# changelog

author: Jan Macku <jamacku@redhat.com> - 1.27-1
changelog:
  - alternatives: properly handle chars with const in normalize_path
  - alternatives: use exit in main instead of return for critical failures
  - alternatives: fix leak
  - alternatives: fix leak
  - alternatives: fix possible overrun
  - alternatives: fix all the leaks of groups in readConfig
  - alternatives: fix all the leaks of read line in readConfig
  - alternatives: fix leak
  - alternatives: fix memory leak
  - alternatives: fix memory leak
  - alternatives: initialize parameters in main to NULL
  - alternatives: fix memory leak
  - Translated using Weblate (Korean)
  - Translated using Weblate (English (United Kingdom))
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Finnish)
  - Translated using Weblate (Japanese)
  - Translated using Weblate (Swedish)
  - Translated using Weblate (Japanese)
  - Translated using Weblate (Polish)
  - Translated using Weblate (Korean)
  - Translated using Weblate (Georgian)
  - Update translation files
  - Translated using Weblate (Japanese)
  - Fix systemd dependency


author: Jan Macku <jamacku@redhat.com> - 1.29-1
changelog:
  - add basic mkosi config
  - remove not used directory from makefile
  - ntsysv: fix leaks
  - leveldb: security_context_t is deprecated
  - leveldb: fix leak
  - leveldb: fix leak
  - leveldb: fix leak
  - leveldb: fix leak
  - leveldb: fix leak
  - chkconfig: fix leak
  - chkconfig: fix leak
  - chkconfig: fix memory leak when deleting a service
  - leveldb: add destructors for service
  - leveldb: fix memory leak
  - leveldb.c: fix memory leak
  - chkconfig: fix leak
  - leveldb: fix memory leak
  - alternatives: ensure the current alt. is freed if parsing fails
  - alternatives: ensure the current group is freed
  - Translated using Weblate (English (United Kingdom))
  - Translated using Weblate (Turkish)


author: Jan Macku <jamacku@redhat.com> - 1.31-1
changelog:
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (Ukrainian)
  - Translated using Weblate (French)
  - Update translation files
  - Translated using Weblate (Turkish)


author: Jan Macku <jamacku@redhat.com> - 1.32-1
changelog:
  - Allow paths with /usr/sbin and /usr/bin as equivalent
  - mkosi: update conf to match latest mkosi version
  - Translated using Weblate (Italian)


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.13-1
changelog:
  - Fix check for biosboot partition in GRUB2.check (vtrefny)
    Resolves: RHEL-56591
  - dracut: Remove 'linear' from modules to load (vtrefny)
    Resolves: RHEL-33812
  - Ignore all storage errors when trying to activate swaps (vtrefny)
    Resolves: RHEL-56591


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.14-1
changelog:
  - network: do not crash on destroyed device object in GUI (rvykydal)
    Resolves: RHEL-56141
  - Fix crash on continue after a missing package non-critical error (mkolman)
    Resolves: INSTALLER-4045
    Resolves: RHEL-57699


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.16-1
changelog:
  - Subscription code updates - adjust unit tests (mkolman)
    Resolves: RHEL-49661
    Related: INSTALLER-3903
    Related: INSTALLER-3882
  - Subscription code updates - GTK GUI (mkolman)
    Resolves: RHEL-49661
    Related: INSTALLER-3903
    Related: INSTALLER-3882
  - Subscription code updates - backend (mkolman)
    Resolves: RHEL-49661
    Related: INSTALLER-3903
    Related: INSTALLER-3882
  - Bump minimal subscription manager versions (mkolman)
    Resolves: RHEL-49661
    Related: INSTALLER-3063
    Related: INSTALLER-3882


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.17-1
changelog:
  - network: add warning for kickstart network configuration when running from
    nfs (rvykydal)
    Resolves: RHEL-35250
  - Explicitly place biosboot partition only on stage1 disk (vtrefny)
    Resolves: RHEL-61143
  - network: handle autoconnections policy for rhel upstream (rvykydal)
    Resolves: RHEL-53196


author: Paweł Poławski <ppolawsk@redhat.com> - 40.22.3.18-1
changelog:
  - Update to version 40.22.3.18
  - util: Add additional information for EFI systems (riehecky)
    Resolves: RHEL-55129
  - Use log levels when getting logs from GLib (jkonecny)
    Related: RHEL-58834
  - Remove GLib logging condition for HW logging (jkonecny)
    Related: RHEL-58834
  - Move GLib imports to pyanaconda.core.glib (jkonecny)
    Related: RHEL-58834
  - Redirect only GLib loggers to Journal (mkolman)
    Related: RHEL-58834
  - Log stderr to journal only on supported platforms (jkonecny)
    Related: RHEL-58834
  - Fix journal redirect on systems without journal (jkonecny)
    Related: RHEL-58834
  - Suppress warning from systemd user session (jkonecny)
    Resolves: RHEL-67911
  - Fix RDP var contains string instead of bool (jkonecny)
    Related: RHEL-67911
  - Set --rdp in liveinst unsupported (jkonecny)
    Related: RHEL-67911
  - Stop pretending liveinst+vnc is supported (#678354) (kkoukiou)
    Related: RHEL-67911
  - Create GRDServer class only when required (jkonecny)
    Related: RHEL-67911
  - Fix typo in the GRD source file name (jkonecny)
    Related: RHEL-67911
  - Do not change compositor options when not defined (jkonecny)
    Related: RHEL-58181
  - Add release-notes for Wayland migration (jkonecny)
    Related: RHEL-58181
  - Remove Wayland detection logic from code (jkonecny)
    Related: RHEL-58181
  - Do not create GRDServer on Live ISO (jkonecny)
    Related: RHEL-67911
  - Remove dead spice_vd_agent code (jkonecny)
    Related: RHEL-67911
  - Switch keyboard management to Localed (jkonecny)
    Resolves: RHEL-58181
  - Add localed signal support to LocaledWrapper (jkonecny)
    Resolves: RHEL-58181
  - Add missing support to localed for compositor (jkonecny)
    Related: RHEL-58181


author: Paweł Poławski <ppolawsk@redhat.com> - 40.22.3.19-1
changelog:
  - Update to version 40.22.3.19
  - util: Add additional information for EFI systems (riehecky)
    Resolves: RHEL-55129
  - Use log levels when getting logs from GLib (jkonecny)
    Related: RHEL-58834
  - Remove GLib logging condition for HW logging (jkonecny)
    Related: RHEL-58834
  - Move GLib imports to pyanaconda.core.glib (jkonecny)
    Related: RHEL-58834
  - Redirect only GLib loggers to Journal (mkolman)
    Related: RHEL-58834
  - Log stderr to journal only on supported platforms (jkonecny)
    Related: RHEL-58834
  - Fix journal redirect on systems without journal (jkonecny)
    Related: RHEL-58834
  - Suppress warning from systemd user session (jkonecny)
    Resolves: RHEL-67911
  - Fix RDP var contains string instead of bool (jkonecny)
    Related: RHEL-67911
  - Set --rdp in liveinst unsupported (jkonecny)
    Related: RHEL-67911
  - Stop pretending liveinst+vnc is supported (#678354) (kkoukiou)
    Related: RHEL-67911
  - Create GRDServer class only when required (jkonecny)
    Related: RHEL-67911
  - Fix typo in the GRD source file name (jkonecny)
    Related: RHEL-67911
  - Do not change compositor options when not defined (jkonecny)
    Related: RHEL-58181
  - Add release-notes for Wayland migration (jkonecny)
    Related: RHEL-58181
  - Remove Wayland detection logic from code (jkonecny)
    Related: RHEL-58181
  - Do not create GRDServer on Live ISO (jkonecny)
    Related: RHEL-67911
  - Remove dead spice_vd_agent code (jkonecny)
    Related: RHEL-67911
  - Switch keyboard management to Localed (jkonecny)
    Resolves: RHEL-58181
  - Add localed signal support to LocaledWrapper (jkonecny)
    Resolves: RHEL-58181
  - Add missing support to localed for compositor (jkonecny)
    Related: RHEL-58181


author: Katerina Koukiou <k.koukiou@gmail.com> - 40.22.3.20-1
changelog:
  - Avoid side effect of ask rdp methods (jkonecny)
    Related: RHEL-69940
  - Do not crash if RDP is selected after regular GUI startup failed (#2326410)
    (mkolman)
    Resolves: RHEL-69940
  - Only match liveinst.desktop app in live environment (ales.astone)
    Resolves: RHEL-67390
  - Show correct taskbar icon in Wayland (ales.astone)
    Resolves: RHEL-67390
  - Hide server-side-decorations in Wayland (ales.astone)
    Resolves: RHEL-67390
  - liveinst: Allow running as a Wayland-native application (neal)
    Resolves: RHEL-67390
  - Support leavebootorder for bootupd (jkonecny)
    Resolves: RHEL-40896
  - bootupd: call bootupctl with --update-firmware (awilliam)
    Resolves: RHEL-40896


author: Neal Gompa <ngompa@centosproject.org> - 40.22.3.20-1.1
changelog:
  - Add changes for CentOS Hyperscale
    + Re-enable Btrfs support
    + Add CentOS Stream Hyperscale config


author: Jiri Konecny <jkonecny@redhat.com> - 40.22.3.21-1
changelog:
  - Disable keyboard shortcut switching on gnome-kiosk (jkonecny)
    Related: RHEL-71880
    Resolves: RHEL-74504
  - Improve name of compositor layout selection method (jkonecny)
    Related: RHEL-71880
    Resolves: RHEL-74504
  - Split LocaledWrapper code for compositor (jkonecny)
    Related: RHEL-71880
    Resolves: RHEL-74504
  - security: do not crash initramfs ks parsing on failing certificate dump
    (rvykydal)
    Resolves: RHEL-61434
  - security: require pykickstart version with %certificates support (rvykydal)
    Resolves: RHEL-61434
  - security: add service to transfer certificates from initramfs (rvykydal)
    Resolves: RHEL-61434
  - security: import certificates in initramfs (rvykydal)
    Resolves: RHEL-61434
  - security: install certificates in pre-install phase only for dnf payload
    (rvykydal)
    Resolves: RHEL-61434
  - security: raise exception if certificate destination is unknown (rvykydal)
    Resolves: RHEL-61434
  - security: log a warning when dumping certificate over an existing file
    (rvykydal)
    Resolves: RHEL-61434
  - security: pre-install certificates before payload installation (rvykydal)
    Resolves: RHEL-61434
  - security: add API to install certificates early before payload (rvykydal)
    Resolves: RHEL-61434
  - security: install certificates on target system (rvykydal)
    Resolves: RHEL-61434
  - security: Add API for installation on target system (rvykydal)
    Resolves: RHEL-61434
  - security: import certificates early after Anaconda start (rvykydal)
    Resolves: RHEL-61434
  - security: add API to import certificates to Anaconda environment (rvykydal)
    Related: RHEL-61434
  - security: add API: Certificate getter (rvykydal)
    Resolves: RHEL-61434
  - kickstart: extend section specification for list of section data (rvykydal)
    Resolves: RHEL-61434
  - security: implement the support to install certificates to Anaconda
    (k.koukiou)
    Resolves: RHEL-61434


author: Jiri Konecny <jkonecny@redhat.com> - 40.22.3.22-1
changelog:
  - Fix RDP question will switch to GUI instead of TUI (jkonecny)
    Resolves: RHEL-77162
  - rpmostree: Use `--merge` for kargs (walters)
    Resolves: RHEL-73029
  - Revert "dracut: Remove 'linear' from modules to load" (vtrefny)
    Resolves: RHEL-76805


author: Radek Vykydal <rvykydal@redhat.com> - 40.22.3.23-1
changelog:
  - security: add a development note for certificates import in initramfs
    (rvykydal)
    Related: RHEL-77156
  - security: do not issue warning on existing certificate file during dump
    (rvykydal)
    Resolves: RHEL-77156
  - Add systemd override to make /usr RW in Dracut (mkolman)
    Resolves: RHEL-77192
  - network: pass NM global dns configuration to the installed system (rvykydal)
    Resolves: RHEL-71415
  - network: pass global dns initrd option to the installed system (rvykydal)
    Resolves: RHEL-71415


author: Radek Vykydal <rvykydal@redhat.com> - 40.22.3.25-1
changelog:
  - network: add dnsconfd to installer environment (rvykydal)
    Resolves: RHEL-79800
  - network: add dnsconfd to selected packages if used in installer (rvykydal)
    Resolves: RHEL-79802


author: Radek Vykydal <rvykydal@redhat.com> - 40.22.3.26-1
changelog:
  - network: start dnsconfd in initramfs (rvykydal)
    Resolves: RHEL-80302
  - network: enable dnsconfd service on installed system if required (rvykydal)
    Resolves: RHEL-80011
  - network: pass 16-dns-backend.conf to target system (rvykydal)
    Resolves: RHEL-80232
  - netowrk: enable dnsconfd service in installer environment (rvykydal)
    Resolves: RHEL-80011


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.27-1
changelog:
  - Update the tests/README.rst file (jkonecny)
    Related: RHEL-48821
  - Move shell testing to a separated directory (jkonecny)
    Related: RHEL-48821
  - Enable dynamic bash commands disable for tests (jkonecny)
    Related: RHEL-48821
  - Add test for config_get dracut function (jkonecny)
    Related: RHEL-48821
  - Fix trailing `/` when downloading stage2 image (jkonecny)
    Resolves: RHEL-48821
  - Fix whitespace chars broke Dracut config parsing (jkonecny)
    Related: RHEL-48821


author: Martin Kolman <mkolman@redhat.com> - 40.22.3.28-1
changelog:
  - network: update NM autoconnections configuration for centos (rvykydal)
    Resolves: RHEL-67815
  - Run restorecon after copying logs (champetier.etienne)
    Resolves: RHEL-86788
  - s390x - enable raid1 as a stage2 device (dan)
    Resolves: RHEL-83924
    Resolves: INSTALLER-4148
  - edns: restart dnsconfd only after the first kickstart parsing (rvykydal)
    Resolves: RHEL-83931
  - edns: allow dnsconfd name resolution for kickstart fetching (rvykydal)
    Resolves: RHEL-83931
  - network: disable autoconnections on RHEL also for BOOTIF option (rvykydal)
    Resolves: RHEL-69400
  - security: fix dnsconfd backend option check in initramfs (rvykydal)
    Resolves: RHEL-83576


author: Vojtech Trefny <vtrefny@redhat.com> - 3.10.0-17
changelog:
  - Do not remove PVs from devices file if disabled or doesn't exist
    Resolves: RHEL-65846
  - iscsi: Use node.startup=onboot option for Login
    Resolves: RHEL-53719
  - tests: Make sure selinux_test doesn't try to create mountpoints
    Resolves: RHEL-78988


author: Lukáš Zaoral <lzaoral@redhat.com> - 9.6-1
changelog:
  - rebase to latest upstream version (rhbz#2338620)
  - sync i18n patch with SUSE (Kudos to Berny Völker!)


author: Michel Lind <salimma@centosproject.org> - 1:30.1-6
changelog:
  - Pick up changes from Fedora 42/43's emacs-1:30.1-5
  - Fixes: CVE-2024-53920
  - Fixes: CVE-2025-1244
  - Resolves: https://pagure.io/centos-sig-hyperscale/package-updates/issue/384


author: Michel Lind <salimma@fedoraproject.org> - 3.41-1
changelog:
  - Update to upstream v3.41
  - Update upstream URL (see README.rst) and download protocol to https
  - Related: rhbz#2393562


author: Michel Lind <salimma@centosproject.org> - 0.9.10-0.1
changelog:
  - Update to 0.9.10
  - Enable kpatch-build on aarch64
  - Rebase EL-only patches
  - Refresh clang PGO patches
  - Switch to autopatch for easier application of upstream patches


author: Michel Lind <salimma@centosproject.org> - 0.9.10-0.3
changelog:
  - Make kpatch-runtime obsolete a floating version of kpatch
    This preserves the upgrade path if in the future cXs's kpatch is updated


author: Vojtech Trefny <vtrefny@redhat.com> - 3.1.0-3
changelog:
  - Fix creating MD RAID arrays without specifying bitmap localtion
    Resolves: RHEL-31379
  - crypto: Fix double free in bd_crypto_luks_remove_key
    Resolves: RHEL-31489
  - tests: Fix running tests without ntfsprogs
    Resolves: RHEL-32875


author: Vojtech Trefny <vtrefny@redhat.com> - 3.1.0-6
changelog:
  - Fix passing size for pvresize over DBus
    Resolves: RHEL-45872
  - Upstream kernel VDO support
    Resolves: RHEL-31953


author: Michel Lind <salimma@centosproject.org> - 6.9.0-2
changelog:
  - Mark libbpf support as dependent on missing header file
  - some feature checks not shown unless VF=1 is passed


author: Michel Lind <salimma@centosproject.org> - 6.17.10-1
changelog:
  - Update to 6.17.10
  - Switch to using the full Linux tarball as the standalone one is missing
    some aarch64 files since 6.15.0
  - Workaround for some header files incorrectly shipped in kernel-headers


author: Michel Lind <salimma@centosproject.org> - 6.19~rc6-1
changelog:
  - Update to 6.19-pre6
  - this includes https://github.com/torvalds/linux/commit/bdf96c4ecd69523d97
    c98e47284caddde20b1df7
  - remove workaround bumping the hs+fb release number, we no longer build
    for hsx


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.1-1
changelog:
  - Version 2.10.1
  - Default to ntfs-3g for stability reasons (#2182206)
  - Use Recommends: for filesystem tools (#2169848)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.1-3
changelog:
  - Use a SPDX license tag
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - udiskslinuxmanager: Fix use after free
  - tests: Fix targetcli_config.json


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.90-4
changelog:
  - Rebase to upstream 2.10.90 (pre-)release
  - lvm2: Try opening for unused device detection harder (RHEL-39935)


author: Brian C. Lane <bcl@redhat.com> - 3.52.7-1
changelog:
  - Add support for inline certificates with `%certificate` section (k.koukiou)
    Resolves: RHEL-61435


author: Brian C. Lane <bcl@redhat.com> - 3.52.8-1
changelog:
  - Update %certificate section documentation (rvykydal)
    Related: RHEL-61435
  - Make %certificate section option --dir mandatory. (rvykydal)
    Resolves: RHEL-76502


author: Brian C. Lane <bcl@redhat.com> - 3.52.9-1
changelog:
  - workflows: Switch to using ubuntu-latest (bcl)
    Related: RHEL-80086
  - Do not remove "md" prefix from RAID names (vtrefny)
    Resolves: RHEL-80086


author: Neal Gompa <ngompa@centosproject.org> - 3.52.9-1.1
changelog:
  - Merge upstream/c10s changes into Hyperscale
  - Restore Btrfs support to the autopart kickstart command


author: Brian C. Lane <bcl@redhat.com> - 3.52.10-1
changelog:
  - pylint: Ignore files in .git (bcl)
    Related: RHEL-96217
  - Add support for RDP (jkonecny)
    Resolves: RHEL-96217


author: Brian C. Lane <bcl@redhat.com> - 3.52.2-1
changelog:
  - Switch DEFAULT_VERSION to RHEL10 (bcl)
    Resolves: RHEL-30566
  - Add a DEFAULT_VERSION variable to version.py (bcl)
  - Deprecate network team options on RHEL 10 (rvykydal)


author: Brian C. Lane <bcl@redhat.com> - 3.52.3-1
changelog:
  - btrfs: Remove support for the btrfs command on RHEL10 (bcl)
    Resolves: RHEL-34009
  - Deprecate modularity on RHEL 10 (marusak.matej)
    Resolves: RHEL-34829


author: Brian C. Lane <bcl@redhat.com> - 3.52.4-1
changelog:
  - timezone: Remove the --isUtc, --nontp, and --ntpserver arguments (bcl)
    Related: RHEL-34009
  - packages: Remove the old camel case arguments on RHEL10 (bcl)
    Resolves: RHEL-34009
  - nvdimm: Remove support for the nvdimm command on RHEL10 (bcl)
    Related: RHEL-34009


author: Brian C. Lane <bcl@redhat.com> - 3.52.6-1
changelog:
  - doc/versionremoved: Update VersionChange import for Sphinx 8.0.0 (bcl)
    Related: RHEL-61426
  - workflow: Use python 3.12.7 for testing (bcl)
    Related: RHEL-61426
  - options: adjust to behavior change in upstream _parse_optional (awilliam)
    Resolves: RHEL-61426


author: Roberto Campesato <render@metalabs.org> - 9.1.0-1.1
changelog:
  - Merge latest changes from Fedora
  - Added fb-only patch based on experimental AMD changes for SEV/SNP
    to make PCI passthrough work with SNP


author: Petr Lautrbach <lautrbach@redhat.com> 41.8-4
changelog:
  - Move %postInstall to %posttrans
  - Use `Requires(meta): (rpm-plugin-selinux if rpm-libs)`
  - Drop obsolete modules from config
  - Install dnf protected files only when policy is built


author: Zdenek Pytela <zpytela@redhat.com> - 41.9-1
changelog:
  - Allow virtqemud connect to sanlock over a unix stream socket
  - Allow virtqemud relabel virt_var_run_t directories
  - Allow svirt_tcg_t read vm sysctls
  - Allow virtnodedevd connect to systemd-userdbd over a unix socket
  - Allow svirt read virtqemud fifo files
  - Allow svirt attach_queue to a virtqemud tun_socket
  - Allow virtqemud run ssh client with a transition
  - Allow virt_dbus_t connect to virtqemud_t over a unix stream socket
  - Update keyutils policy
  - Allow sshd_keygen_t connect to userdbd over a unix stream socket
  - Allow postfix-smtpd read mysql config files
  - Allow locate stream connect to systemd-userdbd
  - Allow the staff user use wireshark
  - Allow updatedb connect to userdbd over a unix stream socket
  - Allow gpg_t set attributes of public-keys.d
  - Allow gpg_t get attributes of login_userdomain stream
  - Allow systemd_getty_generator_t read /proc/1/environ
  - Allow systemd_getty_generator_t to read and write to tty_device_t


author: Zdenek Pytela <zpytela@redhat.com> - 41.10-1
changelog:
  - Update afterburn file transition policy
  - Allow systemd_generator read attributes of all filesystems
  - Allow fstab-generator read and write cryptsetup-generator unit file
  - Allow cryptsetup-generator read and write fstab-generator unit file
  - Allow systemd_generator map files in /etc
  - Allow systemd_generator read init's process state
  - Allow coreos-installer-generator read sssd public files
  - Allow coreos-installer-generator work with partitions
  - Label /etc/mdadm.conf.d with mdadm_conf_t
  - Confine coreos generators
  - Label /run/metadata with afterburn_runtime_t
  - Allow afterburn list ssh home directory
  - Label samba certificates with samba_cert_t
  - Label /run/coreos-installer-reboot with coreos_installer_var_run_t
  - Allow virtqemud read virt-dbus process state
  - Allow staff user dbus chat with virt-dbus
  - Allow staff use watch /run/systemd
  - Allow systemd_generator to write kmsg


author: Zdenek Pytela <zpytela@redhat.com> - 41.11-1
changelog:
  - Make cgroup_memory_pressure_t a part of the file_type attribute
  - Allow ssh_t to change role to system_r
  - Update policy for coreos generators
  - Allow init_t nnp domain transition to firewalld_t
  - Label /run/modprobe.d with modules_conf_t
  - Allow virtnodedevd run udev with a domain transition
  - Allow virtnodedev_t create and use virtnodedev_lock_t
  - Allow virtstoraged manage files with virt_content_t type
  - Allow virtqemud unmount a filesystem with extended attributes
  - Allow svirt_t connect to unconfined_t over a unix domain socket


author: Zdenek Pytela <zpytela@redhat.com> - 41.26-1
changelog:
  - [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  - [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  - [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  - [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  - [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  - Allow systemd-networkd read mount pid files
  - Update policy for samba-bgqd
  - Allow chronyd read networkmanager's pid files
  - Allow staff user connect to generic tcp ports
  - Allow gnome-remote-desktop dbus chat with policykit
  - Allow tlp the setpgid process permission
  - Update the bootupd policy
  - Allow sysadm_t use the io_uring API
  - Allow sysadm user dbus chat with virt-dbus
  - Allow virtqemud_t read virsh_t files
  - Allow virt_dbus_t connect to virtd_t over a unix stream socket
  - Allow systemd-tpm2-generator read hardware state information
  - Allow coreos-installer-generator execute generic programs
  - Allow coreos-installer domain transition on udev execution
  - Revert "Allow unconfined_t execute kmod in the kmod domain"
  - Allow iio-sensor-proxy create and use unix dgram socket
  - Allow virtstoraged read vm sysctls
  - Support ssh connections via systemd-ssh-generator
  - Label all semanage store files in /etc as semanage_store_t
  - Add file transition for nvidia-modeset


author: Zdenek Pytela <zpytela@redhat.com> - 41.27-1
changelog:
  - Update ktlsh policy
  - Allow request-key to read /etc/passwd
  - Allow request-key to manage all domains' keys
  - Add support for the KVM guest memfd anon inodes
  - Allow auditctl signal auditd
  - Dontaudit systemd-coredump the sys_resource capability
  - Allow traceroute_t bind rawip sockets to unreserved ports
  - Fix the cups_read_pid_files() interface to use read_files_pattern
  - Allow virtqemud additional permissions for tmpfs_t blk devices
  - Allow virtqemud rw access to svirt_image_t chr files
  - Allow virtqemud rw and setattr access to fixed block devices
  - Label /etc/mdevctl.d/scripts.d with bin_t
  - Allow virtqemud open svirt_devpts_t char files
  - Allow virtqemud relabelfrom virt_log_t files
  - Allow svirt_tcg_t read virtqemud_t fifo_files
  - Allow virtqemud rw and setattr access to sev devices
  - Allow virtqemud directly read and write to a fixed disk
  - Allow virtqemud_t relabel virt_var_lib_t files
  - Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  - Add gnome_filetrans_gstreamer_admin_home_content() interface
  - Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  - Make bootupd_t permissive
  - Allow init_t nnp domain transition to locate_t
  - allow gdm and iiosensorproxy talk to each other via D-bus
  - Allow systemd-journald getattr nsfs files
  - Allow sendmail to map mail server configuration files
  - Allow procmail to read mail aliases
  - Allow cifs.idmap helper to set attributes on kernel keys
  - Allow irqbalance setpcap capability in the user namespace
  - Allow sssd_selinux_manager_t the setcap process permission
  - Allow systemd-sleep manage efivarfs files
  - Allow systemd-related domains getattr nsfs files
  - Allow svirt_t the sys_rawio capability
  - Allow alsa watch generic device directories
  - Move systemd-homed interfaces to seperate optional_policy block
  - Update samba-bgqd policy
  - Update virtlogd policy
  - Allow svirt_t the sys_rawio capability
  - Allow qemu-ga the dac_override and dac_read_search capabilities
  - Allow bacula execute container in the container domain
  - Allow httpd get attributes of dirsrv unit files
  - Allow samba-bgqd read cups config files
  - Add label rshim_var_run_t for /run/rshim.pid


author: Zdenek Pytela <zpytela@redhat.com> - 41.28-1
changelog:
  - Update virtqemud policy regarding the svirt_tcg_t domain
  - Allow virtqemud domain transition on numad execution
  - Support virt live migration using ssh
  - Allow virtqemud permissions needed for live migration
  - Allow virtqemud the getpgid process permission
  - Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  - Allow virtqemud relabelfrom virt_log_t files
  - Allow virtqemud relabel tun_socket
  - Add policy for systemd-import-generator
  - Confine vsftpd systemd system generator
  - Allow virtqemud read and write sgx_vepc devices
  - Allow systemd-networkd list cgroup directories
  - Allow xdm dbus chat with power-profiles-daemon
  - Allow ssh_t read systemd config files
  - Add Valkey rules to Redis module


author: Zdenek Pytela <zpytela@redhat.com> - 41.29-1
changelog:
  - Allow virtqemud domain transition to nbdkit
  - Add nbdkit interfaces defined conditionally
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  - Confine the switcheroo-control service
  - Allow svirt_t read sysfs files
  - Add rhsmcertd interfaces
  - Add the ssh_exec_sshd() interface
  - Add the gpg_domtrans_agent() interface
  - Label /usr/bin/dnf5 with rpm_exec_t
  - Label /dev/pmem[0-9]+ with fixed_disk_device_t
  - allow kdm to create /root/.kde/ with correct label
  - Change /usr/sbin entries to use /usr/bin or remove them
  - Allow systemd-homed get filesystem quotas
  - Allow login_userdomain getattr nsfs files
  - Allow virtqemud send a generic signal to the ssh client domain
  - Dontaudit request-key read /etc/passwd


author: Zdenek Pytela <zpytela@redhat.com> - 41.30-1
changelog:
  - Allow systemd-generator connect to syslog over a unix stream socket
  - Allow virtqemud manage fixed disk device nodes
  - Allow iio-sensor-proxy connect to syslog over a unix stream socket
  - Allow virtstoraged write to sysfs files
  - Allow power-profiles-daemon write sysfs files
  - Update iiosensorproxy policy
  - Allow pcmsensor write nmi_watchdog state information
  - Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  - Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  - Add the gpg_read_user_secrets() interface
  - Allow gnome-remote-desktop read resolv.conf
  - Update switcheroo policy
  - Allow nfsidmap connect to systemd-homed over a unix socket
  - Add the auth_write_motd_var_run_files() interface
  - Add the bind_exec_named_checkconf() interface
  - Add the virt_exec_virsh() interface


author: Zdenek Pytela <zpytela@redhat.com> - 41.31-1
changelog:
  - Allow snapperd execute systemctl in the caller domain
  - Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  - Allow iio-sensor-proxy read iio devices
  - Label /dev/iio:device[0-9]+ devices
  - Allow systemd-coredump the sys_admin capability
  - Allow apcupsd's apccontrol to send messages using wall
  - contrib/thumb: also allow per-user thumbnailers
  - contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  - Allow virt_domain to use pulseaudio - conditional
  - Allow pcmsensor read nmi_watchdog state information
  - Allow init_t nnp domain transition to gssproxy_t


author: Zdenek Pytela <zpytela@redhat.com> - 41.32-1
changelog:
  - Allow virtqemud use hostdev usb devices conditionally
  - Allow virtqemud map svirt_image_t plain files
  - Allow virtqemud work with nvdimm devices
  - Support saving and restoring a VM to/from a block device
  - Allow virtnwfilterd dbus chat with firewalld
  - Dontaudit systemd-logind remove all files
  - Add the files_dontaudit_read_all_dirs() interface
  - Add the files_dontaudit_delete_all_files() interface
  - Allow rhsmcertd notify virt-who
  - Allow irqbalance to run unconfined scripts conditionally
  - Fix binsbin-convert.sh to handle exceptions


author: Zdenek Pytela <zpytela@redhat.com> - 41.33-1
changelog:
  - Allow systemd-networkd the sys_admin capability
  - Update systemd-networkd policy in systemd v257
  - Separate insights-core from insights-client
  - Removed unused insights_client interfaces calls from other modules
  - Update policy for insights_client wrt new rules for insights_core_t
  - Add policy for insights-core
  - Allow systemd-networkd use its private tmpfs files
  - Allow boothd connect to systemd-machined over a unix socket
  - Update init_explicit_domain() interface
  - Allow tlp to read/write nmi_watchdog state information
  - Allow power-profiles-daemon the bpf capability
  - Allow svirt_t to connect to nbdkit over a unix stream socket
  - Update ktlshd policy to read /proc/keys and domain keyrings
  - Allow virt_domain read hardware state information unconditionally
  - Allow init mounton crypto sysctl files
  - Rename winbind_rpcd_* types to samba_dcerpcd_*
  - Support peer-to-peer migration of vms using ssh


author: Zdenek Pytela <zpytela@redhat.com> - 41.34-1
changelog:
  - Add context for plymouth debug log files
  - Allow rlimit inheritance for domains transitioning to local_login_t
  - Update insights-core policy
  - Allow insights-core map all non-security files
  - Allow insights-core map audit config and log files
  - Allow insights-client manage insights_client_var_log_t files
  - Remove duplicate dev_rw_dma_dev(xdm_t)
  - Allow thumbnailer read and write the dma device
  - Allow named_filetrans_domain filetrans raid/mdadm named content
  - Allow afterburn to mount and read config drives
  - Allow mptcpd the net_admin capability


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 256.6-4
changelog:
  - Make backports Meta specific
  - Only apply backports when building the Meta specific build
  - Use a custom patch range for the Meta specific backports so we don't
    conflict with the ones from Fedora
  - Backport PrivateUsers=identity as well


author: Daan De Meyer <daan.j.demeyer@gmail.com> - 256.7-2
changelog:
  - Backport various PRs to streamline upgrades
  - Logging improvements to help debug issues
  - Removing a fallback from the private manager bus to the system bus that
    isn't required and complicates debugging issues
  - Simplification of user manager reloads which also helps debugging issues
    by reducing what can go wrong during upgrades


author: Dominique Martinet <asmadeus@codewreck.org> - 0.9.0-1
changelog:
  - Update to 0.9.0
  - fix fd leak (probably #2290715)
  - enable lz4 compression by default
  - add supprt for av1 software encoding/decoding
  - add support for vsock transport
  - fix build with gcc-14


author: Dominique Martinet <asmadeus@codewreck.org> - 0.9.1-1
changelog:
  - Update to 0.9.1
  - don't abort on double-^C (#2262447)
  - fix for compositors using drm_syncobj protocol


