# changelog

author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-108
changelog:
  - Allow sosreport to send a signal to ABRT
  - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t
  - Label /usr/sbin/htcacheclean as httpd_exec_t
  Resolves:#1037529
  - Added support for rdisc unit file
  - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
  - Allow runuser running as logrotate connections to system DBUS
  - Label bcache devices as fixed_disk_device_t
  - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
  - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-109
changelog:
  - Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t
  Resolves:#1039879
  - Add labeling for /usr/lib/systemd/system/mariadb.service
  - Allow hyperv_domain to read sysfs
  - Fix ldap_read_certs() interface to allow acess also link files
  - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
  - Allow tuned to run modprobe
  - Allow portreserve to search /var/lib/sss dir
  - Add SELinux support for the teamd package contains team network device control daemon.
  - Dontaudit access check on /proc for bumblebee
  - Bumblebee wants to load nvidia modules
  - Fix rpm_named_filetrans_log_files and wine.te
  - Add conman policy for rawhide
  - DRM master and input event devices are used by  the TakeDevice API
  - Clean up bumblebee policy
  - Update pegasus_openlmi_storage_t policy
  - Add freeipmi_stream_connect() interface
  - Allow logwatch read madm.conf to support RAID setup
  - Add raid_read_conf_files() interface
  - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
  - add rpm_named_filetrans_log_files() interface
  - Allow dkim-milter to create files/dirs in /tmp
  - update freeipmi policy
  - Add policy for freeipmi services
  - Added rdisc_admin and rdisc_systemctl interfaces
  - opensm policy clean up
  - openwsman policy clean up
  - ninfod policy clean up
  - Added new policy for ninfod
  - Added new policy for openwsman
  - Added rdisc_admin and rdisc_systemctl interfaces
  - Fix kernel_dontaudit_access_check_proc()
  - Add support for /dev/uhid
  - Allow sulogin to get the attributes of initctl and sys_admin cap
  - Add kernel_dontaudit_access_check_proc()
  - Fix dev_rw_ipmi_dev()
  - Fix new interface in devices.if
  - DRM master and input event devices are used by  the TakeDevice API
  - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
  - Added support for default conman port
  - Add interfaces for ipmi devices


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-110
changelog:
  - Allow freeipmi_ipmidetectd_t to use freeipmi port
  - Update freeipmi_domain_template()
  - Allow journalctl running as ABRT to read /run/log/journal
  - Allow NM to read dispatcher.d directory
  - Update freeipmi policy
  - Type transitions with a filename not allowed inside conditionals
  - Allow tor to bind to hplip port
  - Make new type to texlive files in homedir
  - Allow zabbix_agent to transition to dmidecode
  - Add rules for docker
  - Allow sosreport to send signull to unconfined_t
  - Add virt_noatsecure and virt_rlimitinh interfaces
  - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port
  - Add sysadm_u_default_contexts
  - Add logging_read_syslog_pid()
  - Fix userdom_manage_home_texlive() interface
  - Make new type to texlive files in homedir
  - Add filename transitions for /run and /lock links
  - Allow virtd to inherit rlimit information
  Resolves:#975358


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-111
changelog:
  - Add labeling for /var/lib/servicelog/servicelog.db-journal
  - Add support for freeipmi port
  - Add sysadm_u_default_contexts
  - Make new type to texlive files in homedir
  - Allow subscription-manager running as sosreport_t to manage rhsmcertd
  - Additional fixes for docker.te
  - Remove ability to do mount/sys_admin by default in virt_sandbox domains
  - New rules required to run docker images within libivrt
  - Add label for ~/.cvsignore
  - Change mirrormanager to be run by cron
  - Add mirrormanager policy
  - Fixed bumblebee_admin() and mip6d_admin()
  - Add log support for sensord
  - Fix typo in docker.te
  - Allow amanda to do backups over UDP
  - Allow bumblebee to read /etc/group and clean up bumblebee.te
  - type transitions with a filename not allowed inside conditionals
  - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7
  - Make new type to texlive files in homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-112
changelog:
  - Allow sshd to write to all process levels in order to change passwd when running at a level
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
  - Allow apcuspd_t to status and start the power unit file
  - Allow udev to manage kdump unit file
  - Added new interface modutils_dontaudit_exec_insmod
  - Allow cobbler to search dhcp_etc_t directory
  - systemd_systemctl needs sys_admin capability
  - Allow sytemd_tmpfiles_t to delete all directories
  - passwd to create gnome-keyring passwd socket
  - Add missing zabbix_var_lib_t type
  - Fix filename trans for zabbixsrv in zabbix.te
  - Allow fprintd_t to send syslog messages
  - Add  zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
  - Allow mozilla plugin to chat with policykit, needed for spice
  - Allow gssprozy to change user and gid, as well as read user keyrings
  - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
  - Allow polipo to connect to http_cache_ports
  - Allow cron jobs to manage apache var lib content
  - Allow yppassword to manage the passwd_file_t
  - Allow showall_t to send itself signals
  - Allow cobbler to restart dhcpc, dnsmasq and bind services
  - Allow certmonger to manage home cert files
  - Add userdom filename trans for user mail domains
  - Allow apcuspd_t to status and start the power unit file
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Allow smbd_t to signull cluster
  - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
  - Add label for /var/spool/cron.aquota.user
  - Allow sandbox_x domains to use work with the mozilla plugin semaphore
  - Added new policy for speech-dispatcher
  - Added dontaudit rule for insmod_exec_t  in rasdaemon policy
  - Updated rasdaemon policy
  - Allow system_mail_t to transition to postfix_postdrop_t
  - Clean up mirrormanager policy
  - Allow virt_domains to read cert files, needs backport to RHEL7
  - Allow sssd to read systemd_login_var_run_t
  - Allow irc_t to execute shell and bin-t files:
  - Add new access for mythtv
  - Allow rsync_t to manage all non auth files
  - allow modemmanger to read /dev/urand
  - Allow sandbox apps to attempt to set and get capabilties


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-114
changelog:
  - Add default lvm_var_run_t label for /var/run/multipathd
  Resolves:#1051430
  - Fix log labeling to have correct default label for them after logrotate
  - Add files_write_root_dirs
  - Add new openflow port label for 6653/tcp and 6633/tcp
  - Add xserver_manage_xkb_libs()
  - Label tcp/8891 as milter por
  - Allow gnome_manage_generic_cache_files also create cache_home_t files
  - Fix aide.log labeling
  - Fix log labeling to have correct default label for them after logrotate
  - Allow mysqld-safe write access on /root to make mysqld working
  - Allow sosreport domtrans to prelikn
  - Allow OpenvSwitch to connec to openflow ports
  - Allow NM send dgram to lldpad
  - Allow hyperv domains to execute shell
  - Allow lsmd plugins stream connect to lsmd/init
  - Allow sblim domains to create /run/gather with correct labeling
  - Allow httpd to read ldap certs
  - Allow cupsd to send dbus msgs to process with different MLS level
  - Allow bumblebee to stream connect to apmd
  - Allow bumblebee to run xkbcomp
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Allow docker to getattr on itself
  - Additional rules needed for sandbox apps
  - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
  - httpd should be able to send signal/signull to httpd_suexec_t
  - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-116
changelog:
  - Add missing files_create_var_lib_dirs()
  - Fix typo in ipsec.te
  - Allow passwd to create directory in /var/lib
  - Add filename trans also for event21
  - Allow iptables command to read /dev/rand
  - Add sigkill capabilityfor ipsec_t
  - Add filename transitions for bcache devices
  - Add additional rules to create /var/log/cron by syslogd_t with correct labeling
  - Add give everyone full access to all key rings
  - Add default lvm_var_run_t label for /var/run/multipathd
  - Fix log labeling to have correct default label for them after logrotate
  - Labeled ~/.nv/GLCache as being gstreamer output
  - Allow nagios_system_plugin to read mrtg lib files
  - Add mrtg_read_lib_files()
  - Call rhcs_rw_cluster_tmpfs for dlm_controld
  - Make authconfing as named_filetrans domain
  - Allow virsh to connect to user process using stream socket
  - Allow rtas_errd to read rand/urand devices and add chown capability
  - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
  Resolves:#1051497
  - Add also chown cap for abrt_upload_watch_t. It already has dac_override
  - Allow sosreport to manage rhsmcertd pid files
  - Add rhsmcertd_manage_pid_files()
  - Allow also setgid cap for rpc.gssd
  - Dontaudit access check for abrt on cert_t
  - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-118
changelog:
  - Allow init_t to work on transitient and snapshot unit files
  - Add logging_manage_syslog_config()
  - Update sysnet_dns_name_resolve() to allow connect to dnssec por
  - Allow pegasus_openlmi_storage_t to read hwdata
  Resolves:#1031721
  - Fix rhcs_rw_cluster_tmpfs()
  - Allow fenced_t to bind on zented udp port
  - Added policy for vmtools
  - Fix mirrormanager_read_lib_files()
  - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
  - Allow ctdb to create sock files in /var/run/ctdb
  - Add sblim_filetrans_named_content() interface
  - Allow rpm scritplets to create /run/gather with correct labeling
  - Allow gnome keyring domains to create gnome config dirs
  - Dontaudit read/write to init stream socket for lsmd_plugin_t
  - Allow automount to read nfs link files
  - Allow lsm plugins to read/write lsmd stream socket
  - Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
  - Add also labeling for /var/run/ctdb
  - Add missing labeling for /var/lib/ctdb
  - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
  - Dontaudit hypervkvp to search homedirs
  - Dontaudit hypervkvp to search admin homedirs
  - Allow hypervkvp to execute bin_t and ifconfig in the caller domain
  - Dontaudit xguest_t to read ABRT conf files
  - Add abrt_dontaudit_read_config()
  - Allow namespace-init to getattr on fs
  - Add thumb_role() also for xguest
  - Add filename transitions to create .spamassassin with correct labeling
  - Allow apache domain to read mirrormanager pid files
  - Allow domains to read/write shm and sem owned by mozilla_plugin_t
  - Allow alsactl to send a generic signal to kernel_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-119
changelog:
  - Add cron unconfined role support for uncofined SELinux user
  - Call corenet_udp_bind_all_ports() in milter.te
  - Allow fence_virtd to connect to zented port
  - Fix header for mirrormanager_admin()
  - Allow dkim-milter to bind udp ports
  - Allow milter domains to send signull itself
  - Allow block_suspend for yum running as mock_t
  - Allow beam.smp to manage couchdb files
  - Add couchdb_manage_files()
  - Add labeling for /var/log/php_errors.log
  - Allow bumblebee to stream connect to xserver
  - Allow bumblebee to send a signal to xserver
  - gnome-thumbnail to stream connect to bumblebee
  - Allow xkbcomp running as bumblebee_t to execute  bin_t
  - Allow logrotate to read squid.conf
  - Additional rules to get docker and lxc to play well with SELinux
  - Allow bumbleed to connect to xserver port
  - Allow pegasus_openlmi_storage_t to read hwdata


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-120
changelog:
  - Allow apache to write to the owncloud data directory in /var/www/html...
  - Allow consolekit to create log dir
  - Add support for icinga CGI scripts
  - Add support for icinga
  - Allow kdumpctl_t to create kdump lock file
  Resolves:#1055634
  - Allow kdump to create lnk lock file
  - Allow nscd_t block_suspen capability
  - Allow unconfined domain types to manage own transient unit file
  - Allow systemd domains to handle transient init unit files
  - Add interfaces to handle transient


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-121
changelog:
  - Allow gdm to create /var/gdm with correct labeling
  - Allow domains to append rkhunterl lib files. #1057982
  - Allow systemd_tmpfiles_t net_admin to communicate with journald
  - Add interface to getattr on an isid_type for any type of file
  - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
  - Allow initrc_t domtrans to authconfig if unconfined is enabled
  - Allow docker and mount on devpts chr_file
  - Allow docker to transition to unconfined_t if boolean set
  - init calling needs to be optional in domain.te
  - Allow uncofined domain types to handle transient unit files
  - Fix labeling for vfio devices
  - Allow net_admin capability and send system log msgs
  - Allow lldpad send dgram to NM
  - Add networkmanager_dgram_send()
  - rkhunter_var_lib_t is correct type
  - Back port pcp policy from rawhide
  - Allow openlmi-storage to read removable devices
  - Allow system cron jobs to manage rkhunter lib files
  - Add rkhunter_manage_lib_files()
  - Fix ftpd_use_fusefs boolean to allow manage also symlinks
  - Allow smbcontrob block_suspend cap2
  - Allow slpd to read network and system state info
  - Allow NM domtrans to iscsid_t if iscsiadm is executed
  - Allow slapd to send a signal itself
  - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
  - Fix plymouthd_create_log() interface
  - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
  - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
  - Allow postfix and cyrus-imapd to work out of box
  - Allow fcoemon to talk with unpriv user domain using unix_stream_socket
  - Dontaudit domains that are calling into journald to net_admin
  - Add rules to allow vmtools to do what it does
  - snapperd is D-Bus service
  - Allow OpenLMI PowerManagement to call 'systemctl --force reboot'
  - Add haproxy_connect_any boolean
  - Allow haproxy also to use http cache port by default
  Resolves:#1058248


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-122
changelog:
  - Update snapper policy
  - Allow domains to append rkhunter lib files
  - Allow snapperd to getattr on all fs
  - Allow xdm to create /var/gdm with correct labeling
  - Add label for snapper.log
  - Allow fail2ban-client to read apache log files
  - Allow thumb_t to execute dbus-daemon in thumb_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-123
changelog:
  - Turn on bacula, rhnsd policy
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl
  - Fixes for *_admin interfaces
  - Add pegasus_openlmi_storage_var_run_t type def
  - Add support for /var/run/openlmi-storage
  - Allow tuned to create syslog.conf with correct labeling
  - Add httpd_dontaudit_search_dirs boolean
  - Add support for winbind.service
  - ALlow also fail2ban-client to read apache logs
  - Allow vmtools to getattr on all fs
  - Add support for dey_sapi port
  - Add logging_filetrans_named_conf()
  - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-124
changelog:
  - Added osad policy
  - Allow postfix to deliver to procmail
  - Allow bumblebee to seng kill signal to xserver
  - Allow vmtools to execute /usr/bin/lsb_release
  - Allow docker to write system net ctrls
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix pcp.te
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-125
changelog:
  - Addopt corenet rules for unbound-anchor to rpm_script_t
  - Allow runuser to send send audit messages.
  - Allow postfix-local to search .forward in munin lib dirs
  - Allow udisks to connect to D-Bus
  - Allow spamd to connect to spamd port
  - Fix syntax error in snapper.te
  - Dontaudit osad to search gconf home files
  - Allow rhsmcertd to manage /etc/sysconf/rhn director
  - Fix pcp labeling to accept /usr/bin for all daemon binaries
  - Fix mcelog_read_log() interface
  - Allow iscsid to manage iscsi lib files
  - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
  - Make tuned_t as unconfined domain for RHEL7.0
  - Allow ABRT to read puppet certs
  - Add sys_time capability for virt-ga
  - Allow gemu-ga to domtrans to hwclock_t
  - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
  - Fix some AVCs in pcp policy
  - Add to bacula capability setgid and setuid and allow to bind to bacula ports
  - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
  - Add access rhnsd and osad to /etc/sysconfig/rhn
  - drbdadm executes drbdmeta
  - Fixes needed for docker
  - Allow epmd to manage /var/log/rabbitmq/startup_err file
  - Allow beam.smp connect to amqp port
  - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
  - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
  - Allow systemd_tmpfiles_t to manage all non security files on the system
  - Added labels for bacula ports
  - Fix label on /dev/vfio/vfio
  - Add kernel_mounton_messages() interface
  - init wants to manage lock files for iscsi


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-126
changelog:
  - Add lvm_read_metadata()
  - Allow auditadm to search /var/log/audit dir
  - Add lvm_read_metadata() interface
  - Allow confined users to run vmtools helpers
  - Fix userdom_common_user_template()
  - Generic systemd unit scripts do write check on /
  - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
  - Add additional fixes needed for init_t and setup script running in generic unit files
  - Allow general users to create packet_sockets
  - added connlcli port
  - Add init_manage_transient_unit() interface
  - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
  - Fix userdomain.te to require passwd class
  - devicekit_power sends out a signal to all processes on the message bus when power is going down
  - Dontaudit rendom domains listing /proc and hittping system_map_t
  - Dontauit leaks of var_t into ifconfig_t
  - Allow domains that transition to ssh_t to manipulate its keyring
  - Define oracleasm_t as a device node
  - Change to handle /root as a symbolic link for os-tree
  - Allow sysadm_t to create packet_socket, also move some rules to attributes
  - Add label for openvswitch port
  - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
  - Allow postfix_local to read .forward in pcp lib files
  - Allow pegasus_openlmi_storage_t to read lvm metadata
  - Add additional fixes for pegasus_openlmi_storage_t
  - Allow bumblebee to manage debugfs
  - Make bumblebee as unconfined domain
  - Allow snmp to read etc_aliases_t
  - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
  - Allow pegasus_openlmi_storage_t to read /proc/1/environ
  - Dontaudit read gconf files for cupsd_config_t
  - make vmtools as unconfined domain
  - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
  - Allow collectd_t to use a mysql database
  - Allow ipa-otpd to perform DNS name resolution
  - Added new policy for keepalived
  - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
  - Add additional fixes new pscs-lite+polkit support
  - Add labeling for /run/krb5kdc
  - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
  - Allow pcscd to read users proc info
  - Dontaudit smbd_t sending out random signuls
  - Add boolean to allow openshift domains to use nfs
  - Allow w3c_validator to create content in /tmp
  - zabbix_agent uses nsswitch
  - Allow procmail and dovecot to work together to deliver mail
  - Allow spamd to execute files in homedir if boolean turned on
  - Allow openvswitch to listen on port 6634
  - Add net_admin capability in collectd policy
  - Fixed snapperd policy
  - Fixed bugsfor pcp policy
  - Allow dbus_system_domains to be started by init
  - Fixed some interfaces
  - Add kerberos_keytab_domain attribute
  - Fix snapperd_conf_t def


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-127
changelog:
  - Add snapperd_home_t for HOME_DIR/.snapshots directory
  - Make sosreport as unconfined domain
  - Allow sosreport to execute grub2-probe
  - Allow NM to manage hostname config file
  - Allow systemd_timedated_t to dbus chat with rpm_script_t
  - Allow lsmd plugins to connect to http/ssh/http_cache ports by default
  - Add lsmd_plugin_connect_any boolean
  - Allow mozilla_plugin to attempt to set capabilities
  - Allow lsdm_plugins to use tcp_socket
  - Dontaudit mozilla plugin from getattr on /proc or /sys
  - Dontaudit use of the keyring by the services in a sandbox
  - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
  - Allow rabbitmq_beam to connect to jabber_interserver_port
  - Allow logwatch_mail_t to transition to qmail_inject and queueu
  - Added new rules to pcp policy
  - Allow vmtools_helper_t to change role to system_r
  - Allow NM to dbus chat with vmtools
  - Fix couchdb_manage_files() to allow manage couchdb conf files
  - Add support for /var/run/redis.sock
  - dontaudit gpg trying to use audit
  - Allow consolekit to create log directories and files
  - Fix vmtools policy to allow user roles to access vmtools_helper_t
  - Allow block_suspend cap2 for ipa-otpd
  - Allow pkcsslotd to read users state
  - Add ioctl to init_dontaudit_rw_stream_socket
  - Add systemd_hostnamed_manage_config() interface
  - Remove transition for temp dirs created by init_t
  - gdm-simple-slave uses use setsockopt
  - sddm-greater is a xdm type program


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-128
changelog:
  - Make snapperd as unconfined domain and add additional fixes for it
  - Remove nsplugin.pp module on upgrade


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-129
changelog:
  - Allow block_suspend cap2 for systemd-logind and rw dri device
  - Add labeling for /usr/libexec/nm-libreswan-service
  - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
  - Add xserver_rw_xdm_keys()
  - Allow rpm_script_t to dbus chat also with systemd-located
  - Fix ipa_stream_connect_otpd()
  - update lpd_manage_spool() interface
  - Allow krb5kdc to stream connect to ipa-otpd
  - Add ipa_stream_connect_otpd() interface
  - Allow vpnc to unlink NM pids
  - Add networkmanager_delete_pid_files()
  - Allow munin plugins to access unconfined plugins
  - update abrt_filetrans_named_content to cover /var/spool/debug
  - Label /var/spool/debug as abrt_var_cache_t
  - Allow rhsmcertd to connect to squid port
  - Make docker_transition_unconfined as optional boolean
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-130
changelog:
  - Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
  - Add sysnet_filetrans_named_content_ifconfig() interface
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow kerberos keytab domains to manage sssd/userdomain keys"
  - Allow to run ip cmd in neutron_t domain


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-131
changelog:
  - Added pcp rules
  - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
  - clean up ctdb.te
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-132
changelog:
  - Modify xdm_write_home to allow create files/links in /root with xdm_home_
  - Allow virt domains to read network state
  Resolves:#1072019


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-133
changelog:
  - Allow numad to write scan_sleep_millisecs
  - Turn on entropyd_use_audio boolean by default
  - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
  - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
  - Fix label on irclogs in the homedir
  - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
  - Allow postgresql to use ldap
  - Add missing syslog-conn port
  - Add support for /dev/vmcp and /dev/sclp
  Resolves:#1069310


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-134
changelog:
  - Allow unpriv SELinux users to dbus chat with firewalld
  - Add lvm_write_metadata()
  - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
  - Allow pegasus_openlmi_storage_t to write lvm metadata
  - Add hide_broken_symptoms for kdumpgui because of systemd bug
  - Make kdumpgui_t as unconfined domain
  Resolves:#1044299
  - Allow docker to connect to tcp/5000


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-137
changelog:
  - Allow vmtools_helper_t to execute bin_t
  - Add support for /usr/share/joomla
  - /var/lib/containers should be labeled as openshift content for now
  - Allow docker domains to talk to the login programs, to allow a process to login into the container
  - Allow install_t do dbus chat with NM
  - Fix interface names in anaconda.if
  - Add install_t for anaconda. A new type is a part of anaconda policy
  - sshd to read network sysctls


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-138
changelog:
  - Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
  - Allow net_admin cap for fence_virtd running as fenced_t
  - Make  abrt-java-connector working
  - Make cimtest script 03_defineVS.py of ComputerSystem group working
  - Fix git_system_enable_homedirs boolean
  - Allow munin mail plugins to read network systcl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-139
changelog:
  - Allow collectd to talk to libvirt
  - Allow chrome_sandbox to use leaked unix_stream_sockets
  - Dontaudit leaks of sockets into chrome_sandbox_t
  - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
  - Run vmtools as unconfined domains
  - Allow snort to manage its log files
  - Allow systemd_cronjob_t to be entered via bin_t
  - Allow procman to list doveconf_etc_t
  - allow keyring daemon to create content in tmpfs directories
  - Add proper labelling for icedtea-web
  - vpnc is creating content in networkmanager var run directory
  - Label sddm as xdm_exec_t to make KDE working again
  - Allow postgresql to read network state
  - Allow java running as pki_tomcat to read network sysctls
  - Fix cgroup.te to allow cgred to read cgconfig_etc_t
  - Allow beam.smp to use ephemeral ports
  - Allow winbind to use the nis to authenticate passwords


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-140
changelog:
  - Allow docker to read tmpfs_t symlinks
  - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-142
changelog:
  - Add support for /var/spool/rhsm/debug
  - Make virt_sandbox_use_audit as True by default
  - Allow svirt_sandbox_domains to ptrace themselves


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-143
changelog:
  - Add additional fixes for rtas_errd
  - Fix transitions for tmp/tmpfs in rtas.te
  - Allow rtas_errd to readl all sysctls


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-144
changelog:
  - allow anaconda to dbus chat with systemd-localed
  - Add fixes for haproxy based on bperkins@redhat.com
  - Allow cmirrord to make dmsetup working
  - Allow NM to execute arping
  - Allow users to send messages through talk
  - Add userdom_tmp_role for secadm_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-145
changelog:
  - Allow also unpriv user to run vmtools
  - Allow secadm to read /dev/urandom and meminfo
  Resolves:#1079250
  - Add booleans to allow docker processes to use nfs and samba
  - Add mdadm_tmpfs support
  - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
  - Allow vmware-user-sui to use user ttys
  - Allow talk 2 users logged via console too
  - Allow ftp services to manage xferlog_t
  - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
  - allow anaconda to dbus chat with systemd-localed


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-146
changelog:
  - add gnome_append_home_config()
  - Allow thumb to append GNOME config home files
  - Allow rasdaemon to rw /dev/cpu//msr
  - fix /var/log/pki file spec
  - make bacula_t as auth_nsswitch domain
  - Identify pki_tomcat_cert_t as a cert_type
  - Define speech-dispater_exec_t as an application executable
  - Add a new file context for /var/named/chroot/run directory
  - update storage_filetrans_all_named_dev for sg* devices
  - Allow auditctl_t  to getattr on all removeable devices
  - Allow nsswitch_domains to stream connect to nmbd
  - Allow unprivusers to connect to memcached
  - label /var/lib/dirsrv/scripts-INSTANCE as bin_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-147
changelog:
  - Back port fixes for pegasus_openlmi_admin_t from rawhide
  Resolves:#1080973
  - Add labels for ostree
  - Add SELinux awareness for NM
  - Label /usr/sbin/pwhistory_helper as updpwd_exec_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-148
changelog:
  - Allow kdm to send signull to remote_login_t process
  - Add gear policy
  - Turn on gear_port_t
  - Allow cgit to read gitosis lib files by default
  - Allow vdagent to read xdm state
  - Allow NM and fcoeadm to talk together over unix_dgram_socket


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-149
changelog:
  - Allow xauth_t to read user_home_dir_t lnk_file
  - Add labeling for lightdm-data
  - Allow certmonger to manage ipa lib files
  - Add support for /var/lib/ipa
  - Allow pegasus to getattr virt_content
  - Added some new rules to pcp policy
  - Allow chrome_sandbox to execute config_home_t
  - Add support for ABRT FAF


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-151
changelog:
  - varnishd wants chown capability
  - update ntp_filetrans_named_content() interface
  - Add additional fixes for neutron_t. #1083335
  - Dontaudit getattr on proc_kcore_t
  - Allow pki_tomcat_t to read ipa lib files
  - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
  - Allow init_t run /sbin/augenrules
  - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
  - Allow unpriv SELinux user to use sandbox
  - Add default label for /tmp/hsperfdata_root


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-152
changelog:
  - Fix Multiple same specifications for /var/named/chroot/dev/zero
  - Add labels for /var/named/chroot_sdb/dev devices
  - Add support for strongimcv
  - Use kerberos_keytab_domains in auth_use_nsswitch
  - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
  - Allow net_raw cap for neutron_t and send sigkill to dnsmasq
  - Fix ntp_filetrans_named_content for sntp-kod file
  - Add httpd_dbus_sssd boolean
  - Dontaudit exec insmod in boinc policy
  - Rename kerberos_keytab_domain to kerberos_keytab_domains
  - Add kerberos_keytab_domain()
  - Fix kerberos_keytab_template()
  - Make all domains which use kerberos as kerberos_keytab_domain
  Resolves:#1083670
  - Allow kill capability to winbind_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-154
changelog:
  - Add support for us_cli ports
  - Fix labeling for /var/run/user/<UID>/gvfs
  - add support for tcp/9697
  - Additional rules required by openstack,  needs backport to F20 and RHEL7
  - Additional access required by docker
  - ALlow motion to use tcp/8082 port
  - Allow init_t to setattr/relabelfrom dhcp state files
  - Dontaudit antivirus domains read access on all security files by default
  - Add missing alias for old amavis_etc_t type
  - Allow block_suspend cap for haproxy
  - Additional fixes for  instack overcloud
  - Allow OpenStack to read mysqld_db links and connect to MySQL
  - Remove dup filename rules in gnome.te
  - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
  - Allow iscsid to handle own unit files
  - Add iscsi_systemctl()
  - Allow mongod to create also sock_files in /run with correct labeling
  - Allow httpd to send signull to apache script domains and don't audit leaks
  - Allow rabbitmq_beam to connect to httpd port
  - Allow aiccu stream connect to pcscd
  - Allow dmesg to read hwdata and memory dev
  - Allow all freeipmi domains to read/write ipmi devices
  - Allow sblim_sfcbd to use also pegasus-https port
  - Allow rabbitmq_epmd to manage rabbit_var_log_t files
  - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
  - Allow docker to status any unit file and allow it to start generic unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-2
changelog:
  - Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
  - Label /usr/lib/erlang/erts.*/bin files as bin_t
  - Add files_dontaudit_access_check_home_dir() inteface.
  - Allow udev_t mounton udev_var_run_t dirs #(1128618)
  - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
  - Add init_dontaudit_read_state() interface.
  - Add label for ~/.local/share/fonts
  - Allow unconfined_r to access unconfined_service_t.
  - Allow init to read all config files
  - Add new interface to allow creation of file with lib_t type
  - Assign rabbitmq port.
  - Allow unconfined_service_t to dbus chat with all dbus domains
  - Add new interfaces to access users keys.
  - Allow domains to are allowed to mounton proc to mount on files as well as dirs
  - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
  - Add a port definition for shellinaboxd
  - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
  - Allow userdomains to stream connect to pcscd for smart cards
  - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
  - Update to rawhide-contrib changes
  Resolves:#1123844


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-3
changelog:
  - Add back kill permisiion for system class
  - Allow iptables read fail2ban logs.
  - Fix radius labeled ports
  - Add userdom_manage_user_tmpfs_files interface
  - Allow libreswan to connect to VPN via NM-libreswan.
  - Label 4101 tcp port as brlp port
  - fix dev_getattr_generic_usb_dev interface
  - Allow all domains to read fonts
  - Make sure /run/systemd/generator and system is labeled correctly on creation.
  - Dontaudit aicuu to search home config dir. 
  - Make keystone_cgi_script_t domain. 
  Resolves:#1138424
  - Fix bug in drbd policy, 
  - Added support for cpuplug. 
  - ALlow sanlock_t to read sysfs_t.
  - Added sendmail_domtrans_unconfined interface
  - Fix broken interfaces
  - radiusd wants to write own log files.
  - Label /usr/libexec/rhsmd as rhsmcertd_exec_t
  - Allow rhsmcertd send signull to setroubleshoot. 
  - Allow rhsmcertd manage rpm db. 
  - Added policy for blrtty. 
  - Fix keepalived policy
  - Allow rhev-agentd dbus chat with systemd-logind.
  - Allow keepalived manage snmp var lib sock files.
  - Add support for /var/lib/graphite-web
  - Allow NetworkManager to create Bluetooth SDP sockets
  - It's going to do the the discovery for DUN service for modems with Bluez 5.
  - Allow swift to connect to all ephemeral ports by default.
  - Allow sssd to read selinux config to add SELinux user mapping.
  - Allow lsmd to search own plguins.
  - Allow abrt to read /dev/memto generate an unique machine_id and uses  sosuploader's algorithm based off dmidecode[1] fields.
  - ALlow zebra for user/group look-ups.
  - Allow nova domains to getattr on all filesystems.
  - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
  - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
  - Allow rhnsd_t to manage also rhnsd config symlinks.
  - ALlow user mail domains to create dead.letter.
  - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. 
  - Allow pki-tomcat to change SELinux object identity.
  - Allow radious to connect to apache ports to do OCSP check
  - Allow git cgi scripts to create content in /tmp
  - Allow cockpit-session to do GSSAPI logins.
  - Allow sensord read in /proc 
  - Additional access required by usbmuxd


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-5
changelog:
  - Add back kill permisiion for service class
  Resolves:#1150011
  - Make rhsmcertd_t also as dbus domain.
  - Allow named to create DNS_25 with correct labeling.
  - Add cloudform_dontaudit_write_cloud_log()
  - Call auth_use_nsswitch to apache to read/write cloud-init keys.
  - Allow cloud-init to dbus chat with certmonger.
  - Fix path to mon_statd_initrc_t script.
  - Allow all RHCS services to read system state.
  - Allow dnssec_trigger_t to execute unbound-control in own domain.
  - kernel_read_system_state needs to be called with type. Moved it to antivirus.if.
  - Added policy for mon_statd and mon_procd services. BZ (1077821)
  - Allow opensm_t to read/write /dev/infiniband/umad1.
  - Allow mongodb to manage own log files.
  - Allow neutron connections to system dbus.
  - Add support for /var/lib/swiftdirectory.
  - Allow nova-scheduler to read certs.
  - Allow openvpn to access /sys/fs/cgroup dir.
  - Allow openvpn to execute  systemd-passwd-agent in  systemd_passwd_agent_t to make openvpn working with systemd.
  - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.
  - Add auth_use_nsswitch for portreserve to make it working with sssd.
  - automount policy is non-base module so it needs to be called in optional block.
  - ALlow sensord to getattr on sysfs.
  - Label /usr/share/corosync/corosync as cluster_exec_t.
  - Allow lmsd_plugin to read passwd file. BZ(1093733)
  - Allow read antivirus domain all kernel sysctls.
  - Allow mandb to getattr on file systems
  - Allow nova-console to connect to mem_cache port.
  - Make sosreport as unconfined domain.
  - Allow mondogdb to  'accept' accesses on the tcp_socket port.
  - ALlow sanlock to send a signal to virtd_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-7
changelog:
  - Allow modemmanger to connectto itself
  Resolves:#1120152 
  - Allow pki_tomcat to create link files in /var/lib/pki-ca.
  Resolves:#1121744 
  - varnishd needs to have fsetid capability
  Resolves:#1125165
  - Allow snapperd to dbus chat with system cron jobs.
  Resolves:#1152447
  - Allow dovecot to create user's home directory when they log into IMAP 
  Resolves:#1152773   
  - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.
  - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. 
  - Allow nslcd to execute netstat.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow nslcd to read /dev/urandom.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-8
changelog:
  - Allow guest to connect to libvirt using unix_stream_socket.
  - Allow all bus client domains to dbus chat with unconfined_service_t.
  - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
  - Make opensm as nsswitch domain to make it working with sssd.
  - Allow brctl to read meminfo.
  - Allow winbind-helper to execute ntlm_auth in the caller domain.
  Resolves:#1160339
  - Make plymouthd as nsswitch domain to make it working with sssd.
  Resolves:#1160196
  - Make drbd as nsswitch domain to make it working with sssd.
  - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
  - Add support for /var/lib/sntp directory.
  - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc
  - Allow winbind to read usermodehelper
  - Allow telepathy domains to execute shells and bin_t
  - Allow gpgdomains to create netlink_kobject_uevent_sockets
  - Allow mongodb to bind to the mongo port and mongos to run as mongod_t
  - Allow abrt to read software raid state.
  - Allow nslcd to execute netstat.
  - Allow dovecot to create user's home directory when they log into IMAP.
  - Allow login domains to create kernel keyring with different level.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-9
changelog:
  - Dontaudit access check on setfiles/load_policy for sssd_t.
  Resolves:#1140106
  - Add kdump_rw_inherited_kdumpctl_tmp_pipes()
  Resolves:#1156442
  - Make linuxptp services as unconfined.
  - Added new policy linuxptp.
  Resolves:#1149693
  - Label keystone cgi files as keystone_cgi_script_exec_t.
  Resolves:#1138424
  - Make tuned as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-10
changelog:
  - Label /etc/strongimcv as ipsec_conf_file_t.
  - Add support for /usr/bin/start-puppet-ca helper script
  Resolves:#1160727
  - Allow rpm scripts to enable/disable transient systemd units.
  Resolves:#1154613 
  - Make kpropdas nsswitch domain
  Resolves:#1153561
  - Make all glance domain as nsswitch domains
  Resolves:#1113281
  - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active
  - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t
  Resolves:#1140106


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-11
changelog:
  - Allow radius to bind tcp/1812 radius port.
  - Dontaudit list user_tmp files for system_mail_t.
  - Label virt-who as virtd_exec_t.
  - Allow rhsmcertd to send a null signal to virt-who running as virtd_t.
  - Add missing alias for _content_rw_t.
  Resolves:#1089177
  - Allow spamd to access razor-agent.log.
  - Add fixes for sfcb from libvirt-cim TestOnly bug.
  - Allow NetworkManager stream connect on openvpn.
  - Make /usr/bin/vncserver running as unconfined_service_t.
  - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
  - Label /etc/docker/certs.d as cert_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-12
changelog:
  - Add seutil_dontaudit_access_check_semanage_module_store() interface
  Resolves:#1140106
  - Update to have all _systemctl() interface also init_reload_services().
  - Dontaudit access check on SELinux module store for sssd.
  - Add labeling for /sbin/iw.
  - Allow named_filetrans_domain to create ibus directory with correct labeling.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-13
changelog:
  - Remove old pkcsslotd.pp from minimum package
  - Allow rlogind to use also rlogin ports.
  - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
  - Allow bacula to connect also to postgresql.
  - Label /usr/libexec/tomcat/server as tomcat_exec_t
  - Add support for /usr/sbin/ctdbd_wrapper
  - Add support for /usr/libexec/ppc64-diag/rtas_errd
  - Allow rpm_script_roles to access system_mail_t
  - Allow brltty to create /var/run/brltty
  - Allow lsmd plugin to access netlink_route_socket
  - Allow smbcontrol to read passwd
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
  Resolves:#1140106
  - Allow osad to execute rhn_check
  - Allow load_policy to rw inherited sssd pipes because of selinux_child
  - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
  - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
  - Add additional booleans substitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-14
changelog:
  - Allow virt_qemu_ga_t to execute kmod.
  - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
  - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
  Resolves:#1113725
  - Enable OpenStack cinder policy
  - Add support for /usr/share/vdsm/daemonAdapter
  - Add support for /var/run/gluster


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-15
changelog:
  - Fix bugs in interfaces discovered by sepolicy.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Allow lsm plugins to connect to tcp/18700 by default.
  - Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
  - Fix pcp_domain_template() interface.
  - Fix conman.te.
  - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
  - Allow glance-scrubber to connect tcp/9191.
  - Add missing setuid capability for sblim-sfcbd.
  - Allow pegasus ioctl() on providers.
  - Add conman_can_network.
  - Allow chronyd to read chrony conf files located in /run/timemaster/.
  - Allow radius to bind on tcp/1813 port.
  - dontaudit block suspend access for openvpn_t 
  - Allow conman to create files/dirs in /tmp.
  - Update xserver_rw_xdm_keys() interface to have 'setattr'.
  Resolves:#1172291 
  - Allow sulogin to read /dev/urandom and /dev/random.
  - Update radius port definition to have also tcp/18121
  - Label prandom as random_device_t.
  - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-16
changelog:
  - Allow sssd to send dbus all user domains.
  Resolves:#1172291
  - Allow lsm plugin to read certificates.
  - Fix labeling for keystone CGI scripts.
  - Make snapperd back as unconfined domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-17
changelog:
  - Allow ipsec to execute _updown.netkey script to run unbound-control.
  - Allow neutron to read rpm DB.
  - Add additional fixes for hyperkvp
   * creates new ifcfg-{name} file
   * Runs hv_set_ifconfig.sh, which does the following
   * Copies ifcfg-{name} to /etc/sysconfig/network-scripts
  - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
  - Add labeling for pacemaker.log.
  - Allow radius to connect/bind radsec ports.
  - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
  - Allow  virt_qemu_ga to dbus chat with rpm.
  - Update virt_read_content() interface to allow read also char devices.
  - Allow glance-registry to connect to keystone port.
  Resolves:#1181818


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-18
changelog:
  - Add auditing support for ipsec.
  Resolves:#1182524
  - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
  - Allow netutils chown capability to make tcpdump working with -w


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-21
changelog:
  - pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
  - Allow fowner capability for sssd because of selinux_child handling.
  - ALlow bind to read/write inherited ipsec pipes
  - Allow hypervkvp to read /dev/urandom and read  addition states/config files.
  - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
  - Add glusterd_filetrans_named_pid() interface
  - Allow radiusd to connect to radsec ports.
  - Allow setuid/setgid for selinux_child
  - Allow lsmd plugin to connect to tcp/5988 by default.
  - Allow lsmd plugin to connect to tcp/5989 by default.
  - Update ipsec_manage_pid() interface.
  Resolves:#1184978


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23
changelog:
  - Update seutil_manage_config() interface.
  Resolves:#1185962
  - Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
  - Turn on docker_transition_unconfined by default


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-24
changelog:
  - ALlow mongod execmem by default.
  - Update policy/mls for sockets. Rules were contradictory.
  Resolves:#1207133
  - Allow a user to login with different security level via ssh.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-25
changelog:
  - Label /usr/libexec/postgresql-ctl as postgresql_exec_t. 
  - Add more restriction on entrypoint for unconfined domains.
  - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface
  - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default.
  - Update policy/mls for sockets related to access perm. Rules were contradictory.
  - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r
  un sudo from NRPE utils scripts and allow run nagios in conjunction w
  ith PNP4Nagios.
  Resolves:#1201054
  - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead.
  - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type
  - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)?
  - Add support for iprdbg logging files in /var/log.
  - Add fixes to rhsmcertd_t
  - Allow puppetagent_t to transfer firewalld messages over dbus
  - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  - Add support for mongod/mongos systemd unit files.
  - cloudinit and rhsmcertd need to communicate with dbus
  - Allow dovecot_t sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-26
changelog:
  - Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs
  - Add cgdcbxd policy 
  Resolves:#1072493
  - Fix ftp_homedir boolean
  Resolve:#1097775
  - Dontaudit ifconfig writing inhertited /var/log/pluto.log.
  - Allow cluster domain to dbus chat with systemd-logind.
  Resolves:#1145215
  - Dontaudit write access to inherited kdumpctl tmp files
  Resolves:#1156442
  - Allow isnsd_t to communicate with sssd
  Resolves:#1167702
  - Allow rwho_t to communicate with sssd
  Resolves:#1167718
  - Allow sblim_gatherd_t to communicate with sssd
  Resolves:#1167732
  - Allow pkcs_slotd_t to communicate with sssd
  Resolves:#1167737
  - Allow openvswitch_t to communicate with sssd
  Resolves:#1167816
  - Allow mysqld_safe_t to communicate with sssd
  Resolves:#1167832
  - Allow sshd_keygen_t to communicate with sssd
  Resolves:#1167840
  - Add support for iprdbg logging files in /var/log.
  Resolves:#1174363
  - Allow tmpreaper_t to manage ntp log content
  Resolves:#1176965
  - Allow gssd_t to manage ssh keyring
  Resolves:#1184791
  - Allow httpd_sys_script_t to send system log messages
  Resolves:#1185231
  - Allow apcupsd_t to read /sys/devices
  Resolves:#1189185
  - Allow dovecot_t sys_resource capability
  Resolves:#1191143
  - Add support for mongod/mongos systemd unit files.
  Resolves:#1197038
  - Add bacula fixes
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  Resolves:#1203991


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-27
changelog:
  - Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.
  - Allow samba-net to access /var/lib/ctdbd dirs/files.
  - Allow glusterd to send a signal to smbd.
  - Make ctdbd as home manager to access also FUSE.
  - Allow glusterd to use geo-replication gluster tool.
  - Allow glusterd to execute ssh-keygen.
  - Allow glusterd to interact with cluster services.
  - Allow glusterd to connect to the system DBUS for service (acquire_svc).
  - Label /dev/log correctly.
  Resolves:#1230932


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-28
changelog:
  - Allow glusterd to send generic signals to systemd_passwd_agent processes.
  - Allow glusterd to access init scripts/units without defined policy
  - Allow glusterd to run init scripts.
  - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-29
changelog:
  - We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.
  - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.
  - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. 
  - Label gluster python hooks also as bin_t.
  - Allow glusterd to interact with gluster tools running in a user domain
  - Add glusterd_manage_lib_files() interface.
  - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. 
  - Allow samba_t net_admin capability to make CIFS mount working.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-30
changelog:
  - Allow iptables to read ctdbd lib files.
  Resolves:#1224879
  - Add systemd_networkd_t to nsswitch domains.
  - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. 
  Resolves:#1130675
  - Allow NetworkManager write to sysfs. 
  - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
  - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
  - Allow NetworkManager write to sysfs. 
  - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. 
  - Dontaudit apache to manage snmpd_var_lib_t files/dirs. 
  - Add interface snmp_dontaudit_manage_snmp_var_lib_files().
  - Dontaudit mozilla_plugin_t cap. sys_ptrace. 
  - Rename xodbc-connect port to xodbc_connect
  - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. 
  - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. 
  - Dontaudit chrome to read passwd file. 
  - nrpe needs kill capability to make gluster moniterd nodes working. 
  Resolves:#1235587


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-31
changelog:
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins
  Resolves:#1233550
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
  - Add support for oddjob based helper in FreeIPA.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add nagios_domtrans_unconfined_plugins() interface.
  - Update mta_filetrans_named_content() interface to cover more db files. 
  Resolves:#1167468
  - Add back ftpd_use_passive_mode boolean with fixed description.
  - Allow pmcd daemon stream connect to mysqld.
  - Allow pcp domains to connect to own process using unix_stream_socket. 
  Resolves:#1213709
  - Allow  abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add support for oddjob based helper in FreeIPA.
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-32
changelog:
  - Allow gluster to connect to all ports. It is required by random services executed by gluster.
  - Add interfaces winbind_signull(), samba_unconfined_net_signull().
  - Dontaudit smbd_t block_suspend capability. This is kernel bug.
  - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
      checking if processes exists.
  - Add tmpreaper booleans to use nfs_t and samba_share_t.
  - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server
  - Allow connect ypserv to portmap_port_t
  - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
  - Add support for openstack-nova-* packages
  - Allow NetworkManager_t send signull to dnssec_trigger_t.
  - Allow glusterd to execute showmount in the showmount domain.
  - Label swift-container-reconciler binary as swift_t.
  - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.
  - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?"
  Resolves:#1213540
  - Merge all nova_* labels under one nova_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-33
changelog:
  - Allow networkmanager read rfcomm port.
  Resolves:#1212498
  - Remove non exists label.
  - Fix *_admin intefaces where body is not consistent with header.
  - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config
  - Remove non exits nfsd_ro_t label.
  - Make all interfaces related to openshift_cache_t as deprecated.
  - Add rpm_var_run_t label to rpm_admin header
  - Add jabberd_lock_t label to jabberd_admin header.
  - Add samba_unconfined_script_exec_t to samba_admin header.
  - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
  - Fix ctdb policy
  - Add samba_signull_winbind()
  - Add samba_signull_unconfined_net()
  - Allow ctdbd_t send signull to samba_unconfined_net_t.
  - Allow openshift_initrc_t to communicate with firewalld over dbus 
  Resolves:#1221326


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-34
changelog:
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow networkmanager to  communicate via dbus with systemd_hostanmed. 
  Resolves: #1234954
  - Allow stream connect logrotate to prosody.
  - Add prosody_stream_connect() interface.
  -  httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.
  - Allow prosody to create own tmp files/dirs.
  Resolves:#1212498


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-35
changelog:
  - gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te
  - Allow pcp_pmcd daemon to read postfix config files.
  - Allow pcp_pmcd daemon to search postfix spool dirs.
  Resolves: #1213740
  - Added Booleans: pcp_read_generic_logs.
  Resolves: #1213740
  - Allow drbd to read configuration options used when loading modules.
  Resolves: #1134883
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow glusterd to communicate with cluster domains over stream socket.
  - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-36
changelog:
  - Allow drbd to get attributes from filesystems.
  - Allow redis to read kernel parameters.
  Resolves: #1209518
  - Allow virt_qemu_ga_t domtrans to passwd_t
  - Allow audisp_remote_t to start power unit files domain to allow halt system.
  Resolves: #1186780
  - Allow audisp_remote_t to read/write user domain pty.
  Resolves: #1186780
  - Label /usr/sbin/chpasswd as passwd_exec_t.
  - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).
  Resolves:#1221121


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-37
changelog:
  - Allow httpd_suexec_t to read and write Apache stream sockets 
  Resolves: #1243569
  - Allow qpid to create lnk_files in qpid_var_lib_t
  Resolves: #1247279


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-38
changelog:
  - Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files).
    Resolves: #1243902
  - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
    Resolves: #1238079
  - Allow lsm_plugin_t to rw raw_fixed_disk.
    Resolves:#1238079
  - Allow rhsmcertd to send signull to unconfined_service.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-39
changelog:
  - Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
  Resolves:#1073314
  - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS.
  - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users.
  - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
  - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
  Resolves:#1183503
  - Add support for /etc/sanlock which is writable by sanlock daemon.
  Resolves:#1231377
  - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
  Resolves:#1243775 
  - Allow snapperd to pass data (one way only) via pipe negotiated over dbus
  Resolves:#1250550
  - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-40
changelog:
  - Add interface to read/write watchdog device
  - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
  Resolves:#1210237
  - Allow apcupsd_t to read /sys/devices 
  Resolves:#1189185
  - Allow logrotate to reload services.
  Resolves: #1242453
  - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
  Resolves: #1244260
  - Allow openhpid liboa_soap plugin to read generic certs.
  Resolves: #1244248
  - Allow openhpid liboa_soap plugin to read resolv.conf file.
  Resolves: #1244248
  - Label /usr/libexec/chrony-helper as chronyd_exec_t
  - Allow chronyd_t to read dhcpc state.
  - Allow chronyd to execute mkdir command.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-41
changelog:
  - Allow pcp_domain to manage pcp_var_lib_t lnk_files.
  Resolves: #1252341
  - Label /var/run/xtables.* as iptables_var_run_t
  Resolves: #1243403


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-42
changelog:
  - Fix label on /var/tmp/kiprop_0
  Resolves:#1220763
  - Allow lldpad_t to getattr tmpfs_t.
  Resolves: #1246220
  - Label /dev/shm/lldpad.* as lldapd_tmpfs_t
  Resolves: #1246220
  - Allow audisp client to read system state.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-43
changelog:
  - Allow openhpid_t to read system state.
  Resolves: #1244248
  - Added labels for files provided by rh-nginx18 collection
  Resolves: #1249945
  - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
  Resolves: #1252968
  - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
  Resolves: #1243431
  - Allow abrt_dump_oops_t to read proc_security_t files.
  - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains
  - Add interface abrt_dump_oops_domtrans()
  - Add mountpoint dontaudit access check in rhsmcertd policy.
  Resolves: #1243431
  - Allow samba_net_t to manage samba_var_t sock files.
  Resolves: #1252937
  - Allow chrome setcap to itself.
  Resolves: #1251996
  - Allow httpd daemon to manage httpd_var_lib_t lnk_files.
  Resolves: #1253706
  - Allow chronyd exec systemctl
  Resolves: #1243764
  - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.
  Resolves: #1243764
  - Added interface fs_dontaudit_write_configfs_dirs
  - Add label for kernel module dep files in /usr/lib/modules
  Resolves:#916635
  - Allow kernel_t domtrans to abrt_dump_oops_t
  - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.
  - Allow systemd-networkd to send logs to systemd-journald.
  Resolves: #1236616


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-44
changelog:
  - Allow exec pidof under hypervkvp domain.
  Resolves: #1254870
  - Allow hypervkvp daemon create connection to the system DBUS
  Resolves: #1254870


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-45
changelog:
  - Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.
  Resolves: #1252442


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-46
changelog:
  - Allow watchdog execute fenced python script. Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764
  - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-47
changelog:
  - Fix regexp in chronyd.fc file
  Resolves: #1243764
  - Allow passenger to getattr filesystem xattr
  Resolves: #1196555
  - Label mdadm.conf.anackbak as mdadm_conf_t file.
  Resolves: #1088904
  - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc."
  - Allow watchdog execute fenced python script.
  Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t.
  Resolves: #1230877


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-48
changelog:
  - Fix labeling for fence_scsi_check script
  Resolves: #1255020
  - Allow openhpid to read system state Allow openhpid to connect to tcp http port.
   Resolves: #1244248
  - Allow openhpid to read snmp var lib files.
   Resolves: #1243902
  - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
  - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
  Resolves: #1243403
  - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl 
  Resolves: #1255020


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-49
changelog:
  - Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. 
  Resolves:#1250456


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-50
changelog:
  - Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager 
  Resolves: #1192338
  - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
   Resolves: #1238079
  - Allow rhsmcertd_t send signull to unconfined_service_t domains. 
  Resolves: #1176078
  - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.
  - Allow openhpid_t daemon to manage snmp files and dirs. 
  Resolves: #1243902
  - Allow mdadm_t domain read/write to general ptys and unallocated ttys. 
  Resolves: #1073314
  - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
   Resolves: #1176078


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-51
changelog:
  - Label /etc/ipa/nssdb dir as cert_t
  Resolves:#1262718
  - Do not provide docker policy files which is shipped by docker-selinux.rpm
  Resolves:#1262812


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-52
changelog:
  - Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.
  Resolves: #1230300
  - Allow qpid daemon to connect on amqp tcp port.
  Resolves: #1261805


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-53
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. 
  Resolves: #1256459


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-54
changelog:
  - Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
  Resolves:#1261938
  - Allow abrt_t domain to write to kernel msg device.
  Resolves: #1257828
  - Allow rpcbind_t domain to change file owner and group
  Resolves: #1265266


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-55
changelog:
  - We need to require sandbox_web_type attribute in sandbox_x_domain_template(). 
  Resolves: #1261938
  - ipsec: The NM helper needs to read the SAs
  Resolves: #1259786
  - ipsec: Allow ipsec management to create ptys
  Resolves: #1259786


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-56
changelog:
  - Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.
  - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.
  Resolves:#1266928


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-57
changelog:
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs
  Resolves: #1254188
  - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
  Resolves:#1261938


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-58
changelog:
  - Allow search dirs in sysfs types in kernel_read_security_state.
  Resolves: #1254188
  - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.
  Resolves: #1254188


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-60
changelog:
  Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.
  Resolves:#1247880


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-61
changelog:
  - Allow smbcontrol domain to send sigchld to ctdbd domain.
  Resolves: #1293784
  - Allow openvswitch read/write hugetlb filesystem.
  Resolves: #1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-62
changelog:
  - Allow openvswitch to manage hugetlfs files and dirs.
  Resolves: rhbz#1278495
  - Add fs_manage_hugetlbfs_files() interface.
  Resolves: rhbz#1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-64
changelog:
  - Add new SELinux policy fo targetd daemon.
  Resolves: rhbz#1063714
  - Add new SELinux policy fo ipmievd daemon.
  Resolves: rhbz#1083031
  - Add new SELinux policy fo hsqldb daemon.
  Resolves: rhbz#1083171
  - Add new SELinux policy for blkmapd daemon.
  Resolves: rhbz#1072997
  - Allow p11-child to connect to apache ports.
  - Label /usr/sbin/lvmlockd binary file as lvm_exec_t.
  Resolves: rhbz#1278028
  - Add interface "lvm_manage_lock" to lvm policy.
  Resolves: rhbz#1063714


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-65
changelog:
  - Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902
  - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.
  Resolves:  rhbz#1242506
  - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
  Resolves: rhbz#1284972
  - Add support for systemd-hwdb daemon.
   Resolves: rhbz#1257940
  - Add interface fs_setattr_cifs_dirs().
   Resolves: rhbz#1284972


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-67
changelog:
  - Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
  Resolves: rhbz#1263770
  - Fix context of "/usr/share/nginx/html".
  Resolves: rhbz#1261857
  - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
  Resolves: rhbz#1270344
  - Allow pmlogger to create pmlogger.primary.socket link file.
   Resolves: rhbz#1270344
  - Label nagios scripts as httpd_sys_script_exec_t.
  Resolves: rhbz#1260306
  - Add dontaudit interface for kdumpctl_tmp_t
  Resolves: rhbz#1156442
  - Allow mdadm read files in EFI partition.
  Resolves: rhbz#1291801
  - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
  Resolves: rhbz#1293140
  - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs
  Resolves: rhbz#1293140
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  Resolves: rhbz#1265102
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp.
  Resolves: rhbz#1213409
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  Resolves: rhbz#1206525
  - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
  Resolves: rhbz#1275246
  - cockpit has grown content in /var/run directory
  Resolves: rhbz#1279429
  - Allow collectd setgid capability
  Resolves:#1310898
  - Remove declaration of empty booleans in virt policy.
  Resolves: rhbz#1103153
  - Fix typo in drbd policy
  - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.
  Resolves: rhbz#1134883
  - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
  Resolves: rhbz#1293788
  - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
  Resolves: rhbz#1254188
  - Allow abrt_t to read sysctl_net_t files.
  Resolves: rhbz#1254188
  - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
  - Allow abrt-hook-ccpp to getattr on all executables.
  - Allow setuid/setgid capabilities for abrt-hook-ccpp.
   Resolves: rhbz#1254188
  - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling.
   Resolves: rhbz#1254188
  - Allow abrt-hook-ccpp to change SELinux user identity for created objects.
   Resolves: rhbz#1254188
  - Dontaudit write access to inherited kdumpctl tmp files.
   Resolves: rbhz#1156442
  - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
   Resolves: rhbz#1291801
  - Label 8952 tcp port as nsd_control.
   Resolves: rhbz#1293140
  - Allow ipsec to use pam.
   Resolves: rhbz#1315700
  - Allow to log out to gdm after screen was resized in session via vdagent.
  Resolves: rhbz#1249020
  - Allow setrans daemon to read /proc/meminfo.
   Resolves: rhbz#1316804
  - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
  Resolves: rhbz#1298151
  - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
  Resolves: rhbz#1236579
  - Add new selinux policy for systemd-resolved dawmon.
  Resolves: rhbz#1236579
  - Add interface ssh_getattr_server_keys() interface.
  Resolves: rhbz#1306197
  - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
  Resolves: rhbz#1306197
  - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used.
  Resolves: rhbz#1309417
  - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.
  Resolves: rhbz#1293788


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-68
changelog:
  - Create new permissivedomains CIL module and make it active.
  Resolves: rhbz#1320451
  - Add support for new mock location - /usr/libexec/mock/mock.
  Resolves: rhbz#1271209
  - Allow bitlee to create bitlee_var_t dirs.
  Resolves: rhbz#1268651
  - Allow CIM provider to read sssd public files.
  Resolves: rhbz#1263339
  - Fix some broken interfaces in distro policy.
  Resolves: rhbz#1121171
  - Allow power button to shutdown the laptop.
  Resolves: rhbz#995898
  - Allow lsm plugins to create named fixed disks.
  Resolves: rhbz#1238066
  - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777
  - Allow hyperv domains to rw hyperv devices.
  Resolves: rhbz#1309361
  - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1297323
  - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.
  - Add support for /dev/mptctl device used to check RAID status.
   Resolves: rhbz#1258029
  - Create hyperv* devices and create rw interfaces for this devices.
  Resolves: rhbz#1309361
  - Add fixes for selinux userspace moving the policy store to /var/lib/selinux.
  - Remove optional else block for dhcp ping


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-69
changelog:
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1319442
  - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.
  Resolves: rhbz#1296640
  - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
  Resolves: rhbz#1097775
  - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.
  Resolves: rhbz#1262483
  - Allow nsd daemon to create log file in /var/log as nsd_log_t
  Resolves: rhbz#1293140
  - Sanlock policy update.   - New sub-domain for sanlk-reset daemon
  Resolves: rhbz#1212324
  - Label all run tgtd files, not just socket files
  Resolves: rhbz#1280280
  - Label all run tgtd files, not just socket files.
  Resolves: rhbz#1280280
  - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
  Resolves: rhbz#1321049
  - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.
  Resolves: rhbz#1318224
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow targetd to read/write to /dev/mapper/control device.
  Resolves: rhbz#1063714
  - Allow KDM to get status about power services. This change allow kdm to be able do shutdown.
  Resolves: rhbz#1316724
  - Allow systemd-resolved daemon creating netlink_route sockets.
  Resolves:rhbz#1236579
  - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used
  Resolves: rhbz#1065362
  - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t
  Resolves: rhbz#1321943
  - Label all nvidia binaries as xserver_exec_t
  Resolves: rhbz#1322283


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-70
changelog:
  - Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
   Resolves: rhbz#1312809
   Resolves: rhbz#1323947
  - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144
  - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.
  Resolves: rhbz#1324144
  - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.
  Resolves: rhbz#1324144
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.
  Resolves: rhbz#1309454


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-71
changelog:
  - Add interface glusterd_dontaudit_read_lib_dirs()
  Resolves: rhbz#1295680
  - Dontaudit Occasionally observing AVC's while running geo-rep automation
  Resolves: rhbz#1295680
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1331561
  - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content 
  Resolves: rhbz#1246522
  - Allow stunnel create log files. 
  Resolves: rhbz#1296851
  - Label tcp port 8181 as intermapper_port_t.
  Resolves: rhbz#1334783
  - Label tcp/udp port 2024 as xinuexpansion4_port_t
  Resolves: rhbz#1334783
  - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t
  Resolves: rhbz#1334783
  - Dontaudit ldconfig read gluster lib files.
  Resolves: rhbz#1295680
  - Add interface auth_use_nsswitch() to systemd_domain_template.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-72
changelog:
  - We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.
  Resolves: rhbz#1333952


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-73
changelog:
  - Allow logwatch to domtrans to postqueue
  Resolves: rhbz#1331542
  - Label /var/log/ganesha.log as gluster_log_t
  - Allow glusterd_t domain to create glusterd_log_t files.
  - Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow zabbix to connect to postgresql port
  Resolves: rhbz#1330479
  - Add userdom_destroy_unpriv_user_shared_mem() interface.
  Related: rhbz#1306403
  - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
  Resolves: rhbz#1306403


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-74
changelog:
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-75
changelog:
  - dnsmasq: allow NetworkManager to control dnsmasq via D-Bus
  Resolves: rhbz#1336722
  - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
  Resolves: rhbz#1333198
  - sftpd_* booleans are functionless these days.
  Resolves: rhbz#1335656
  - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737
  - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.
  Resolves: rhbz#1264390
  - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
  Resolves: rhbz#1337061
  - Revert "Allow all domains some process flags."
  Resolves: rhbz#1303644
  - Revert "Remove setrlimit to all domains."
  Resolves: rhbz#1303644
  - Label /usr/sbin/xrdp* files as bin_t
  Resolves: rhbz#1276777
  - Add mls support for some db classes
  Resolves: rhbz#1303651
  - Allow systemd_resolved_t to check if ipv6 is disabled.
  Resolves: rhbz#1236579
  - Allow systemd_resolved to read systemd_networkd run files.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-76
changelog:
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - New interfaces needed for systemd-machinectl
  Resolves: rhbz#1236580
  - New interfaces needed by systemd-machine
  Resolves: rhbz#1236580
  - Add interface allowing sending and receiving messages from virt over dbus.
  Resolves: rhbz#1236580
  - Backport docker policy from Fedora.
  Related: #1303123
  Resolves: #1341257
  - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.
  Resolves: rhbz#1236580
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added interfaces needed by new docker policy.
  Related: rhbz#1303123
  - Add support for systemd-machined daemon
  Resolves: rhbz#1236580
  - Allow rpm-ostree domain transition to install_t domain from init_t.
  Resolves: rhbz#1340542


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-77
changelog:
  - Allow tmpreaper_t to read/setattr all non_security_file_type dirs
  Resolves: rhbz#1115987
  - Allow firewalld to create firewalld_var_run_t directory.
  Resolves: rhbz#1304723
  - Add interface firewalld_read_pid_files()
  Resolves: rhbz#1304723
  - Label /usr/libexec/rpm-ostreed as rpm_exec_t.
  Resolves: rhbz#1340542
  - Allow sanlock service to read/write cephfs_t files.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - Add interface files_setattr_non_security_dirs()
  Resolves: rhbz#1115987
  - Add support for onloadfs
  - Allow iptables to read firewalld pid files.
  Resolves: rhbz#1304723
  - Add SELinux support for ceph filesystem.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  Resolves: rhbz#1236580


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-78
changelog:
  - Allow glusterd domain read krb5_keytab_t files.
  Resolves: rhbz#1343929
  - Fix typo in files_setattr_non_security_dirs.
  Resolves: rhbz#1115987


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-80
changelog:
  - Allow conman to kill conman_unconfined_script.
  Resolves: rhbz#1297323
  - Make conman_unconfined_script_t as init_system_domain.
  Resolves:rhbz#1297323
  - Allow init dbus chat with apmd.
  Resolves:rhbz#995898
  - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
  Resolves: rhbz#1233252
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Add mediawiki rules to proper scope
  Resolves: rhbz#1301186
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Allow mysqld_safe to inherit rlimit information from mysqld
  Resolves: rhbz#1323673
  - Allow collectd_t to stream connect to postgresql.
  Resolves: rhbz#1344056
  - Allow mediawiki-script to read /etc/passwd file.
  Resolves: rhbz#1301186
  - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
  Resolves: rhbz#1344505
  - Add labels for mediawiki123
  Resolves: rhbz#1293872
  - Fix label for all fence_scsi_check scripts
  - Allow ip netns to mounton root fs and unmount proc_t fs.
  Resolves: rhbz#1343776
  Resolves: rhbz#1286851
  - Allow sysadm_t to run newaliases command.
  Resolves: rhbz#1344828
  - Add interface sysnet_filetrans_named_net_conf()
  Resolves: rhbz#1344505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-81
changelog:
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Allow mongod log to syslog.
  Resolves: rhbz#1306995
  - Allow rhsmcertd connect to port tcp 9090
  Resolves: rhbz#1337319
  - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. 
  Resolves: rhbz#1262483
  Resolves: rhbz#1277506
  - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
  Resolves: rhbz#1301516
  - Add new boolean spamd_update_can_network.
  Resolves: rhbz#1305469
  - Allow rhsmcertd connect to tcp netport_port_t
  Resolves: rhbz#1329475
  - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
  Resolves: rhbz#1328234
  - Allow prosody to bind to fac_restore tcp port.
  Resolves: rhbz#1321787
  - Allow ninfod to read raw packets
  Resolves: rhbz#1317964
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1260835
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1271159
  - Allow tuned to use policykit. This change is required by cockpit.
  Resolves: rhbz#1346464
  - Allow conman_t to read dir with conman_unconfined_script_t binary files.
  Resolves: rhbz#1297323
  - Allow pegasus to read /proc/sysinfo.
  Resolves: rhbz#1265883
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255
  - Label tcp ports:16379, 26379 as redis_port_t
  Resolves: rhbz#1348471
  - Allow systemd to relabel /var and /var/lib directories during boot.
  - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
  - Add files_relabelto_var_lib_dirs() interface.
  - Label tcp port 2004 as mailbox_port_t.
  Resolves: rhbz#1332843
  - Label tcp and udp port 5582 as fac_restore_port_t
  Resolves: rhbz#1321787
  - Allow sysadm_t user to run postgresql-setup.
  Resolves: rhbz#1282543
  - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
  Resolves: rhbz#1297480
  - Update netlink socket classes.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-82
changelog:
  - Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
  Resolves:rhbz#1331315
  - Label named-pkcs11 binary as named_exec_t.
  Resolves: rhbz#1331315
  - Allow glusterd daemon to get systemd status
  Resolves: rhbz#1321785
  - Allow logrotate dbus-chat with system_logind daemon
  Resolves: rhbz#1283134
  - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
  Resolves: rhbz#1336211
  - Add interface cron_read_pid_files()
  Resolves: rhbz#1336211
  - Allow pcp_pmlogger to create unix dgram sockets
  Resolves: rhbz#1336211
  - Add hwloc-dump-hwdata SELinux policy
  Resolves: rhbz#1344054
  - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
  Resolves: rhbz#1121171
  - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
  Resolves: rhbz#1259764
  - Create label for openhpid log files. 
  esolves: rhbz#1259764
  - Label /var/lib/ganglia as httpd_var_lib_t
  Resolves: rhbz#1260536
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Include patch from distgit repo: policy-RHEL-7.1-flask.patch.
  Resolves: rhbz#1329560
  - Update refpolicy to handle hwloc
  Resolves: rhbz#1344054
  - Label /etc/dhcp/scripts dir as bin_t
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-83
changelog:
  - Allow krb5kdc_t to communicate with sssd
  Resolves: rhbz#1319933
  - Allow prosody to bind on prosody ports
  Resolves: rhbz#1304664
  - Add dac_override caps for fail2ban-client
  Resolves: rhbz#1316678
  - dontaudit read access for svirt_t on the file /var/db/nscd/group
  Resolves: rhbz#1301637
  - Allow inetd child process to communicate via dbus with systemd-logind
  Resolves: rhbz#1333726
  - Add label for brltty log file
  Resolves: rhbz#1328818
  - Allow dspam to read the passwd file
  Resolves: rhbz#1286020
  - Allow snort_t to communicate with sssd
  Resolves: rhbz#1284908
  - svirt_sandbox_domains need to be able to execmod for badly built libraries.
  Resolves: rhbz#1206339
  - Add policy for lttng-tools package.
  Resolves: rhbz#1256374
  - Make mirrormanager as application domain.
  Resolves: rhbz#1328234
  - Add support for the default lttng-sessiond port - tcp/5345.  This port is used by LTTng 2.x central tracing registry session daemon.
  - Add prosody ports
  Resolves: rhbz#1304664
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-84
changelog:
  - Fix typo in brltty SELinux module
  - Add new SELinux module sbd
  Resolves: rhbz#1322725
  - Allow pcp dmcache metrics collection
  Resolves: rhbz#1309883
  - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
  Resolves: rhbz#1350782
  - Allow openvpn to create sock files labeled as openvpn_var_run_t
  Resolves: rhbz#1328246
  - Allow hypervkvp daemon to getattr on  all filesystem types.
  Resolves: rhbz#1349356
  - Allow firewalld to create net_conf_t files
  Resolves: rhbz#1304723
  - Allow mock to use lvm
  Resolves: rhbz#1271209
  - Allow keepalived to create netlink generic sockets.
  Resolves: rhbz#1349809
  - Allow mirromanager creating log files in /tmp
  Resolves:rhbz#1328818
  - Rename few modules to make it consistent with source files
  Resolves: rhbz#1351445
  - Allow vmtools_t to transition to rpm_script domain
  Resolves: rhbz#1342119
  - Allow nsd daemon to manage nsd_conf_t dirs and files
  Resolves: rhbz#1349791
  - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
  Resolves: rhbz#1346900
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535
  - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
  Resolves: rhbz#1086240
  - Add interface lvm_getattr_exec_files()
  Resolves: rhbz#1271209
  - Fix typo Compliling vs. Compiling
  Resolves: rhbz#1351445


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-85
changelog:
  - Allow virtual machines to rw infiniband devices.
  Resolves: rhbz#1210263
  - Allow opensm daemon to rw infiniband_mgmt_device_t
  Resolves: rhbz#1210263
  - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.
  Resolves: rhbz#1350756
  - Make label for new infiniband_mgmt deivices
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-86
changelog:
  - Allow udev to manage systemd-hwdb files
  - Add interface systemd_hwdb_manage_config()
  Resolves: rhbz#1350756
  - Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-87
changelog:
  - Allow lttng tools to block suspending
  Resolves: rhbz#1256374
  - Allow creation of vpnaas in openstack
  Resolves: rhbz#1352710
  - virt: add strict policy for virtlogd daemon
  Resolves:rhbz#1311606
  - Update makefile to support snapperd_contexts file
  Resolves: rhbz#1352681


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-88
changelog:
  - Allow rhsmcertd to copy certs into /etc/docker/cert.d
  - Add interface docker_rw_config()
  Resolves: rhbz#1344500
  - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t
  Resolves: rhbz#1355632
  - Allow rhsmcertd to read network sysctls
  Resolves: rhbz#1329475
  - Label /var/log/graphite-web dir as httpd_log_t
  Resolves: rhbz#1310898
  - Allow mock to use generic ptys
  Resolves: rhbz#1271209
  - Allow adcli running as sssd_t to write krb5.keytab file.
  Resolves: rhbz#1356082
  - Allow openvswitch connect to openvswitch_port_t type.
  Resolves: rhbz#1335024
  - Add SELinux policy for opendnssec service.
  Resolves: rhbz#1350957
  - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd
  Resolves: rhbz#1350957
  - label /dev/ndctl0 device as nvram_device_t
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-89
changelog:
  - Allow firewalld to manage net_conf_t files.
  Resolves:rhbz#1304723
  - Allow logrotate read logs inside containers.
  Resolves: rhbz#1303514
  - Allow sssd to getattr on fs_t
  Resolves: rhbz#1356082
  - Allow opendnssec domain to manage bind chace files
  Resolves: rhbz#1350957
  - Fix typo in rhsmcertd  policy module
  Resolves: rhbz#1329475
  - Allow systemd to get status of systemd-logind daemon
  Resolves: rhbz#1356141
  - Label more ndctl devices not just ndctl0
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-90
changelog:
  - Allow ipa-dnskey read system state.
  Reasolves: rhbz#1350957
  - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
  Resolves: rhbz#1350957


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-92
changelog:
  - Dontaudit mock_build_t can list all ptys.
  Resolves: rhbz#1271209
  - Allow ftpd_t to mamange userhome data without any boolean.
  Resolves: rhbz#1097775
  - Add logrotate permissions for creating netlink selinux sockets.
  Resolves: rhbz#1283134
  - Allow lsmd_plugin_t to exec ldconfig.
  Resolves: rhbz#1238066
  - Allow vnstatd domain to read /sys/class/net/ files
  Resolves: rhbz#1358243
  - Remove duplicate allow rules in spamassassin SELinux module
  Resolves:rhbz#1358175
  - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
  Resolves:rhbz#1358175
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857
  - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
  Resolves: rhbz#1330464
  - Allow gnome-keyring also manage user_tmp_t sockets.
  Resolves: rhbz#1257057
  - corecmd: Remove fcontext for /etc/sysconfig/libvirtd
  Resolves:rhbz#1351382


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-93
changelog:
  - Dontaudit mock to write to generic certs.
  Resolves: rhbz#1271209
  - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
  Resolves: rhbz#1347514
  - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain"
  - Allow modemmanager to write to systemd inhibit pipes
  Resolves: rhbz#1365214
  - Label corosync-qnetd and corosync-qdevice as corosync_t domain
  Resolves: rhbz#1347514
  - Allow ipa_helper to read network state
  Resolves: rhbz#1361636
  - Label oddjob_reqiest as oddjob_exec_t
  Resolves: rhbz#1361636
  - Add interface oddjob_run()
  Resolves: rhbz#1361636
  - Allow modemmanager chat with systemd_logind via dbus
  Resolves: rhbz#1362273
  - Allow NetworkManager chat with puppetagent via dbus
  Resolves: rhbz#1363989
  - Allow NetworkManager chat with kdumpctl via dbus
  Resolves: rhbz#1363977
  - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
  Resolves: rhbz#1322725
  - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
  Resolves: rhbz#1349058
  - Allow rasdaemon to use tracefs filesystem.
  Resolves: rhbz#1364380
  - Fix typo bug in dirsrv policy
  - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
  Resolves: rhbz#1283134
  - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
  Resolves: rhbz#1362688
  - Allow dirsrv to read dirsrv_share_t content
  Resolves: rhbz#1363662
  - Allow virtlogd_t to append svirt_image_t files.
  Resolves: rhbz#1358140
  - Allow hypervkvp domain to read hugetlbfs dir/files.
  Resolves: rhbz#1349356
  - Allow mdadm daemon to read nvme_device_t blk files
  Resolves: rhbz#1362564
  - Allow selinuxusers and unconfineduser to run oddjob_request
  Resolves: rhbz#1361636
  - Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
  Resolves: rhbz#1362539
  - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*.
  Resolves: rhbz#1363769
  - Fix typo in device interfaces
  Resolves: rhbz#1349058
  - Add interfaces for managing ipmi devices
  Resolves: rhbz#1349058
  - Add interfaces to allow mounting/umounting tracefs filesystem
  Resolves: rhbz#1364380
  - Add interfaces to allow rw tracefs filesystem
  Resolves: rhbz#1364380
  - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
  Resolves: rhbz#1362564
  - Label /sys/kernel/debug/tracing filesystem
  Resolves: rhbz#1364380
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-94
changelog:
  - Allow ipmievd domain to create lock files in /var/lock/subsys/
  Resolves:rhbz#1349058
  - Update policy for ipmievd daemon.
  Resolves:rhbz#1349058
  - Dontaudit hyperkvp to getattr on non security files.
  Resolves: rhbz#1349356
  - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
  Resolves: rhbz#1347514
  - Fixed lsm SELinux module
  - Add sys_admin capability to sbd domain
  Resolves: rhbz#1322725
  - Allow vdagent to comunnicate with systemd-logind via dbus
  Resolves: rhbz#1366731
  - Allow lsmd_plugin_t domain to create fixed_disk device.
  Resolves: rhbz#1238066
  - Allow opendnssec domain to create and manage own tmp dirs/files
  Resolves: rhbz#1366649
  - Allow opendnssec domain to read system state
  Resolves: rhbz#1366649
  - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
  Resolves: rhbz#1366649
  - Allow rasdaemon to mount/unmount tracefs filesystem.
  Resolves: rhbz#1364380
  - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/
  Resolves: rhbz#1367520
  - Modify interface den_read_nvme() to allow also read nvme_device_t block files.
  Resolves: rhbz#1362564
  - Label /var/run/storaged as lvm_var_run_t.
  Resolves: rhbz#1264390
  - Allow unconfineduser to run ipa_helper_t.
  Resolves: rhbz#1361636


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-95
changelog:
  - Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
  Resolves:rhbz#1366915
  - Allow certmonger to manage all systemd unit files
  Resolves:rhbz#1366915
  - Grant certmonger "chown" capability
  Resolves:rhbz#1366915
  - Allow ipa_helper_t stream connect to dirsrv_t domain
  Resolves: rhbz#1368418
  - Update oracleasm SELinux module
  Resolves: rhbz#1331383
  - label /var/lib/kubelet as svirt_sandbox_file_t
  Resolves: rhbz#1369159
  - Add few interfaces to cloudform.if file
  Resolves: rhbz#1367834
  - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
  Resolves: rhbz#1347514
  - Allow krb5kdc_t to read krb4kdc_conf_t dirs.
  Resolves: rhbz#1368492
  - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
  Resolves: rhbz#1365653
  - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.
  Resolves: rhbz#1365653
  - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type
  Resolves: rhbz#1331383
  - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
  Resolves: rhbz#1367834
  - Allow iptables to creating netlink generic sockets.
  Resolves: rhbz#1364359


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-96
changelog:
  - Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Move label for /var/lib/docker/vfs/ to proper SELinux module
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - Allow systemd-machined to communicate to lxc container using dbus
  - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
  - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
  - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-97
changelog:
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  Resolves: rhbz#1331383
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  Resolves: rhbz#1206525
  - Allow mdadm_t to getattr all device nodes
  Resolves: rhbz#1365171
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  Resolves:rhbz#1052880
  - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy.
  Resolves: rhbz#1372705
  - Allow guest-set-user-passwd to set users password.
  Resolves: rhbz#1369693
  - Allow samdbox domains to use msg class
  Resolves: rhbz#1372677
  - Allow domains using kerberos to read also kerberos config dirs
  Resolves: rhbz#1368492
  - Allow svirt_sandbox_domains to r/w onload sockets
  Resolves: rhbz#1342930
  - Add interface fs_manage_oracleasm()
  Resolves: rhbz#1331383
  - Label /dev/kfd as hsa_device_t
  Resolves: rhbz#1373488
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
  Resolves: rhbz#1368097
  - Add interface to write to nsfs inodes
  Resolves: rhbz#1372705
  - Allow systemd services to use PrivateNetwork feature
  Resolves: rhbz#1372705
  - Add a type and genfscon for nsfs.
  Resolves: rhbz#1372705
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
  Resolves: rhbz#1290400


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-98
changelog:
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  Resolves: rhbz#1331383
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  Resolves: rhbz#1206525


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-99
changelog:
  - Allow iscsid create netlink iscsid sockets.
  Resolves: rhbz#1358266
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  Resolves: rhbz#1375462


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-100
changelog:
  - Allow ftp daemon to manage apache_user_content
  Resolves: rhbz#1097775
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  Resolves: rhbz#1331383
  - Allow oracleasm to rw inherited fixed disk device
  Resolves: rhbz#1331383
  - Allow collectd to connect on unix_stream_socket
  Resolves: rhbz#1377259


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-101
changelog:
  - Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
  Resolves: rhbz#1309883


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-103
changelog:
  - Allow sssd_selinux_manager_t to manage also dir class.
  Resolves: rhbz#1368097
  - Add interface seutil_manage_default_contexts_dirs()
  Resolves: rhbz#1368097


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-104
changelog:
  - Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros
  - Add selinux-policy-migrate-local-changes service
  Resolves: rhbz#1381588


author: Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-105
changelog:
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  Resolves: rhbz#1384488
  - Allow glusterd to get attributes on /sys/kernel/config directory.
  Resolves: rhbz#1384483


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-106
changelog:
  - Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
  Resolves: rhbz#1392010


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-108
changelog:
  - Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients
  Resolves: rhbz#1393505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-109
changelog:
  - Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
  Resolves: rhbz#1399250


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-112
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Allow systemd to stop glusterd_t domains.
  Resolves: rhbz#1400493


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-113
changelog:
  - Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes.
  Resolves: rhbz#1403254


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-115
changelog:
  - Allow glusterd_t to bind on med_tlp port.
  Resolves: rhbz#1404152
  - Update ctdbd_t policy to reflect all changes.
  Resolves: rhbz#1402451
  - Label tcp port 24009 as med_tlp_port_t
  Resolves: rhbz#1404152
  -  Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-116
changelog:
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1404152
  - Revert: Allow glusterd_t to bind on med_tlp port.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-117
changelog:
  - Allow systemd container to read/write usermodehelperstate
  Resolves: rhbz#1403254
  - Label udp ports in range 24007-24027 as gluster_port_t
  Resolves: rhbz#1404152


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-118
changelog:
  - Allow firewalld to getattr open search read modules_object_t:dir
  Resolves: rhbz#1418391
  - Fix label for nagios plugins in nagios file conxtext file
  Resolves: rhbz#1277718
  - Add sys_ptrace capability to pegasus domain
  Resolves: rhbz#1381238
  - Allow sssd_t domain setpgid
  Resolves:rhbz#1416780
  - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk.
  Resolves: rhbz#1350927
  - Allow kdumpgui domain to read nvme device
  Resolves: rhbz#1415084
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization.
  Resolves: rhbz#1146987
  - Add user namespace capability object classes.
  Resolves: rhbz#1368057
  - Add module_load permission to class system
  Resolves:rhbz#1368057
  - Add the validate_trans access vector to the security class 
  Resolves: rhbz#1368057
  - Add "binder" security class and access vectors
  Resolves: rhbz#1368057
  - Allow ifconfig_t domain read nsfs_t
  Resolves: rhbz#1349814
  - Allow ping_t domain to load kernel modules.
  Resolves: rhbz#1388363


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-119
changelog:
  - Add interface init_stream_connectto()
  Resolves:rhbz#1365947
  - Allow rhsmcertd domain signull kernel.
  Resolves: rhbz#1379781
  - Allow kdumpgui domain to read nvme device
  - Allow insmod_t to load kernel modules
  Resolves: rhbz#1421598
  - Add interface files_load_kernel_modules()
  Resolves: rhbz#1421598
  - Add SELinux support for systemd-initctl daemon
  Resolves:rhbz#1365947
  - Add SELinux support for systemd-bootchart
  Resolves: rhbz#1365953


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-120
changelog:
  - Allow initrc_t domain to run rhel-autorelabel script properly during boot process
  Resolves: rhbz#1379722
  - Allow systemd_initctl_t to create and connect unix_dgram sockets
  Resolves: rhbz#1365947
  - Allow ifconfig_t to mount/unmount nsfs_t filesystem
  Resolves: rhbz#1349814
  - Add interfaces allowing mount/unmount nsfs_t filesystem
  Resolves: rhbz#1349814


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-122
changelog:
  - Allow nfsd_t domain rw sysctl_rpc_t dirs
  Resolves: rhbz#1405304
  - Allow cgdcbxd_t to manage cgroup files.
  Resolves: rhbz#1358493
  - Allow cmirrord_t domain to create netlink_connector sockets
  Resolves: rhbz#1412670
  - Allow fcoemon to create netlink scsitransport sockets
  Resolves: rhbz#1362496
  - Allow quota_nld_t create netlink_generic sockets
  Resolves: rhbz#1358679
  - Allow cgred_t create netlink_connector sockets
  Resolves: rhbz#1376357
  - Add dhcpd_t domain fowner capability
  Resolves: rhbz#1358485
  - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
  Resolves: rhbz#1358478
  - Rename docker module to container module
  Resolves: rhbz#1386916
  - Allow setflies to mount tracefs
  Resolves: rhbz#1376357
  - Allow iptables to read nsfs files.
  Resolves: rhbz#1411316
  - Allow systemd_bootchart_t domain create dgram sockets.
  Resolves: rhbz#1365953
  - Rename docker interfaces to container
  Resolves: rhbz#1386916


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-123
changelog:
  - Allow nfsd_t domain to create sysctls_rpc_t files
  Resolves: rhbz#1405304
  - Allow openvswitch to create netlink generic sockets.
  Resolves: rhbz#1397974
  - Create kernel_create_rpc_sysctls() interface
  Resolves: rhbz#1405304


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-124
changelog:
  - Allow rhsmcertd_t dbus chat with system_cronjob_t
  Resolves: rhbz#1405341
  - Allow openvswitch exec hostname and readinitrc_t files
  Resolves: rhbz#1405479
  - Improve SELinux context for mysql_db_t objects.
  Resolves: rhbz#1391521
  - Allow postfix_postdrop to communicate with postfix_master via pipe.
  Resolves: rhbz#1379736
  - Add radius_use_jit boolean
  Resolves: rhbz#1426205
  - Label /var/lock/subsys/iptables as iptables_lock_t
  Resolves: rhbz#1405441
  - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t
  Resolves: rhbz#1332803
  - Allow can_load_kernmodule to load kernel modules.
  Resolves: rhbz#1423427
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-125
changelog:
  - Update ganesha policy
  Resolves: rhbz#1426554
  Resolves: rhbz#1383784
  - Allow chronyd to read adjtime
  Resolves: rhbz#1416015
  - Fixes for chrony version 2.2
  Resolves: rhbz#1416015
  - Add interface virt_rw_stream_sockets_svirt()
  Resolves: rhbz#1415841
  - Label /dev/ss0 as gpfs_device_t
  Resolves: rhbz#1383784
  - Allow staff to rw svirt unix stream sockets.
  Resolves: rhbz#1415841
  - Label /rhev/data-center/mnt as mnt_t
  Resolves: rhbz#1408275
  - Associate sysctl_rpc_t with proc filesystems
  Resolves: rhbz#1350927
  - Add new boolean: domain_can_write_kmsg
  Resolves: rhbz#1415715


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-128
changelog:
  - Add handling booleans via selinux-policy macros in custom policy spec files.
  Resolves: rhbz#1380854


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-130
changelog:
  - Allow gssproxy to get attributes on all filesystem object types.
  Resolves: rhbz#1430295
  - Allow ganesha to chat with unconfined domains via dbus
  Resolves: rhbz#1426554
  - add the policy required for nextcloud
  Resolves: rhbz#1425530
  - Add nmbd_t capability2 block_suspend
  Resolves: rhbz#1425357
  - Label /var/run/chrony as chronyd_var_run_t
  Resolves: rhbz#1416015
  - Add domain transition from sosreport_t to iptables_t
  Resolves: rhbz#1359789
  - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd
  Resolves: rhbz:#1332803


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-131
changelog:
  - Remove tomcat_t domain from unconfined domains
  Resolves: rhbz#1432083
  - Create new boolean: sanlock_enable_home_dirs()
  Resolves: rhbz#1432783
  - Allow mdadm_t domain to read/write nvme_device_t
  Resolves: rhbz#1431617
  - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
  Resolves: rhbz#1383621
  - Dontaudit domain to create any file in /proc. This is kernel bug.
  Resolves: rhbz#1412679
  - Add interface dev_rw_nvme
  Resolves: rhbz#1431617


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-132
changelog:
  - Add haproxy_t domain fowner capability
  Resolves: rhbz#1386233
  - Allow domain transition from ntpd_t to hwclock_t domains
  Resolves: rhbz#1375624
  - Allow cockpit_session_t setrlimit and sys_resource
  Resolves: rhbz#1402316
  - Dontaudit svirt_t read state of libvirtd domain
  Resolves: rhbz#1426106
  - Update httpd and gssproxy modules to reflects latest changes in freeipa
  Resolves: rhbz#1432115
  - Allow iptables read modules_conf_t
  Resolves: rhbz#1367520


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-133
changelog:
  - Allow drbd load modules
  Resolves: rhbz#1134883
  - Revert "Add sys_module capability for drbd
  Resolves: rhbz#1134883"
  - Allow stapserver list kernel modules
  Resolves: rhbz#1325976
  - Update targetd policy
  Resolves: rhbz#1373860
  - Add sys_admin capability to amanda
  Resolves: rhbz#1371561
  - Allow hypervvssd_t to read all dirs.
  Resolves: rhbz#1331309
  - Label /run/haproxy.sock socket as haproxy_var_run_t
  Resolves: rhbz#1386233
  - Allow oddjob_mkhomedir_t to mamange autofs_t dirs.
  Resolves: rhbz#1408819
  - Allow tomcat to connect on http_cache_port_t
  Resolves: rhbz#1432083
  - Allow geoclue to send msgs to syslog.
  Resolves: rhbz#1434286
  - Allow condor_master_t domain capability chown.
  Resolves: rhbz#1277506
  - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t.
  Resolves: rhbz#1167468
  - Allow nova domain search for httpd configuration.
  Resolves: rhbz#1190761
  - Add sys_module capability for drbd
  Resolves: rhbz#1134883
  - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files
  Resolves: rhbz#1286474
  - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus
  Resolves: rhbz#1278010


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-134
changelog:
  - Allow named_t domain bind on several udp ports
  Resolves: rhbz#1312972
  - Update nscd_use() interface
  Resolves: rhbz#1281716
  - Allow radius_t domain ptrace
  Resolves: rhbz#1426641
  - Update nagios to allos exec systemctl
  Resolves: rhbz#1247635
  - Update pcp SELinux module to reflect all pcp changes
  Resolves: rhbz#1271998
  - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t
  Resolves: rhbz#1325527
  - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-136
changelog:
  - geoclue wants to dbus chat with avahi
  Resolves: rhbz#1434286
  - Allow iptables get list of kernel modules
  Resolves: rhbz#1367520
  - Allow unconfined_domain_type to enable/disable transient unit
  Resolves: rhbz#1337041
  - Add interfaces init_enable_transient_unit() and init_disable_transient_unit
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  Resolves: rhbz#1435264
  - Label sysroot dir under ostree as root_t
  Resolves: rhbz#1428112


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-137
changelog:
  - Dontaudit firewalld wants write to /root
  Resolves: rhbz#1438708
  - Dontaudit firewalld to create dirs in /root/
  Resolves: rhbz#1438708
  - Allow sendmail to search network sysctls
  Resolves: rhbz#1369376
  - Add interface gssd_noatsecure()
  Resolves: rhbz#1438036
  - Add interface gssproxy_noatsecure()
  Resolves: rhbz#1438036
  - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals
  Resolves: rhbz#1379371
  - Allow chronyd_t net_admin capability to allow support HW timestamping.
  Resolves: rhbz#1416015
  - Update tomcat policy
  Resolves: rhbz#1436689
  Resolves: rhbz#1436383
  - Allow certmonger to start haproxy service
  Resolves: rhbz#1349394
  - Allow init noatsecure for gssd and gssproxy
  Resolves: rhbz#1438036


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-139
changelog:
  - Fix all AVC denials during pkispawn of CA
  Resolves: rhbz#1436383
  - Update pki interfaces and tomcat module
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-140
changelog:
  - Allow pcp_pmcd_t net_admin capability.
  - Allow pcp_pmcd_t read net sysctls
  - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t
  Resolves: rhbz#1336211


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-142
changelog:
  - Allow sbd_t to read/write fixed disk devices
  Resolves: rhbz#1440165
  - Add sys_ptrace capability to radiusd_t domain
  Resolves: rhbz#1426641
  - Allow cockpit_session_t domain connects to ssh tcp ports.
  Resolves: rhbz#1413509


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-143
changelog:
  - Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed.
  Resolves: rhbz#1431859
  - Fix policy to reflect all changes in new IPA release
  Resolves: rhbz#1432115
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-145
changelog:
  - Update tomcat policy to adjust for removing unconfined_domain attr.
  Resolves: rhbz#1432083
  - Allow httpd_t domain read also httpd_user_content_type lnk_files.
  Resolves: rhbz#1383621
  - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
  Resolves: rhbz#1436689
  - Dontaudit <user>_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
  Resolves: rhbz#1425530
  - Add interface ipa_filetrans_named_content()
  Resolves: rhbz#1432115
  - Allow tomcat use nsswitch
  Resolves: rhbz#1436689
  - Allow certmonger_t start/status generic services
  Resolves: rhbz#1436689
  - Allow dirsrv read cgroup files.
  Resolves: rhbz#1436689
  - Allow ganesha_t domain read/write infiniband devices.
  Resolves: rhbz#1383784
  - Allow sendmail_t domain sysctl_net_t files
  Resolves: rhbz#1369376
  - Allow targetd_t domain read network state and getattr on loop_control_device_t
  Resolves: rhbz#1373860
  - Allow condor_schedd_t domain send mails.
  Resolves: rhbz#1277506
  - Alow certmonger to create own systemd unit files.
  Resolves: rhbz#1436689
  - Allow staff to systemctl virt server when staff_use_svirt=1
  Resolves: rhbz#1415841
  - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
  Resolves: rhbz#1432115
  - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t
  Resolves: rhbz#1428112


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-146
changelog:
  - Allow pki_tomcat_t domain read /etc/passwd.
  Resolves: rhbz#1436689
  - Allow tomcat_t domain read ipa_tmp_t files
  Resolves: rhbz#1436689
  - Label new path for ipa-otpd
  Resolves: rhbz#1446353
  - Allow radiusd_t domain stream connect to postgresql_t
  Resolves: rhbz#1446145
  - Allow rhsmcertd_t to execute hostname_exec_t binaries.
  Resolves: rhbz#1445494
  - Allow virtlogd to append nfs_t files when virt_use_nfs=1
  Resolves: rhbz#1402561


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-147
changelog:
  - Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-148
changelog:
  - Allow hypervkvp_t domain execute hostname
  Resolves: rhbz#1449064
  - Dontaudit sssd_selinux_manager_t use of net_admin capability
  Resolves: rhbz#1444955
  - Allow tomcat_t stream connect to pki_common_t
  Resolves: rhbz#1447436
  - Dontaudit xguest_t's attempts to listen to its tcp_socket
  - Allow sssd_selinux_manager_t to ioctl init_t sockets
  Resolves: rhbz#1436689
  - Allow <role>_su_t to create netlink_selinux_socket
  Resolves rhbz#1146987
  - Allow unconfined_t to module_load any file
  Resolves rhbz#1442994


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-149
changelog:
  - Update targetd policy to accommodate changes in the service
  Resolves: rhbz#1424621
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  Resolves: rhbz#1450819
  - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
  Resolves: rhbz#1415841
  - Allow radius domain stream connec to postgresql
  Resolves: rhbz#1446145
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  Resolves: rhbz#1449977
  - Allow glusterd_t domain start ganesha service
  Resolves: rhbz#1448090
  - Made few cosmetic changes in sssd SELinux module
  Resolves: rhbz#1448060
  - sssd-kcm should not run as unconfined_service_t BZ(1447411)
  Resolves: rhbz#1448060
  - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct
  Resolves: rhbz#1448056
  - Allow keepalived_t domain read usermodehelper_t
  Resolves: rhbz#1449769
  - Allow tomcat_t domain read pki_common_t files
  Resolves: rhbz#1447436
  - Add interface pki_read_common_files()
  Resolves: rhbz#1447436


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-150
changelog:
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  Resolves: rhbz#1451318
  - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
  Resolves: rhbz#1448056 Resolves: rhbz#1448060
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  Resolves: rhbz#1450819
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  Resolves: rhbz#1373321
  - Allow netutils setpcap capability
  Resolves:1444438


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-151
changelog:
  - nmbd_t needs net_admin capability like smbd
  Resolves: rhbz#1431859
  - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
  Resolves: rhbz#1431859
  - Allow rngd domain read sysfs_t
  Resolves: rhbz#1451735
  - Add interface pki_manage_common_files()
  Resolves: rhbz#1447436
  - Allow tomcat_t domain to manage pki_common_t files and dirs
  Resolves: rhbz#1447436
  - Use stricter fc rules for sssd sockets in /var/run
  Resolves: rhbz#1448060
  - Allow certmonger reads httpd_config_t files
  Resolves: rhbz#1436689
  - Allow keepalived_t domain creating netlink_netfilter_socket.
  Resolves: rhbz#1451684
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  Resolves: rhbz#1451318
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  Resolves: rhbz#1373321


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-152
changelog:
  - Allow httpd_t reading kerberos kdc config files
  Resolves: rhbz#1452215
  - Allow tomcat_t domain connect to ibm_dt_2 tcp port.
  Resolves: rhbz#1447436
  - Allow stream connect to initrc_t domains
  Resolves: rhbz#1447436
  - Allow  dnsmasq_t domain to read systemd-resolved pid files.
  Resolves: rhbz#1453114
  - Allow tomcat domain name_bind on tcp bctp_port_t
  Resolves: rhbz#1451757
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1447669
  - Allow condor_master_t write to sysctl_net_t
  Resolves: rhbz#1277506
  - Allow nagios check disk plugin read /sys/kernel/config/
  Resolves: rhbz#1277718
  - Allow pcp_pmie_t domain execute systemctl binary
  Resolves: rhbz#1271998
  - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
  Resolves: rhbz#1247635
  - Label tcp/udp port 1792 as ibm_dt_2_port_t
  Resolves: rhbz#1447436
  - Add interface fs_read_configfs_dirs()
  - Add interface fs_read_configfs_files()
  - Fix systemd_resolved_read_pid interface
  - Add interface systemd_resolved_read_pid()
  Resolves: rhbz#1453114
  - Allow sshd_net_t domain read/write into crypto devices
  Resolves: rhbz#1452759
  - Label 8999 tcp/udp as bctp_port_t
  Resolves: rhbz#1451757


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-154
changelog:
  - Add few allow rules to ganesha module
  Resolves: rhbz#1448090
  - Allow condor_master_t to read sysctls.
  Resolves: rhbz#1277506
  - Add dac_override cap to ctdbd_t domain
  Resolves: rhbz#1435708
  - Label 8750 tcp/udp port as dey_keyneg_port_t
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-155
changelog:
  - Create new interface: glusterd_read_lib_files()
  - Allow ganesha read glusterd lib files.
  - Allow ganesha read network sysctls
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-156
changelog:
  - Add new boolean virt_use_glusterd
  Resolves: rhbz#1455994
  - Add capability sys_boot for sbd_t domain
  - Allow sbd_t domain to create rpc sysctls.
  Resolves: rhbz#1455631
  - Allow ganesha_t domain to manage glusterd_var_run_t pid files.
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-157
changelog:
  - Allow tomcat to connect on all unreserved ports
  - Allow ganesha to connect to all rpc ports
  Resolves: rhbz#1448090
  - Update ganesha with another fixes.
  Resolves: rhbz#1448090
  - Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
  Resolves: rhbz#1448090
  - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files
  Resolves: rhbz#1448090
  - Hide broken symptoms when machine is configured with network bounding.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-158
changelog:
  - Allow iscsi domain load kernel module.
  Resolves: rhbz#1457874
  - Allow keepalived domain connect to squid tcp port
  Resolves: rhbz#1457455
  - Allow krb5kdc_t domain read realmd lib files.
  Resolves: rhbz#1436689
  - xdm_t should view kernel keys
  Resolves: rhbz#1432645


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-160
changelog:
  - Allow named_t to bind on udp 4321 port
  Resolves: rhbz#1312972
  - Allow systemd-sysctl cap. sys_ptrace
  Resolves: rhbz#1458999


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-163
changelog:
  - Allow sssd_t to read realmd lib files.
  Resolves: rhbz#1436689
  - Add permission open to files_read_inherited_tmp_files() interface
  Resolves: rhbz#1290633
  Resolves: rhbz#1457106


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-170
changelog:
  - Add few rules to make working targetd daemon with SELinux
  Resolves: rhbz#1373860
  - Allow ipmievd_t domain to load kernel modules
  Resolves: rhbz#1441081
  - Allow logrotate to reload transient systemd unit
  Resolves: rhbz#1440515
  - Add certwatch_t domain dac_override and dac_read_search capabilities
  Resolves: rhbz#1422000
  - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
  Resolves: rhbz#1412072
  - Allow nscd_t domain to search network sysctls
  Resolves: rhbz#1432361
  - Allow iscsid_t domain to read mount pid files
  Resolves: rhbz#1482097
  - Allow ksmtuned_t domain manage sysfs_t files/dirs
  Resolves: rhbz#1413865
  - Allow keepalived_t domain domtrans into iptables_t
  Resolves: rhbz#1477719
  - Allow rshd_t domain reads net sysctls
  Resolves: rhbz#1477908
  - Add interface seutil_dontaudit_read_module_store()
  - Update interface lvm_rw_pipes() by adding also open permission
  - Label /dev/clp device as vfio_device_t
  Resolves: rhbz#1477624
  - Allow ifconfig_t domain unmount fs_t
  Resolves: rhbz#1477445
  - Label /dev/gpiochip* devices as gpio_device_t
  Resolves: rhbz#1477618
  - Add interface  dev_manage_sysfs()
  Resolves: rhbz#1474989


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-171
changelog:
  - Allow targetd_t to create own tmp files.
  - Dontaudit targetd_t to exec rpm binary file.
  Resolves: rhbz#1373860
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-173
changelog:
  - Allow tomcat to setsched 
  Resolves: rhbz#1492730
  - Fix rules blocking ipa-server upgrade process
  Resolves: rhbz#1478371
  - Add new boolean tomcat_read_rpm_db()
  Resolves: rhbz#1477887
  - Allow tomcat to connect on mysqld tcp ports
  - Add ctdbd_t domain sys_source capability and allow setrlimit
  Resolves: rhbz#1491235
  - Fix keepalived SELinux module
  - Allow automount domain to manage mount pid files
  Resolves: rhbz#1482381
  - Allow stunnel_t domain setsched
  Resolves: rhbz#1479383
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1486638
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1484572
  - Remove snapperd_t from unconfined domaines
  Resolves: rhbz#1365555
  - Fix typo bug in apache module
  Resolves: rhbz#1397311
  - Dontaudit that system_mail_t is trying to read /root/ files
  Resolves: rhbz#1147945
  - Make working webadm_t userdomain
  Resolves: rhbz#1323792
  - Allow redis domain to execute shell scripts.
  Resolves: rhbz#1421326
  - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
  Resolves: rhbz#1473303
  - Add couple capabilities to keepalived domain and allow get attributes of all domains
  Resolves: rhbz#1429327
  - Allow dmidecode read rhsmcertd lock files
  Resolves: rhbz#1300799
  - Add new interface rhsmcertd_rw_lock_files()
  Resolves: rhbz#1300799
  - Label all plymouthd archives as plymouthd_var_log_t
  Resolves: rhbz#1478323
  - Allow cloud_init_t to dbus chat with systemd_timedated_t
  Resolves: rhbz#1440730
  - Allow logrotate_t to write to kmsg
  Resolves: rhbz#1397744
  - Add capability kill to rhsmcertd_t
  Resolves: rhbz#1398338
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464063
  - Allow winbind to manage smbd_tmp_t files
  Resolves: rhbz#1475566
  - Dontaudit that system_mail_t is trying to read /root/ files
  Resolves: rhbz#1147945
  - Make working webadm_t userdomain
  Resolves: rhbz#1323792
  - Allow redis domain to execute shell scripts.
  Resolves: rhbz#1421326
  - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
  Resolves: rhbz#1473303
  - Add couple capabilities to keepalived domain and allow get attributes of all domains
  Resolves: rhbz#1429327
  - Allow dmidecode read rhsmcertd lock files
  Resolves: rhbz#1300799
  - Add new interface rhsmcertd_rw_lock_files()
  Resolves: rhbz#1300799
  - Label all plymouthd archives as plymouthd_var_log_t
  Resolves: rhbz#1478323 
  - Allow cloud_init_t to dbus chat with systemd_timedated_t
  Resolves: rhbz#1440730
  - Allow logrotate_t to write to kmsg
  Resolves: rhbz#1397744
  - Add capability kill to rhsmcertd_t
  Resolves: rhbz#1398338
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464063
  - Allow winbind to manage smbd_tmp_t files
  Resolves: rhbz#1475566
  - Add interface systemd_tmpfiles_run
  - End of file cannot be in comment
  - Allow systemd-logind to use ypbind
  Resolves: rhbz#1479350
  - Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface
  Resolves: rhbz#1412838
  - Allow sysctl_irq_t assciate with proc_t
  Resolves: rhbz#1485909
  - Enable cgourp sec labeling
  Resolves: rhbz#1485947
  - Add cgroup_seclabel policycap.
  Resolves: rhbz#1485947
  - Allow sshd_t domain to send signull to xdm_t processes
  Resolves: rhbz#1448959
  - Allow updpwd_t domain auth file name trans
  Resolves: rhbz#1412838
  - Allow sysadm user to run systemd-tmpfiles
  Resolves: rbhz#1325364
  - Add support labeling for vmci and vsock device
  Resolves: rhbz#1451358
  - Add userdom_dontaudit_manage_admin_files() interface
  Resolves: rhbz#1323792
  - Allow iptables_t domain to read files with modules_conf_t label
  Resolves: rhbz#1373220
  - init: Add NoNewPerms support for systemd.
  Resolves: rhbz#1480518
  - Add nnp_nosuid_transition policycap and related class/perm definitions.
  Resolves: rhbz#1480518
  - refpolicy: Infiniband pkeys and endports
  Resolves: rhbz#1464484


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-174
changelog:
  - We should not ship selinux-policy with permissivedomains enabled.
  Resolves: rhbz#1494172
  - Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox
  Resolves: rhbz#1492606


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-175
changelog:
  - Allow pegasus_openlmi_services_t to read generic certs
  Resolves: rhbz#1462292
  - Allow ganesha_t domain to read random device
  Resolves: rhbz#1494382
  - Allow zabbix_t domain to change its resource limits
  Resolves: rhbz:#1504074
  - Add new boolean nagios_use_nfs
  Resolves: rhbz#1504826
  - Allow system_mail_t to search network sysctls
  Resolves: rhbz#1505779
  - Add samba_manage_var_dirs() interface
  - Fix typo bug in virt filecontext file
  - Allow nagios_script_t to read nagios_spool_t files
  Resolves: rhbz#1426824
  - Allow samba to manage var dirs/files
  Resolves: rhbz#1415088
  - Allow sbd_t to create own sbd_tmpfs_t dirs/files
  Resolves: rhbz#1380795
  - Allow firewalld and networkmanager to chat with hypervkvp via dbus
  Resolves: rhbz#1377276
  - Allow dmidecode to read rhsmcert_log_t files
  Resolves: rhbz#1300799
  - Allow mail system to connect mariadb sockets.
  Resolves: rhbz#1368642
  - Allow logrotate_t to change passwd and reloead services
  Resolves: rhbz#1450789
  - Allow mail system to connect mariadb sockets.
  Resolves: rhbz#1368642
  - Allow logrotate_t to change passwd and reloead services
  Resolves: rhbz#1450789
  - Allow pegasus_openlmi_services_t to read generic certs
  Resolves: rhbz#1462292
  - Allow ganesha_t domain to read random device
  Resolves: rhbz#1494382
  - Allow zabbix_t domain to change its resource limits
  Resolves: rhbz:#1504074
  - Add new boolean nagios_use_nfs
  Resolves: rhbz#1504826
  - Allow system_mail_t to search network sysctls
  Resolves: rhbz#1505779
  - Add samba_manage_var_dirs() interface
  - Fix typo bug in virt filecontext file
  - Allow nagios_script_t to read nagios_spool_t files
  Resolves: rhbz#1426824
  - Allow samba to manage var dirs/files
  Resolves: rhbz#1415088
  - Allow sbd_t to create own sbd_tmpfs_t dirs/files
  Resolves: rhbz#1380795
  - Allow firewalld and networkmanager to chat with hypervkvp via dbus
  Resolves: rhbz#1377276
  - Allow dmidecode to read rhsmcert_log_t files
  Resolves: rhbz#1300799
  - Allow mail system to connect mariadb sockets.
  Resolves: rhbz#1368642
  - Allow logrotate_t to change passwd and reloead services
  Resolves: rhbz#1450789
  - Allow chronyd_t do request kernel module and block_suspend capability
  Resolves: rhbz#1350765
  - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label
  Resolves: rhbz#1447278
  - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables
  Resolves: rhbz#1491994
  - Allow svnserve to use kerberos
  Resolves: rhbz#1475271
  - Allow conman to use ptmx. Add conman_use_nfs boolean
  Resolves: rhbz#1377915
  - Add nnp transition for services using: NoNewPrivileges systemd security feature
  Resolves: rhbz#1311430
  - Add SELinux support for chronyc
  Resolves: rhbz#1470150
  - Add dac_read_search capability to openvswitch_t domain
  Resolves: rhbz#1501336
  - Allow svnserve to manage own svnserve_log_t files/dirs
  Resolves: rhbz#1480741
  - Allow keepalived_t to search network sysctls
  Resolves: rhbz#1477542
  - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain
  Resolves: rhbz#1446777
  - Add dccp_socket into socker_class_set subset
  Resolves: rhbz#1459941
  - Allow iptables_t to run setfiles to restore context on system
  Resolves: rhbz#1489118
  - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t
  Resolves: rhbz:#1411400
  - Make nnp transition Active
  Resolves: rhbz#1480518
  - Label tcp 51954 as isns_port_t
  Resolves: rhbz#1390208
  - Add dac_read_search capability chkpwd_t
  Resolves: rhbz#1376991
  - Add support for running certbot(letsencrypt) in crontab
  Resolves: rhbz#1447278
  - Add init_nnp_daemon_domain interface
  - Allow xdm_t to gettattr /dev/loop-control device
  Resolves: rhbz#1462925
  - Allow nnp trasintion for unconfined_service_t
  Resolves: rhbz#1311430
  - Allow unpriv user domains and unconfined_service_t to use chronyc
  Resolves: rhbz#1470150
  - Allow iptables to exec plymouth.
  Resolves: rhbz#1480374
  - Fix typo in fs_unmount_tracefs interface.
  Resolves: rhbz#1371057
  - Label postgresql-check-db-dir as postgresql_exec_t
  Resolves: rhbz#1490956


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-176
changelog:
  - Allow chronyc_t domain to use user_ptys
  Resolves: rhbz#1470150
  - allow ptp4l to read /proc/net/unix file
  - Allow conmand to use usb ttys.
  Resolves: rhbz#1505121
  - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst
  Resolves: rhbz#1505845
  - Allow chronyd daemon to execute chronyc.
  Resolves: rhbz#1508486
  - Allow firewalld exec ldconfig.
  Resolves: rhbz#1375576
  - Allow mozilla_plugin_t domain to dbus chat with devicekit
  Resolves: rhbz#1460477
  - Dontaudit leaked logwatch pipes
  Resolves: rhbz#1450119
  - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon.
  Resolves: rhbz#1507048
  - Allow httpd_t domain to execute hugetlbfs_t files
  Resolves: rhbz#1507682
  - Allow nfsd_t domain to read configfs_t files/dirs
  Resolves: rhbz#1439442
  - Hide all allow rules with ptrace inside deny_ptrace boolean
  Resolves: rhbz#1421075
  - Allow tgtd_t domain to read generic certs
  Resolves: rhbz#1438532
  - Allow ptp4l to send msgs via dgram socket to unprivileged user domains
  Resolves: rhbz#1429853
  - Allow dirsrv_snmp_t to use inherited user ptys and read system state
  Resolves: rhbz#1428568
  - Allow glusterd_t domain to create own tmpfs dirs/files
  Resolves: rhbz#1411310
  - Allow keepalived stream connect to snmp
  Resolves: rhbz#1401556
  - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
  Resolves: rhbz#1507089


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-177
changelog:
  - Allow jabber domains to connect to postgresql ports
  Resolves: rhbz#1438489
  - Dontaudit accountsd domain creating dirs in /root
  Resolves: rhbz#1456760 
  - Dontaudit slapd_t to block suspend system
  Resolves: rhbz: #1479759 
  - Allow spamc_t to stream connect to cyrus.
  Resolves: rhbz#1382955 
  - allow imapd to read /proc/net/unix file
  Resolves: rhbz#1393030 
  - Allow passenger to connect to mysqld_port_t
  Resolves: rhbz#1433464


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-178
changelog:
  - Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability
  Resolves: rhbz#1510145


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-179
changelog:
  - Allow ldap_t domain to manage also slapd_tmp_t lnk files
  Resolves: rhbz#1510883
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1508360
  - Add dac_read_search and dac_override capabilities to ganesha
  Resolves: rhbz#1483451


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-181
changelog:
  - Allow tomcat_t to manage pki_tomcat pid files
  Resolves: rhbz#1478371
  - networkmanager: allow talking to openvswitch
  Resolves: rhbz#1517247
  - Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs
  Resolves: rhbz#1517895
  - Allow domains networkmanager_t and opensm_t to control IPoIB VLANs
  Resolves: rhbz#1517744
  - Fix typo in guest interface file
  Resolves: rhbz#1468254
  - Allow isnsd_t domain to accept tcp connections.
  Resolves: rhbz#1390208


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-182
changelog:
  - Label /dev/drm_dp_aux* as xserver_misc_device_t
  Resolves: rhbz#1520897
  - Allow sysadm_t to run puppet_exec_t binaries as puppet_t
  Resolves: rhbz#1255745


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-184
changelog:
  - Allow chronyc_t domain to manage chronyd_keys_t files.
  Resolves: rhbz#1530525
  - Make virtlog_t domain system dbus client
  Resolves: rhbz#1481109
  - Update openvswitch SELinux module
  Resolves: rhbz#1482682
  - Allow virtd_t to create also sock_files with label virt_var_run_t
  Resolves: rhbz#1484075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-185
changelog:
  - Allow vmtools_t domain creating vmware_log_t files
  Resolves: rhbz#1507048
  - Allow openvswitch_t domain to acces infiniband devices
  Resolves: rhbz#1532705


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-186
changelog:
  - Allow virt_domains to acces infiniband pkeys.
  Resolves: rhbz#1533183
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  Resolves: rhbz#1535133
  - Allow audisp_remote_t domain write to files on all levels
  Resolves: rhbz#1534924


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  Resolves: rhbz#1535196
  - Add new interface ppp_filetrans_named_content()
  Resolves: rhbz#1530601
  - Allow keepalived_t read sysctl_net_t files
  Resolves: rhbz#1477542
  - Allow puppetmaster_t domtran to puppetagent_t
  Resolves: rhbz#1376893
  - Allow kdump_t domain to read kernel ring buffer
  Resolves: rhbz#1540004
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  Resolves: rhbz#1539416
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  Resolves: rhbz#1530601
  - Allow updpwd_t domain to create files in /etc with shadow_t label
  Resolves: rhbz#1412838
  - Allow iptables sysctl load list support with SELinux enforced
  Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
  - Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
  Resolves: rhbz#1540702
  - Allow keepalived_t domain getattr proc filesystem
  Resolves: rhbz#1477542
  - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
  Resolves: rhbz#1538544
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
  Resolves: rhbz:#1539416
  - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
  Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
  - Allow dirsrv_t domain to create tmp link files
  Resolves: rhbz#1536011
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  Resolves: rhbz#1428568
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
  - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  Resolves: rhbz#1540702
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
  Resolves: rhbz#1546721


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-193
changelog:
  - Backport several changes for snapperdfrom Fedora Rawhide
  Resolves: rhbz#1556798
  - Allow snapperd_t to set priority for kernel processes
  Resolves: rhbz#1556798
  - Make ganesha nfs server.
  Resolves: rhbz#1511489
  - Allow vxfs filesystem to use SELinux labels
  Resolves: rhbz#1482880
  - Add map permission to selinux-policy
  Resolves: rhbz#1460322


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-194
changelog:
  - Add new boolean redis_enable_notify()
  Resolves: rhbz#1421326
  - Label  /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t
  Resolves: rhbz#1549514
  - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/
  Resolves: rbhz#1463593
  - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t
  Resolves: rbhz#1463593


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-195
changelog:
  - Rename tang policy to tangd
  - Allow virtd_t domain to relabel virt_var_lib_t files 
  Resolves: rhbz#1558121
  - Allow logrotate_t domain to stop services via systemd
  Resolves: rhbz#1527522
  - Add tang policy
  Resolves: rhbz#1509055
  - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t
  Resolves: rhbz#1559859
  - Improve snapperd SELinux policy
  Resolves: rhbz#1365555
  - Allow snapperd_t daemon to create unlabeled dirs.
  Resolves: rhbz#1365555
  - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence
  Resolves: rhbz#1271324
  - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP
  Resolves: rhbz#1503835
  - Add new Boolean tomcat_use_execmem
  Resolves: rhbz#1565226
  - Allow domain transition from logrotate_t to chronyc_t
  Resolves: rhbz#1568281
  - Allow nfsd_t domain to read/write sysctl fs files
  Resolves: rhbz#1516593
  - Allow conman to read system state
  Resolves: rhbz#1377915
  - Allow lircd_t to exec shell and add capabilities dac_read_search and dac_override
  Resolves: rhbz#1550700
  - Allow usbmuxd to access /run/udev/data/+usb:*.
  Resolves: rhbz#1521054
  - Allow abrt_t domain to manage kdump crash files 
  Resolves: rhbz#1491585
  - Allow systemd to use virtio console
  Resolves: rhbz#1558121
  - Allow transition from sysadm role into mdadm_t domain.
  Resolves: rhbz#1551568
  - Label /dev/op_panel and /dev/opal-prd as opal_device_t
  Resolves: rhbz#1537618
  - Label /run/ebtables.lock as iptables_var_run_t
  Resolves: rhbz#1511437
  - Allow udev_t domain to manage udev_rules_t char files.
  Resolves: rhbz#1545094
  - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin.
  Resolves: rhbz#1567753
  - Fix filesystem inteface file, we don't have nsfs_fs_t type, just nsfs_t
  Resolves: rhbz#1547700
  - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-196
changelog:
  - Add dbus_stream_connect_system_dbusd() interface.
  - Allow pegasus_t domain to mount tracefs_t filesystem
  Resolves:rhbz#1374570
  - Allow psad_t domain to read all domains state
  Resolves: rhbz#1558439
  - Add net_raw capability to named_t domain BZ(1545586)
  - Allow tomcat_t domain to connect to mongod_t tcp port
  Resolves:rhbz#1539748
  - Allow dovecot and postfix to connect to systemd stream sockets
  Resolves: rhbz#1368642
  - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t
  Resolves:rhbz#1351750
  - Rename tang policy to tangd
  - Add interface systemd_rfkill_domtrans()
  - Allow users staff and sysadm to run wireshark on own domain
  Resolves:rhbz#1546362
  - Allow systemd-bootchart to create own tmpfs files
  Resolves:rhbz#1510412


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-197
changelog:
  - Improve procmail_domtrans() to allow mmaping procmail_exec_t
  - Allow hypervvssd_t domain to read fixed disk devices
  Resolves: rhbz#1581225
  - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries
  Resolves: rhbz#1581551
  - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary
  Resolves: rhbz#1581551
  - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries
  Resolves: rhbz#1581551
  - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries.
  Resolves: rhbz#1581551
  - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-199
changelog:
  - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db  is turned on
  Resolves: rhbz:#1579219
  - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp
  Resolves: rhbz#1574418
  - Allow chrome_sandbox_t to mmap tmp files
  Resolves: rhbz#1574392
  - Allow ulogd_t to create netlink_netfilter sockets.
  Resolves: rhbz#1575924
  - Update ulogd SELinux security policy
  - Allow rhsmcertd_t domain send signull to apache processes
  Resolves: rhbz#1576555
  - Allow freeipmi domain to read sysfs_t files
  Resolves: rhbz#1575918
  - Allow smbcontrol_t to create dirs with samba_var_t label
  Resolves: rhbz#1574521
  - Allow swnserve_t domain to stream connect to sasl domain
  Resolves: rhbz#1574537
  - Fix typo in sysnetwork.if file
  Resolves: rhbz#1581551


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-202
changelog:
  - Update ctdb domain to support gNFS setup 
  Resolves: rhbz#1576818
  - Allow authconfig_t dbus chat with policykit
  Resolves: rhbz#1551241
  - Allow lircd_t domain to read passwd_file_t
  Resolves: rhbz:#1550700
  - Allow lircd_t domain to read system state
  Resolves: rhbz#1550700
  - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795)
  Resolves: rhbz#1574521
  - Allow tangd_t domain read certs
  Resolves: rhbz#1509055
  - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db  is turned on
  Resolves: rhbz:#1579219
  - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp
  Resolves: rhbz#1574418
  - Allow ctdb_t domain modify ctdb_exec_t files
  Resolves: rhbz#1572584
  - Allow chrome_sandbox_t to mmap tmp files
  Resolves: rhbz#1574392
  - Allow ulogd_t to create netlink_netfilter sockets.
  Resolves: rhbz#1575924
  - Update ulogd SELinux security policy
  - Allow rhsmcertd_t domain send signull to apache processes
  Resolves: rhbz#1576555
  - Allow freeipmi domain to read sysfs_t files
  Resolves: rhbz#1575918
  - Allow smbcontrol_t to create dirs with samba_var_t label
  Resolves: rhbz#1574521
  - Allow swnserve_t domain to stream connect to sasl domain
  Resolves: rhbz#1574537
  - Allow SELinux users (except guest and xguest) to using bluetooth sockets
  Resolves: rhbz#1557299
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557299
  - Fix broken sysadm SELinux module
  Resolves: rhbz#1557311
  - Allow user_t and staff_t domains create netlink tcpdiag sockets
  Resolves: rhbz#1557281
  - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file
  Resolves: rhbz#1583089
  - Allow systemd_networkd_t to read/write tun tap devices
  Resolves: rhbz#1583830
  - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set
  Resolves: rhbz#1583771
  - Allow audisp_t domain to mmap audisp_exec_t binary
  Resolves: rhbz#1583551
  - Fix duplicates in sysadm.te file
  Resolves: rhbz#1307183
  - Allow sysadm_u use xdm
  Resolves: rhbz#1307183
  - Fix typo in sysnetwork.if file
  Resolves: rhbz#1581551


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-203
changelog:
  - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type
  - Allow dac override capability to mandb_t domain BZ(1529399)
  Resolves: rhbz#1423361
  - Allow inetd_child process to chat via dbus with abrt
  Resolves: rhbz#1428805
  - Allow zabbix_agent_t domain to connect to redis_port_t
  Resolves: rhbz#1418860
  - Allow rhsmcertd_t domain to read xenfs_t files
  Resolves: rhbz#1405870
  - Allow zabbix_agent_t to run zabbix scripts
  Resolves: rhbz#1380697
  - Allow rabbitmq_t domain to create own tmp files/dirs
  Resolves: rhbz#1546897
  - Allow policykit_t mmap policykit_auth_exec_t files
  Resolves: rhbz#1583082
  - Allow ipmievd_t domain to read general certs
  Resolves: rhbz#1514591
  - Add sys_ptrace capability to pcp_pmie_t domain
  - Allow squid domain to exec ldconfig
  Resolves: rhbz#1532017
  - Make working gpg agent in gpg_agent_t domain
  Resolves: rhbz#1535109
  - Update gpg SELinux policy module
  - Allow kexec to read kernel module files in /usr/lib/modules.
  Resolves: rhbz#1536690
  - Allow mailman_domain to read system network state
  Resolves: rhbz#1413510
  - Allow mailman_mail_t domain to search for apache configs
  Resolves: rhbz#1413510
  - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices
  Resolves: rhbz#1499208
  - Allow antivirus_domain to read all domain system state
  Resolves: rhbz#1560986
  - Allow targetd_t domain to red gconf_home_t files/dirs
  Resolves: rhbz#1546671
  - Allow freeipmi domain to map sysfs_t files
  Resolves: rhbz#1575918
  - Label /usr/libexec/bluetooth/obexd as obexd_exec_t
  Resolves: rhbz#1351750
  - Update rhcs SELinux module
  Resolves: rhbz#1589257
  - Allow iscsid_t domain mmap kernel modules
  Resolves: rhbz#1589295
  - Allow iscsid_t domain mmap own tmp files
  Resolves: rhbz#1589295
  - Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binary
  Resolves: rhbz#1589295
  - Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files.
  Resolves: rhbz#1589271
  - Allow nscd_t domain to mmap system_db_t files
  Resolves: rhbz#1589271
  - Add interface nagios_unconfined_signull()
  - Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domain
  Resolves: rhbz#1550700
  - Add missing requires
  - Allow tomcat domain sends email
  Resolves: rhbz#1585184
  - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867)
  Resolves: rhbz#1585714
  - Allow kdump_t domain to map /boot files
  Resolves: rhbz#1588884
  - Fix typo in netutils policy
  - Allow confined users get AFS tokens
  Resolves: rhbz#1417671
  - Allow sysadm_t domain to chat via dbus
  Resolves: rhbz#1582146
  - Associate sysctl_kernel_t type with filesystem attribute
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557299
  - Allow user_t and staff_t domains create netlink tcpdiag sockets
  Resolves: rhbz#1557281
  - Add interface dev_map_sysfs
  - Allow xdm_t domain to execute xdm_var_lib_t files
  Resolves: rhbz#1589139
  - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t
  Resolves: rhbz#1569344
  - Label /dev/vhost-vsock char device as vhost_device_t
  - Add files_map_boot_files() interface
  Resolves: rhbz#1588884
  - Update traceroute_t domain to allow create dccp sockets
  Resolves: rhbz#1548350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-204
changelog:
  - Fix typo in logwatch interface file
  - Allow spamd_t to manage logwatch_cache_t files/dirs
  - Allow dnsmasw_t domain to create own tmp files and manage mnt files
  - Allow fail2ban_client_t to inherit rlimit information from parent process
  Resolves: rhbz#1513100
  - Allow nscd_t to read kernel sysctls
  Resolves: rhbz#1512852
  - Label /var/log/conman.d as conman_log_t
  Resolves: rhbz#1538363
  - Add dac_override capability to tor_t domain
  Resolves: rhbz#1540711
  - Allow certmonger_t to readwrite to user_tmp_t dirs
  Resolves: rhbz#1543382
  - Allow abrt_upload_watch_t domain to read general certs
  Resolves: rhbz#1545098
  - Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binary
  Resolves: rhbz#1583087
  - Allow postfix_domain to mmap postfix_qmgr_exec_t binaries
  Resolves: rhbz#1583088
  - Allow postfix_domain to mmap postfix_pickup_exec_t binaries
  Resolves: rhbz#1583091
  - Allow chornyd_t read phc2sys_t shared memory
  Resolves: rhbz#1578883
  - Allow virt_qemu_ga_t read utmp
  Resolves: rhbz#1571202
  - Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files
  - Add setgid and setuid capabilities to mysqlfd_safe_t domain
  Resolves: rhbz#1474440
  - Add tomcat_can_network_connect_db boolean
  Resolves: rhbz#1477948
  - Update virt_use_sanlock() boolean to read sanlock state
  Resolves: rhbz#1448799
  - Add sanlock_read_state() interface
  - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026)
  Resolves: rhbz#1563423
  - Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary file
  Resolves:rhbz#1583080
  - Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binaries
  Resolves: rhbz#1583086
  - Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t file
  Resolves: rhbz#1583802
  - Allow zoneminder_t to getattr of fs_t
  Resolves: rhbz#1585328
  - Fix denials during ipa-server-install process on F27+
  Resolves: rhbz#1586029
  - Allow ipa_dnskey_t to exec ipa_dnskey_exec_t files
  Resolves: rhbz#1586033
  - Allow rhsmcertd_t domain to send signull to postgresql_t domain
  Resolves: rhbz#1588119
  - Allow policykit_t domain to dbus chat with dhcpc_t
  Resolves: rhbz#1364513
  - Adding new boolean keepalived_connect_any()
  Resolves: rhbz#1443473
  - Allow amanda to create own amanda_tmpfs_t files
  Resolves: rhbz#1452444
  - Add amanda_tmpfs_t label. BZ(1243752)
  - Allow gdomap_t domain to connect to qdomap_port_t
  Resolves: rhbz#1551944
  - Fix typos in sge
  - Fix typo in openvswitch policy
  - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type
  - Allow sshd_keygen_t to execute plymouthd
  Resolves: rhbz#1583531
  - Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binary
  Resolves: rhbz#1583090
  - Allow systemd_networkd_t create and relabel tun sockets
  Resolves: rhbz#1583830
  - Allow map audisp_exec_t files fordomains executing this binary
  Resolves: rhbz#1586042
  - Add new interface postgresql_signull()
  - Add fs_read_xenfs_files() interface.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-205
changelog:
  - Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t 
  Resolves: rhbz#1591191
  - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label
  Resolves: rhbz#1452595
  - Allow abrt_t domain to write to rhsmcertd pid files
  Resolves: rhbz#1492059
  - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control
  Resolves: rhbz#1463470
  - Add vhostmd_t domain to read/write to svirt images
  Resolves: rhbz#1465276
  - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets
  Resolves: rhbz#1460715
  - Update openvswitch policy
  Resolves: rhbz#1594729
  - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files
  Resolves: rhbz#1583084
  - Allow sssd_t and slpad_t domains to mmap generic certs
  Resolves: rhbz#1592016
  Resolves: rhbz#1592019
  - Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t files
  Resolves: rhbz#1592022
  - Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameter
  Resolves: rhbz#1583080
  - Allow chronyc_t domain use inherited user ttys
  Resolves: rhbz#1593267
  - Allow stapserver_t domain to mmap own tmp files
  Resolves: rhbz#1593122
  - Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_t
  Resolves: rhbz#1592026
  - Update policy for ypserv_t domain
  Resolves: rhbz#1592032
  - Allow abrt_dump_oops_t domain to mmap all non security files
  Resolves: rhbz#1593728
  - Allow svirt_t domain mmap svirt_image_t files
  Resolves: rhbz#1592688
  - Allow virtlogd_t domain to write inhibit systemd pipes.
  Resolves: rhbz#1593740
  - Allow sysadm_t and staff_t domains to use sudo io logging
  Resolves: rhbz#1564470
  - Allow sysadm_t domain create sctp sockets
  Resolves: rhbz#1571591
  - Update mount_domtrans() interface to allow caller domain mmap mount_exec_t
  Resolves: rhbz#1592025
  - Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_t
  Resolves: rhbz#1594661


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-206
changelog:
  - Allow tangd_t domain to create tcp sockets
  Resolves: rhbz#1595775
  - Update postfix policy to allow postfix_master_t domain to mmap all postfix* binaries
  Resolves: rhbz#1595328
  - Allow amanda_t domain to have setgid capability
  Resolves: rhbz#1452444
  - Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t files
  Resolves: rhbz#1595667


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-207
changelog:
  - Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t files
  Resolves: rhbz#1596306
  - Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t files
  Resolves: rhbz#1589257
  - Allow radiusd_t domain to read network sysctls
  Resolves: rhbz#1516233
  - Allow chronyc_t domain to use nscd shm
  Resolves: rhbz#1596563
  - Label /var/lib/tomcats dir as tomcat_var_lib_t
  Resolves: rhbz#1596367
  - Allow lsmd_t domain to mmap lsmd_plugin_exec_t files
  Resolves: rhbz#bea0c8174
  - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t
  Resolves: rhbz#1596509
  - Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t files
  Resolves: rhbz#1596072
  - Allow xdm_t to read systemd hwdb
  Resolves: rhbz#1596720
  - Allow dhcpc_t domain to mmap files labeled as ping_exec_t
  Resolves: rhbz#1596065


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-208
changelog:
  - Dontaudit oracleasm_t domain to request sys_admin capability
  - Allow iscsid_t domain to load kernel module
  Resolves: rhbz#1589295
  - Update rhcs contexts to reflects the latest fenced changes
  - Allow httpd_t domain to rw user_tmp_t files
  Resolves: rhbz#1608355
  - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t
  Resolves: rhbz#1521063
  - Allow tangd_t dac_read_search
  Resolves: rhbz#1607810
  - Allow glusterd_t domain to mmap user_tmp_t files
  - Allow mongodb_t domain to mmap own var_lib_t files
  Resolves: rhbz#1607729
  - Allow iscsid_t domain to mmap sysfs_t files
  Resolves: rhbz#1602508
  - Allow tomcat_domain to search cgroup dirs
  Resolves: rhbz#1600188
  - Allow httpd_t domain to mmap own cache files
  Resolves: rhbz#1603505
  - Allow cupsd_t domain to mmap cupsd_etc_t files
  Resolves: rhbz#1599694
  - Allow kadmind_t domain to mmap krb5kdc_principal_t
  Resolves: rhbz#1601004
  - Allow virtlogd_t domain to read virt_etc_t link files
  Resolves: rhbz#1598593
  - Allow dirsrv_t domain to read crack db
  Resolves: rhbz#1599726
  - Dontaudit pegasus_t to require sys_admin capability
  Resolves: rhbz#1374570
  - Allow mysqld_t domain to exec mysqld_exec_t binary files
  - Allow abrt_t odmain to read rhsmcertd lib files
  Resolves: rhbz#1601389
  - Allow winbind_t domain to request kernel module loads
  Resolves: rhbz#1599236
  - Allow gpsd_t domain to getsession and mmap own tmpfs files
  Resolves: rhbz#1598388
  - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791)
  Resolves: rhbz#1600157
  - Allow tomcat_domain to read cgroup_t files
  Resolves: rhbz#1601151
  - Allow varnishlog_t domain to mmap varnishd_var_lib_t files
  Resolves: rhbz#1600704
  - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)
  Resolves: rhbz#1600692
  - Fix ntp SELinux module
  - Allow innd_t domain to mmap news_spool_t files
  Resolves: rhbz#1600591
  - Allow haproxy daemon to reexec itself. BZ(1447800)
  Resolves: rhbz#1600578
  - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t
  Resolves: rhbz#1559859
  - Allow pkcs_slotd_t domain to mmap own tmpfs files
  Resolves: rhbz#1600434
  - Allow fenced_t domain to reboot
  Resolves: rhbz#1293384
  - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247)
  Resolves: rhbz#1557299
  - Allow lircd to use nsswitch. BZ(1401375)
  - Allow targetd_t domain mmap lvm config files
  Resolves: rhbz#1546671
  - Allow amanda_t domain to read network system state
  Resolves: rhbz#1452444
  - Allow abrt_t domain to read rhsmcertd logs
  Resolves: rhbz#1492059
  - Allow application_domain_type also mmap inherited user temp files BZ(1552765)
  Resolves: rhbz#1608421
  - Allow ipsec_t domain to read l2tpd pid files
  Resolves: rhbz#1607994
  - Allow systemd_tmpfiles_t do mmap system db files
  - Improve domain_transition_pattern to allow mmap entrypoint bin file.
  Resolves: rhbz#1460322
  - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655)
  Resolves: rhbz#1600528
  - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled
  Resolves: rhbz#1601928
  - Allow ipsec_t can exec ipsec_exec_t
  Resolves: rhbz#1600684
  - Allow netutils_t domain to mmap usmmon device
  Resolves: rhbz#1600586
  - Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655)
  - Allow userdomain sudo domains to use generic ptys
  Resolves: rhbz#1564470
  - Allow traceroute to create icmp packets
  Resolves: rhbz#1548350
  - Allow systemd domain to mmap lvm config files BZ(1594584)
  - Add new interface lvm_map_config
  - refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-209
changelog:
  - Allow sblim_sfcbd_t domain to mmap own tmpfs files
  Resolves: rhbz#1609384
  - Update logging_manage_all_logs() interface to allow caller domain map all logfiles
  Resolves: rhbz#1592028


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-211
changelog:
  - Allow innd_t domain to mmap own var_lib_t files
  Resolves: rhbz#1600591
  - Update screen_role_temaplate interface
  Resolves: rhbz#1384769
  - Allow cupsd_t to create cupsd_etc_t dirs
  Resolves: rhbz#1452595
  - Allow chronyd_t domain to mmap own tmpfs files
  Resolves: rhbz#1596563
  - Allow cyrus domain to mmap own var_lib_t and var_run files
  Resolves: rhbz#1610374
  - Allow sysadm_t domain to create rawip sockets
  Resolves: rhbz#1571591
  - Allow sysadm_t domain to listen on socket
  Resolves: rhbz#1557299
  - Update sudo_role_template() to allow caller domain also setattr generic ptys
  Resolves: rhbz#1564470
  - Allow netutils_t domain to create bluetooth sockets
  Resolves: rhbz#1600586


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-212
changelog:
  - Allow kpropd domain to exec itself
  Resolves: rhbz#1600705
  - Allow ipmievd_t to mmap kernel modules BZ(1552535)
  - Allow hsqldb_t domain to mmap own temp files
  Resolves: rhbz#1612143
  - Allow hsqldb_t domain to read cgroup files
  Resolves: rhbz#1612143
  - Allow rngd_t domain to read generic certs
  Resolves: rhbz#1612456
  - Allow innd_t domain to mmap own var_lib_t files
  Resolves: rhbz#1600591
  - Update screen_role_temaplate interface
  Resolves: rhbz#1384769
  - Allow cupsd_t to create cupsd_etc_t dirs
  Resolves: rhbz#1452595
  - Allow chronyd_t domain to mmap own tmpfs files
  Resolves: rhbz#1596563
  - Allow cyrus domain to mmap own var_lib_t and var_run files
  Resolves: rhbz#1610374
  - Allow sysadm_t domain to create rawip sockets
  Resolves: rhbz#1571591
  - Allow sysadm_t domain to listen on socket
  Resolves: rhbz#1557299
  - Update sudo_role_template() to allow caller domain also setattr generic ptys
  Resolves: rhbz#1564470
  - Allow netutils_t domain to create bluetooth sockets
  Resolves: rhbz#1600586


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-215
changelog:
  - Allow systemd_dbusd_t domain read/write to nvme devices
  Resolves: rhbz#1614236
  - Allow mysqld_safe_t do execute itself
  - Allow smbd_t domain to chat via dbus with avahi daemon
  Resolves: rhbz#1600157
  - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t
  Resolves: rhbz#1452595
  - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)
  Resolves: rhbz#1452444
  - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain
  Resolves: rhbz#1384769
  - Add alias httpd__script_t to _script_t to make sepolicy generate working
  Resolves: rhbz#1271324
  - Allow kprop_t domain to read network state
  Resolves: rhbz#1600705
  - Allow sysadm_t domain to accept socket
  Resolves: rhbz#1557299
  - Allow sshd_t domain to mmap user_tmp_t files
  Resolves: rhbz#1613437


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-216
changelog:
  - Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files
  Resolves: rhbz#1615342
  - Allow kdumpctl to write to files on all levels
  Resolves: rhbz#1615342
  - Fix typo in radius policy
  Resolves: rhbz#1619197
  - Allow httpd_t domain to mmap httpd_config_t files
  Resolves: rhbz#1615894
  - Add interface dbus_acquire_svc_system_dbusd()
  - Allow sanlock_t domain to connectto to unix_stream_socket
  Resolves: rhbz#1614965
  - Update nfsd_t policy because of ganesha features
  Resolves: rhbz#1511489
  - Allow conman to getattr devpts_t
  Resolves: rhbz#1377915
  - Allow tomcat_domain to connect to smtp ports
  Resolves: rhbz#1253502
  - Allow tomcat_t domain to mmap tomcat_var_lib_t files
  Resolves: rhbz#1618519
  - Allow slapd_t domain to mmap slapd_var_run_t files
  Resolves: rhbz#1615319
  - Allow nagios_t domain to mmap nagios_log_t files
  Resolves: rhbz#1618675
  - Allow nagios to exec itself and mmap nagios spool files BZ(1559683)
  - Allow nagios to mmap nagios config files BZ(1559683)
  - Allow kpropd_t domain to mmap krb5kdc_principal_t files
  Resolves: rhbz#1619252
  - Update syslogd policy to make working elasticsearch
  - Label tcp and udp ports 9200 as wap_wsp_port
  - Allow few domains to rw inherited kdumpctl tmp pipes
  Resolves: rhbz#1615342


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-218
changelog:
  - Allow kdumpctl_t domain to getattr fixed disk device in mls
  Resolves: rhbz#1615342
  - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry
  Resolves: rhbz#1615342


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-219
changelog:
  - Allow virtd_t domain to create netlink_socket
  - Allow rpm_t domain to write to audit
  - Allow rpm domain to mmap rpm_var_lib_t files
  Resolves: rhbz#1619785
  - Allow nagios_script_t domain to mmap nagios_etc_t files
  Resolves: rhbz#1620013
  - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t
  Resolves: rhbz#1460715
  - Allow secadm_t domain to mmap audit config and log files
  - Allow insmod_t domain to read iptables pid files
  - Allow systemd to mounton /etc
  Resolves: rhbz#1619785


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-220
changelog:
  - Allow nagios_script_t domain to mmap nagios_log_t files
  Resolves: rhbz#1620013
  - Allow nagios_script_t domain to mmap nagios_spool_t files
  Resolves: rhbz#1620013
  - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl
  Resolves: rhbz#1622197
  - Update selinux_validate_context() interface to allow caller domain to mmap security_t files
  Resolves: rhbz#1622061


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-221
changelog:
  - Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
  - Allow httpd_t domain to mmap tmp files
  Resolves: rhbz#1608355
  - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
  - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
  - Label /dev/tpmrm[0-9]* as tpm_device_t
  - Allow semanage_t domain mmap usr_t files
  Resolves: rhbz#1622607
  - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-223
changelog:
  - Make working SELinux sandbox with Wayland.
  Resolves: rhbz#1624308
  - Allow svirt_t domain to mmap svirt_image_t block files
  Resolves: rhbz#1624224
  - Add caps dac_read_search and dav_override to pesign_t domain
  - Allow iscsid_t domain to mmap userio chr files
  Resolves: rhbz#1623589
  - Add boolean: domain_can_mmap_files.
  Resolves: rhbz#1460322
  - Add execute_no_trans permission to mmap_exec_file_perms pattern
  - Allow sudodomain to search caller domain proc info
  - Allow xdm_t domain to mmap and read cert_t files
  - Replace optional policy blocks to make dbus interfaces effective
  Resolves: rhbz#1624414
  - Add interface dev_map_userio_dev()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-224
changelog:
  - Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
  Resolves: rhbz#1625678
  - Allow chronyd_t domain to read virt_var_lib_t files
  - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)
  Resolves: rhbz#1625613
  - Allow tomcat services create link file in /tmp
  Resolves: rhbz#1624289
  - Add boolean: domain_can_mmap_files.
  Resolves: rhbz#1460322


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-225
changelog:
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  Resolves: rhbz#1627114
  - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t
  Resolves: rhbz#1567753


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
  - Allow tomcat servers to manage usr_t files
  Resolves: rhbz#1625678
  - Dontaudit tomcat serves to append to /dev/random device
  Resolves: rhbz#1625678
  - Allow sys_nice capability to mysqld_t domain
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  Resolves: rhbz#1622602
  - Allow syslogd_t domain to manage cert_t files
  Resolves: rhbz#1615995


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Add interface apache_read_tmp_dirs()
  - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
  Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Allow tomcat_domain to read /dev/random
  Resolves: rhbz#1631666
  - Allow neutron_t domain to use pam
  Resolves: rhbz#1630318


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
  - Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
  - Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-230
changelog:
  -Allow nova_t domain to use pam
  Resolves: rhbz:#1640528
  - sysstat: grant sysstat_t the search_dir_perms set
  Resolves: rhbz#1637416
  - Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain
  Resolves: rhbz#1630318
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1564470
  - Make ganesha policy active again
  Resolves: rhbz#1511489


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
changelog:
  - Allow gssd_t domain to read/write kernel keyrings of every domain.
  Resolves: rhbz#1487350
  - Add interface domain_rw_all_domains_keyrings()
  Resolves: rhbz#1487350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-233
changelog:
  - Allow gssd_t domain to manage kernel keyrings of every domain.
  Resolves: rhbz#1487350
  - Add new interface domain_manage_all_domains_keyrings()
  Resolves: rhbz#1487350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-234
changelog:
  - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t
  Resolves: rhbz#1623942
  - Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_t
  Resolves: rhbz#1475271
  - Allow passwd_t domain chroot
  - Add miscfiles_filetrans_named_content_letsencrypt() to optional_block
  - Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_t
  Resolves: rhbz#1447278
  - Allow staff_t user to systemctl iptables units.
  Resolves: rhbz#1360470


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-235
changelog:
  - Allow sandbox_xserver_t domain write to user_tmp_t files
  Resolves: rhbz#1646521
  - Allow virt_qemu_ga_t domain to read network state
  Resolves: rhbz#1630347
  - Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipes
  Resolves: rhbz#1589086
  - Add boltd policy
  Resolves: rhbz#1589086
  - Allow virt domains to read/write cephfs filesystems
  Resolves: rhbz#1558836
  - Allow gpg_t to create own tmpfs dirs and sockets
  Resolves: rhbz#1535109
  - Allow gpg_agent_t to send msgs to syslog/journal
  Resolves: rhbz#1535109
  - Allow virtual machine to write to fixed_disk_device_t
  Resolves: rhbz#1499208
  - Update kdump_manage_crash() interface to allow also manage dirs by caller domain
  Resolves: rhbz#1491585
  - Add kpatch policy
  Resolves: rhbz#1602435
  - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t
  Resolves: rhbz#1623942
  - Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_t
  Resolves: rhbz#1475271
  - Allow systemd to mount boltd_var_run_t dirs
  Resolves: rhbz#1589086
  - Allow systemd to mounont boltd lib dirs
  Resolves: rhbz#1589086
  - Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domain
  Resolves: rhbz#1602435
  - Allow passwd_t domain chroot
  - Add miscfiles_filetrans_named_content_letsencrypt() to optional_block
  - Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_t
  Resolves: rhbz#1447278
  - Allow staff_t user to systemctl iptables units.
  Resolves: rhbz#1360470


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-236
changelog:
  - Update policy with multiple allow rules to make working installing VM in MLS policy
  Resolves: rhbz#1558121
  - Allow virt domain to use interited virtlogd domains fifo_file
  Resolves: rhbz#1558121
  - Allow chonyc_t domain to rw userdomain pipes
  Resolves: rhbz#1618757
  - Add file contexts in ganesha.fc file to label logging ganesha files properly.
  Resolves: rhbz#1628247


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237
changelog:
  - Allow virtd_lxc_t domains use BPF
  Resolves: rhbz#1626115
  - F29 NetworkManager implements a new code for IPv4 address conflict detection (RFC 5227) based on n-acd [1], which uses eBPF to process ARP packets from the network.
  Resolves: rhbz#1626115
  - Allow unconfined user all perms under bpf class BZ(1565738
  Resolves: rhbz#1626115
  - Allow unconfined and sysadm users to use bpftool BZ(1591440)
  Resolves: rhbz#1626115
  - Allow systemd to manage bpf dirs/files
  Resolves: rhbz#1626115
  - Create new type bpf_t and label /sys/fs/bpf with this type
  Resolves:rhbz#1626115
  - Add new interface init_prog_run_bpf()
  Resolves:rhbz#1626115
  - add definition of bpf class and systemd perms
  Resolves: rhbz#1626115


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238
changelog:
  - Update redis_enable_notify() boolean to fix sending e-mail by redis when this boolean is turned on
  Resolves: rhbz#1646765


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-239
changelog:
  - Allow sbd_t domain read/write all sysctls
  Resolves: rhbz#1671132
  - Allow kpatch_t domain to communicate with policykit_t domsin over dbus
  Resolves: rhbz#1602435
  - Allow boltd_t to stream connect to sytem dbus
  Resolves: rhbz#1589086
  - Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process.
  Resolves: rhbz#1589086


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-240
changelog:
  - named wants to access /proc/sys/net/ipv4/ip_local_port_range to get ehphemeral range.
  Resolves: rhbz#1683754
  - Allow sbd_t domain to bypass permission checks for sending signals
  Resolves: rhbz#1671132
  - Allow sbd_t domain read/write all sysctls
  Resolves: rhbz#1671132
  - Allow kpatch_t domain to communicate with policykit_t domsin over dbus
  Resolves: rhbz#1602435
  - Allow boltd_t to stream connect to sytem dbus
  Resolves: rhbz#1589086
  - Update userdom_admin_user_template() and init_prog_run_bpf() interfaces to make working bpftool for confined admin
  Resolves: rhbz#1626115
  - Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process.
  Resolves: rhbz#1589086


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-241
changelog:
  - Update vmtools policy Resolves: rhbz#1656814 Allow domain transition from vmtools_t to vmtools_unconfined_t when shell_exec_t is entrypoint.
  - Allow virt_qemu_ga_t domain to read udev_var_run_t files
  Resolves: rhbz#1663092
  - Update nagios_run_sudo boolean with few allow rules related to accessing sssd
  Resolves: rhbz#1653309
  - Allow nfsd_t to read nvme block devices BZ(1562554)
  Resolves: rhbz#1655493
  - Allow tangd_t domain to bind on tcp ports labeled as tangd_port_t
  Resolves: rhbz#1650909
  - Allow all domains to send dbus msgs to vmtools_unconfined_t processes
  Resolves: rhbz#1656814
  - Label /dev/pkey as crypt_device_t
  Resolves: rhbz#1623068
  - Allow sudodomains to write to systemd_logind_sessions_t pipes.
  Resolves: rhbz#1687452
  - Allow all user domains to read realmd_var_lib_t files and dirs to check if IPA is configured on the system
  Resolves: rhbz#1667962
  - Fixes: xenconsole does not start
  Resolves: rhbz#1601525
  - Label /usr/lib64/libcuda.so.XX.XX library as textrel_shlib_t.
  Resolves: rhbz#1636197
  - Create tangd_port_t with default label tcp/7406
  Resolves: rhbz#1650909


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-246
changelog:
  - Allow ngaios to use chown capability
  Resolves: rhbz#1653309
  - Dontaudit gpg_domain to create netlink_audit sockets
  Resolves: rhbz#1535109
  - Update fs_rw_cephfs_files() interface to allow also caller domain to read/write cephpfs_t lnk files
  Resolves: rhbz#1558836
  - Update domain_can_mmap_files() boolean to allow also mmap lnk files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247
changelog:
  - Fix typo in gpg SELinux module
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1535109
  - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on
  Resolves: rhbz#1653309
  - Allow nrpe_t domain to be dbus cliennt
  Resolves: rhbz#1653309
  - Add interface sssd_signull()
  Resolves: rhbz#1653309
  - Update userdomains to allow confined users to create gpg keys
  Resolves: rhbz#1535109


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Add interface systemd_logind_read_state()
  Resolves: rhbz#1653309


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-252.4
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1766095


author: Aurelien Degremont <aurelien.degremont@cea.fr> - 1.5-1.ocean1
changelog:
  - Add 2 patches from master branch
    > Fix error with tuning.conf handling
    > Improve return code handling


author: Dominique Martinet <dominique.martinet@cea.fr> - 1.5-2.ocean1.st1
changelog:
  - local st patches:
    > Start order: Always start MDT-0000 before other MDTs.
    > Dry-run: do not call set_status directly from _launch.
    > Lustre: add a --nounload option.
    > status: add option --no-ha to not check HA.
    > Status: disable mountdata check by default unless needed at display level.
    > Lustre.Target: make mountdata multiple choice.
    > Lustre start order: always start MDT before OST.


author: Thomas Leibovici <thomas.leibovici@cea.fr> - 1.5-2.ocean1.st2
changelog:
  - Add patch from master branch:
    > Lustre.Action.Fsck: ev_error workaround for ClusterShell 1.8.0
  - Local st patch:
    > Client.py: Enhance multimount of same FS


author: Dominique Martinet <dominique.martinet@cea.fr> - 1.5-12.g6f70505.ocean1
changelog:
  - Rebase to public commit v1.5-12-g6f70505
  - All unlanded patches listed below
  - New patch for lnet_conf option to behave like lnet.service
  - Update spec file to be rhel8 compatible (needs external python2-clustershell)


author: Dominique Martinet <dominique.martinet@cea.fr> - 1.5-12.g6f70505.ocean3
changelog:
  - Move script back to sbin
  - Rebased spec based on upstream spec
  - ... heavily modified to work on el8


author: - slurm-18.08.6.ocean1 - <regine.gaudin@cea.fr>
changelog:
  - Fix sacct -j start time bug: slurm-18.08.6-sacct-job-start-time.patch
  - Rebuild for Ocean2.7
  - Adapt slurm-17.11.5-hwloc_optimization.patch in task_cgroup_cpuset to slurm-18.08.6: slurm-18.08.6-hwloc_optimization.patch
  - Fix user_name intead of from_name in sender building slurm-18.08.4-mail-from-user-config.patch
  - Added freeipmi-devel and lua-devel as BuildRequires
  - Add pmix and multiple_slurmd in spec file be aware that ?with_multiple_slurm/pmixd is required and not ?_with_multiple_slurmd/pmix
    as bcond does not work properly
  - Adapt patches used in slurm-17.11.6 if needed for slurm-18.08.4:
    Adapt patch slurm-17.11.6-drain_on_uid_not_found_batch_and_interactive.patch to slurm-18.08.4: slurm-18.08.4-drain_on_uid_not_found_batch_and_interactive.patch
    Adapt patch slurm-17.11.6-avoid_set_slurmd_addr.patch to slurm-18.08.4: slurm-18.08.4-avoid_set_slurmd_addr.patch
    Adapt patch slurm-17.11.6-plugins-for-pam-slurm.patch to slurm-18.08.4: slurm-18.08.4-plugins-for-pam-slurm.patch
    Adapt patch slurm-17.11.6-mail-from-user.patch to slurm-18.08.4: slurm-18.08.4-mail-from-user.patch
    Adapt patch slurm-17.11.6-from-user-config.patch to slurm-18.08.4: slurm-18.08.4-mail-from-user-config.patch
    Adapt only last missing part of slurm-17.11.5_fix_dynamic_knl_feature_plugin.patch: slurm-18.08.4_fix_dynamic_knl_feature_plugin.patch
  - Add a patch to include jobid in message when writing thru logger daemon as it is done when writing in a logfile.
  - Add a patch to send mails with From:job_user@server in mail header
  - Add options in slurm configuration file to control that feature
  - Race condition on nodes list leads to segv of the controller while reconfigure : slurm-17.11.6-race_condition_route_topology.patch
    Add slurmctld epilog call when deadline jobs are encountered : slurm-17.11.6-deadline.epilog.patch
    Add batch jobs environnement variables in epilog controller for deadline jobs relaunch purpose : slurm-17.11.6-set_env_variables_in_epilog.patch
  - Bad parallelism management in pmi_server leading to resource contention and failure of srun
    with loop of multiple mpi monoprocesses.
    patch: slurm-17.11.6_pmi_server.patch
  - Compile with pmix-1.2.5 and pmix-2.1.4
  - Suppress double malloc in kvs_put from PMI2-KVS-data-structure-is-improved-by-using-xhash_t.patch
    Replaced PMI2-KVS-data-structure-is-improved-by-using-xhash_t.patch
    patch: PMI2-KVS-data-structure-is-improved-by-using-xhash_t_2.patch
  - Use hash implementation for PMI2 for improving performance
    patch. PMI2-KVS-data-structure-is-improved-by-using-xhash_t.patch
  - Remove protection on read/write
  - Protects read/write functions to PMIi_WriteSimpleCommand and PMIi_ReadCommand
   and adds mutex for thread-safety slurm-pmi2.patch
  - Unresolved slurmdb_conf symbol in plugins
    lead to dlopen plugings failure of pam_slurm preventing to be
    allowed to ssh to allocates nodes, so link plugind with slurmfull.so
    patch: slurm-17.11.1-plugins-for-pam-slurm.patch
  - Enable to set AVOID_SET_SLURMD_ADDR to avoid preloading slurmd addr
    at slurmctld startup and defer the loads while attempting connections
    patch: slurm-17.11.1-avoid_set_slurmd_addr.patch
  - Adapt patch slurm-17.11.0-0rc2_fix_dynamic_knl_feature_plugin.patch to 17.11.5
  - Drain nodes when uid/guid not found
  - Adapt patch slurm-17.11.0-hwloc_optimization.patch to 17.11.5
  - Restrict access to readonly db for coordinator


author: - slurm-18.08.6.ocean2 - <regine.gaudin@cea.fr>
changelog:
  - Fix --mail-user and MailFromDomain wrong appending : slurm-18.08.6-mail-from-user-config.patch
  - Fix sbcast jobpackid inconsistancy adding for protocol slurm.17 slurm-18.08.6-bug7080-sbcast-jobpackid.patch
  - Add debuginfo in slurm.spec


author: - slurm-18.08.6.ocean3 - <regine.gaudin@cea.fr>
changelog:
  - Avoid filling slurmctld log under-allocated message due to double deallocation of job's resources
    slurm-18.08.6-war-double-deallocation-job-resources.patch


author: - slurm-18.08.6.ocean4 - <regine.gaudin@cea.fr>
changelog:
  - Fix inappropriated maxsize check unpackmem size, valid for array but not mem : slurm-18.08.6_bugfix_maxsize_unpackmem.patch


author: - slurm-18.08.6.ocean5 - <regine.gaudin@cea.fr>
changelog:
  - Add patch from schedmd CVE-2019-19728.patch
  - Fix debug function scope too large via export from libslurmfull, makes app using debug call segv: slurm-18.08.6-debug-scope-too-large.patch
  - Backport patches for memory leak fixed in slurm19 : slurm-18.08.6-fix_memory_leak.patch
  - Add --with-libcurl for jobcomp/elasticsearch plugin generation


author: - slurm-18.08.6.ocean6 - <regine.gaudin@cea.fr>
changelog:
  - Add patch for large mpmd submission from 64K to 256K ranks : slurm-18.08.6-increase_max_ranks.patch
  - Fix typo in coordinator patch
  - Suppress two deadline patchs for memory leak as deadline no more used : slurm-17.11.6-deadline.epilog.patch and slurm-17.11.6-set_env_variables_in_epilog.patch


author: - slurm-18.08.6.ocean7 - <regine.gaudin@cea.fr>
changelog:
  - Add timeouts in elasticsearch plugin because of potential deadlock of slurmctld if http server is not responding : slurm-18.08.6-elasticsearch.patch


author: - slurm-18.08.6.ocean8 - <regine.gaudin@cea.fr>
changelog:
  - Fix race condition in route-topology leading to segfault of slurcmtld : slurm-18.08.6-fix-segfault-adding-slurmctldlock-route-topology.patch


author: - slurm-18.08.6.ocean9 - <regine.gaudin@cea.fr>
changelog:
  - Add null string for undefined job_desc.tres in jobsubmit.lua:  slurm-18.08.6-add-null-string-undefined-tres-jobsubmit-lua.patch


author: - slurm-18.08.6.ocean10 - <regine.gaudin@cea.fr>
changelog:
  - Add pam_slurm_adopt modifications for nice dcv : slurm-18.08.6-pam_slurm_adopt.patch
  - Add CVE provided by schedmd : cve-2020-27745.patch


author: - slurm-19.05.5-1.ocean3 - <aurelien.cedeyn@cea.fr>
changelog:
  - Fix sview deactivation at build time.
  - Fix %bcond options when invoking configure.
  - Fix pmix path.


author: - slurm-19.05.5-1.ocean6 - <regine.gaudin@cea.fr>
changelog:
  - Suppress partial sview desactivation as leading to gdb coredump on slurmstepd with debuginfo
  - Add 2 pmix versions to pmix path
  - Add null string for undefined job_desc.tres in jobsubmit.lua:  slurm-18.08.6-add-null-string-undefined-tres-jobsubmit-lua.patch
  - Fix race condition in route-topology leading to segfault of slurcmtld : slurm-18.08.6-fix-segfault-adding-slurmctldlock-route-topology.patch
  - Add pam_slurm_adopt modifications for nice dcv : slurm-18.08.6-pam_slurm_adopt.patch


author: - slurm-19.05.5-1.ocean7 - <regine.gaudin@cea.fr>
changelog:
  - Change info to debug msg filling log file with partial upgrade : sources/slurm-19.05.5-info-to-debug-msg-different-nodes-versions.patch


author: - slurm-19.05.5-1.ocean9 - <regine.gaudin@cea.fr>
changelog:
  - Apply improvement schedmd pmix algorithm slurm20 patches, increase +1 ocean version for slurm redhat8 version compatibility: 0002-PMIx-use-xstrfmtcatat-in-_set_mapsinfo.patch, 0001-PMIx-add-pmixp_count_digits_base10-utility-function.patch, 0002-PMIx-preallocate-the-map-buffer-space.patch, 0002-Change-default-SLURM_PMIX_TMPDIR-to-include-user-id.patch, 0002-PMIx-improve-process-map-parsing-algorithm.patch
  - reactivate _with_shared_libslurm configure as sstat fails with  error symbol lookup
  - prefer abort when no state files available rather than losing jobs : slurm-19.05.5-.abort-when-no-state-files.patch


author: - slurm-19.05.5-1.ocean10 - <regine.gaudin@cea.fr>
changelog:
  - Adapt schedmd cve : 0002-Adapt-cve-2021-31215.patch-for-slurm19.patch 
  - Define default shared_libslurm


author: - slurm-19.05.5-1.ocean11 - <regine.gaudin@cea.fr>
changelog:
  - Modify slurm-19.05.5-.abort-when-no-state-files.patch leading to fatal even when we start a new empty cluster, restrict to recover >0 only


author: Francois Diakhate <francois.diakhate@cea.fr> 0.24.1.ocean1
changelog:
  - fix partially uninitialized values in lua spank:get_item results
    patch: spank-plugins-lua-initialize-values.patch
  - add HAVE_SPANK_OPTION_GETOPT=1 for non-chaos systems (compiles with support for spank_option_getopt)
  - enable llnl and lua plugins on non-chaos systems


author: Francois Diakhate <francois.diakhate@cea.fr> 0.24.1.ocean2
changelog:
  - define _GNU_SOURCE to for compatibility with glibc >= 2.14
  - fix naming conflict with system headers


author: Regine Gaudin <regine.gaudin@cea.fr> - 0.24-1.ocean8
changelog:
  - Rebuild for Slurm 17.11.6
  - Suppress autoaffinity.c, not needed and conflicts type with slurm 17.11


author: Romain Fihue <romain.fihue@cea.fr> - 0.24-3.ocean2
changelog:
  - Fix LUA script environment setup. All scripts are now launched in separate envionment
    This may consume a bit more memory, but the old way is not working anymore
    in Lua > 5.2.


author: HAUTREUX Matthieu <matthieu.hautreux@cea.fr> - 0.2.5-1
changelog:
  - Correct a bug in --x11=first|last management, ensuring that only the
    targeted nodes performed X11 related actions


