research SDR devices (RHEL-72701)
  - hwdb: add RTL-SDR devices (RHEL-72701)
  - hwdb: merge entries for Ettus Research B200 (RHEL-72701)
  - hwdb: make Saitek PLC Pro Flight Rudder Pedals a joystick (#37601) (RHEL-72701)
  - hwdb: fix touchpad for ASUS X1504ZA (#37696) (RHEL-72701)
  - hwdb: add support for Loupedeck devices (RHEL-72701)
  - hwdb: Acer Nitro ANV15-51 Mic Toggle (RHEL-72701)
  - hwdb: Added Beacn and TC-Helicon Audio controllers (#37798) (RHEL-72701)
  - hwdb: Add support for Lenovo IdeaPad Slim 5 series (RHEL-72701)
  - hwdb: Add hwbd definitions for maker tools (RHEL-72701)
  - hwdb: Add accel orientation quirk for the Microtech e-tab Pro (RHEL-72701)
  - hwdb: add 70-maker-tools.hwdb to meson.build (RHEL-72701)
  - hwdb: fix typo in 70-maker-tools.hwdb (RHEL-72701)
  - hwdb: update (RHEL-72701)
  - Fix Positivo K116J search key and www shortcut (RHEL-72701)
  - hwdb: Acer Nitro ANV15-51 Nitro Sense Toggle (RHEL-72701)
  - hwdb: several cleanups (RHEL-72701)
  - hwdb: disable Asus ROG keyboards sending poweroff (RHEL-72701)
  - hwdb: update (RHEL-72701)
  - hwdb: update autosuspend rules (RHEL-72701)
  - hwdb: set touchpad resolution for ThinkPad T14 Gen2a (RHEL-72701)
  - Revert "hwdb: disable Asus ROG keyboards sending poweroff" (RHEL-72701)
  - hwdb: Add launch emoji keyboard mapping for Asus M1607KA (RHEL-72701)
  - Enable KEY_PERFORMANCE key present on Linux 6.17 (RHEL-72701)
  - hwdb: add HP 150 Wired Mouse (#37341) (RHEL-72701)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-14
changelog:
  - test: add test case for AddDependencyUnitFiles assert (RHEL-108257)
  - TEST-17: drop unnecessary $PATH setting (RHEL-108242)
  - chase: check the result is a directory or regular file only when the resolved path exists (RHEL-108006)
  - bootctl: stop printing "Stub/Boot loader set partition information" (RHEL-108251)
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109552)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-15
changelog:
  - coredump: drop RestrictSUIDSGID= option (#38640) (RHEL-113920)
  - ukify: fix insertion of padding in merged sections (RHEL-114414)
  - core: introduce Unit.dependency_generation counter and restart loop when dependency is updated in the loop (RHEL-112203)
  - core/unit: use UNIT_FOREACH_DEPENDENCY_SAFE() at several more places (RHEL-112203)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-16
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118216)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118216)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118216)
  - timer: don't run service immediately after restart of a timer (RHEL-118216)
  - test: store and compare just the property value (RHEL-118216)


author: Jan Macku <jamacku@redhat.com> - 257-1
changelog:
  - Rebase to new upstream release v257 (RHEL-71409)
  - netif-naming-scheme: introduce rhel-10.0 scheme (RHEL-44417)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-17
changelog:
  - pam_systemd: honor session class provided via PAM environment (RHEL-109832)
  - udev/net_id: introduce naming scheme for RHEL-10.2 (RHEL-72813)
  - udev/net_id: introduce naming scheme for RHEL-9.8 (RHEL-72813)
  - test: split VM-only subtests from TEST-74-AUX-UTILS to new VM-only test (RHEL-112205)
  - core/transaction: first drop unmergable jobs for anchor jobs (RHEL-112205)
  - test: add test case for issue #38765 (RHEL-112205)
  - strv: add strv_equal_ignore_order() helper (RHEL-109902)
  - pam: minor coding style tweaks (RHEL-109902)
  - user-record: add helper that checks if a provided user name matches a record (RHEL-109902)
  - user-record: add support for alias user names to user record (RHEL-109902)
  - pam_systemd_home: use right field name in error message (RHEL-109902)
  - pam_systemd_home: support login with alias names + user names with realms (RHEL-109902)
  - homed: support user record aliases (RHEL-109902)
  - homectl: add support for creating users with alias names (RHEL-109902)
  - test: add test for homed alias and realm user resolution (RHEL-109902)
  - update TODO (RHEL-109902)
  - udev: create symlinks for s390 PTP devices (RHEL-120177)
  - test: build the crashing test binary outside of the test (RHEL-113920)
  - test: exclude test-stacktrace(-not)?-symbolized from the coredump check (RHEL-113920)
  - mkosi: install test dependencies for EnterNamespace= test (RHEL-113920)
  - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
  - coredump: restore compatibility with older patterns (RHEL-104135)
  - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
  - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
  - coredump: use %d in kernel core pattern (RHEL-104135)
  - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
  - coredump: get rid of a bogus assertion (RHEL-104135)
  - coredump: add support for new %F PIDFD specifier (RHEL-104135)
  - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
  - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
  - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
  - coredump: fix 0-passed-as-pointer warning (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-19
changelog:
  - man: fix a missing word (RHEL-120277)
  - sd_bus_open_user_machine(): Don't shortcut without necessary env (RHEL-129179)
  - udev: set clock group for PTP and RTC devices (RHEL-113051)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126122)
  - strv: introduce string_strv_hashmap_remove() (RHEL-126937)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-126937)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-126937)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-126937)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-20
changelog:
  - tools/check-version-history: avoid DeprecationWarning with newer lxml (RHEL-128767)
  - man: don't duplicate version in History section (RHEL-128767)
  - tools: ignore root element explicitly in check-version-history (RHEL-128767)
  - systemd-logind: Add signal section in man systemd-logind (RHEL-128767)
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118216)
  - timer: rebase last_trigger timestamp if needed (RHEL-118216)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
changelog:
  - Backport upstream changes to jailify extraction directory
    Includes related gnulib changes to add openat2
    Fixes CVE-2025-45582


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-10
changelog:
  - added "padding with zeros" info message (#2089298)
  - do not report disk error as file shrank (#2089316)
  - upstream fix for savannah bug 64581, commit 51142180
    (crash with TAR_OPTIONS)
  - Backport fix for regression in the --no-overwrite-dir option
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: John Kacur <jkacur@redhat.com> - 0.19-7
changelog:
  - Add missing patch to prevents tuna gui from starting if display not available
  - remove oscilloscope which is unsupported in rhel
  - Add rpmsinpect.yaml and gating.yaml
  - Add tests dir
  - update the current version of python-linux-procfs as a requires
  Resolves: RHEL-30171


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-11
changelog:
  - Fix syntax warnings
  - Switch RHEL10 pkg to use autosetup like c9s does in tuna, -v makes it more verbose
  Resolves: RHEL-106288


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-12
changelog:
  - Reverting the previous syntax warnings fix patch and replacing it with the
  tuna-Fix-string-syntax-warnings-with-raw-strings patch.
  Resolves: RHEL-106288


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-13
changelog:
  - Applied tuna: Fix help.py syntax warnings and tuna: help.py
  - Requested to remove resolves statement from previous entry.
  Resolves: RHEL-106290


author: John Kacur <jkacur@redhat.com> - 0.19-14
changelog:
  - Update man page with cpu_power command
  - Fix show_threads -t and show_irqs -q to not match everything if no match
  - Fix run command failing to apply BATCH policy
  - Add -U and -K to the move command
  Resolves: RHEL-107914 RHEL-106070 RHEL-93776 RHEL-106068


author: John Kacur <jkacur@redhat.com> - 0.20-1
changelog:
  - Update to upstream version 0.20
  - Convert spec file to use pyproject-rpm-macros
  - Use %pyproject_buildrequires, %pyproject_build, %pyproject_install
  - Use %pyproject_save_files for automatic file list generation
  - Remove oscilloscope (unsupported in RHEL)
  Resolves: RHEL-114902, RHEL-83080


author: John Kacur <jkacur@redhat.com> - 0.20-2
changelog:
  - Add python3-pip, python3-setuptools, python3-wheel BuildRequires
  - Delete setup.py in %prep so pyproject.toml build is used
  - Compress man page during %prep similar to rteval
  - Install tuna script and compressed man page explicitly
  Resolves: RHEL-114902


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182117
    - plugin_scheduler: fix perf fd leaks
      resolves: rhbz#2173938
    - allow skipping rollback when restarting TuneD or switching profile
      resolves: rhbz#2203142
    - function_calc_isolated_cores: no errors for offline CPUs
      resolves: rhbz#2217015


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-17121
    - print all arguments of failing commands in error messages
      resolves: RHEL-3689
    - plugin_sysctl: added support for sysctl names with slash
      resolves: RHEL-3707
    - tuned-adm: added support for moving devices between plugin instances
      resolves: RHEL-15141
    - api: added methods for retrieval of plugin instances and devices
      resolves: RHEL-15137
    - plugin_cpu: amd-pstate mentioned instead of just intel_pstate
      resolves: RHEL-16469
    - hotplug: do not report ENOENT errors on device remove
      resolves: RHEL-11342
    - plugin_sysctl: expand variables when reporting overrides
      resolves: RHEL-18972
    - plugin_acpi: new plugin which handles ACPI platform_profile
      resolves: RHEL-16966
    - plugin_bootloader: skip calling rpm-ostree kargs in no-op case
      resolves: RHEL-20767
    - plugin_cpu: support cstate settings of pm_qos_resume_latency_us
      resolves: RHEL-21129
    - scheduler: add option for ignoring IRQs affinity
      resolves: RHEL-21923
    - plugin_intel_uncore: new plugin for uncore setting


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17121
    - renamed intel_uncore plugin to uncore
    - network-throughput: increased net.ipv4.tcp_rmem default value
      resolves: RHEL-25847


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-50567
    - spec: create /etc/tuned/profiles directory
      resolves: RHEL-46721
    - hotplug: wait for device initialization
    - sap-netweaver: increased vm.max_map_count
    - daemon: buffer sighup signal
    - added an option to configure profile directories
    - api: added commands to dynamically create/destroy instances
    - functions: added 'intel_recommended_pstate'
    - functions: added 'log' which helps with debugging
    - functions: added 'package2cpus' and 'packages2uncores' matchers
    - functions: added 'lscpu' to list CPU details
    - plugins: added plugin_irq
    - plugin_video: added support for amdgpu `panel_power_savings` attribute
    - plugin_cpu: check that writes are necessary if they may cause redundant IPIs
    - plugin_uncore: allow to configure frequency limits using percent
    - amd-pstate: added support for controlling core performance boost
    - plugin_scheduler: adjusted error logging in _set_affinity
    - plugin_audio: enabled controller reset to fix suspend with NVIDIA
    - plugin_irq: fixed expansion of variables
    - plugin_irqbalance: switched to IRQBALANCE_BANNED_CPULIST


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50567
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-3
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66636
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66613


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-70454
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
      resolves: RHEL-74384
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
      resolves: RHEL-69933
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
      resolves: RHEL-74384
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
      resolves: RHEL-69933
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - sap-hana: Set transparent_hugepages to madvise
      resolves: RHEL-68454
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70454
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94809
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
      resolves: RHEL-94842
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
      resolves: RHEL-88238
    - functions: silenced errors if module kvm_intel does not exist
    - functions: make calc_isolated_cores return CPU ranges
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
      resolves: RHEL-79913
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: disable appropriate P-State drivers
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
      resolves: RHEL-97087
    - udev-settle: obey udev buffer size and handle possible tracebacks
      resolves: RHEL-92637
    - daemon: re-raise daemon init exception in no-daemon mode
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
    - gui: fix the profile deleter script


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024a-3
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-32178)
  - Remove hardcoded versioned path to javac.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.
  - Harden against links to removed zones


author: Patsy Griffin <pats@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74296)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84740)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Jakub Martisko <jamartis@redhat.com> - 6.0-65
changelog:
  - Fix: Unzip Fails on Large Zip Files
  - Use the patch from Debian dealing with this
  Resolves: RHEL-45993


author: Jakub Martisko <jamartis@redhat.com> - 6.0-67
changelog:
  - zipinfo: remove the extra %c that caused invalid reads
  - zipinfo: fix the whitespaces in the output
  - Zipbombs: Port Another patch, orinally made by Mark Adler
  - https://github.com/madler/unzip/commit/af0d07f95809653b669d88aa0f424c6d5aa48ba0
    Resolves: RHEL-59972
    Resolves: RHEL-6286


author: - Chung Chung <cchung@redhat.com> - 8.3.2.1-1
changelog:
  - Add vdocalculatesize utility.
  - Improve handling of corrupt index metadata.
  - Resolves: RHEL-129392


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.076-2
changelog:
  - enable building without GPM support - build with GPM in Fedora
  - 2262371 - gvim: symbol lookup error: gvim: undefined symbol: g_once_init_enter_pointer


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-6
changelog:
  - RHEL-113549 CVE-2025-53906 vim: Vim path traversal
  - RHEL-113543 CVE-2025-53905 vim: Vim path traversial


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1:2.10-8
changelog:
  - Backport WPA3 support for Broadcom devices. Fixes: rhbz#2226569
  - Enable parsing of IPv6 addresses in RADIUS configuration (#2095296)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-10
changelog:
  - Fix package configuration/add missing patches to avoid regressions when
    upgrading from rhel-9 (RHEL-43250)
  - Backport P2P fixc causing nmci failures (RHEL-17701)
  - Disable OpenSSL ENGINE API (RHEL-33750)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-10
changelog:
  - Fix package configuration/add missing patches to avoid regressions when
    upgrading from rhel-9 (RHEL-43250)
  - Backport P2P fix causing nmci failures (RHEL-17701)
  - Disable OpenSSL ENGINE API (RHEL-33750)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-1
changelog:
  - Update to version 2.11 (RHEL-59010)
  - backport fix for known regression on brcmfmac (rhbz#2302577)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.11-4
changelog:
  - Use pkcs11 provider to resolve PKCS11 URIs (RHEL-86951)
  - De-clutter syslog from CTRL-EVENT-SIGNAL-CHANGE messages (RHEL-71344)


author: Jakub Martisko <jamartis@redhat.com> - 3.0-42
changelog:
  - Use C implementation of some functions instead of asm
  - Fix the missing compiler/linker flags
  - Minor spec clean up
  Resolves: RHEL-33526


