# changelog

author: Zdenek Pytela <zpytela@redhat.com> - 37.2-1
changelog:
  - Use the networkmanager_dispatcher_plugin attribute in allow rules
  - Make a custom nm-dispatcher plugin transition
  - Label port 4784/tcp and 4784/udp with bfd_multi
  - Allow systemd watch and watch_reads user ptys
  - Allow sblim-gatherd the kill capability
  - Label more vdsm utils with virtd_exec_t
  - Add ksm service to ksmtuned
  - Add rhcd policy
  - Dontaudit guest attempts to dbus chat with systemd domains
  - Dontaudit guest attempts to dbus chat with system bus types
  - Use a named transition in systemd_hwdb_manage_config()
  - Add default fc specifications for patterns in /opt
  - Add the files_create_etc_files() interface
  - Allow nm-dispatcher console plugin create and write files in /etc
  - Allow nm-dispatcher console plugin transition to the setfiles domain
  - Allow more nm-dispatcher plugins append to init stream sockets
  - Allow nm-dispatcher tlp plugin dbus chat with nm
  - Reorder networkmanager_dispatcher_plugin_template() calls
  - Allow svirt connectto virtlogd
  - Allow blueman map its private memfd: files
  - Allow sysadm user execute init scripts with a transition
  - Allow sblim-sfcbd connect to sblim-reposd stream
  - Allow keepalived_unconfined_script_t dbus chat with init
  - Run restorecon with "-i" not to report errors


author: Zdenek Pytela <zpytela@redhat.com> - 37.3-1
changelog:
  - Allow nm-dispatcher custom plugin execute systemctl
  - Allow nm-dispatcher custom plugin dbus chat with nm
  - Allow nm-dispatcher custom plugin create and use udp socket
  - Allow nm-dispatcher custom plugin create and use netlink_route_socket
  - Use create_netlink_socket_perms in netlink_route_socket class permissions
  - Add support for nm-dispatcher sendmail scripts
  - Allow sslh net_admin capability
  - Allow insights-client manage gpg admin home content
  - Add the gpg_manage_admin_home_content() interface
  - Allow rhsmcertd create generic log files
  - Update logging_create_generic_logs() to use create_files_pattern()
  - Label /var/cache/insights with insights_client_cache_t
  - Allow insights-client search gconf homedir
  - Allow insights-client create and use unix_dgram_socket
  - Allow blueman execute its private memfd: files
  - Move the chown call into make-srpm.sh


author: Zdenek Pytela <zpytela@redhat.com> - 37.4-1
changelog:
  - Allow auditd_t noatsecure for a transition to audisp_remote_t
  - Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
  - Allow pcp_domain execute its private memfd: objects
  - Add support for samba-dcerpcd
  - Add policy for wireguard
  - Confine targetcli
  - Allow systemd work with install_t unix stream sockets
  - Allow iscsid the sys_ptrace userns capability
  - Allow xdm connect to unconfined_service_t over a unix stream socket


author: Zdenek Pytela <zpytela@redhat.com> - 37.5-1
changelog:
  - Allow transition to insights_client named content
  - Add the insights_client_filetrans_named_content() interface
  - Update policy for insights-client to run additional commands 3
  - Allow dhclient manage pid files used by chronyd
  - Allow stalld get scheduling policy of kernel threads
  - Allow samba-dcerpcd work with sssd
  - Allow dlm_controld send a null signal to a cluster daemon
  - Allow ksmctl create hardware state information files
  - Allow winbind_rpcd_t connect to self over a unix_stream_socket
  - Update samba-dcerpcd policy for kerberos usage
  - Allow insights-client execute its private memfd: objects
  - Update policy for insights-client to run additional commands 2
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  - Change space indentation to tab in insights-client
  - Use socket permissions sets in insights-client
  - Update policy for insights-client to run additional commands
  - Change rpm_setattr_db_files() to use a pattern
  - Allow init_t to rw insights_client unnamed pipe
  - Add rpm setattr db files macro
  - Fix insights client
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  - Allow rabbitmq to access its private memfd: objects
  - Update policy for samba-dcerpcd
  - Allow stalld setsched and sys_nice


author: Zdenek Pytela <zpytela@redhat.com> - 37.6-1
changelog:
  - Allow stalld set scheduling policy of kernel threads
  - Allow targetclid read /var/target files
  - Allow targetclid read generic SSL certificates (fixed)
  - Allow firewalld read the contents of the sysfs filesystem
  - Fix file context pattern for /var/target
  - Use insights_client_etc_t in insights_search_config()
  - Allow nm-dispatcher ddclient plugin handle systemd services
  - Allow nm-dispatcher winbind plugin run smbcontrol
  - Allow nm-dispatcher custom plugin create and use unix dgram socket
  - Update samba-dcerpcd policy for kerberos usage 2
  - Allow keepalived read the contents of the sysfs filesystem
  - Allow amandad read network sysctls
  - Allow cups-lpd read network sysctls
  - Allow kpropd read network sysctls
  - Update insights_client_filetrans_named_content()
  - Allow rabbitmq to use systemd notify
  - Label /var/target with targetd_var_t
  - Allow targetclid read generic SSL certificates
  - Update rhcd policy
  - Allow rhcd search insights configuration directories
  - Add the kernel_read_proc_files() interface
  - Require policycoreutils >= 3.4-1
  - Add a script for enclosing interfaces in ifndef statements
  - Disable rpm verification on interface_info


author: Zdenek Pytela <zpytela@redhat.com> - 37.7-1
changelog:
  - Update winbind_rpcd_t
  - Allow some domains use sd_notify()
  - Revert "Allow rabbitmq to use systemd notify"
  - fix(sedoctool.py): Fix syntax warning: "is not" with a literal
  - Allow nm-dispatcher console plugin manage etc files
  - Allow networkmanager_dispatcher_plugin list NetworkManager_etc_t dirs
  - Allow nm-dispatcher console plugin setfscreate
  - Support using systemd-update-helper in rpm scriptlets
  - Allow nm-dispatcher winbind plugin read samba config files
  - Allow domain use userfaultfd over all domains
  - Allow cups-lpd read network sysctls


author: Zdenek Pytela <zpytela@redhat.com> - 37.8-1
changelog:
  - Allow sa-update to get init status and start systemd files
  - Use insights_client_filetrans_named_content
  - Make default file context match with named transitions
  - Allow nm-dispatcher tlp plugin send system log messages
  - Allow nm-dispatcher tlp plugin create and use unix_dgram_socket
  - Add permissions to manage lnk_files into gnome_manage_home_config
  - Allow rhsmcertd to read insights config files
  - Label /etc/insights-client/machine-id
  - fix(devices.fc): Replace single quote in comment to solve parsing issues
  - Make NetworkManager_dispatcher_custom_t an unconfined domain


author: Zdenek Pytela <zpytela@redhat.com> - 37.9-1
changelog:
  - Allow nm-dispatcher custom plugin dbus chat with nm
  - Allow nm-dispatcher sendmail plugin get status of systemd services
  - Allow xdm read the kernel key ring
  - Allow login_userdomain check status of mount units
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  - Allow services execute systemd-notify
  - Do not allow login_userdomain use sd_notify()
  - Allow launch-xenstored read filesystem sysctls
  - Allow systemd-modules-load write to /dev/kmsg and send a message to syslogd
  - Allow openvswitch fsetid capability
  - Allow openvswitch use its private tmpfs files and dirs
  - Allow openvswitch search tracefs dirs
  - Allow pmdalinux read files on an nfsd filesystem
  - Allow winbind-rpcd write to winbind pid files
  - Allow networkmanager to signal unconfined process
  - Allow systemd_hostnamed label /run/systemd/* as hostnamed_etc_t
  - Allow samba-bgqd get a printer list
  - fix(init.fc): Fix section description
  - Allow fedora-third-party read the passwords file
  - Remove permissive domain for rhcd_t
  - Allow pmie read network state information and network sysctls
  - Revert "Dontaudit domain the fowner capability"
  - Allow sysadm_t to run bpftool on the userdomain attribute
  - Add the userdom_prog_run_bpf_userdomain() interface
  - Allow insights-client rpm named file transitions
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content


author: Zdenek Pytela <zpytela@redhat.com> - 37.10-1
changelog:
  - Allow ipsec_t read/write tpm devices
  - Allow rhcd execute all executables
  - Update rhcd policy for executing additional commands 2
  - Update insights-client policy for additional commands execution 2
  - Allow sysadm_t read raw memory devices
  - Allow chronyd send and receive chronyd/ntp client packets
  - Allow ssh client read kerberos homedir config files
  - Label /var/log/rhc-worker-playbook with rhcd_var_log_t
  - Update insights-client policy (auditctl, gpg, journal)
  - Allow system_cronjob_t domtrans to rpm_script_t
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  - Update tor_bind_all_unreserved_ports interface
  - Allow chronyd bind UDP sockets to ptp_event ports.
  - Allow unconfined and sysadm users transition for /root/.gnupg
  - Add gpg_filetrans_admin_home_content() interface
  - Update rhcd policy for executing additional commands
  - Update insights-client policy for additional commands execution
  - Add userdom_view_all_users_keys() interface
  - Allow gpg read and write generic pty type
  - Allow chronyc read and write generic pty type
  - Allow system_dbusd ioctl kernel with a unix stream sockets
  - Allow samba-bgqd to read a printer list
  - Allow stalld get and set scheduling policy of all domains.
  - Allow unconfined_t transition to targetclid_home_t


