<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="8">
<package pkgid="1584035368b6d3eb5eb5887cbf044a186e55bc0372b738848023017f53145f64" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="25be9b926fcebd93512a852efba83323bb55de847f2874fc7ca4b1956b692b6c" name="selinux-policy" arch="src">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="b4e64e2259200092fcd7717f368cdfe6668c3dde2247f23cc3cdf49f4580fe23" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="26909e2e682d21777de78b4186d21824baef7457c7551fbc9fff24211dc46127" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="5283a3c8dc4d5ab3de4d434f3c33aed347ebe54301c2d29dc90713b353aca503" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="1c945c9490c1dc1ff2a85e57e48446ee47c121154067759f8e58405a0b16abed" name="selinux-policy-mls" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="655d5936e0b3a51c40f3b260c67a0beab2c4f0ef7c04aefb9e1f6118fa401a90" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
<package pkgid="c2a3921f59cee7dc605e108dc6828da6ca16a82dad97385dfe6e7b0a4fcd90c7" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="41.33" rel="1.fc43"/>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.25-1" date="1729857600">- Allow dirsrv-snmp map dirsv_tmpfs_t files
- Label /usr/lib/node_modules_22/npm/bin with bin_t
- Add policy for /usr/libexec/samba/samba-bgqd
- Allow gnome-remote-desktop watch /etc directory
- Allow rpcd read network sysctls
- Allow journalctl connect to systemd-userdbd over a unix socket
- Allow some confined users send to lldpad over a unix dgram socket
- Allow lldpad send to unconfined_t over a unix dgram socket
- Allow lldpd connect to systemd-machined over a unix socket
- Confine the ktls service</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.26-1" date="1732017600">- [5/5][sync from 'mysql-selinux'] Add mariadb-backup
- [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
- [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
- [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
- [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
- Allow systemd-networkd read mount pid files
- Update policy for samba-bgqd
- Allow chronyd read networkmanager's pid files
- Allow staff user connect to generic tcp ports
- Allow gnome-remote-desktop dbus chat with policykit
- Allow tlp the setpgid process permission
- Update the bootupd policy
- Allow sysadm_t use the io_uring API
- Allow sysadm user dbus chat with virt-dbus
- Allow virtqemud_t read virsh_t files
- Allow virt_dbus_t connect to virtd_t over a unix stream socket
- Allow systemd-tpm2-generator read hardware state information
- Allow coreos-installer-generator execute generic programs
- Allow coreos-installer domain transition on udev execution
- Revert "Allow unconfined_t execute kmod in the kmod domain"
- Allow iio-sensor-proxy create and use unix dgram socket
- Allow virtstoraged read vm sysctls
- Support ssh connections via systemd-ssh-generator
- Label all semanage store files in /etc as semanage_store_t
- Add file transition for nvidia-modeset</changelog>
  <changelog author="Petr Lautrbach &lt;lautrbach@redhat.com&gt; - 41.26-2" date="1733140800">- Rebuild with SELinux Userspace 3.8</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.27-1" date="1734436800">- Update ktlsh policy
- Allow request-key to read /etc/passwd
- Allow request-key to manage all domains' keys
- Add support for the KVM guest memfd anon inodes
- Allow auditctl signal auditd
- Dontaudit systemd-coredump the sys_resource capability
- Allow traceroute_t bind rawip sockets to unreserved ports
- Fix the cups_read_pid_files() interface to use read_files_pattern
- Allow virtqemud additional permissions for tmpfs_t blk devices
- Allow virtqemud rw access to svirt_image_t chr files
- Allow virtqemud rw and setattr access to fixed block devices
- Label /etc/mdevctl.d/scripts.d with bin_t
- Allow virtqemud open svirt_devpts_t char files
- Allow virtqemud relabelfrom virt_log_t files
- Allow svirt_tcg_t read virtqemud_t fifo_files
- Allow virtqemud rw and setattr access to sev devices
- Allow virtqemud directly read and write to a fixed disk
- Allow virtqemud_t relabel virt_var_lib_t files
- Allow virtqemud_t relabel virtqemud_var_run_t sock_files
- Add gnome_filetrans_gstreamer_admin_home_content() interface
- Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
- Make bootupd_t permissive
- Allow init_t nnp domain transition to locate_t
- allow gdm and iiosensorproxy talk to each other via D-bus
- Allow systemd-journald getattr nsfs files
- Allow sendmail to map mail server configuration files
- Allow procmail to read mail aliases
- Allow cifs.idmap helper to set attributes on kernel keys
- Allow irqbalance setpcap capability in the user namespace
- Allow sssd_selinux_manager_t the setcap process permission
- Allow systemd-sleep manage efivarfs files
- Allow systemd-related domains getattr nsfs files
- Allow svirt_t the sys_rawio capability
- Allow alsa watch generic device directories
- Move systemd-homed interfaces to seperate optional_policy block
- Update samba-bgqd policy
- Update virtlogd policy
- Allow svirt_t the sys_rawio capability
- Allow qemu-ga the dac_override and dac_read_search capabilities
- Allow bacula execute container in the container domain
- Allow httpd get attributes of dirsrv unit files
- Allow samba-bgqd read cups config files
- Add label rshim_var_run_t for /run/rshim.pid</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.28-1" date="1735905600">- Update virtqemud policy regarding the svirt_tcg_t domain
- Allow virtqemud domain transition on numad execution
- Support virt live migration using ssh
- Allow virtqemud permissions needed for live migration
- Allow virtqemud the getpgid process permission
- Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
- Allow virtqemud relabelfrom virt_log_t files
- Allow virtqemud relabel tun_socket
- Add policy for systemd-import-generator
- Confine vsftpd systemd system generator
- Allow virtqemud read and write sgx_vepc devices
- Allow systemd-networkd list cgroup directories
- Allow xdm dbus chat with power-profiles-daemon
- Allow ssh_t read systemd config files
- Add Valkey rules to Redis module</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.29-1" date="1736942400">- Allow virtqemud domain transition to nbdkit
- Add nbdkit interfaces defined conditionally
- Allow samba-bgqd connect to cupsd over an unix domain stream socket
- Confine the switcheroo-control service
- Allow svirt_t read sysfs files
- Add rhsmcertd interfaces
- Add the ssh_exec_sshd() interface
- Add the gpg_domtrans_agent() interface
- Label /usr/bin/dnf5 with rpm_exec_t
- Label /dev/pmem[0-9]+ with fixed_disk_device_t
- allow kdm to create /root/.kde/ with correct label
- Change /usr/sbin entries to use /usr/bin or remove them
- Allow systemd-homed get filesystem quotas
- Allow login_userdomain getattr nsfs files
- Allow virtqemud send a generic signal to the ssh client domain
- Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.30-1" date="1737979200">- Allow systemd-generator connect to syslog over a unix stream socket
- Allow virtqemud manage fixed disk device nodes
- Allow iio-sensor-proxy connect to syslog over a unix stream socket
- Allow virtstoraged write to sysfs files
- Allow power-profiles-daemon write sysfs files
- Update iiosensorproxy policy
- Allow pcmsensor write nmi_watchdog state information
- Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
- Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
- Add the gpg_read_user_secrets() interface
- Allow gnome-remote-desktop read resolv.conf
- Update switcheroo policy
- Allow nfsidmap connect to systemd-homed over a unix socket
- Add the auth_write_motd_var_run_files() interface
- Add the bind_exec_named_checkconf() interface
- Add the virt_exec_virsh() interface</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.31-1" date="1738324800">- Allow snapperd execute systemctl in the caller domain
- Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
- Allow iio-sensor-proxy read iio devices
- Label /dev/iio:device[0-9]+ devices
- Allow systemd-coredump the sys_admin capability
- Allow apcupsd's apccontrol to send messages using wall
- contrib/thumb: also allow per-user thumbnailers
- contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
- Allow virt_domain to use pulseaudio - conditional
- Allow pcmsensor read nmi_watchdog state information
- Allow init_t nnp domain transition to gssproxy_t</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.32-1" date="1738756800">- Allow virtqemud use hostdev usb devices conditionally
- Allow virtqemud map svirt_image_t plain files
- Allow virtqemud work with nvdimm devices
- Support saving and restoring a VM to/from a block device
- Allow virtnwfilterd dbus chat with firewalld
- Dontaudit systemd-logind remove all files
- Add the files_dontaudit_read_all_dirs() interface
- Add the files_dontaudit_delete_all_files() interface
- Allow rhsmcertd notify virt-who
- Allow irqbalance to run unconfined scripts conditionally
- Fix binsbin-convert.sh to handle exceptions</changelog>
  <changelog author="Zdenek Pytela &lt;zpytela@redhat.com&gt; - 41.33-1" date="1738929600">- Allow systemd-networkd the sys_admin capability
- Update systemd-networkd policy in systemd v257
- Separate insights-core from insights-client
- Removed unused insights_client interfaces calls from other modules
- Update policy for insights_client wrt new rules for insights_core_t
- Add policy for insights-core
- Allow systemd-networkd use its private tmpfs files
- Allow boothd connect to systemd-machined over a unix socket
- Update init_explicit_domain() interface
- Allow tlp to read/write nmi_watchdog state information
- Allow power-profiles-daemon the bpf capability
- Allow svirt_t to connect to nbdkit over a unix stream socket
- Update ktlshd policy to read /proc/keys and domain keyrings
- Allow virt_domain read hardware state information unconditionally
- Allow init mounton crypto sysctl files
- Rename winbind_rpcd_* types to samba_dcerpcd_*
- Support peer-to-peer migration of vms using ssh</changelog>
</package>
</otherdata>