# changelog

author: Zdenek Pytela <zpytela@redhat.com> - 35.11-1
changelog:
  - Revert "Label /etc/cockpit/ws-certs.d with cert_t"
  - Allow login_userdomain write to session_dbusd tmp socket files
  - Label /var/run/user/%{USERID}/dbus with session_dbusd_tmp_t


author: Zdenek Pytela <zpytela@redhat.com> - 35.12-1
changelog:
  - Fix badly indented used interfaces
  - Allow domain transition to sssd_t
  - Dontaudit sfcbd sys_ptrace cap_userns
  - Label /var/lib/plocate with locate_var_lib_t
  - Allow hostapd talk with unconfined user over unix domain dgram socket
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  - Allow system_mail_t read inherited apache system content rw files
  - Add apache_read_inherited_sys_content_rw_files() interface
  - Allow rhsm-service execute its private memfd: objects
  - Allow dirsrv read configfs files and directories
  - Label /run/stratisd with stratisd_var_run_t
  - Allow tumblerd write to session_dbusd tmp socket files


author: Zdenek Pytela <zpytela@redhat.com> - 35.13-1
changelog:
  - Allow systemd services watch dbusd pid directory and its parents
  - Allow ModemManager connect to the unconfined user domain
  - Label /dev/wwan.+ with modem_manager_t
  - Allow alsactl set group Process ID of a process
  - Allow domtrans to sssd_t and role access to sssd
  - Creating interface sssd_run_sssd()
  - Label utilities for exFAT filesystems with fsadm_exec_t
  - Label /dev/nvme-fabrics with fixed_disk_device_t
  - Allow init delete generic tmp named pipes
  - Allow timedatex dbus chat with xdm


author: Zdenek Pytela <zpytela@redhat.com> - 36.1-1
changelog:
  - Label exFAT utilities at /usr/sbin
  - policy/modules/contrib: Support /usr/lib/sysimage/rpm as the rpmdb path
  - Enable genfs_seclabel_symlinks policy capability
  - Sync policy/policy_capabilities with refpolicy
  - refpolicy: drop unused socket security classes
  - Label new utility of NetworkManager nm-priv-helper
  - Label NetworkManager-dispatcher service with separate context
  - Allow sanlock get attributes of filesystems with extended attributes
  - Associate stratisd_data_t with device filesystem
  - Allow init read stratis data symlinks


author: Zdenek Pytela <zpytela@redhat.com> - 36.2-1
changelog:
  - Allow sysadm_passwd_t to relabel passwd and group files
  - Allow confined sysadmin to use tool vipw
  - Allow login_userdomain map /var/lib/directories
  - Allow login_userdomain watch library and fonts dirs
  - Allow login_userdomain watch system configuration dirs
  - Allow login_userdomain read systemd runtime files
  - Allow ctdb create cluster logs
  - Allow alsa bind mixer controls to led triggers
  - New policy for insight-client
  - Add mctp_socket security class and access vectors
  - Fix koji repo URL pattern
  - Update chronyd_pid_filetrans() to allow create dirs
  - Update NetworkManager-dispatcher policy
  - Allow unconfined to run virtd bpf
  - Allow nm-privhelper setsched permission and send system logs
  - Add the map permission to common_anon_inode_perm permission set
  - Rename userfaultfd_anon_inode_perms to common_inode_perms
  - Allow confined users to use kinit,klist and etc.
  - Allow rhsmcertd create rpm hawkey logs with correct label


author: Zdenek Pytela <zpytela@redhat.com> - 36.3-1
changelog:
  - Update NetworkManager-dispatcher policy to use scripts
  - Allow init mounton kernel messages device
  - Revert "Make dbus-broker service working on s390x arch"
  - Remove permissive domain for insights_client_t
  - Allow userdomain read symlinks in /var/lib
  - Allow iptables list cgroup directories
  - Dontaudit mdadm list dirsrv tmpfs dirs
  - Dontaudit dirsrv search filesystem sysctl directories
  - Allow chage domtrans to sssd
  - Allow postfix_domain read dovecot certificates
  - Allow systemd-networkd create and use netlink netfilter socket
  - Allow nm-dispatcher read nm-dispatcher-script symlinks
  - filesystem.te: add genfscon rule for ntfs3 filesystem
  - Allow rhsmcertd get attributes of cgroup filesystems
  - Allow sandbox_web_client_t watch various dirs
  - Exclude container.if from policy devel files
  - Run restorecon on /usr/lib/sysimage/rpm instead of /var/lib/rpm


author: Zdenek Pytela <zpytela@redhat.com> - 36.4-1
changelog:
  - Update NetworkManager-dispatcher cloud and chronyc policy
  - Update insights-client: fc pattern, motd, writing to etc
  - Allow systemd-sysctl read the security state information
  - Allow init create and mounton to support PrivateDevices
  - Allow sosreport dbus chat abrt systemd timedatex


author: Zdenek Pytela <zpytela@redhat.com> - 36.5-1
changelog:
  - Add support for nm-dispatcher console helper scripts
  - Allow nm-dispatcher plugins read its directory and sysfs
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  - devices: Add a comment about cardmgr_dev_t
  - Add basic policy for BinderFS
  - Label /var/run/ecblp0 pipe with cupsd_var_run_t
  - Allow rpmdb create directory in /usr/lib/sysimage
  - Allow rngd drop privileges via setuid/setgid/setcap
  - Allow init watch and watch_reads user ttys
  - Allow systemd-logind dbus chat with sosreport
  - Allow chronyd send a message to sosreport over datagram socket
  - Remove unnecessary /etc file transitions for insights-client
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  - Update insights-client policy


