# changelog

author: Zdenek Pytela <zpytela@redhat.com> - 45.8-1
changelog:
  - Include key_socket in socket_class_set
  - Remove 14 permissive domains
  - ci: Run cockpit-machines tests in PRs
  - Remove the lockdown class from the policy


author: Zdenek Pytela <zpytela@redhat.com> - 45.9-1
changelog:
  - Allow init_t nnp domain transition to postgresql_t
  - Move bootupd systemd interface to 2 optional blocks
  - Allow net_admin to the nfsd_t domain
  - Allow kernel write to unconfined and sysadm users' keys
  - Allow staff user ioctl cockpit-session stream sockets
  - Allow the staff user mount on tmpfs directories
  - Allow staff user the dac_override capability in the user namespace
  - Allow aide get attributes of all filesystems
  - Make insights_client_t accessible from the system cronjob
  - Support systemtap on a UEFI+SecureBoot system
  - Allow systemd-coredump signull spc container
  - Allow dhcpcd hook scripts read generic files in /proc


author: Zdenek Pytela <zpytela@redhat.com> - 45.10-1
changelog:
  - Changes adapting to bind packages with suffixes
  - Dontaudit unconfined_t map its private directories
  - Support cronie create crontab backups
  - Allow nfsidmapd read virt lib files
  - Allow sysadm_t run and read/write networkmanager bpf programs
  - Allow dhcpc_hook_t connect to init_t over a unix stream socket
  - Allow unconfined_t mounton its lnk_files
  - Allow wireguard read cgroup files
  - Label /usr/local/share/man with man_t
  - Allow pcscd get attributes of a pty filesystem
  - Allow geoclue read cgroup files


author: Zdenek Pytela <zpytela@redhat.com> - 45.11-1
changelog:
  - Allow ctdbd manage access to Samba PID directories
  - Allow rhsmcertd read selinux config and default file contexts
  - Allow staff_t and user_t execute udev without a domain transition
  - Allow mpd dbus chat with avahi
  - Allow init_t nnp domain transition to mpd_t
  - Update tuned-ppd policy
  - Update policy for virsh_ssh_t to help with live migration
  - Update sysadm policy for encrypted volumes usage
  - Allow bootupd read all passwd sources
  - Allow local login and sshd-session signull cockpit-session
  - Allow sysadm_t read/write kvm devices
  - Allow sysadm user run fail2ban-client
  - Add 2 interfaces helping to handle cloud-what cache files
  - Allow all domains to use inherited sshd-session pipes
  - Dontaudit tlp_t dac_override (bsc#1272935)
  - Use NetworkManager_t instead of networkmanager_t


author: Zdenek Pytela <zpytela@redhat.com> - 45.12-1
changelog:
  - Update qatlib policy
  - Allow rhsmcertd read the file_contexts files
  - rhsmcertd: allow bootc/ostree transient package persistence detection
  - Allow virtproxyd connect to systemd-homed over a unix stream socket
  - Allow system_mail_t read procmail home content
  - Label malware-detection-config.yml with insights_client_etc_rw_t
  - Add bcachefs as a SELinux capable filesystem
  - Allow unconfined_service_t nnp_transition to container_runtime_t
  - Add the files_write_system_conf_files() interface
  - Allow haveged (entropyd_t)  create and use its private tmpfs files


author: Zdenek Pytela <zpytela@redhat.com> - 45.13-1
changelog:
  - Allow namespace_init_t execute generic programs in bin directories
  - Update the ssh_server_template() template
  - Add rules for sshd vsock socket read/write
  - Allow dhcpc hook query the chronyd service
  - Allow insights-client read gconf home files
  - Allow login_userdomain mount, remount, unmount all mount points
  - Allow login_userdomain mount on all mount points
  - Revert "Allow userdomain get attributes of files on an nsfs filesystem"
  - Allow accountsd create and use its private tmpfs files
  - Add the anaconda_read_state_install() interface


author: Zdenek Pytela <zpytela@redhat.com> - 45.14-1
changelog:
  - Label malware-detection-config.yml with insights_client_etc_rw_t
  - Add the files_write_system_conf_files() interface
  - Allow bluez dbus api pass sockets over dbus
  - Support sandboxing features for sysadm_t
  - Update dhcpc-hook policy
  - Allow dhcpc hook query the chronyd service
  - Support gnome-remote-desktop's smartcard redirection support
  - Allow gnome-remote-desktop read sssd public files
  - Allow gnome-remote-desktop connect to unreserved ports
  - Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  - Label /run/audit with auditd_var_run_t
  - Allow auditd manage its private run dirs
  - Allow virtqemud relabelfrom its private fifo files
  - Update the ssh_server_template() template
  - Add rules for sshd vsock socket read/write
  - Allow sshd-auth/sshd-session get attributes of their sshd parent
  - Allow qatlib manage hugetlbfs directories
  - Allow sanlock the sys_admin capability
  - Allow lsmd-plugin use libStorageMgmt to provision storage
  - Allow insights-client read gconf home files
  - rhsmcertd: allow bootc/ostree transient package persistence detection
  - Allow rhsmcertd read the file_contexts files
  - Allow rhsmcertd read selinux config and default file contexts
  - Use NetworkManager_t instead of networkmanager_t


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.15-1
changelog:
  - restorecon.py: exclude more paths
  - Improve disable_ipv6 plugin then_text
  - Update generated configuration files
  - Update translations


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.36-1
changelog:
  - audit_data: include syslog when needed
  - Rename appdata to metainfo
  - Replace python-six with python 3 only code


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.37-1
changelog:
  - Migrate from libxml2 to xml.etree.ElementTree
  - Handle ImportError when setroubleshoot.browser is not available
  - Add support for multiple commands in fix_cmd


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.37-5
changelog:
  - Update GPL2 license texts to the latest version
  - Limit RPC request size in RequestReceiver to prevent memory exhaustion


author: Martin Osvald <mosvald@redhat.com> - 2.15.1-1
changelog:
  - Add several IANA-registered ports that were missing from /etc/services
    (rhbz#2460484)
  - tarantool 3301/tcp+udp  - Tarantool in-memory computing platform
  - roughtime 5319/tcp+udp  - Roughtime time synchronization (RFC 8915)
  - matter 5540/tcp+udp     - Matter smart home protocol
  - rms-agent 5994/tcp      - RMS Agent Listening Service
  - pgbackrest 8432/tcp     - PostgreSQL Backup
  - matrix-fed 8448/tcp     - Matrix Federation Protocol
  - ollama 11434/tcp        - Ollama local LLM server


author: Marta Lewandowska <mlewando@redhat.com> - 15.8-4
changelog:
  - Phase 1 of the bootloader updates proposal implementation
  - https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1


author: Michal Hlavinka <mhlavink@redhat.com> - 1:7.5-9
changelog:
  - use notify-send for notification for users with graphical sessions
  - smartd notify for all SMARTD_FAILTYPEs


author: Carl George <carlwgeorge@fedoraproject.org> - 3.51.2-1
changelog:
  - Update to 3.51.2
  - https://www.sqlite.org/releaselog/3_51_2.html
  - Resolves: rhbz#2417968
  - Include LICENSE.md file
  - Resolves: rhbz#2418961


author: Petr Khartskhaev <pkhartsk@redhat.com> - 3.52.0-1
changelog:
  - Update to version 3.52.0
  - Resolves: rhbz#2445301
  - Add sqlite3_rsync to the -tools subpackage
  - Resolves: rhbz#2441923


author: Petr Khartskhaev <pkhartsk@redhat.com> - 3.53.2-1
changelog:
  - Update to version 3.53.2
  - Enable the carray() table-valued function
  - Resolves: rhbz#2484543
  - Resolves: rhbz#2481057


author: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com> - 261.2-1
changelog:
  - Version 261.2
  - a bugfix release with correctness and security-relevant fixes too. 276
    patches, so too much to describe here.


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
changelog:
  - Backport upstream fix for savannah bug 65838, commit 1e6ce98e (fedora#2427654)
  - added "padding with zeros" info message (#2089298)
  - do not report disk error as file shrank (#2089316)
  - upstream fix for savannah bug 64581, commit 51142180
    (crash with TAR_OPTIONS) (fedora#2389217)
  - Backport fix for regression in the --no-overwrite-dir option
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html
  - Backport upstream changes to jailify extraction directory
    Includes related gnulib changes to add openat2
    Fixes CVE-2025-45582 (fedora#2380007)


author: Jerry James <loganjerry@gmail.com> - 2022.2.0-1
changelog:
  - Version 2022.2.0
  - Drop the doc subpackage which cannot be built due to missing deps
  - Add patch to disable -fcf-protection=full on non-x86 architectures


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.15-3
changelog:
  - Fixed SPDX license case, it was according to the SPDX standard, but
    now it should be more easy to validate with some XML validators


author: Vincent Mihalkovic <vmihalko@redhat.com> - 2.3.1-1
changelog:
  - update to 2.3.1, switch source to GitLab unix-tree archive
  - refresh patches for 2.3.1 (tree-static-analysis.patch tree.c hunk)


author: Patsy Griffin <patsy@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (#2338511)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  Update to tzdata-2025b (#2354293)
    - Chile's Aysén Region moves from -04/-03 to -03 year-round,
      diverging from America/Santiago and creating a new zone
      America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  Update to tzdata-2026b (#2461119)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Patsy Griffin <patsy@redhat.com> - 2026c-1
changelog:
  Update to tzdata-2026c (#2498187)
    - Alberta moved to permanent -06 on 2026-06-18.
    - Morocco moves to permanent +00 on 2026-09-20.


author: Michal Schorm <mschorm@redhat.com> - 2.3.14-4
changelog:
  - [cleanup] Drop obsolete MySQL-5 driver config from odbcinst.ini
  - [bugfix] Own /usr/lib64/unixODBC/ directory for ODBC connector plugins
  - [bugfix] Update MariaDB driver path in odbcinst.ini
  - [workaround] Remove broken Setup/Setup64 entries from PostgreSQL driver
    config
  - [bugfix] Update PostgreSQL driver path in odbcinst.ini


author: Michal Schorm <mschorm@redhat.com> - 2.3.14-7
changelog:
  - [refactor] Use consistent '/usr/lib64' macro syntax in '%files devel'
  - [enhancement] Add 'MDBTools' driver entry to 'odbcinst.ini'
  - [enhancement] Add missing 'Suggests' for all ODBC driver packages
  - [bugfix] Fix incorrect 'FileUsage' values in 'odbcinst.ini'
  - [bugfix] Remove dead 'Port' key from [FreeTDS] driver definition
  - [cleanup] Drop obsolete 'keep-typedefs.patch'
  - [design change] Enable ODBC driver search path, use bare library names in
    'odbcinst.ini'


author: Jakub Martisko <jamartis@redhat.com> - 6.0-65
changelog:
  - Zipinfo: remove the extra %c that cause invalid reads
  - Zipinfo: fix the whitespace formating of the help message
  Related: RHEL-59972


author: Jakub Martisko <jamartis@redhat.com> - 6.0-71
changelog:
  - Port some RHEL downstream patches to fedora
  - Fixes for RHEL-86228, RHEL-45997 + some issues found by coverity and other scans
  - Fixes for CVE-2022-0529 and 2022-0530 (Thanks Stewart Smith for the Heads up about these)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.114-14
changelog:
  - drop console.apps files as pam no longer uses those and pam_console
    was dropped https://fedoraproject.org/wiki/Changes/RemovePamConsole


author: Michael Jeanson <mjeanson@efficios.com> - 0.15.0-1
changelog:
  - New upstream release
  - The 'signal' flavour of liburcu was removed upstream
  - Enable compiler atomics


author: Michal Ruprich <mruprich@redhat.com> - 2.2.0-1
changelog:
  - New version 2.2.0
  - Resolves: rhbz#2298879 - Using options -nc and -O simultaneously causes existing files to be clobbered/truncated
  - Resolves: rhbz#2327788 - wget starts using non-working IPv6 addresses on dual stack
  - Resolves: rhbz#2327728 - Crash: "free(): double free detected in tcache 2" when using --load-cookies
  - Resolves: rhbz#2280151 - wget2 always re-downdloads when using custom output filename


author: Sun Haiyong <sunhaiyong@zdbr.net> - 3.2.9-3
changelog:
  - Add loongarch64 to the condition for using lib64 in the wx-config file.
  - Skip failing tests on riscv64


author: Pavel Reichl <preichl@redhat.com> - 7.0.1-1
changelog:
  - Update to upstream v7.0.1
  - Move xfs_healer systemd units from xfsprogs-xfs_scrub to main xfsprogs package
  - Related: rhbz#2467694


author: Peter Hutterer <peter.hutterer@redhat.com> - 2.45-1
changelog:
  - xkeyboard-config 2.45
    xkeyboard-config changed from /usr/share/X11/xkb to /usr/share/xkeyboard-config-2/,
    with the same contents and the old location symlinked to the new one.
    Add a pretrans script to move the old location to the new one to stick with the
    upstream packaging approach.


author: Jonathan Wright <jonathan@almalinux.org> - 1.60.4-1
changelog:
  - update to 1.60.4 rhbz#2334236
  - re-enable builds against libxml2, no more bundled libexpat
  - fixes rhbz#2310136
  - fixes rhbz#2310146
  - fixes rhbz#2310152


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.3.7-13
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
  - Fix build with GCC15 (Dominik Mierzejewski)


author: Richard W.M. Jones <rjones@redhat.com> - 1:5.8.3-1
changelog:
  - New upstream version 5.8.3 (fixes RHBZ#2453487, CVE-2026-34743)
  - Add Arabic language translations


