# changelog

author: Tom Stellard <tstellar@redhat.com> - 3.1-2
changelog:
  - Use make macros
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Use -fno-semantic-interposition and more make macros


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-4
changelog:
  - Use libsepol.so.2
  - Convert matchpathcon to selabel_lookup()
  - Change userspace AVC setenforce and policy load messages to audit
    format
  - Remove trailing slash on selabel_file lookups
  - Use kernel status page by default


author: Tom Stellard <tstellar@redhat.com> - 3.1-2
changelog:
  - Use make macros
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Use set_build_flags and -fno-semantic-interposition


author: Petr Lautrbach <plautrba@redhat.com> - 3.1-4
changelog:
  - Drop deprecated functions and duplicated symbols
  - Dange library version to libsepol.so.2
  - temporary ship -compat with libsepol.so.1
  - Re-enable LTO flags


author: Petr Lautrbach <plautrba@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
      were dropped from libsepol.


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.6-23
changelog:
  - Revert "Add support for /sys/fs/kdbus and allow login_pgm domain to access it."
  - Revert "Add interface to allow types to associate with cgroup filesystems"
  - Revert "kdbusfs should not be accessible for now."
  - Revert "kdbusfs should not be accessible for now by default for shipped policies. It should be moved to kdbus.pp"
  - Revert "Add kdbus.pp policy to allow access /sys/fs/kdbus. It needs to go with own module because this is workaround for now to avoid SELinux in enforcing mode."
  - Remove the legacy kdbus module
  - Remove "kdbus = module" from modules-targeted-base.conf


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.6-24
changelog:
  - Add ipa_helper_noatsecure() interface unconditionally
  - Conditionally allow nagios_plugin_domain dbus chat with init
  - Revert "Update allow rules set for nrpe_t domain"
  - Add ipa_helper_noatsecure() interface to ipa.if
  - Label /usr/libexec/qemu-pr-helper with virtd_exec_t
  - Allow kadmind manage kerberos host rcache
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  - Define named file transition for sshd on /tmp/krb5_0.rcache2
  - Allow systemd-machined create userdbd runtime sock files
  - Disable kdbus module before updating


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.6-25
changelog:
  - Allow certmonger fowner capability
  - The nfsdcld service is now confined by SELinux
  - Change transitions for ~/.config/Yubico
  - Allow all users to connect to systemd-userdbd with a unix socket
  - Add file context for ~/.config/Yubico
  - Allow syslogd_t domain to read/write tmpfs systemd-bootchart files
  - Allow login_pgm attribute to get attributes in proc_t
  - Allow passwd to get attributes in proc_t
  - Revert "Allow passwd to get attributes in proc_t"
  - Revert "Allow login_pgm attribute to get attributes in proc_t"
  - Allow login_pgm attribute to get attributes in proc_t
  - Allow passwd to get attributes in proc_t
  - Allow traceroute_t and ping_t to bind generic nodes.
  - Create macro corenet_icmp_bind_generic_node()
  - Allow unconfined_t to node_bind icmp_sockets in node_t domain


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-1
changelog:
  - Bump version as Fedora 33 has been branched
  - Allow php-fpm write access to /var/run/redis/redis.sock
  - Allow journalctl to read and write to inherited user domain tty
  - Update rkt policy to allow rkt_t domain to read sysfs filesystem
  - Allow arpwatch create and use rdma socket
  - Allow plymouth sys_chroot capability
  - Allow gnome-initial-setup execute in a xdm sandbox
  - Add new devices and filesystem interfaces


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-2
changelog:
  - Allow openvswitch fowner capability and create netlink sockets
  - Allow additional permissions for gnome-initial-setup
  - Add to map non_security_files to the userdom_admin_user_template template
  - kernel/filesystem: Add exfat support (no extended attributes)


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-4
changelog:
  - Allow chronyd_t to accept and make NTS-KE connections
  - Allow domain write to an automount unnamed pipe
  - Label /var/run/zincati/public/motd.d/* as motd_var_run_t
  - Allow login programs to (only) read MOTD files and symlinks
  - Relabel /usr/sbin/charon-systemd as ipsec_exec_t
  - Confine systemd-sleep service
  - Add fstools_rw_swap_files() interface
  - Label 4460/tcp port as ntske_port_t
  - Add lvm_dbus_send_msg(), lvm_rw_var_run() interfaces


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-5
changelog:
  - Remove empty line from rshd.fc
  - Allow systemd-logind read swap files
  - Add fstools_read_swap_files() interface
  - Allow dyntransition from sshd_t to unconfined_t
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.7-6
changelog:
  - rpc.fc: Include /etc/exports.d dir & files
  - Create chronyd_pid_filetrans() interface
  - Change invalid type redisd_t to redis_t in redis_stream_connect()
  - Revert "Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template"
  - Allow init dbus chat with kernel
  - Allow initrc_t create /run/chronyd-dhcp directory with a transition
  - Drop gcc from dependencies in Travis CI
  - fc_sort.py: Use "==" for comparing integers.
  - re-implement fc_sort in python
  - Remove invalid file context line
  - Drop git from dependencies in Travis CI


