# changelog

author: Zdenek Pytela <zpytela@redhat.com> - 37.6-1
changelog:
  - Allow stalld set scheduling policy of kernel threads
  - Allow targetclid read /var/target files
  - Allow targetclid read generic SSL certificates (fixed)
  - Allow firewalld read the contents of the sysfs filesystem
  - Fix file context pattern for /var/target
  - Use insights_client_etc_t in insights_search_config()
  - Allow nm-dispatcher ddclient plugin handle systemd services
  - Allow nm-dispatcher winbind plugin run smbcontrol
  - Allow nm-dispatcher custom plugin create and use unix dgram socket
  - Update samba-dcerpcd policy for kerberos usage 2
  - Allow keepalived read the contents of the sysfs filesystem
  - Allow amandad read network sysctls
  - Allow cups-lpd read network sysctls
  - Allow kpropd read network sysctls
  - Update insights_client_filetrans_named_content()
  - Allow rabbitmq to use systemd notify
  - Label /var/target with targetd_var_t
  - Allow targetclid read generic SSL certificates
  - Update rhcd policy
  - Allow rhcd search insights configuration directories
  - Add the kernel_read_proc_files() interface
  - Require policycoreutils >= 3.4-1
  - Add a script for enclosing interfaces in ifndef statements
  - Disable rpm verification on interface_info


author: Zdenek Pytela <zpytela@redhat.com> - 37.7-1
changelog:
  - Update winbind_rpcd_t
  - Allow some domains use sd_notify()
  - Revert "Allow rabbitmq to use systemd notify"
  - fix(sedoctool.py): Fix syntax warning: "is not" with a literal
  - Allow nm-dispatcher console plugin manage etc files
  - Allow networkmanager_dispatcher_plugin list NetworkManager_etc_t dirs
  - Allow nm-dispatcher console plugin setfscreate
  - Support using systemd-update-helper in rpm scriptlets
  - Allow nm-dispatcher winbind plugin read samba config files
  - Allow domain use userfaultfd over all domains
  - Allow cups-lpd read network sysctls


author: Zdenek Pytela <zpytela@redhat.com> - 37.8-1
changelog:
  - Allow sa-update to get init status and start systemd files
  - Use insights_client_filetrans_named_content
  - Make default file context match with named transitions
  - Allow nm-dispatcher tlp plugin send system log messages
  - Allow nm-dispatcher tlp plugin create and use unix_dgram_socket
  - Add permissions to manage lnk_files into gnome_manage_home_config
  - Allow rhsmcertd to read insights config files
  - Label /etc/insights-client/machine-id
  - fix(devices.fc): Replace single quote in comment to solve parsing issues
  - Make NetworkManager_dispatcher_custom_t an unconfined domain


author: Zdenek Pytela <zpytela@redhat.com> - 37.9-1
changelog:
  - Allow nm-dispatcher custom plugin dbus chat with nm
  - Allow nm-dispatcher sendmail plugin get status of systemd services
  - Allow xdm read the kernel key ring
  - Allow login_userdomain check status of mount units
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  - Allow services execute systemd-notify
  - Do not allow login_userdomain use sd_notify()
  - Allow launch-xenstored read filesystem sysctls
  - Allow systemd-modules-load write to /dev/kmsg and send a message to syslogd
  - Allow openvswitch fsetid capability
  - Allow openvswitch use its private tmpfs files and dirs
  - Allow openvswitch search tracefs dirs
  - Allow pmdalinux read files on an nfsd filesystem
  - Allow winbind-rpcd write to winbind pid files
  - Allow networkmanager to signal unconfined process
  - Allow systemd_hostnamed label /run/systemd/* as hostnamed_etc_t
  - Allow samba-bgqd get a printer list
  - fix(init.fc): Fix section description
  - Allow fedora-third-party read the passwords file
  - Remove permissive domain for rhcd_t
  - Allow pmie read network state information and network sysctls
  - Revert "Dontaudit domain the fowner capability"
  - Allow sysadm_t to run bpftool on the userdomain attribute
  - Add the userdom_prog_run_bpf_userdomain() interface
  - Allow insights-client rpm named file transitions
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content


author: Zdenek Pytela <zpytela@redhat.com> - 37.10-1
changelog:
  - Allow ipsec_t read/write tpm devices
  - Allow rhcd execute all executables
  - Update rhcd policy for executing additional commands 2
  - Update insights-client policy for additional commands execution 2
  - Allow sysadm_t read raw memory devices
  - Allow chronyd send and receive chronyd/ntp client packets
  - Allow ssh client read kerberos homedir config files
  - Label /var/log/rhc-worker-playbook with rhcd_var_log_t
  - Update insights-client policy (auditctl, gpg, journal)
  - Allow system_cronjob_t domtrans to rpm_script_t
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  - Update tor_bind_all_unreserved_ports interface
  - Allow chronyd bind UDP sockets to ptp_event ports.
  - Allow unconfined and sysadm users transition for /root/.gnupg
  - Add gpg_filetrans_admin_home_content() interface
  - Update rhcd policy for executing additional commands
  - Update insights-client policy for additional commands execution
  - Add userdom_view_all_users_keys() interface
  - Allow gpg read and write generic pty type
  - Allow chronyc read and write generic pty type
  - Allow system_dbusd ioctl kernel with a unix stream sockets
  - Allow samba-bgqd to read a printer list
  - Allow stalld get and set scheduling policy of all domains.
  - Allow unconfined_t transition to targetclid_home_t


author: Zdenek Pytela <zpytela@redhat.com> - 37.11-1
changelog:
  - Allow tor get filesystem attributes
  - Allow utempter append to login_userdomain stream
  - Allow login_userdomain accept a stream connection to XDM
  - Allow login_userdomain write to boltd named pipes
  - Allow staff_u and user_u users write to bolt pipe
  - Allow login_userdomain watch various directories
  - Update rhcd policy for executing additional commands 5
  - Update rhcd policy for executing additional commands 4
  - Allow rhcd create rpm hawkey logs with correct label
  - Allow systemd-gpt-auto-generator to check for empty dirs
  - Update rhcd policy for executing additional commands 3
  - Allow journalctl read rhcd fifo files
  - Update insights-client policy for additional commands execution 5
  - Allow init remount all file_type filesystems
  - Confine insights-client systemd unit
  - Update insights-client policy for additional commands execution 4
  - Allow pcp pmcd search tracefs and acct_data dirs
  - Allow httpd read network sysctls
  - Dontaudit domain map permission on directories
  - Revert "Allow X userdomains to mmap user_fonts_cache_t dirs"
  - Revert "Allow xdm_t domain to mmap /var/lib/gdm/.cache/fontconfig BZ(1725509)"
  - Update insights-client policy for additional commands execution 3
  - Allow systemd permissions needed for sandboxed services
  - Add rhcd module
  - Make dependency on rpm-plugin-selinux unordered


author: Zdenek Pytela <zpytela@redhat.com> - 37.12-1
changelog:
  - nut-upsd: kernel_read_system_state, fs_getattr_cgroup
  - Add numad the ipc_owner capability
  - Allow gst-plugin-scanner read virtual memory sysctls
  - Allow init read/write inherited user fifo files
  - Update dnssec-trigger policy: setsched, module_request
  - added policy for systemd-socket-proxyd
  - Add the new 'cmd' permission to the 'io_uring' class
  - Allow winbind-rpcd read and write its key ring
  - Label /run/NetworkManager/no-stub-resolv.conf net_conf_t
  - blueman-mechanism can read ~/.local/lib/python*/site-packages directory
  - pidof executed by abrt can readlink /proc/*/exe
  - Fix typo in comment
  - Do not run restorecon /etc/NetworkManager/dispatcher.d in mls and minimum


author: Zdenek Pytela <zpytela@redhat.com> - 37.13-1
changelog:
  - Remove the ipa module
  - Allow sss daemons read/write unnamed pipes of cloud-init
  - Allow postfix_mailqueue create and use unix dgram sockets
  - Allow xdm watch user home directories
  - Allow nm-dispatcher ddclient plugin load a kernel module
  - Stop ignoring standalone interface files
  - Drop cockpit module
  - Allow init map its private tmp files
  - Allow xenstored change its hard resource limits
  - Allow system_mail-t read network sysctls
  - Add bgpd sys_chroot capability


author: Zdenek Pytela <zpytela@redhat.com> - 37.14-1
changelog:
  - Allow rotatelogs read httpd_log_t symlinks
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  - Allow system cronjobs dbus chat with setroubleshoot
  - Allow setroubleshootd read device sysctls
  - Allow virt_domain read device sysctls
  - Allow rhcd compute selinux access vector
  - Allow insights-client manage samba var dirs
  - Label ports 10161-10162 tcp/udp with snmp
  - Allow aide to connect to systemd_machined with a unix socket.
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  - Allow vlock search the contents of the /dev/pts directory
  - Allow insights-client send null signal to rpm and system cronjob
  - Label port 15354/tcp and 15354/udp with opendnssec
  - Allow ftpd map ftpd_var_run files
  - Allow targetclid to manage tmp files
  - Allow insights-client connect to postgresql with a unix socket
  - Allow insights-client domtrans on unix_chkpwd execution
  - Add file context entries for insights-client and rhc
  - Allow pulseaudio create gnome content (~/.config)
  - Allow login_userdomain dbus chat with rhsmcertd
  - Allow sbd the sys_ptrace capability
  - Allow ptp4l_t name_bind ptp_event_port_t


