# changelog

author: Rafael Aquini <aquini@redhat.com> [2.6.32-551.el6]
changelog:
  - [net] netfilter: ipset: autoload set type modules safely (Jiri Pirko) [1208051]
  - [net] dynticks: avoid flow_cache_flush() interrupting every core (Marcelo Leitner) [1191559]
  - [x86] Mark Intel Broadwell-DE processor as supported (Steve Best) [1099685]
  - [x86] Mark Intel Skylake-S processor as supported (Steve Best) [1132156]
  - [x86] Mark Intel Skylake-Y processor as supported (Steve Best) [1194009]
  - [netdrv] mlx4_core: Fix error message deprecation for ConnectX-2 cards (Amir Vadai) [1157841]
  - [netdrv] mlx4_core: Deprecate error message at ConnectX-2 cards startup to debug (Amir Vadai) [1157841]
  - [netdrv] ixgbevf: Add code to check for Tx hang (John Greene) [1150344]
  - [netdrv] ixgbevf: Fix ordering of shutdown to correctly disable Rx and Tx (John Greene) [1150344]
  - [netdrv] ixgbevf: set vlan_features in a single write instead of several ORs (John Greene) [1150344]
  - [netdrv] ixgbevf: add RSS support for X550 (John Greene) [1150344]
  - [netdrv] ixgbevf: enable multiple queue support (John Greene) [1150344]
  - [netdrv] ixgbevf: Fix checksum error when using stacked vlan (John Greene) [1150344]
  - [netdrv] ixgbevf: fix possible crashes in probe and remove (John Greene) [1150344]
  - [netdrv] ixgbevf: add support for X550 VFs (John Greene) [1150344]
  - [netdrv] ixgbevf: compare total_rx_packets and budget in ixgbevf_clean_rx_irq (John Greene) [1150344]
  - [netdrv] ixgbevf: Update Rx next to clean in real time (John Greene) [1150344]
  - [netdrv] ixgbevf: reorder main loop in ixgbe_clean_rx_irq to allow for do/while/continue (John Greene) [1150344]
  - [netdrv] ixgbevf: Cleanup variable usage, improve stack performance (John Greene) [1150344]
  - [netdrv] ixgbevf: Combine the logic for post Rx processing into single function (John Greene) [1150344]
  - [netdrv] ixgbevf: Test Rx status bits directly out of the descriptor (John Greene) [1150344]
  - [netdrv] ixgbevf: Update ixgbevf_alloc_rx_buffers to handle clearing of status bits (John Greene) [1150344]
  - [netdrv] ixgbevf: remove useless bd_number from struct ixgbevf_adapter (John Greene) [1150344]
  - [netdrv] ixgbevf: Resolve missing-field-initializers warnings (John Greene) [1150344]
  - [netdrv] ixgbevf: introduce delay for checking VFLINKS on 82599 (John Greene) [1150344]
  - [netdrv] ixgbevf: Remove unused get_supported_physical_layer pointer (John Greene) [1150344]
  - [netdrv] ixgbevf: do vlan cleanup (John Greene) [1150344]
  - [netdrv] ibmveth: Add function to enable live MAC address changes (Gustavo Duarte) [1198748]
  - [netdrv] ibmveth: Add function to enable live MAC address changes (Gustavo Duarte) [1198748]
  - [tools] perf: Fix race in build_id_cache__add_s() (Milos Vyletel) [1204102]
  - [edac] sb_edac: Add support for Broadwell-DE processor (Seth Jennings) [1197939]
  - [edac] sb_edac: Fix typo computing number of banks (Seth Jennings) [1197939]
  - [acpi] memhotplug: add parameter to disable memory hotplug (Igor Mammedov) [1207249]
  - [acpi] processor: Convert apic_id to phys_id to make it arch agnostic (Prarit Bhargava) [1201164]
  - [acpi] processor: Make it possible to get local x2apic id via _MAT (Prarit Bhargava) [1201164]
  - [acpi] scan: bail out early if failed to parse APIC ID for CPU (Prarit Bhargava) [1201164]
  - [acpi] processor: use apic_id and remove duplicated _MAT evaluation (Prarit Bhargava) [1201164]
  - [acpi] processor: Introduce apic_id in struct processor to save parsed APIC id (Prarit Bhargava) [1201164]
  - [acpi] processor: export acpi_get_cpuid() (Prarit Bhargava) [1201164]
  - [acpi] video: Fix use_native_backlight selection logic (Benjamin Tissoires) [1205233]
  - [acpi] video: Change the default for video.use_native_backlight to 1 (Benjamin Tissoires) [1205233]
  - [acpi] video: Add systems that should favour native backlight interface (Benjamin Tissoires) [1205233]
  - [acpi] video: Do not register backlight if win8 and native interface exists (Benjamin Tissoires) [1205233]
  - [acpi] video: separate backlight control and event interface (Benjamin Tissoires) [1205233]
  - [acpi] video: correct acpi_video_bus_add error processing (Benjamin Tissoires) [1205233]
  - [acpi] video: use after input_unregister_device() (Benjamin Tissoires) [1205233]
  - [acpi] video: Don't start video device until its associated input device has been allocated (Benjamin Tissoires) [1205233]
  - [acpi] video: Harden video bus adding (Benjamin Tissoires) [1205233]
  - [acpi] video: fix unused but set variables in ACPI (Benjamin Tissoires) [1205233]
  - [acpi] video: use kasprintf (Benjamin Tissoires) [1205233]
  - [video] backlight: fix KABI breakage (Benjamin Tissoires) [1205233]
  - [video] backlight: introduce backlight_device_registered (Benjamin Tissoires) [1205233]
  - [video] backlight: add backlight type (Benjamin Tissoires) [1205233]
  - [acpi] preparation of backlight backports (Benjamin Tissoires) [1205233]
  - [acpi] acpica: expose OSI version (Benjamin Tissoires) [1205233]
  - [scsi] hpsa: dont meddle with hw which isn't ours (cciss) (Tomas Henzl) [1204886]
  - [scsi] be2iscsi: Bump driver version (Rob Evers) [1189845]
  - [scsi] be2iscsi: Fix kernel panic when device initialization fails (Rob Evers) [1189845]
  - [x86] tls: Interpret an all-zero struct user_desc as "no segment" (Kurt Stutsman) [1172798] {CVE-2014-8133}
  - [x86] tls: Don't validate lm in set_thread_area() after all (Kurt Stutsman) [1172798] {CVE-2014-8133}
  - [x86] tls: Disallow unusual TLS segments (Kurt Stutsman) [1172798] {CVE-2014-8133}
  - [x86] tls: Validate TLS entries to protect espfix (Kurt Stutsman) [1172798] {CVE-2014-8133}


author: Rafael Aquini <aquini@redhat.com> [2.6.32-552.el6]
changelog:
  - [fs] cifs: Don't replace dentries for dfs mounts (Sachin Prabhu) [1204047]
  - [fs] nfsv4: Don't decode fs_locations if we didn't ask for them (Benjamin Coddington) [1206695]
  - [usb] storage: Use normalized sense when emulating autosense (Gopal Tiwari) [1202951]
  - [scsi] virtio-scsi: avoid cancelling uninitialized work items (Paolo Bonzini) [1066623]
  - [sound] alsa: hda_intel: apply the Seperate stream_tag for Sunrise Point (Adrian Huang) [1209541]
  - [netdrv] qlcnic: Update version to 5.3.62.1 (Chad Dupuis) [1196516]
  - [netdrv] qlcnic: Delete existing multicast MAC list before adding new (Chad Dupuis) [1196516]
  - [netdrv] bnx2x: Force fundamental reset for EEH recovery (Michal Schmidt) [1199576]
  - [drivers] core: fix possible missing of device probe (Michal Schmidt) [1149614]
  - [drivers] core: deferral race condition fix (Michal Schmidt) [1149614]
  - [drivers] core: Fix ordering between deferred_probe and exiting initcalls (Michal Schmidt) [1149614]
  - [drivers] core: Move deferred devices to the end of dpm_list before probing (Michal Schmidt) [1149614]
  - [drivers] core: fixup reversed deferred probe order (Michal Schmidt) [1149614]
  - [drivers] core: KABI fix, put deferred_probe in device_private under __GENKSYMS__ (Michal Schmidt) [1149614]
  - [drivers] core: move the deferred probe pointer into the private area (Michal Schmidt) [1149614]
  - [drivers] revert "core: fix addition of delayed probe infrastructure" (Michal Schmidt) [1149614]
  - [infiniband] qib: Fix potential NULL d_inode dereference (Doug Ledford) [1185095]
  - [infiniband] qib: Add support for the new QMH7360 card (Doug Ledford) [1185095]
  - [infiniband] qib: Do not write EEPROM (Doug Ledford) [1185095]
  - [infiniband] qib: remove pointless assignments (Doug Ledford) [1185095]
  - [infiniband] qib: Correct reference counting in debugfs qp_stats (Doug Ledford) [1185095]
  - [infiniband] qib: Change get_user_pages() usage to always NULL vmas (Doug Ledford) [1185095]
  - [infiniband] qib: Return error for unsupported QP creation flags (Doug Ledford) [1185095]
  - [infiniband] qib: Additional Intel branding changes (Doug Ledford) [1185095]
  - [infiniband] qib: Fix port in pkey change event (Doug Ledford) [1185095]
  - [infiniband] qib: Use pci_enable_msix_range() instead of pci_enable_msix() (Doug Ledford) [1185095]
  - [infiniband] ocrdma: Update sli data structure for endianness (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Report correct value of max_fast_reg_page_list_len (Doug Ledford) [1149273]
  - [infiniband] ocrdma: report asic-id in query device (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Fix off by one in ocrdma_query_gid() (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Use unsigned for bit index (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Help gcc generate better code for ocrdma_srq_toggle_bit (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Update the ocrdma module version string (Doug Ledford) [1149273]
  - [infiniband] ocrdma: set vlan present bit for user AH (Doug Ledford) [1149273]
  - [infiniband] ocrdma: remove reference of ocrdma_dev out of ocrdma_qp structure (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Add support for interrupt moderation (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Honor return value of ocrdma_resolve_dmac (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Allow expansion of the SQ CQEs via buddy CQ expansion of the QP (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Discontinue support of RDMA-READ-WITH-INVALIDATE (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Host crash on destroying device resources (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Do proper cleanup even if FW is in error state (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Report correct state in ibv_query_qp (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Debugfs enhancments for ocrdma driver (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Report correct count of interrupt vectors while registering ocrdma device (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Move PD resource management to driver (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Increase the GID table size (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Add support for IB stack compliant stats in sysfs (Doug Ledford) [1149273]
  - [infiniband] core: Replace ib_umem's offset field with a full address (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Always resolve destination mac from GRH for UD QPs (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Fix ocrdma_query_qp() to report q_key value for UD QPs (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Save the bit environment, spare unncessary parenthesis (Doug Ledford) [1149273]
  - [infiniband] ocrdma: The kernel has a perfectly good BIT() macro - use it (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Don't memset() buffers we just allocated with kzalloc() (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Remove a unused-label warning (Doug Ledford) [1149273]
  - [infiniband] ocrdma: Convert kernel VA to PA for mmap in user (Doug Ledford) [1149273]
  - [infiniband] ipoib: drop mcast_mutex usage (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: deserialize multicast joins (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: fix MCAST_FLAG_BUSY usage (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: No longer use flush as a parameter (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: Use dedicated workqueues per interface (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: Make the carrier_on_task race aware (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: Consolidate rtnl_lock tasks in workqueue (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: change init sequence ordering (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: factor out ah flushing (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: validate struct ipoib_cb size (Doug Ledford) [1141191 1145910]
  - [infiniband] ipoib: Remove unnecessary test for NULL before debugfs_remove() (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: Consolidate rtnl_lock tasks in workqueue" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: Make the carrier_on_task race aware" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: fix MCAST_FLAG_BUSY usage" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: fix mcast_dev_flush/mcast_restart_task race" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: change init sequence ordering" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: Use dedicated workqueues per interface" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: Make ipoib_mcast_stop_thread flush the workqueue" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: No longer use flush as a parameter" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: fix IPOIB_MCAST_RUN flag usage" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: Add a helper to restart the multicast task" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: make delayed tasks not hold up everything" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: Handle -ENETRESET properly in our callback" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: don't restart our thread on ENETRESET" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: remove unneeded locks" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: fix race between mcast_dev_flush and mcast_join" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: fix ipoib_mcast_restart_task" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: flush the ipoib_workqueue on unregister" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: cleanup a couple debug messages" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: make sure we reap all our ah on shutdown" (Doug Ledford) [1141191 1145910]
  - [infiniband] revert "ipoib: don't queue a work struct up twice" (Doug Ledford) [1141191 1145910]
  - [pci] msi: Fix pci_msix_vec_count() htmldocs failure (Doug Ledford) [1185095]
  - [pci] msi: Add pci_msix_vec_count() (Doug Ledford) [1185095]


author: Rafael Aquini <aquini@redhat.com> [2.6.32-553.el6]
changelog:
  - [scsi] fnic: IOMMU Fault occurs when IO and abort IO is out of order (Chris Leech) [1024066]
  - [scsi] fnic Driver crashed with NULL pointer reference (Chris Leech) [1024066]
  - [scsi] fnic: For Standalone C series, "sending VLAN request" message (Chris Leech) [1024066]
  - [scsi] fnic: Improper resue of exchange Ids (Chris Leech) [1024066]
  - [scsi] fnic: Memcopy only mimumum of data or trace buffer (Chris Leech) [1024066]
  - [scsi] fnic: assign FIP_ALL_FCF_MACS to fcoe_all_fcfs (Chris Leech) [1024066]
  - [scsi] fnic: part of treewide: fix errors in printk (Chris Leech) [1024066]
  - [scsi] fnic: fnic Control Path Trace Utility (Chris Leech) [1024066]
  - [scsi] fnic: Failing to queue aborts due to Q full cause terminate (Chris Leech) [1024066]
  - [scsi] fnic: NoFIP solicitation frame in NONFIP mode and changed IO (Chris Leech) [1024066]
  - [scsi] remove unnecessary pci_set_drvdata() (Chris Leech) [1024066]
  - [scsi] scsi: Convert uses of compare_ether_addr to ether_addr_equal (Chris Leech) [1024066]
  - [scsi] fnic: Incremented driver version (Chris Leech) [1024066]
  - [scsi] fnic: Fnic Statistics Collection (Chris Leech) [1024066]
  - [scsi] fnic: host reset returns nonzero value(errno) on (Chris Leech) [1024066]
  - [scsi] fnic: fnic Driver Tuneables Exposed through CLI (Chris Leech) [1024066]
  - [scsi] fnic: Kernel panic while running sh/nosh with max lun (Chris Leech) [1024066]
  - [scsi] fnic: Hitting BUG_ON(io_req->abts_done) (Chris Leech) [1024066]
  - [scsi] fnic: Remove QUEUE_FULL handling code (Chris Leech) [1024066]
  - [scsi] fnic: On system with >1.1TB RAM, VIC fails multipath (Chris Leech) [1024066]
  - [scsi] fnic: FC stat param seconds_since_last_reset not (Chris Leech) [1024066]
  - [scsi] lseek(fd, n, SEEK_END) does *not* go to eof - n (Chris Leech) [1024066]
  - [netdrv] tun: Fix csum_start with VLAN acceleration (Jason Wang) [1036482]
  - [netdrv] tun: unbreak truncated packet signalling (Jason Wang) [1036482]
  - [netdrv] tuntap: hardware vlan tx support (Jason Wang) [1036482]
  - [vhost] vhost-net: fix handle_rx buffer size (Jason Wang) [1036482]
  - [netdrv] mlx4_en: Reduce memory consumption on kdump kernel (Amir Vadai) [1100303]
  - [netdrv] mlx4_core: Use low memory profile on kdump kernel (Amir Vadai) [1100303]
  - [netdrv] mlx4: Use is_kdump_kernel() to detect kdump kernel (Amir Vadai) [1100303]
  - [kernel] crash_dump: Make is_kdump_kernel() accessible from modules (Amir Vadai) [1100303]


author: Rafael Aquini <aquini@redhat.com> [2.6.32-554.el6]
changelog:
  - [kabi] Adding symbol si_meminfo (Petr Oros) [1150668]
  - [kabi] Adding symbol pv_mmu_ops (Petr Oros) [1177818]
  - [kabi] Adding symbol mmput (Petr Oros) [1177818]
  - [kabi] Adding symbol get_task_mm (Petr Oros) [1177818]
  - [kabi] Adding symbol cpu_active_mask (Petr Oros) [1177818]
  - [kabi] Adding symbol __node_distance (Petr Oros) [1177818]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-555.el6]
changelog:
  - [crypto] testmgr: fix RNG return code enforcement (Herbert Xu) [1208804]
  - [netdrv] i40e: Fix RSS size at init since default num queue calculation has changed (Stefan Assmann) [1209444]
  - [netdrv] i40e: Move RSS table size for VSIs to the VSI struct (Stefan Assmann) [1209444]
  - [netdrv] i40e: Enable more than 64 qps for the Main VSI (Stefan Assmann) [1209444]
  - [netdrv] i40e: use netdev_rss_key_fill() helper (Stefan Assmann) [1209444]
  - [net] netfilter: xtables: make use of caller family rather than target family (Florian Westphal) [1210697]
  - [s390] dasd: fix panic in DASD driver during boot (Hendrik Brueckner) [1193535]
  - [md] dm-io: fix a race condition in the wake up code for sync_io (Mike Snitzer) [1205853]
  - [edac] sb_edac: fix corruption/crash on imbalanced Haswell home agents (Seth Jennings) [1210148]
  - [fs] proc: show all supplementary groups in /proc/pid/status (Jerome Marchand) [960050]
  - [kernel] futex: Take hugepages into account when generating futex_key (Jerome Marchand) [1193250]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-556.el6]
changelog:
  - [mm] readahead: get back a sensible upper limit (Rafael Aquini) [1187940]
  - [fs] quota: Properly invalidate caches even for filesystems with blocksize < pagesize (Lukas Czerner) [893926]
  - [fs] xfs: fix behaviour of XFS_IOC_FSSETXATTR on directories (Zorro Lang) [1200705]
  - [fs] xfs: allow logical-sector-sized DIO (Eric Sandeen) [1197195]
  - [fs] xfs: rename xfs_buftarg structure members (Eric Sandeen) [1197195]
  - [fs] xfs: clean up xfs_buftarg (Eric Sandeen) [1197195]
  - [fs] xfs: simplify xfs_setsize_buftarg callchain; remove unused arg (Eric Sandeen) [1197195]
  - [fs] fuse: avoid scheduling while atomic (Brian Foster) [1144128]
  - [fs] pipe: kill ->map() and ->unmap() (Brian Foster) [1144128]
  - [fs] fuse: use clear_highpage() and KM_USER0 instead of KM_USER1 (Brian Foster) [1144128]
  - [s390] af_iucv: fix AF_IUCV sendmsg() errno (Hendrik Brueckner) [1211173]
  - [s390] zcrypt: improve device probing for zcrypt adapter cards (Hendrik Brueckner) [1211174]
  - [cpufreq] fix null ptr dereference (Petr Oros) [1186720]
  - [powerpc] eeh: Remove reference to PCI device (Gustavo Duarte) [1189019]
  - [powerpc] pci: Override pcibios_release_device() (Gustavo Duarte) [1189019]
  - [powerpc] eeh: Export functions for hotplug (Gustavo Duarte) [1189019]
  - [pci] Add pcibios_release_device() (Gustavo Duarte) [1189019]
  - [netdrv] mlx4_en: do not ignore autoneg in mlx4_en_set_pauseparam (Amir Vadai) [1121491]
  - [netdrv] mlx4_core: Replace pr_warning with pr_warn (Amir Vadai) [1136753]
  - [netdrv] mlx4_core: Deprecate use_prio module parameter (Amir Vadai) [1136753]
  - [x86] intel_pstate: Add CPUID for BDW-H CPU (Steve Best) [1164883]
  - [x86] crypto: aesni - fix memory usage in GCM decryption (Kurt Stutsman) [1213330] {CVE-2015-3331}


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-557.el6]
changelog:
  - [firmware] cxgb4: update firmware to revision 1.13.32.0 for T4 and T5 (Jarod Wilson) [1189255]
  - [netdrv] cxgb4: Add warning msg when attaching to adapters which have FLASHes smaller than 2Mb (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Increase epd buff size for debug interface (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Configure 0B MRs to match HW implementation (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Fix locking issue in process_mpa_request (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Limit MRs to < 8GB for T4/T5 devices (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Wake up waiters after flushing the qp (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Handle NET_XMIT return codes (Sai Vemuri) [1211742]
  - [netdrv] libcxgbi: fix freeing skb prematurely (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: use set_wr_txq() to set tx queues (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: handle non-pdu-aligned rx data (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: additional types of negative advice (Sai Vemuri) [1211742]
  - [netdrv] cxgb4/cxgb4i: set the max. pdu length in firmware (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: fix credit check for tx_data_wr (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: fix tx immediate data credit check (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: Don't block unload/cxgb4 unload when remote closes TCP connection (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Update FW version string to match FW binary version 1.12.25.0 (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Add a check for flashing FW using ethtool (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fill in supported link mode for SFP modules (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix missing initialization of win0_lock (Sai Vemuri) [1211742]
  - [netdrv] cxgb4vf: FL Starvation Threshold needs to be larger than the SGE's Egress Congestion Threshold (Sai Vemuri) [1211742]
  - [netdrv] cxgb4/cxgb4vf: For T5 use Packing and Padding Boundaries for SGE DMA transfers (Sai Vemuri) [1211742]
  - [netdrv] cxgb4vf: Move fl_starv_thres into adapter->sge data structure (Sai Vemuri) [1211742]
  - [netdrv] cxgb4vf: Replace repetitive pci device ID's with right ones (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: send abort_rpl correctly (Sai Vemuri) [1211742]
  - [netdrv] libcxgbi: support ipv6 address host_param (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: Fix -Wmaybe-uninitialized warning (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: Fix -Wunused-function warning (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix build failure in cxgb4 when ipv6 is disabled/not in-built (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: Remove duplicated CLIP handling code (Sai Vemuri) [1211742]
  - [netdrv] cxgb4i: avoid holding mutex in interrupt context (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Fix ntuple calculation for ipv6 and remove duplicate line (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Take IPv6 into account for best_mtu and set_emss (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Make c4iw_wr_log_size_order static (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix FW flash logic using ethtool (Sai Vemuri) [1211742]
  - [netdrv] cxgb4vf: Add 40G support for cxgb4vf driver (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Wait for device to get ready before reading any register (Sai Vemuri) [1211742]
  - [netdrv] cxgb4/cxgb4vf: Updated the LSO transfer length in CPL_TX_PKT_LSO for T5 (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: clean up a type issue (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: potential shift wrapping bug (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Add support for adaptive rx (Sai Vemuri) [1211742]
  - [netdrv] cxgb4/cxgb4vf: Add Devicde ID for two more adapter (Sai Vemuri) [1211742]
  - [netdrv] cxgb4vf: Remove superfluous "idx" parameter of CH_DEVICE() macro (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Use BAR2 Going To Sleep (GTS) for T5 and later (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Don't allocate adapter structure for all PF's (Sai Vemuri) [1211742]
  - [netdrv] cxgb4/cxgb4vf: Add device ID for new adapter and remove for dbg adapter (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix t4_flash_erase_sectors() to throw an error when requested to erase sectors which aren't in the FLASH (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Add support to S25FL032P flash (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Allow T4/T5 firmware sizes up to 1MB (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Issue mbox commands on correct mbox (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Avoid dumping Write-only registers in register dump (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Detect and display firmware reported errors (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix T5 adapter accessing T4 adapter registers (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fixed the code to use correct length for part number (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix for handling 1Gb/s SFP+ Transceiver Modules (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Free completed tx skbs promptly (Sai Vemuri) [1211742]
  - [netdrv] cxgb4: Fix race condition in cleanup (Sai Vemuri) [1211742]
  - [infiniband] cxgb4: Only call CQ completion handler if it is armed (Sai Vemuri) [1211742]
  - [netdrv] iw_cxgb4: Don't limit TPTE count to 32KB (Sai Vemuri) [1211742]
  - [netdrv] iw_cxgb4: advertise the correct device max attributes (Sai Vemuri) [1211742]
  - [netdrv] iw_cxgb4: Support query_qp() verb (Sai Vemuri) [1211742]
  - [netdrv] iw_cxgb4: log detailed warnings for negative advice (Sai Vemuri) [1211742]
  - [scsi] cxgb4i: Fix ipv6 build failure caught with randconfig (Sai Vemuri) [1145278]
  - [scsi] cxgb4i: remove spurious use of rcu (Sai Vemuri) [1145278]
  - [scsi] cxgb4i: Guard ipv6 code with a config check (Sai Vemuri) [1145278]
  - [scsi] cxgb4i: Add ipv6 code to driver, call into libcxgbi ipv6 api (Sai Vemuri) [1145278]
  - [scsi] libcxgbi: Add ipv6 api to driver (Sai Vemuri) [1145278]
  - [scsi] cxgb4i: Use cxgb4_select_ntuple to correctly calculate ntuple fields (Sai Vemuri) [1145278]
  - [scsi] cxgb4i: add support for T5 adapter (Sai Vemuri) [1145278]
  - [scsi] csgb4i: convert skb->transport_header into skb_transport_header(skb) (Sai Vemuri) [1145278]
  - [netdrv] cxgb4: Export symbols required by cxgb4i for ipv6 support and required defines (Sai Vemuri) [1145278]
  - [netdrv] cxfb4vf: Add config option to enable Chelsio cxgb4vf driver (Sai Vemuri) [1112417]
  - [netdrv] cxfb4vf: Call dev_kfree/consume_skb_any instead of <dev_>kfree_skb (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Use pci_enable_msix_range() instead of pci_enable_msix() (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Turn off SGE RX/TX Callback Timers and interrupts in PCI shutdown routine (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Adds device ID for few more Chelsio T4 Adapters (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Check if rx checksum offload is enabled, while reading hardware calculated checksum (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Adds device Id for few more Chelsio adapters (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Remove superfluous call to pci_disable_msix() (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: make functions static and remove dead code (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: added much cleaner implementation of is_t4() (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: use DEFINE_PCI_DEVICE_TABLE (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: remove unnecessary pci_set_drvdata() (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Staticize local symbols (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Add support for Chelsio T5 adapter (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Add support for Chelsio's T480-CR and T440-LP-CR adapters (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Fix VLAN extraction counter increment (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Fix extraction of cpl_rx_pkt from the response queue descriptor (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Use netdev_<level> and pr_<level> (Sai Vemuri) [1112417 1145275]
  - [netdrv] cxgb4vf: remove __dev* attributes (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: do vlan cleanup (Sai Vemuri) [1112417]
  - [netdrv] cxgb<3, 4>*: improve Kconfig dependencies (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Use defined Mailbox Timeout (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Quiesce Virtual Interfaces on shutdown (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Behave properly when CONFIG_DEBUG_FS isn't defined (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Check driver parameters in the right place (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: recover from failure in cxgb4vf_open (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix mailbox data/control coherency domain race (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix setting unicast/multicast addresses (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Advertise NETIF_F_TSO_ECN (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix up "Section Mismatch" compiler warning (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: add ethtool statistics for GRO (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: minor comment/symbolic name cleanup (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: add call to Firmware to reset VF State (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Fail open if link_start() fails (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: flesh out PCI Device ID Table (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix some errors in Gather List to skb conversion (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix bug in Generic Receive Offload (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue() (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: remove call to stop TX queues at load time (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: make single bit signed bitfields unsigned (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Use netif_set_real_num_<rx, tx>_queues (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: do not use PCI resources before pci_enable_device() (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Fix bug where we were only allocating one queue in MSI mode (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Fix off-by-one error checking for the end of the mailbox delay array (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix SGE resource resource deallocation bug (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: fix TX Queue restart (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Implement "Unhandled Interrupts" statistic (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: remove obsolete DECLARE_PCI_UNMAP_ADDR usage (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Use correct shift factor for extracting the SGE DMA Ingress Padding Boundary (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Remove obsolete comment about the lack of a TX Timer Callback (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Stitch new T4 PCI-E SR-IOV Virtual Function driver into the build (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Add new Makefile for T4 PCI-E SR-IOV Virtual Function driver cxgb4vf (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Add main T4 PCI-E SR-IOV Virtual Function driver for cxgb4vf (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Add T4 Virtual Function Scatter-Gather Engine DMA code (Sai Vemuri) [1112417]
  - [netdrv] cxgb4vf: Add core T4 PCI-E SR-IOV Virtual Function hardware definitions and device communication code (Sai Vemuri) [1112417]
  - [infiniband] iw_cxgb4: fix for 64-bit integer division (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: only free allocated fls (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fixed incorrect check for memory operation in t4_memory_rw (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add the MC1 registers to read in the interrupt handler (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Update FW version string to match FW binary version (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix for SR-IOV VF initialization (Sai Vemuri) [1145275]
  - [netdrv] cxgb4i: Move stray CPL definitions to cxgb4 driver (Sai Vemuri) [1145275]
  - [netdrv] cxgb4/iw_cxgb4: Move common defines to cxgb4 (Sai Vemuri) [1145275]
  - [netdrv] cxgb4/iw_cxgb4: work request logging feature (Sai Vemuri) [1145275]
  - [netdrv] cxgb4/iw_cxgb4: display TPTE on errors (Sai Vemuri) [1145275]
  - [netdrv] cxgb4/iw_cxgb4: use firmware ord/ird resource limits (Sai Vemuri) [1145275]
  - [netdrv] iw_cxgb4: Detect Ing. Padding Boundary at run-time (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Initialize the device status page (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Clean up connection on ARP error (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix skb_leak in reject_cr() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: remove unnecessary null test before debugfs_remove_recursive (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Adds device ID for few more Chelsio T4 Adapters (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Replaced the backdoor mechanism to access the HW memory with PCIe Window method (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Use FW interface to get BAR0 value (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fixes cxgb4 probe failure in VM when PF is exposed through PCI Passthrough (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Not need to hold the adap_rcu_lock lock when read adap_rcu_list (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Change default Interrupt Holdoff Packet Count Threshold (Sai Vemuri) [1145275]
  - [netdrv] iw_cxgb4: don't truncate the recv window size (Sai Vemuri) [1145275]
  - [netdrv] iw_cxgb4: Choose appropriate hw mtu index and ISS for iWARP connections (Sai Vemuri) [1145275]
  - [netdrv] iw_cxgb4: Allocate and use IQs specifically for indirect interrupts (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: add missing padding at end of struct c4iw_alloc_ucontext_resp (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add missing padding at end of struct c4iw_create_cq_resp (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix vlan support (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Check if rx checksum offload is enabled, while reading hardware calculated checksum (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Decode the firmware port and module type a bit more for ethtool (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Decode PCIe Gen3 link speed (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Update Kconfig to include Chelsio T5 adapter (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Only allow kernel db ringing for T4 devs (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Force T5 connections to use TAHOE congestion control (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix endpoint mutex deadlocks (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: use the correct max size for firmware flash (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Save the correct mac addr for hw-loopback connections in the L2T (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix over-dereference when terminating (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use uninitialized_var() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add missing debug stats (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Initialize reserved fields in a FW work request (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use pr_warn_ratelimited (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Max fastreg depth depends on DSGL support (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: SQ flush fix (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: rmb() after reading valid gen bit (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Endpoint timeout fixes (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use the BAR2/WC path for kernel QPs and T5 devices (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Disable DSGL use by default (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: rx_data() needs to hold the ep mutex (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Drop RX_DATA packets if the endpoint is gone (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Lock around accept/reject downcalls (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: set error code on kmalloc() failure (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Adds device ID for few more Chelsio Adapters (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Remove addressof casts to same type (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Call dev_kfree/consume_skb_any instead of <dev_>kfree_skb (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Update snd_seq when sending MPA messages (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Connect_request_upcall fixes (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Ignore read reponse type 1 CQEs (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix possible memory leak in RX_PKT processing (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Don't leak skb in c4iw_uld_rx_handler() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Save the correct map length for fast_reg_page_lists (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Default peer2peer mode to 1 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Mind the sq_sig_all/sq_sig_type QP attributes (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix incorrect BUG_ON conditions (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Always release neigh entry (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Allow loopback connections (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Cap CQ size at T4_MAX_IQ_SIZE (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix four byte info leak in c4iw_create_cq() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix underflows in c4iw_create_qp() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes (Sai Vemuri) [1145275]
  - [netdrv] cxgb4/iw_cxgb4: Treat CPL_ERR_KEEPALV_NEG_ADVICE as negative advice (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Calculate len properly for LSO path (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Updates for T5 SGE's Egress Congestion Threshold (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Rectify emitting messages about SGE Ingress DMA channels being potentially stuck (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add code to dump SGE registers when hitting idma hangs (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix some small bugs in t4_sge_init_soft() when our Page Size is 64KB (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: use remove handler as shutdown handler (Sai Vemuri) [1145275]
  - [netdrv] cgxb4: Stop using ethtool SPEED_* constants (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add more PCI device ids (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Don't assume LSO only uses SGL path in t4_eth_xmit() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Remove unused registers and add missing ones (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Query firmware for T5 ULPTX MEMWRITE DSGL capabilities (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: LE-Workaround is not atomic in firmware (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Allow >10G ports to have multiple queues (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Print adapter VPD Part Number instead of Engineering Change field (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add support to recognize 40G links (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Use pci_enable_msix_range() instead of pci_enable_msix() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add missing neigh_release in LE-Workaround path (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix referencing freed adapter (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Don't retrieve stats during recovery (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix gcc warning on 32-bit arch (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Avoid disabling PCI device for towice (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: silence shift wrapping static checker warning (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Changed FW check version to match FW binary version (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: allow large buffer size to have page size (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use cxgb4_select_ntuple to correctly calculate ntuple fields (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Server filters are supported only for IPv4 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Calculate the filter server TID properly (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: make functions static and remove dead code (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add API to correctly calculate tuple fields (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Account for stid entries properly in case of IPv6 (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Assign filter server TIDs properly (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Include TCP as protocol when creating server filters (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Reserve stid 0 for T4/T5 adapters (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: calls skb_set_hash (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Make _c4iw_write_mem_dma() static (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix formatting of physical address (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add new scheme to update T4/T5 firmware (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Much cleaner implementation of is_t4()/is_t5() (Sai Vemuri) [1145275]
  - [netdrv] cgxb4: remove duplicate include in cxgb4.h (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: remove unnecessary pci_set_drvdata() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: remove workqueue when driver registration fails (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Issue RI.FINI before closing when entering TERM (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Advertise ~0ULL as max MR size (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Always do GTS write if cidx_inc == CIDXINC_MASK (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Set arp error handler for PASS_ACCEPT_RPL messages (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix accounting for unsignaled SQ WRs to deal with wrap (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix QP flush logic (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use correct bit shift macros for vlan filter tuples (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Handle newer firmware changes (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add support for active and passive open connection with IPv6 address (Sai Vemuri) [1145275]
  - [infiniband] cma: Add IPv6 support for iWARP (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add CLIP support to store compressed IPv6 address (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add routines to create and remove listening IPv6 servers (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix stack info leak in c4iw_create_qp() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Do not set net_device::dev_id to VI index (Sai Vemuri) [1145275]
  - [netdrv] cxgb3: Correct comparisons and calculations using skb->tail and skb-transport_header (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Force uninitialized state if FW_ON_ADAPTER is < FW_VERSION and we're the MASTER_PF (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: fix error recovery when t4_fw_hello returns a positive value (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix pci_device_id structure initialization with correct PF number (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix SQ allocation when on-chip SQ is disabled (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix error return code in create_qp() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix onchip queue support for T5 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Bump tcam_full stat and WR reply timeout (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Map pbl buffers for dma if using DSGL (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use DSGLs for fastreg and adapter memory writes for T5 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add module_params to enable DB FC & Coalescing on T5 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Turn off db coalescing when RDMA QPs are in use (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add Support for Chelsio T5 adapter (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Disable SR-IOV support for PF4-7 for T5 (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Update driver version and description (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add T5 PCI ids (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add T5 debugfs support (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Enable doorbell drop recovery only for T4 adapter (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add T5 write combining support (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Dump T5 registers (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Initialize T5 (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add macros, structures and inline functions for T5 (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add register definations for T5 (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Allow for backward compatibility with new VPD scheme (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix cast warning (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: "cookie" can stay in host endianness (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Address sparse warnings (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Insert hwtid in pass_accept_req instead in pass_establish (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Don't wakeup threads for MPAv2 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Don't reconnect on abort for mpa_rev 1 (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix endpoint timeout race condition (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Only log rx_data warnings if cpl status is non-zero (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Always log async errors (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Keep QP referenced until TID released (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Display streaming mode error only if detected in RTS (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Abort connections when moving to ERROR state (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Abort connections that receive unexpected streaming mode data (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix incorrect PFVF CMASK (Sai Vemuri) [1145275]
  - [netdrv] cxgb3/cxgb4: Use netdev_<level> and pr_<level> (Sai Vemuri) [1145275 1145278]
  - [infiniband] cxgb4: Fix bug for active and passive LE hash collision path (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix LE hash collision bug for passive open connection (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix LE hash collision bug for active open connection (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add LE hash collision bug fix path in LLD driver (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add T4 filter support (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: remove __dev* attributes (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Chelsio FCoE offload driver submission (common header updates) (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: use WARN (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix initialization of SGE_CONTROL register (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix unable to get UP event from the LLD (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Don't free chunk that we have failed to allocate (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Remove unnecessary #ifdef condition (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Address various sparse warnings (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: allocate enough data in t4_memory_rw() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix build error due to missing linux/vmalloc.h include (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Dynamically allocate memory in t4_memory_rw() and get_vpd_params() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Fix error handling in create_qp() (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Don't attempt to upgrade T4 firmware when cxgb4 will end up as a slave (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Inform caller if driver didn't upgrade firmware (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add support for T4 hardwired driver configuration settings (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add support for T4 configuration file (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Code cleanup to enable T4 Configuration File support (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Add functions to read memory via PCIE memory window (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Fix incorrect values for MEMWIN*_APERTURE and MEMWIN*_BASE (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Move dereference below NULL test (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Remove duplicate register definitions (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Update RDMA/cxgb4 due to macro definition removal in cxgb4 driver (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: set maximal number of default RSS queues (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Include vmalloc.h for vmalloc and vfree (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use vmalloc() for debugfs QP dump (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Add debugfs RDMA memory stats (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Convert import_ep() over to dst_neigh_lookup() (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Debugfs dump_qp() updates (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Use ULP_MODE_TCPDDP (Sai Vemuri) [1145275]
  - [infiniband] cxgb4: Turn on delayed ACK (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: Use netif_set_real_num_<rx, tx>_queues (Sai Vemuri) [1145275]
  - [netdrv] cxgb4: set skb->rxhash (Sai Vemuri) [1145275]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-558.el6]
changelog:
  - [x86] mm: Linux stack ASLR implementation (Jacob Tanenbaum) [1195683] {CVE-2015-1593}
  - [scsi] megaraid_sas: do not process IOCTLs and SCSI commands during driver removal - a fix (Tomas Henzl) [1212364]
  - [fs] xfs: DIO write completion size updates race (Brian Foster) [1198440]
  - [x86] KVM: Fix lost interrupt on irr_pending race (Paolo Bonzini) [1213741]
  - [sound] ALSA: seq-oss: Initialize MIDI clients asynchronously (Jaroslav Kysela) [1212596]
  - [net] ipv6: Don't reduce hop limit for an interface (Denys Vlasenko) [1208493] {CVE-2015-2922}
  - [net] vlan: more careful checksum features handling (Vlad Yasevich) [1212384]
  - [kernel] tracing: Export tracing clock functions (Jerry Snitselaar) [1212502]
  - [input] wacom - use new input-mt routines (Aristeu Rozanski) [1111332 1111333]
  - [input] wacom: enable touch on Intuos 5 (Aristeu Rozanski) [1111332 1111333]
  - [netdrv] bnx2x: Fix kdump when iommu=on (Michal Schmidt) [1211695]
  - [netdrv] bnx2x: Fix busy_poll vs netpoll (Michal Schmidt) [1212365]
  - [netdrv] bnx2x: Fix statistics locking scheme (Michal Schmidt) [1211695]
  - [netdrv] bnx2x: Fix kdump on 4-port device (Michal Schmidt) [1211695]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-559.el6]
changelog:
  - [x86] perf: Add cpu_<prepare|starting|dying> for core_pmu (Jiri Olsa) [1188336]
  - [block] NVMe: Initialize device list head before starting (David Milburn) [1158606]
  - [block] NVMe: Fix potential corruption on sync commands (David Milburn) [1158606]
  - [block] NVMe: Fix potential corruption during shutdown (David Milburn) [1158606]
  - [block] NVMe: Asynchronous controller probe (David Milburn) [1158606]
  - [block] NVMe: Register management handle under nvme class (David Milburn) [1158606]
  - [block] NVMe: Update module version (David Milburn) [1158606]
  - [block] NVMe: Handling devices incapable of I/O (David Milburn) [1158606]
  - [x86] Mark Intel Broadwell-EP processor as supported (Steve Best) [1132146]
  - [fs] nfs: Don't attempt to decode missing directory entries (Benjamin Coddington) [1182830]
  - [acpi] Skip creation of /proc/acpi/power_resource/ entries for duplicate power resource names (Lenny Szubowicz) [1206643]
  - [powerpc] perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH (Steve Best) [1213966]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-560.el6]
changelog:
  - [powercap] RAPL: Add support for Intel Skylake processors (Steve Best) [1187314]
  - [powercap] rapl: add ID for Broadwell server (Steve Best) [1189925]
  - [s390] dasd: Fix unresumed device after suspend/resume having no paths (Hendrik Brueckner) [1213800]
  - [s390] dasd: fix inability to set a DASD device offline (Hendrik Brueckner) [1213799]
  - [s390] dasd: fix unresumed device after suspend/resume (Hendrik Brueckner) [1213801]
  - [netdrv] netvsc: don't flush peers notifying work during setting mtu (Jason Wang) [1203623]
  - [input] wacom: clear ABS_MISC on the touch device (Aristeu Rozanski) [1111332 1111333]
  - [x86] asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Mateusz Guzik) [1209233] {CVE-2015-2830}
  - [fs] gfs2: try harder to obtain journal lock during recovery (Abhijith Das) [1110846]
  - [thermal] intel_powerclamp: add id for broadwell server (Steve Best) [1189954]
  - [net] Fix checksum features handling in netif_skb_features() (Vlad Yasevich) [1220247]
  - [scsi] megaraid_sas : Modify return value of megasas_issue_blocked_cmd() and wait_and_poll() to consider command status returned by firmware (Tomas Henzl) [1219105]
  - [netdrv] Revert "netxen: remove init of dev->perm_addr in drivers" (Tony Camuso) [1213689]
  - [ppc] Build RPA PCI Hotplug driver as module instead of directly into the kernel (Gustavo Duarte) [1095456]
  - [drm] radeon: fix wait in radeon_mn_invalidate_range_start (Rob Clark) [1218794]
  - [drm] i915: Fix and clean BDW PCH identification (Rob Clark) [1218794]
  - [drm] i915/vlv: save/restore the power context base reg (Rob Clark) [1218794]
  - [drm] radeon: Do not directly dereference pointers to BIOS area. (Rob Clark) [1218794]
  - [kernel] makefile: update drm version (Rob Clark) [1218794]
  - [drm] i915/vlv: remove wait for previous GFX clk disable request (Rob Clark) [1218794]
  - [drm] radeon: add extra check in radeon_ttm_tt_unpin_userptr (Rob Clark) [1218794]
  - [drm] i915: Reject the colorkey ioctls for primary and cursor planes (Rob Clark) [1218794]
  - [drm] radeon/dpm: fix 120hz handling harder (Rob Clark) [1218794]
  - [drm] radeon: do a posting read in cik_set_irq (Rob Clark) [1218794]
  - [drm] i915/vlv: remove wait for previous GFX clk disable request (Rob Clark) [1218794]
  - [drm] i915: Align initial plane backing objects correctly (Rob Clark) [1218794]
  - [drm] radeon: drop ttm two ended allocation (Rob Clark) [1218794]
  - [drm] edid: set ELD for firmware and debugfs override EDIDs (Rob Clark) [1218794]
  - [drm] radeon: drop setting UPLL to sleep mode (Rob Clark) [1218794]
  - [drm] radeon: do a posting read in si_set_irq (Rob Clark) [1218794]
  - [drm] radeon: fix interlaced modes on DCE8 (Rob Clark) [1218794]
  - [drm] Fixup racy refcounting in plane_force_disable (Rob Clark) [1218794]
  - [drm] Don't assign fbs for universal cursor support to files (Rob Clark) [1218794]
  - [drm] radeon: fix wait to actually occur after the signaling callback (Rob Clark) [1218794]
  - [drm] radeon: do a posting read in rs600_set_irq (Rob Clark) [1218794]
  - [drm] i915: Dell Chromebook 11 has PWM backlight (Rob Clark) [1218794]
  - [drm] radeon: do a posting read in evergreen_set_irq (Rob Clark) [1218794]
  - [drm] radeon: do a posting read in r600_set_irq (Rob Clark) [1218794]
  - [drm] i915: avoid processing spurious/shared interrupts in low-power states (Rob Clark) [1218794]
  - [drm] radeon: do a posting read in r100_set_irq (Rob Clark) [1218794]
  - [drm] i915: Prevent use-after-free in invalidate_range_start callback (Rob Clark) [1218794]
  - [drm] i915: Check obj->vma_list under the struct_mutex (Rob Clark) [1218794]
  - [drm] radeon: fix DRM_IOCTL_RADEON_CS oops (Rob Clark) [1218794]
  - [drm] i915/bdw: PCI IDs ending in 0xb are ULT. (Rob Clark) [1218794]
  - [drm] i915: Correct the IOSF Dev_FN field for IOSF transfers (Rob Clark) [1218794]
  - [drm] radeon: fix 1 RB harvest config setup for TN/RL (Rob Clark) [1218794]
  - [drm] i915: Insert a command barrier on BLT/BSD cache flushes (Rob Clark) [1218794]
  - [drm] radeon: use drm_mode_vrefresh() rather than mode->vrefresh (Rob Clark) [1218794]
  - [drm] i915: Drop vblank wait from intel_dp_link_down (Rob Clark) [1218794]
  - [drm] radeon: enable native backlight control on old macs (Rob Clark) [1218794]
  - [drm] radeon: fix voltage setup on hawaii (Rob Clark) [1218794]
  - [drm] radeon/dp: Set EDP_CONFIGURATION_SET for bridge chips if necessary (Rob Clark) [1218794]
  - [drm] radeon: workaround for CP HW bug on CIK (Rob Clark) [1218794]
  - [drm] radeon: only enable kv/kb dpm interrupts once v3 (Rob Clark) [1218794]
  - [drm] radeon: Don't try to enable write-combining without PAT (Rob Clark) [1218794]
  - [netdrv] i40e/i40evf: implement KR2 support (Stefan Assmann) [1214872]
  - [kernel] ethtool, net/mlx4_en: Add 100M, 20G, 56G speeds ethtool reporting support (Stefan Assmann) [1214872]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-561.el6]
changelog:
  - [net] Reinstate WIRELESS_EXT_SYSFS in net/wireless/Kconfig (John Linville) [1219434]
  - [netdrv] cxgb4: Firmware macro changes for fw verison 1.13.32.0 (Sai Vemuri) [1219233]
  - [netdrv] cxgb4: Move firmware version MACRO to t4fw_version.h (Sai Vemuri) [1219233]
  - [netdrv] be2net: fix SR-IOV resources optimization (Ivan Vecera) [1211535]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-563.el6]
changelog:
  - [net] tcp: relax tcp_paws_check() (Thadeu Lima de Souza Cascardo) [1209147]
  - [x86] Mark Intel Broadwell-H processor as supported (Steve Best) [1132147]
  - [x86] kernel: ignore NMI IOCK when in kdump kernel (Jerry Snitselaar) [1196263]
  - [kernel] virtio: don't expose u16 in userspace api (Michael S. Tsirkin) [1154634]
  - [x86] apic/uv: Update the UV APIC HUB check (George Beshers) [1219207]
  - [x86] apic/uv: Update the UV APIC driver check (George Beshers) [1219207]
  - [x86] apic/uv: Update the APIC UV OEM check (George Beshers) [1219207]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-564.el6]
changelog:
  - [tools] perf trace: Handle legacy syscalls tracepoints (Jiri Olsa) [1212402]
  - [scsi] qla2xxx: fix busy wait regression (Chad Dupuis) [1207270]
  - [fs] eCryptfs: Remove buggy and unnecessary write in file name decode routine (Mateusz Guzik) [1202156] {CVE-2014-9683}
  - [net] ipv4: Missing sk_nulls_node_init in ping_unhash (Denys Vlasenko) [1218103] {CVE-2015-3636}
  - [s390] dasd: disable CUIR support for z/VM (Hendrik Brueckner) [1223721]
  - [ata] ahci: avoton port-disable reset-quirk (David Milburn) [1223187]
  - [inifinband] iw_cxgb4: don't call neigh_release (Sai Vemuri) [1215835]
  - [fs] sunrpc: Set alloc_slot for backchannel tcp ops (Sachin Prabhu) [1208339]
  - [fs] epoll: convert max_user_watches to long (George Beshers) [741705]
  - [firmware] cxgb4: add missing Makefile invocation for 1.13.32.0 images (Jarod Wilson) [1189255]
  - [fs] proc: make proc_fd_permission() thread-friendly (Carlos Maiolino) [1201593]
  - [acpi] scan: reduce log level of "ACPI: \_PR_.CPU4: failed to get CPU APIC ID" (Charles Rose) [1222466]
  - [netdrv] mlx5: wrong page mask if CONFIG_ARCH_DMA_ADDR_T_64BIT enabled for 32Bit architectures (Doug Ledford) [1141604]
  - [netdrv] vmxnet3: Receive vlan stripped frames in hwaccel path (Neil Horman) [1218404]
  - [fs] NFSv4.1: Deal effectively with interrupted RPC calls (Steve Dickson) [1200956]
  - [fs] NFSv4.1: Try to deal with NFS4ERR_SEQ_MISORDERED (Steve Dickson) [1200956]
  - [fs] NFSv4.1: Handle NFS4ERR_BADSLOT errors correctly (Steve Dickson) [1200956]
  - [kernel] cgroup: fix cgroup_rmdir vs close<eventfd> race (Johannes Weiner) [1167772]
  - [thermal] intel_powerclamp: add id for Avoton SoC (Steve Best) [1225544]
  - [kernel] tracing: Buffer the output of seq_file in case of filled buffer (Jiri Olsa) [1123102]
  - [kernel] tracing: Consolidate protection of reader access to the ring buffer (Jiri Olsa) [1123102]
  - [kernel] tracing: Fix ring_buffer_read_page reading out of page boundary (Jiri Olsa) [1123102]
  - [kernel] ring-buffer: Check for end of page in iterator (Jiri Olsa) [1123102]
  - [netdrv] be2net: use PCI MMIO read instead of config read for errors (Ivan Vecera) [1216088]
  - [thermal] powerclamp: add ids for future xeon cpus (Steve Best) [1183181]
  - [powercap] RAPL: add IDs for future Xeon CPUs (Steve Best) [1183177]
  - [net] flow_dissector: fail on evil iph->ihl (Jason Wang) [1179559]
  - [netdrv] hyperv: Add IPv6 into the hash computation for vRSS (Jason Wang) [1179559]
  - [netdrv] hyperv: Add handling of IP header with option field in netvsc_set_hash (Jason Wang) [1179559]
  - [net] bridge: check return value of ipv6_dev_get_saddr() (Thadeu Lima de Souza Cascardo) [765987]
  - [net] bridge: Fix possibly wrong MLD queries' ethernet source address (Thadeu Lima de Souza Cascardo) [765987]
  - [net] bridge: Use IPv6 link-local address for multicast listener queries (Thadeu Lima de Souza Cascardo) [765987]
  - [net] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition (Jesper Brouer) [1200541 1212801]
  - [net] tcp: Restore RFC5961-compliant behavior for SYN packets (Jesper Brouer) [1200541 1212801]
  - [crypto] drbg - fix maximum value checks on 32 bit systems (Herbert Xu) [1219907]
  - [crypto] drbg - remove configuration of fixed values (Herbert Xu) [1219907]
  - [netdrv] iwlwifi: mvm: protect rate scaling against non-mvm IBSS stations (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: send AP probe as unicast again (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: count interfaces correctly for combination checks (Stanislaw Gruszka) [1206103]
  - [netdrv] wl18xx: show rx_frames_per_rates as an array as it really is (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: fix RX A-MPDU session reorder timer deletion (Stanislaw Gruszka) [1206103]
  - [netdrv] ath9k: fix tracking of enabled AP beacons (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: dvm: run INIT firmware again upon .start() (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: mvm: rs: fix BT Coex check to look at the correct ant (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: mvm: Fix ROC removal (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: mvm: BT Coex - fix a NULL pointer exception (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: fix max_ht_ampdu_exponent for older devices (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: drop unencrypted frames in mesh fwding (Stanislaw Gruszka) [1206103]
  - [netdrv] b43: fix support for 5 GHz only BCM43228 model (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: disable u-APSD queues by default (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: notify channel switch at the end of ieee80211_chswitch_post_beacon() (Stanislaw Gruszka) [1206103]
  - [netdrv] nl80211: ignore HT/VHT capabilities without QoS/WMM (Stanislaw Gruszka) [1206103]
  - [netdrv] ath5k: fix spontaneus AR5312 freezes (Stanislaw Gruszka) [1206103]
  - [netdrv] mac80211: Send EAPOL frames at lowest rate (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: mvm: always use mac color zero (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: mvm: fix failure path when power_update fails in add_interface (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: mvm: validate tid and sta_id in ba_notif (Stanislaw Gruszka) [1206103]
  - [netdrv] iwlwifi: pcie: disable the SCD_BASE_ADDR when we resume from WoWLAN (Stanislaw Gruszka) [1206103]
  - [x86] perf: Don't use -ENOSPC for out of PMU resources (Jiri Olsa) [1215827]
  - [x86] perf: Blacklist all MEM_*_RETIRED events for Ivy Bridge (Jiri Olsa) [1215827]
  - [x86] perf: Add Intel IvyBridge event scheduling constraints (Jiri Olsa) [1215827]
  - [firmware] iwlwifi: update -12.ucode for 3160 / 7260 / 7265 / 7265D (Stanislaw Gruszka) [1194517]
  - [firmware] iwlwifi: update -10.ucode for 3160 / 7260 / 7265 / 7265D (Stanislaw Gruszka) [1194517]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-565.el6]
changelog:
  - [x86] perf/intel: Add INST_RETIRED.ALL workarounds (Jiri Olsa) [1189949]
  - [x86] perf/intel: Add Broadwell core support (Jiri Olsa) [1189949]
  - [x86] perf/intel: Add new cache events table for Haswell (Jiri Olsa) [1189949]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-566.el6]
changelog:
  - [netdrv] iwlwifi: use custom workqueue (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove not used *bt-coex* files (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clean net-detect info if device was reset during suspend (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: take the UCODE_DOWN reference when resuming (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - duplicate the command if sent ASYNC (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: nvm: force mac from otp in case nvm mac is reserved (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Free fw_status after use to avoid memory leak (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix MLME trigger (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: don't disable the busmaster DMA clock for family 8000 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: 7000: modify the firmware name for 3165 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: forbid MIMO on devices that don't support it (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: force quota update update after FW restart (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix typo in CONFIG option (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't power off the device between INIT and OPER firmwares (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: prevent using unmapped memory in fw monitor (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Avoid signal based decisions if ave beacon RSSI is 0 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix scan iteration complete notification handling (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't stop the FW monitor too early (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix Tx Power firmware API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: capture connection loss as part of MLME trigger (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for time events (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: do string formatting in debug triggers (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: fix spelling errors (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't return uninitialized value in get_survey() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove unused arguments (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Fix wrongfully flushing frames in the roc/off channel queue (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add debugfs entry with the number of net-detect scans (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: refactor rs_update_rate_tbl (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: check the size of the trigger struct from the firmware file (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon MLME failures (Stanislaw Gruszka) [1134606]
  - [net] mac80211: Fix mac80211.h docbook comments (Stanislaw Gruszka) [1134606]
  - [net] mac80211: notify the driver about deauth (Stanislaw Gruszka) [1134606]
  - [net] mac80211: notify the driver about association status (Stanislaw Gruszka) [1134606]
  - [net] mac80211: notify the driver about authentication status (Stanislaw Gruszka) [1134606]
  - [netdrv] mac80211: convert rssi_callback() to event_callback() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: fix comment indentation (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Clean up UMAC scan UIDs in the reset and drv_stop flows (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: 8000: change PNVM in case it doesn't match to the HW step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix debug print in the RSA ownership workaround (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow to configure the timeout for the Tx queues (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: drop support for early versions of 8000 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use debugfs_create_bool() for enable_scan_iteration_notif (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: initialize trans_pcie->ref_count on configure() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: inform mac80211 about umac scans that was aborted by restart (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove d0i3 ref correctly during AP start (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: Fix memory leak in iwl_req_fw_callback() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove WARN_ON for invalid BA notification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: take IWL_MVM_REF_UCODE_DOWN before restarting hw (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't wait for firmware verification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new 3165 series PCI IDs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove time-event start/end failure warning (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add iccm data to 8000 b-step data dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: add rx packet sequence number to dbg print (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: properly flush the queues for buffering transport (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: assign new TLV bit for multi-source LAR (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: continue (with error) CSA on GO time event failure (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: simplify iwl_mvm_get_wakeup_status() return (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't double unlock the mutex in __iwl_mvm_resume() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clarify time event end handling (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Always enable the smart FIFO (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: update copyright to include 2015 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add more new 8260 series PCI IDs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - update the new API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix force NMI for 8000 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: freeze the non-shared queues when a station goes to sleep (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: allow the op_mode to freeze the stuck queue timer (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: update Tx statistics when using fixed rate (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't init MCC during CT-kill (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove warning on station exhaustion (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: trans: Take ownership on secure machine before FW load (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new 8260 series PCI IDs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: improve ss_params debug print (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: don't allow the FW to return invalid ch indices (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: reflect TDLS pm state in mvmvif->pm_enabled (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix identation (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove unneeded include iwl-fw-error-dump.h (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: use correct NVM offset for LAR enable for new NVMs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: fix smatch warning: warn: inconsistent indenting (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: include more registers in the prph dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: speed up the Tx DMA stop flow (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support family 8000 B2/C steps (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: always update the quota after association (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - disable RRC by default (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove IWL_UCODE_TLV_API_DISABLE_STA_TX (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: bump API to 13 for devices that use iwlmvm (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: set LAR MCC on D3/D0 transitions (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support LAR updates from BIOS (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: take the MAC address from HW registers (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: allow disabling LAR via module param (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support new PHY_SKU nvm section for family 8000 B0 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: disable 11ac if 11n is disabled (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: iwlmvm: LAR: disable LAR support due to NVM vs TLV conflict (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: change last 5ghz channel to 165 & add support for 8000 family (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: use IWL_DEFAULT_MAX_TX_POWER for max_eirp (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: nvm: init correct nvm channel list for 8000 devices (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: LAR: Add chub mcc change notify command (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: don't declare support for 5ghz if not supported (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: ignore IBSS flag as regulatory NO-IR indication (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: consider LAR support during NVM parse (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: create regdomain from mcc_update_cmd response (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: init country code on init/recovery (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add MCC update FW API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: disconnect if CSA time event fails scheduling (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: dvm: drop VO packets when mac80211 tells us to (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix compilation with IWLWIFI_DEBUGFS not set (Stanislaw Gruszka) [1134606]
  - [netdrv] wireless: Use eth_<foo>_addr instead of memset (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't override passive dwell in case of fragmented scan (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon low RSSI (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon statistics (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: restart firmware recording when no configuration is set (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon command response (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon channel switch (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon missed beacons (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add the cause of the firmware dump in the dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add framework for triggers for fw dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use only 40 ms for fragmented scan (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow to force the Rx chains from debugfs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new TLV capability flag for BT PLCR (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't iterate interfaces to disconnect in net-detect (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: new Alive / error table API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support beacon statistics for BSS client (Stanislaw Gruszka) [1134606]
  - [net] cfg80211: add nl80211 beacon-only statistics (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't write to DBGC_OUT_CTRL when stopping the recording (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove deprecated scan API code (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: deprecate -9.ucode for 3160 / 7260 / 7265 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support radio statistics as global survey (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add statistics API version 10 (Stanislaw Gruszka) [1134606]
  - [net] cfg80211: add scan time to survey data (Stanislaw Gruszka) [1134606]
  - [netdrv] cfg80211: remove "channel" from survey names (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: apply destination before releasing reset (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove unused function in BT coex (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix BT coex shared antenna activity check (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: print single stream params via debugfs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: avoid ss_force from being reset after tx idle (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: increase the number of PAPD channel groups to 9 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: consider TDLS queues as used during drain (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: disable MIMO for low latency P2P (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: adapt rate matching to new STBC/BFER (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: disable beamformer unless FW supports it (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't try to stop scans that are not running anymore (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: better match tx response rate to the LQ table (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: call ieee80211_scan_completed() even if scan abort fails (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: reduce quota threshold (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't send a command the firmware doesn't know (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Fix building channels in scan_config_cmd (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Enable EBS also in single scan on umac interface (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Fix a few EBS error handling bugs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: allow to define the stuck queue timer per queue (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: enable watchdog on Tx queues for mvm (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: ignore stale TDLS ch-switch responses (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: improve TDLS ch-sw state machine (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: prepare the enablement of 31 TFD queues (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: enable forcing single stream Tx decision (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove space padding after sysassert description (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add beamformer support (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: don't dump useless data when a TFD queue hangs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't reprobe if we fail during reconfig and fw_restart is false (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: check IWL_UCODE_TLV_API_SCD_CFG in API and not in capa (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix rx chains configuration in phy ctxt cmd (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: support secured boot flow for family 8000 B step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use a new API for enabling STBC (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: refactor ht/vht init (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: remove stats argument from functions (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: really disable TDLS queues (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - set all the co-running values to 0 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Do not consider invalid HW queues in queue mask (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support family 8000 C step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: init ref_lock (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: document switch case fall-through in iwl_mvm_send_sta_key (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: use STBC regardless of power save mode (Stanislaw Gruszka) [1134606]
  - [netdrv] Revert "iwlwifi: mvm: drop non VO frames when flushing" (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add support for new LTR command (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - fine tune the MPLUT register (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: move U-APSD decision to authentication (Stanislaw Gruszka) [1134606]
  - [netdrv] mac80211: move U-APSD enablement to vif flags (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: ignore temperature updates in the RX statistics notification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: cleanup unuseful and overflowing traces (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: generate statistics debugfs code (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: move statistics API to new header file (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: sync statistics firmware API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: correctly set the NMI register (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add rxf and txf to dump data (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add support for dumping a secondary SRAM (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add debugfs file for misbehaving U-APSD AP (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: let the firmware configure the scheduler (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove unused TLV capability flags (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add print of he nvm version (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: set max_out_time equal to frag_passive_dwell in fragmented scan (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: allow to disable MIMO for P2P only (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow to collect debug data from non-sleepable context (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: make sure state isn't in d0i3 when stopping fw monitor (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Add debugfs entry to enable scan offload notification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new config and PCI IDs for 4165 series (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: make sure state isn't in d0i3 when collecting fw dbg (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: repeat initial legacy rates in LQ table (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't indicate no BA if STA was in powersave (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: organize and cleanup consts (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Alter passive scan fragmentation parameters in case of multi-MAC (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: call to pcie_apply_destination also on family 8000 B step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: ask the fw to wakeup (from d0i3) on sysassert (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: tlv: add support for IWL_UCODE_TLV_SDIO_ADMA_ADDR TLV (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use iwl_mvm_sta_from_mac80211() consistently (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use iwl_mvm_vif_from_mac80211() consistently (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove useless extern definition of iwl4265_2ac_sdio_cfg (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clean refs before stop_device() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: dvm: main: Use setup_timer (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: dvm: tt: Use setup_timer (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support 2 different channels (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: wait for d0i3 exit on hw restart (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: consider d0i3_disable in iwl_mvm_is_d0i3_supported() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: support multiple d0i3 modes (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support IWL_D0I3_MODE_ON_SUSPEND d0i3 mode (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow both d0i3 and d3 wowlan configuration modes (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: add basic reference accounting (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: convert the SRAM dump to the generic memory dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: change SMEM dump to general purpose memory dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add smem content to dump data (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support additional nvm_file in family 8000 B step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: fix max rate allowed if no rate is allowed (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clear tt values when entering CT-kill (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Set the HW step in the core dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow RSSI compensation (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add debugfs to trigger fw debug logs collection (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: let the Manageability Engine know when we leave (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support LnP 1x1 antenna configuration (Stanislaw Gruszka) [1134606]
  - [netdrv] Revert "iwlwifi: use correct fw file in 8000 b-step" (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add fw runtime stack to dump data (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove MODULE_VERSION (Stanislaw Gruszka) [1134606]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-567.el6]
changelog:
  - [serial] add ability to set IRQ via module parameter (Prarit Bhargava) [1210848]
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1185166] {CVE-2015-1805}
  - [netdrv] macvlan: add VLAN filters to lowerdev (Ivan Vecera) [1213846]
  - [x86] Mark Intel Broadwell-DE processor as unsupported (Steve Best) [1226904]
  - [net] ipv6: reallocate addrconf router for ipv6 address when lo device up (Hannes Frederic Sowa) [1223610]
  - [mm] memory-failure: move refcount only in !MF_COUNT_INCREASED (Rafael Aquini) [1222832]
  - [mm] memory-failure: shift page lock from head page to tail page after thp split (Rafael Aquini) [1222832]
  - [mm] memory-failure: transfer page count from head page to tail page after split thp (Rafael Aquini) [1222832]
  - [scsi] lpfc: Correct loss of target discovery after cable swap (Rob Evers) [1226779]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-568.el6]
changelog:
  - [base] reduce boot delay on large memory systems (Seth Jennings) [1221389]
  - [md] dm: run queue on re-queue (Mike Snitzer) [1225158]
  - [fs] take i_mutex during prepare_binprm for set<u,g>id executables (Mateusz Guzik) [1216269] {CVE-2015-3339}
  - [netdrv] i40e: Make sure to be in VEB mode if SRIOV is enabled at probe (Stefan Assmann) [1206000]
  - [netdrv] i40e: start up in VEPA mode by default (Stefan Assmann) [1206000]
  - [netdrv] e1000e: Bump the version to 3.2.5 (John Greene) [1211531]
  - [netdrv] e1000e: fix unit hang during loopback test (John Greene) [1211531]
  - [netdrv] e1000e: fix systim issues (John Greene) [1211531]
  - [netdrv] e1000e: fix legacy interrupt handling in i219 (John Greene) [1211531]
  - [netdrv] e1000e: fix flush_desc_ring implementation (John Greene) [1211531]
  - [netdrv] e1000e: fix logical error in flush_desc_rings (John Greene) [1211531]
  - [netdrv] e1000e: remove call to do_div and sign mismatch warning (John Greene) [1211531]
  - [netdrv] e1000e: i219 execute unit hang fix on every reset or power state transition (John Greene) [1211531]
  - [netdrv] e1000e: i219 fix unit hang on reset and runtime D3 (John Greene) [1211531]
  - [netdrv] e1000e: fix call to do_div to use u64 arg (John Greene) [1211531]
  - [netdrv] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size (John Greene) [1211531]
  - [netdrv] e1000e: Correctly include VLAN_HLEN when changing interface MTU (John Greene) [1211531]
  - [netdrv] e1000e: call netif_carrier_off early on down (John Greene) [1211531]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-569.el6]
changelog:
  - [gpu] drm/radeon: fix freeze for laptop with Turks/Thames GPU (Jerome Glisse) [1213297]
  - [md] dm: fix casting bug in dm_merge_bvec (Mike Snitzer) [1226453]
  - [fs] nfs: Send the size attribute on open(O_TRUNC) (Benjamin Coddington) [1208065]
  - [net] inet: fix processing of ICMP frag_needed messages (Sabrina Dubroca) [1210321]
  - [net] tcp: double default TSQ output bytes limit (Hannes Frederic Sowa) [1140590]
  - [hv] hv_balloon: correctly handle num_pages>INT_MAX case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: correctly handle val.freeram<num_pages case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: survive ballooning request with num_pages=0 (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: eliminate jumps in piecewiese linear floor function (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: do not online pages in offline blocks (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: don't lose memory when onlining order is not natural (Vitaly Kuznetsov) [1006234]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-570.el6]
changelog:
  - [block] fix ext_dev_lock lockdep report (Jeff Moyer) [1230927]
  - [md] Revert "md dm: run queue on re-queue" (Mike Snitzer) [1232007]
  - [firmware] another cxgb4 firmware load fixup (Sai Vemuri) [1189255]
  - [char] tty: Don't protect atomic operation with mutex (Aristeu Rozanski) [1184182]
  - [edac] i5100 add 6 ranks per channel (Aristeu Rozanski) [1171333]
  - [edac] i5100 clean controller to channel terms (Aristeu Rozanski) [1171333]
  - [crypto] rng - Remove krng (Herbert Xu) [1226418]
  - [crypto] drbg - Add stdrng alias and increase priority (Herbert Xu) [1226418]
  - [crypto] seqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] eseqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] chainiv - Move IV seeding into init function (Herbert Xu) [1226418]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-571.el6]
changelog:
  - [netdrv] bnx2x: Move statistics implementation into semaphores (Michal Schmidt) [1231348]
  - [scsi] storvsc: Set the SRB flags correctly when no data transfer is needed (Vitaly Kuznetsov) [1221404]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-573.el6]
changelog:
  - [security] selinux: don't waste ebitmap space when importing NetLabel categories (Paul Moore) [1130197]
  - [x86] Revert "Add driver auto probing for x86 features v4" (Prarit Bhargava) [1231280]
  - [net] bridge: netfilter: don't call iptables on vlan packets if sysctl is off (Florian Westphal) [1236551]
  - [net] ebtables: Allow filtering of hardware accelerated vlan frames (Florian Westphal) [1236551]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.2.1.el6]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240758 1240759] {CVE-2015-5364 CVE-2015-5366}
  - [fs] vfs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1243400 1241030]
  - [fs] vfs: Prevent syncing frozen file system (Lukas Czerner) [1243404 1241791]
  - [fs] vfs: Prevent freeing unlinked file to be indefinitely delayed (Lukas Czerner) [1243406 1236736]
  - [fs] vmcore: continue vmcore initialization if PT_NOTE is found empty (Baoquan He) [1245195 1236437]
  - [fs] vmcore: prevent PT_NOTE p_memsz overflow during header update (Baoquan He) [1245195 1236437]
  - [kernel] audit/fix non-modular users of module_init in core code (Baoquan He) [1245195 1236437]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.3.1.el6]
changelog:
  - [md] Revert "dm: don't schedule delayed run of the queue if nothing to do" (Mike Snitzer) [1246095 1240767]
  - [md] Revert "dm: only run the queue on completion if congested or no requests pending" (Mike Snitzer) [1246095 1240767]


author: Weiping Pan <wpan@redhat.com> 2.0.8.rh1 2
changelog:
  - rebuild oracleasm for RHEL6.5, sync to upstream commit d368091e98dc
  - (oracleasm: Add support for new error return codes from block/SCSI)


author: Weiping Pan <wpan@redhat.com> 2.0.8 4
changelog:
  - add  .clear_inode callback, fix bug 1157408.
  - rebuild oracleasm for RHEL6.6 in brew, update the version to 2.0.8-4


author: Tomas Smetana <tsmetana@redhat.com> 20070328-2
changelog:
  - fix wrong exit status of spawned process after SIGSTOP
  - fix building of debuginfo package, add %{?dist} to release
  - fix handling of SIGTTOU in non-interactive shell
  - remove useless builtins


author: Tomas Smetana <tsmetana@redhat.com> 20071105-2
changelog:
  - fix #405381 - ksh will not handle $(xxx) when typeset -r IFS
  - fix #386501 - bad group in spec file


author: Michal Hlavinka <mhlavink@redhat.com> 20081104-1
changelog:
  - update to 2008-11-04
  - ast-ksh-locales are not useable remove them
  - /usr/bin/ksh symlink was removed


author: Michal Hlavinka <mhlavink@redhat.com> - 20100202-6
changelog:
  - fix infinite loop when whence builtin is used with -q option (#587127)
  - fix stdin for double command substitution (#584704)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-3
changelog:
  - fix file io race condition when file was created, but still does not exist (#660319)
  - use 'alternatives' for (m)ksh switching (#659658)
  - do not forget to restore file handles after execution of sourced script (#651888)
  - fix bug when here document got sometimes truncated (#644362)
  - do not forget to close autoloaded file with function definition (#643811)
  - fix wrong typeset handling of arrays that could caused a crash (#637052)
  - fix minor issues in man page (#619692)
  - fix crash when ksh get SIGPIPE while already executing signal handler (#616691)
  - fix wrong output redirection in SIGPIPE trap (#616684)
  - add RLIMIT_RTPRIO and RLIMIT_NICE support to ulimit (#582690)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-7
changelog:
  - ksh did not wait for pipeline to complete when pipefail option was used (#702016)
  - completion used after an environment variable reported bad susbstituion error (#702015)
  - ksh child exit code not preserved correctly (#702013)
  - do not change $0 in posix function (#702011)
  - fix man page information about default value for PATH variable (#702008)
  - do not use invalid PID values in ksh kill built-in (#701890)
  - fix crashe when IFS is unset inside a function (#683734)
  - do not count empty array elements (#702014)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-14
changelog:
  - fix data corruption in a here-document section of a script at byte 8192 (#786787)
  - restore tty settings after timed out read (#577223)
  - do not create extra process when it's not needed (#781976)
  - fix file descriptor leak (#781498)
  - do not segfault on incorrect oop code (#743840)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-19
changelog:
  - assigning a right justified typedef'd variable to a smaller one
    could corrupt the result (#846678)
  - fix exporting of l/r-justified variable (#846678)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-2
changelog:
  - fix overflow in subshell loop (#858263)
  - set default editing mode to emacs (#761551)
  - ksh -m did not turn monitor mode on (#960034)
  - prevent fork bomb trigered by SIGSTP (#922851)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-14
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1066589)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-16
changelog:
  - do not resend signal on termination (#1075635)
  - fix argv rewrite (#1047506)
  - fix brace expansion on/off (#1078698)
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1070350)
  - fix parser errors related to the end of the here-document marker (#1036931)
  - ksh hangs when command substitution fills out the pipe buffer (#1062296)
  - using typeset -l with a restricted variabled caused segmentation fault (#1083713)
  - ksh stopped on read when monitor mode was enabled (#1023109)
  - monitor mode was documented incorrectly (#1019334)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-17
changelog:
  - do not crash when unsetting running function from another one (#1105138)
  - should report an error when trying to cd into directory without execution bit (#1102627)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-18
changelog:
  - job locking mechanism did not survive compiler optimization (#1112306)
  - wrong return code from a pipe in command substitution (#1117316)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-24
changelog:
  - cd to directory without execution permission can't fail silently (#1160923)
  - current directory could differ from PWD (#1168611)
  - declaration of a two dimemsional associatve array could add an extra 0 element (#1173668)
  - exporting fixed with variable corrupted its data (#1188377)
  - fixes memmory leak on unset of associative array (#1189294)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - fix segfault when handling a trap (#1117404)
  - closing a file descriptor in a command substitution caused loss of the output (#1116072)


author: Paul Nasrat <pnasrat@redhat.com> - 3.3.6-1
changelog:
  - Update to 3.3.6
  - Fix typo  (#189647)
  - Enable threading fixes (#181298)
  - Conditionalize static library


author: Panu Matilainen <pmatilai@redhat.com> - 3.5.9-2
changelog:
  - Remove references to temporary registers from cache on release (#463061)
  - Enable loading of external extensions (#457433)


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.6.2-2
changelog:
  - require tcl(abi) in sqlite-tcl subpackage (#474034)
  - move tcl extensions to arch-specific location
  - enable dependency extraction on the tcl dso
  - require pkgconfig in sqlite-devel


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.12-2
changelog:
  - disable strict aliasing to work around brokenness on 3.6.12 (#494266)
  - run test-suite on build but let it fail for now


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Nalin Dahyabhai <nalin@redhat.com> 0.7
changelog:
  - add openldap-devel as a buildprereq
  - krb5: use a continuous connection
  - krb5: add "realm" config directive
  - ldap: use a continuous connection
  - ldap: add "server", "basedn", "binddn", "user", "authuser" config directives
  - ldap: actually finish the account deletion function
  - ldap: don't send cleartext passwords to the directory
  - fix naming attribute for users (should be uid, not gid)
  - refine the search-by-id,convert-to-name,search-by-name logic
  - fix handling of defaults when the config file is read in but contains no value
  - implement an LDAP information store
  - try to clean up module naming with libtool
  - luseradd: pass plaintext passwords along
  - luseradd: use symbolic attribute names instead of hard-coded
  - lusermod: pass plaintext passwords along
  - lgroupadd: pass plaintext passwords along
  - lgroupmod: pass plaintext passwords along
  - add libuser as a dependency of libuser-devel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - the great adding-of-the-copyright-statements
  - take more care when creating backup files in the files module


author: Nalin Dahyabhai <nalin@redhat.com> 0.8
changelog:
  - add a "quiet" prompter
  - add --interactive flag to sample apps and default to using quiet prompter
  - ldap: attempt a "self" bind if other attempts fail
  - krb5: connect to the password-changing service if the user principal has
    the NULL instance


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add functions for enumerating users and groups, optionally per-module
  - lusermod.c: -s should specify the shell, not the home directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - get bindings for prompts to work correctly
  - clean up some of the add/remove semantics (set source on add)
  - ldap: implement enumeration
  - samples/enum: fix the argument order


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - clean up quota bindings some more
  - finish most of the ldap bindings
  - fix a subtle bug in the files module that would show up when renaming accounts
  - fix mapping methods for entity structures in python


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish implementing is_locked methods in files/shadow module
  - finish cleanup of the python bindings
  - allow conditional builds of modules so that we can build without
    all of the prereqs for all of the modules


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't bail when writing empty fields to colon-delimited files
  - use permissions of the original file when making backup files instead of 0600


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix errors due to uninitialized fields in the python bindings
  - add kwargs support to all python wrappers
  - add a mechanism for passing arguments to python callbacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix group password setting in the files module
  - setpass affects both auth and info, so run both stacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - lib/user.c: catch and ignore errors when running stacks
  - lusermod: fix slightly bogus help messages
  - luseradd: when adding a user and group, use the gid of the group
    instead of the user's uid as the primary group
  - properly set the password field in user accounts created using
    auth-only auth modules (shadow needs "x" instead of "!!")
  - implement home directory removal, start on population


author: Nalin Dahyabhai <nalin@redhat.com> 0.16.1-1
changelog:
  - finish home directory population
  - implement home directory moving
  - change entity get semantics in the python bindings to allow default values for .get()
  - add lu_ent_has(), and a python has_key() method to Entity types
  - don't include tools in the binary package
  - add translated strings


author: Nalin Dahyabhai <nalin@redhat.com> 0.18-1
changelog:
  - actually make the new optional arguments optional
  - fix lu_error_new() to actually report errors right
  - fix part of the python bindings
  - include tools in the binary package again
  - fixup modules so that password-changing works right again
  - add a "key" field to prompt structures for use by apps which like to
    cache these things
  - add an optional "mvhomedir" argument to userModify (python)


author: Nalin Dahyabhai <nalin@redhat.com> 0.20-1
changelog:
  - only call the auth module when setting passwords (oops)
  - use GTrees instead of GHashTables for most internal tables
  - files: complain properly about unset attributes
  - files: group passwords are single-valued, not multiple-valued
  - add lpasswd app, make sure all apps start up popt with the right names


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - luserdel: remove the user's primary group if it has the same name as
    the user and has no members configured (-G disables)
  - fixup some configure stuff to make libuser.conf get generated correctly
    even when execprefix isn't specified


author: Nalin Dahyabhai <nalin@redhat.com> 0.21-1
changelog:
  - finish adding a sasldb module which manipulates a sasldb file
  - add users_enumerate_by_group and groups_enumerate_by_users


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - print uids and gids of users and names in lid app
  - fix tree traversal in users_enumerate_by_group and groups_enumerate_by_users
  - implement enumerate_by_group and enumerate_by_user in ldap module
  - fix id-based lookups in the ldap module
  - implement islocked() method in ldap module
  - implement setpass() method in ldap module
  - add lchfn and lchsh apps
  - add %d substitution to libuser.conf


author: Nalin Dahyabhai <nalin@redhat.com> 0.23-1
changelog:
  - install sv translation
  - make lpasswd prompt for passwords when none are given on the command line
  - make sure all user-visible strings are marked for translation
  - clean up some user-visible strings
  - require PAM authentication in lchsh, lchfn, and lpasswd for non-networked modules


author: Nalin Dahyabhai <nalin@redhat.com> 0.24-3
changelog:
  - stop leaking descriptors in the files module
  - speed up user creation by reordering some checks for IDs being in use
  - update the shadowLastChanged attribute when we set a password
  - adjust usage of getXXXXX_r where needed
  - fix assorted bugs in python binding which break prompting


author: Nalin Dahyabhai <nalin@redhat.com> 0.25-1
changelog:
  - close up some memory leaks
  - add the ability to include resident versions of modules in the library


author: Nalin Dahyabhai <nalin@redhat.com> 0.25.1-1
changelog:
  - rename the quota source files to match the library, which clears up a
    file conflict with older quota packages
  - add ja translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.26-1
changelog:
  - lusermod: change user name in groups the user is a member of during renames
  - lgroupmod: change primary GID for users who are in the group during renumbers
  - ldap.c: handle new attributes more gracefully if possible
  - add ru translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.27-1
changelog:
  - add ko translation files
  - files.c: fix a heap corruption bug in lock/unlock (#51750)
  - files.c: close a memory leak in reading of files


author: Nalin Dahyabhai <nalin@redhat.com> 0.28-1
changelog:
  - apps: print usage on errors
  - lnewusers.c: initialize groups as groups, not users
  - lnewusers.c: set passwords for new accounts
  - luseradd.c: accept group names in addition to IDs for the -g flag
  - luseradd.c: allow the primary GID to be a preexisting group


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - HUP nscd on modifications
  - userutil.c: mmap files we're reading for probable speed gain
  - userutil.c: be conservative with the amount of random data we read
  - docs fixes


author: Nalin Dahyabhai <nalin@redhat.com> 0.30-1
changelog:
  - quotaq: fix argument order when reading quota information
  - user_quota: set quota grace periods correctly
  - luseradd: never create home directories for system accounts


author: Nalin Dahyabhai <nalin@redhat.com> 0.32-1
changelog:
  - link the python module against libpam
  - attempt to import the python modules at build-time to verify dependencies


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - renamed the python module
  - revamped internals to use gobject's gvalues and gvaluearrays instead of
    glists of cached strings
  - add enumeration-with-data functions to the C library


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.91-1
changelog:
  - ldap: finish port to new API
  - sasl: finish port to new API (needs test)
  - libuser: don't commit object changes before passing data to service
    functions which might need differing data sets to figure out what to
    change (for example, ldap)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.93-1
changelog:
  - move shadow initialization for groups to the proper callback
  - rework locking in the files module to not require that files be writable


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.97-1
changelog:
  - files: fix bug in removals
  - ldap: revert attempts at being smart at startup time, because it makes UIs
    very messy (up the three whole dialogs just to start the ldap stuff!)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.98-1
changelog:
  - automatically refresh entities after add, modify, setpass, removepass,
    lock, and unlock operations
  - remove debug spewage when creating and removing mail spools
  - files: fix saving of multi-valued attributes
  - rename MEMBERUID attribute for groups to MEMBERNAME


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.100-1
changelog:
  - be more careful about printing error messages
  - fix refreshing after adding of accounts
  - ldap: try to use a search to convert names to DNs, and only fall back to
    guessing if it turns up nothing
  - files: fix an off-by-one in removal of entries


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.101-1
changelog:
  - fix python bindings of enumerateFull functions
  - adjust prompter wrapping to not error out on successful returns


author: Nalin Dahyabhai <nalin@redhat.com> 0.51-1
changelog:
  - files: ignore blank lines in files
  - libuser: disallow creation of accounts with names containing whitespace,
    control characters, or non-ASCII characters


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.5-1
changelog:
  - expose lu_get_first_unused_id() as a package-private function
  - provide libuser.ADMIN.getFirstUnusedUid and libuser.ADMIN.getFirstUnusedGid
    in python


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.6-1
changelog:
  - use a crypt salt consistent with the defaults/crypt_style setting when
    setting new passwords (#79337)


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.7-1
changelog:
  - ldap: set error codes correctly when we encounter failures initializing
  - don't double-close modules which fail initialization
  - ldap: don't set an error in cases where one is already set


author: Miloslav Trmac <mitr@redhat.com> - 0.51.8-1
changelog:
  - Update to build with latest autotools and gtk-doc
  - Update ALL_LINGUAS and POTFILES.in
  - Rebuild to depend on newer openldap


author: Miloslav Trmac <mitr@redhat.com> - 0.51.10-1
changelog:
  - Don't attempt to lookup using original entity name after entity
    modification (rename in particular) (#78376, #121252)
  - Fix copying of symlinks from /etc/skel (#87572, original patch from gLaNDix)
  - Make --enable-quota work, and fix the quota code to at least compile (#89114)
  - Fix several bugs (#120168, original patch from Steve Grubb)
  - Don't hardcode python version in spec file (#130952, from Robert Scheck)
  - Properly integrate the SELinux patch, it should actually be used now, even
    though it was "enabled" since 0.51.7-6


author: Miloslav Trmac <mitr@redhat.com> - 0.51.11-1
changelog:
  - Allow documented optional arguments in Python
    ADMIN.{addUser,modifyUser,deleteUser} (#119812)
  - Add man pages for lchfn and lchsh
  - LDAP fixes, first round
  - Avoid file conflict on multilib systems
  - Call ldconfig correctly


author: Miloslav Trmac <mitr@redhat.com> - 0.51.12-1
changelog:
  - Don't claim success and exception at the same time (#133479)
  - LDAP fixes, second round
  - Various other bugfixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.2-1
changelog:
  - Allow LDAP connection using ldaps, custom ports or without TLS (original
    patch from Pawel Salek).


author: Miloslav Trmac <mitr@redhat.com> - 0.52.5-1
changelog:
  - Fix home directory renaming in ADMIN.modifyUser (#135280)
  - Further Python reference counting fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.6-1
changelog:
  - Make error reporting more consistent, more verbose and always on stderr
    (partly #133861, original patch by Pawel Salek)
  - Mark strings previously blocked by string freeze for translation


author: Miloslav Trmac <mitr@redhat.com> - 0.53-1
changelog:
  - Support UID and GID values larger than LONG_MAX (#124967)
  - Fix updating of groups after user renaming in lusermod
  - Allow setting a shadow password even if the current shadow password is
    invalid (#131180)
  - Add lu_{user,group}_unlock_nonempty (#86414); module interface ABI has 
    changed
  - Miscellaneous bug and memory leak fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.53.2-1
changelog:
  - Important bug fixes in lchage, lgroupmod, lnewusers and lusermod
  - Minor bug fixes in lpasswd and luseradd
  - Add man pages for the utilities (#61673)


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-1
changelog:
  - Don't silently ignore some I/O errors
  - Don't include a Cyrus SASL v1 header file when libldap links to v2 (#150046)
  - Rebuild with gcc 4


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-2
changelog:
  - Add Requires: glib2-devel to libuser-devel (#152501)
  - Run ldconfig using %post{,un} -p to let RPM play tricks


author: Miloslav Trmac <mitr@redhat.com> - 0.53.5-1
changelog:
  - Ignore nss_compat lines in the "files" module (#154651)
  - Autodetect Python version (#154096)
  - Add BuildRequires: libselinux-devel, s/BuildPrereq/BuildRequires/


author: Miloslav Trmac <mitr@redhat.com> - 0.53.8-1
changelog:
  - Permit "portable" user and group names as defined by SUSv3, plus trailing $
    (#159452)
  - Don't build static libraries


author: Miloslav Trmac <mitr@redhat.com> - 0.54-1
changelog:
  - Make sure attributes with no values can never appear
  - Fix crash in the "files" module when an attribute is missing
  - Use hidden visibility for internal functions, remove them from
    libuser/user_private.h; this changes module interface ABI


author: Miloslav Trmac <mitr@redhat.com> - 0.54.1-1
changelog:
  - Support importing of configuration from shadow-utils (/etc/login.defs and
    /etc/default/useradd)
  - Add libuser.conf(5) man page


author: Miloslav Trmac <mitr@redhat.com> - 0.54.6-1
changelog:
  - Fix bugs in handling of invalid lines in the files and shadow modules
  - Fix pattern matching in lu_*_enumerate_full in the files and shadow modules
  - Add more error reporting, return non-zero exit status on error from utils
  - Use the skeleton directory specified in libuser.conf by Python
    admin.createHome and admin.addUser, add parameter skeleton= to admin.addUser
    (#189984)


author: Miloslav Trmac <mitr@redhat.com> - 0.56-1
changelog:
  - Tighten the API and implementation to avoid corrupting number-like strings;
    the module interface ABI has changed
    Resolves: #226976


author: Miloslav Trmac <mitr@redhat.com> - 0.56.1-1
changelog:
  - When changing passwords, only silently ignore know shadow markers, not all
    invalid hashes
    Resolves: #225495


author: Miloslav Trmač <mitr@redhat.com> - 0.56.4-2
changelog:
  - Split the Python module to a separate subpackage (original patch by Yanko
    Kaneti)
  - Update the License: tag


author: Miloslav Trmač <mitr@redhat.com> - 0.56.5-1
changelog:
  - Work around spurious error messages when run against the Fedora Directory
    server
  - Fix error reporting when creating home directories and creating/removing mail
    spool files
    Resolves: #318121


author: Miloslav Trmač <mitr@redhat.com> - 0.56.6-1
changelog:
  - Set SELinux file contexts when creating home directories, preserve them when
    moving home directories
    Resolves: #351201


author: Miloslav Trmač <mitr@redhat.com> - 0.56.7-1
changelog:
  - Add support for SHA256 and SHA512 in password hashes
    Related: #173583
  - Fix file locking on some architectures
  - Rename sr@Latn.po to sr@latin.po
    Resolves: #426584
  - Address issues from a review by Jason Tibbitts:
    - Remove default.-c, moving the provided functions to libuser proper
    - Remove the WITH_SELINUX build option
    - Move Python library test to %check
    Resolves: #226054


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-7
changelog:
  - Don’t use 512-bit RSA private keys in tests
    Related: #1235518
  - Fix testsuite failures if more than one architecture is building concurrently
    Related: #1235518


author: Jeff Johnson <jbj@redhat.com> 0.15-3687.0
changelog:
  - first build from adapted spec file, only client and libraries for now.
  - internal apr/apr-utils/neon until incompatibilities sort themselves out.
  - avoid libdir issues on x86_64 for the moment.


author: Joe Orton <jorton@redhat.com> 0.22.2-1
changelog:
  - update to 0.22.2; add mod_dav_svn subpackage
  - include Python bindings
  - neon: force use of expat, enable SSL
  - drop check for specific apr version added in -3


author: Jeff Johnson <jbj@redhat.com> 0.22.2-2
changelog:
  - use external neon-0.23.9-2 (i.e. with neon-config), drop internal neon.
  - use db-4.1.25, not db-4.0.14.
  - do "make check" (but ignore failure for now).
  - s390x knows not of httpd >= 2.0.45.


author: Joe Orton <jorton@redhat.com> 1.0.0-2
changelog:
  - add fix for lack of apr_dir_read ordering guarantee (Philip Martin)
  - enable compression in ra_dav by default (Tobias Ringström)


author: Joe Orton <jorton@redhat.com> 1.0.2-2
changelog:
  - add perl MODULE_COMPAT requirement for -perl subpackage
  - move perl man pages into -perl subpackage
  - clean up -perl installation and dependencies (Ville Skyttä, #123045)


author: Joe Orton <jorton@redhat.com> 1.1.3-7
changelog:
  - restore swig bindings support (from upstream via Max Bowsher, #141343)
  - tweak SELinux commentary in default subversion.conf


author: Joe Orton <jorton@redhat.com> 1.1.3-8
changelog:
  - further swig bindings fix (upstream via Max Bowsher, #151798)
  - fix perl File::Path dependency in filter-requires.sh


author: Joe Orton <jorton@redhat.com> 1.2.0-3
changelog:
  - update to 1.2.1
  - fix BuildRequires for ruby and apr-util (#163126)
  - drop static library archives


author: Joe Orton <jorton@redhat.com> 1.2.3-3
changelog:
  - update to 1.2.3
  - update to psvn.el r16070 from Stefan Reichoer
  - merge subversion.conf changes from RHEL4
  - merge filter-requires.sh changes from FC4 updates


author: Joe Orton <jorton@redhat.com> 1.3.2-2
changelog:
  - update to 1.3.2
  - fix Ruby sitelibdir (Garrick Staples, #191611)
  - own /etc/subversion (#189071)
  - update to psvn.el r19857


author: Joe Orton <jorton@redhat.com> 1.4.3-3
changelog:
  - update to 1.4.3 (#228691)
  - remove trailing dot from Summary
  - use current preferred standard BuildRoot
  - add post/postun ldconfig scriptlets for -ruby and -javahl


author: Joe Orton <jorton@redhat.com> 1.4.4-2
changelog:
  - update to 1.4.4
  - add Provides: svn (#245087)
  - fix without-java build (Lennert Buytenhek, #245467)


author: Joe Orton <jorton@redhat.com> 1.4.4-3
changelog:
  - fix build with new glibc open()-as-macro
  - build all swig code in %build, not %install
  - BuildRequire perl(Test::More), perl(ExtUtils::MakeMaker)


author: Joe Orton <jorton@redhat.com> 1.4.4-4
changelog:
  - trim dependencies from .la files
  - detabify spec file
  - test suite disabled to ease stress on builders


author: Joe Orton <jorton@redhat.com> 1.5.6-3
changelog:
  - update to 1.5.6
  - autoload psvn (#238491, Tom Tromey)
  - regenerate swig bindings (#480503)
  - fix build with libtool 2.2 (#469524)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.5-3
changelog:
  - Apply svn2cl upstream patch to fix newline issues with libxml2 2.7.4+,
    see http://bugs.debian.org/546990 for details.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Joe Orton <jorton@redhat.com> - 1.6.11-4
changelog:
  - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709221)
  - add security fix for CVE-2011-0715 (#681174)
  - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672679)


author: Joe Orton <jorton@redhat.com> - 1.6.11-5
changelog:
  - add init script for svnserve (#720790, #711904)
  - fix segfault with "AuthzForceUsernameCase lower" (#751321)
  - fix parent directory access with merges (#749494)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-7
changelog:
  - fix invalid access to memory in tcpListenerTable (#551030)
  - fix crash with interfaces without broadcast addresses (like OpenVPN's tun0)
    (#549390)
  - fix responding to broadcast SNMP requests (#549390)
  - port patches from RHEL-5 to avoid regressions


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-14
changelog:
  - store temporary files in /var/run/net-snmp instead of /tmp (SELinux does
    not allow writing /tmp) (#560081)
  - fix filedescriptor leak in RMON-MIB and Etherlike-MIB (#562108)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-15
changelog:
  - remove net-snmp-gui subpackage, perl-Tk is being removed from
    distro (#568786)
  - fix IF-MIB::ifSpeed of inactive interfaces (#561884)
  - correct the package license


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-19
changelog:
  - fixed exit code of snmp utilities when wrong argument to '-A' option
    is specified (#574061)
  - fixed BER parsing of incoming packets - siletnly discard the invalid ones
    according to RFC (#568651)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-21
changelog:
  - fixed hrFSTable and hrStorageTable to provide persistent table indexes
    according to RFS 2790 (#595325)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-22
changelog:
  - fixed value of ipIfStatsTable.Ip6ReasmReqds (#597265)
  - added missing include files from util_funcs directory (#604636)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-23
changelog:
  - fixed segfault when parsing snmpd.conf with disman entries (#607080)
  - fixed value of IP-MIB::ipv6InterfaceForwarding (#607074)
  - fixed output of snmptranslate tool when displaying ranges of UNSIGNED
    type (#606874)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-27.1
changelog:
  - fixed truncation of sysObjectID (#641113)
  - fixed assertions in calculating of statistics in IF-MIB (#621664)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-28
changelog:
  - fixed recompilation of the package on machine without IPv6 (#657835)
  - fixed SMUX getting stuck on big-endian platforms (#665053)
  - fixed OID comparsion in snmpwalk, now the output does not include
    objects outside requested subtree (#636890)
  - fixed IPv4 address creation in ipAddressTable (#616764)
  - added IPv6 address creation to ipAddressTable (#616336)
  - fixed value of ipAddressPrefixAutonomousFlag OID (#625262)
  - fixed ipv6IfTable - new interfaces were not added there (#627564)
  - extended BRIDGE-MIB implementation to cover RFC 4363 (#630157)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  - fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-38
changelog:
  - fixed snmpd crashing with many AgentX subagent (#749227)
  - fixed SNMPv2-MIB::sysObjectID value when "sysObjectID" config file
    option with long OID was used (#786931)
  - fixed value of BRIDGE-MIB::dot1dBasePortIfIndex.1 (#740172)
  - fixed parsing of "proxy" snmpd.conf option not to enable
    verbose logging by default (#746903)
  - added new "realStorageUnits" config file option to support
    disks > 16 TB in hrStorageTable (#741789)
  - added vxfs, reiserfs and ocfs2 filesystem support to hrStorageTable
    (#746903)
  - fixed snmpd sigsegv when embedded perl script registers one handler
    twice (#748907)
  - fixed setting of SNMP-TARGET-MIB::snmpTargetAddrRowStatus via
    SNMP-SET request on 64-bit platforms (#754275)
  - fixed crash when /var/lib/net-snmp/mib_indexes/ files have wrong
    SELinux context (#754971)
  - fixed memory leak when agentx subagent disconnects in the middle
    of request processing (#736580)
  - fixed slow (re-)loads of TCP-MIB::tcpConnectionTable (#789909)
  - removed 'error finding row index in _ifXTable_container_row_restore'
    error message (#788954)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-43
changelog:
  - fixed value of UCD-SNMP-MIB::extCommand to contain full command
    line (#842279)
  - fixed rpath to perl.so (#848319)
  - added support for port numbers in 'clientaddr' configuration
    option (#833013)
  - fixed rare snmptrapd crash on SIGHTERM handling when embedded perl
    is used (#824402)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#800671)
  - updated documentation of '-c' option of snmptrapd (#784502)
  - fixed endless loop when SIGTEM arrives in middle of internal query
    processing (#851637)
  - fixed UCD-DISKIO-MIB::diskIOLA values (#848155)
  - removed various error log messages related to counte64 expansions
    (#846906)
  - removed various error log messages when IPv6 is disabled (#845157)
  - added support of cvfs filesystem in hrStorageTable (#846532)
  - fixed rare race condintion when populating UCD-SNMP-MIB::prTable,
    which could result in some entries missing in the table (#846436)
  - added support of simfs filesystem in hrStorageTable (#861152)
  - fixed responding to requests on a multihost machine (#825889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-14
changelog:
  - Fix bug where user was prompted for a password when listing keys on an empty system database (#527048)
  - Fix setup-nsssysinit to handle more general flags formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.8
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Fix nsssysinit to enable apps to use the system cert store, patch contributed by David Woodhouse (#546221)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)
  - Sysinit requires coreutils for post install scriplet (#547067)
  - Remove redundant header from the pem module


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.1
changelog:
  - Updated to 3.12.5 from CVS import from Fedora 12
  - Moved blank legacy databases to the lookaside cache
  - Reenabled the full test suite
  - Retagging for a RHEL-6-test-build


author: Elio Maldonado <emaldona@redhat.com> - 3.12.5-7.3
changelog:
  - Resolves: #551784 rebuilt after nss-softokn and nss-util builds
  - this will generate the coorect nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Appying the changes in previous log
  - Changing some BuildRequires to >= as well
  - Temporarily disabling all tests for faster builds


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - Resolves: Bug 784674 - nss should protect against being called before nss_Init
  - Resolves: Bug 784490 - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-1
changelog:
  - Rebase to nss-3.14.0.0-1
  - Resolves: rhbz#837089
  - Update ssl-cbc-random-iv patch for new sources
  - Remove patches rendered obsoleted by rebase to 3.14
  - Add a patch to enforce no pkcs11 bypass


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3.14.3_RTM
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Update expired test certificates (fixed in upstream bug 852781)
  - Sync up pem module's rsawrapr.c with softoken's upstream changes for nss-3.14.3
  - Reactivate the aia tests


author: Elio Maldonado - 3.14.3-2
changelog:
  - Install sechash.h and secmodt.h which are now provided by nss-devel
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue
  - Remove unsafe -r option from commands that remove headers already shipped by nss-util and nss-softoken


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Ensure pem uses system freebl as with this update freebl brings in new API's
  - Resolves: rhbz#918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Syncup with uptream changes for aes gcm and ecc suiteb
  - Enable ecc support for suite b
  - Apply several upstream AES GCM fixes
  - Use the pristine nss upstream sources with ecc included
  - Export NSS_ENABLE_ECC=1 in both the build and the check sections
  - Make failed requests for unsupoprted ssl pkcs 11 bypass non fatal
  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must preserve ABI
  - Related:  rhbz#918950  - rebase nss to 3.14.3


author: Kai Engert <kaie@redhat.com> - 3.14.3-33
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.
    Please ensure that older packages that don't use the alternatives
    system for libnssckbi.so have a smaller n-v-r.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-34
changelog:
  - Fix race condition in cert code related to smart cards
  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-37
changelog:
  - Do not hold issuer certificate handles in the crl cache
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-1
changelog:
  - Rebase to NSS_3.15.1_RTM
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x) 
  - Update patches on account of the shallow tree with the rebase to 3.15.1
  - Update the pem module sources  nss-pem-20130405.tar.bz2 with latest patches applied
  - Remove patches rendered obsolete by the nss rebase and the updated nss-pem sources
  - Enable the iquote.patch to access newly introduced types


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix relative path in %check section to prevent undetected test failures
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Disable the cipher suite already run as part of the nss-softokn build
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-6
changelog:
  - Fix all.sh test for which application was last build by updating nss-versus-softoken-test.path
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Kai Engert <kaie@redhat.com> - 3.15.1-7
changelog:
  - Additional syntax fixes in nss-versus-softoken-test.patch
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-8
changelog:
  - Don't require nss-softokn-fips
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-9
changelog:
  - Rebuild for the pem module to link with freel from nss-softokn-3.14.3-6.el6
  - Related: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]
  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP clients


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-10
changelog:
  - Restore a mistakenly removed patch
  - Resolves: rhbz#961659 - SQL backend does not reload certificates


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-11
changelog:
  - Fix the test for zero failures in the %check section
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to NSS_3_15_3_RTM
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741
  - Resolves: Bug 1031238 - deadlock in trust domain lock and object lock


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Build nss without softoken, freebl, or util sources in the build source tree
  - Resolves: Bug 1032472 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042686 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - make derEncodingsMatch work with encrypted keys
  - rename a patch, dropped the experimental moniker from it
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Fix the numbering and naming of the patches
  - Resolves: Bug 895339 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Install man pages for the nss security tools
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Improve support for ECDSA algorithm via pluggable ECC
  - Document the purpose of the iquote.patch
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-10
changelog:
  - Prevent users from disabling the internal crypto module
  - Resolves: Bug 1059176 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-11
changelog:
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree
  - Add define-uint32.patch to deal with using older version of nss-softokn
  - Fix suboptimal test failure detection shell code in the %check
  unset DISPLAY
   section


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-2
changelog:
  - Restore use of indentation patch until another bug is resolved
  - Resolves: Bug 606022 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-3
changelog:
  - Fix pem module trashing of private keys on failed login
  - Resolves: Bug 1002205 - PEM module trashes private keys if login fails


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-5
changelog:
  - Move removal of directories to the end of the %prep section
  - Resolves: Bug 689919 - build without any softoken or util sources in the tree


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-6
changelog:
  - Update pem sources to the same ones used on rhel-7
  - Remove no longer needed patches on account of this update
  - Resolves: Bug 1002205


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-15
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Rebase to NSS 3.18
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1202488 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686
  - Resolves: Bug 1182902 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-11
changelog:
  - Move libfreebl3.so and its .chk file to /lib{64} keeping
  - symbolic links to them in /usr/lib{64} so as not break others


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-2.1
changelog:
  - Don't enable FIPS when CONFIG_CRYPTO_FIPS=n
  - Fix typo in the package description
  - Fix capitalization error in prelink conflict statement
  - Require nspr 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-4
changelog:
  - Resolves: rhbz#710298 - fix intel optimized aes code to handle case where input and ouput are in the same buffer


author: Elio Maldonado - 3.12.9-12
changelog:
  - Bootstrapping of the builroot in preparation for rebase to 3.14.3
  - Remove hasht.h from the %files devel list to prevent update conflicts with nss-util
  - With 3.14.3 hasht.h will be provided by nss-util-devel
  - Related: rhbz#919172 - rebase nss-softokn to 3.14.3


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue
  - Add export LD_LIBRARY_PATH=$RPM_BUILD_ROOT//usr/lib before the signing commands in __spec_install_post scriplet
    to ensure signing tool links with in-tree freebl so verification uses same algorithm as in signing
  - Add %check section to run the upstream crypto reqression test suite as per packaging guidelines
  - Don't install sechash.h or secmodt.h which as per 3.14 are provided by nss-devel
  - Update the licence to MPLv2.0


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-3
changelog:
  - Add patch to conditionally compile according to old or new sqlite api
  - new is used on rhel-6 while rhel-5 uses old but we need the same code for both
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Enable ECC support for suite b and add upstream fixes for aec gcm
  - Use the unstripped upstream sources with ecc support
  - Limit the ECC support to suite b
  - Apply several upstream aes gcm fixes
  - Rename macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS per upstream
  - Resolves: rhbz#960208 - Enable ECC in nss-softoken
  - Related: rhbz#919172


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
  - Display cpuifo as part of the tests and make NSS_DISABLE_HW_GCM the environment variable to test for
  - When appling the patches use a backup file suffix that better describes the patch purpose


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-6
changelog:
  - create -fips packages 
  - patch submitted by Bob Relyea <rrelyea@redhat.com>
  - fix the script that splits softoken off from nss
  - patch nss/cmd/lib/basicutil.c to build against nss-util-3.15.1
  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS standard. [rhel-6.5.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-7
changelog:
  - Fix the PR_Access stub to actually access the correct permissions
  - Resolves: rhbz#1008513 - Unable to login in fips mode
  - Run the lowhash tests
  - Require nspr-4.0.0 and nss-util-3.15.1


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-8
changelog:
  - Enable new packaging but don't apply nss-fips-post.patch
  - Related: rhbz#1008513 - Unable to login in fips mode


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-11
changelog:
  - Skip calls to CHECK_FORK in {C & NSC}_GetFunctionList
  - Resolves: Bug 1053437 - Admin server segfault when configuration DS configured on SSL port


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-12
changelog:
  - Avoid call to sdb_measureAccess in lib/softoken/sdb.c s_open if NSS_SDB_USE_CACHE is "yes" or "no"
  - Resolves: Bug 1044666 - Can curl HTTPS requests make fewer access system calls?


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-15
changelog:
  - Fix shlibsign to return non-zero on failure
  - Resolves: Bug 587634 - shlibsign returns 0 although if fails


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1182662 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue
  - Add export LD_LIBRARY_PATH=$RPM_BUILD_ROOT//usr/lib64 before the signing commands in __spec_install_post scriplet
    to ensure signing tool links with in-tree freebl so verification uses same algorithm as in signing
  - Add %check section to run the upstream crypto reqression test suite as per packaging guidelines
  - Don't install sechash.h or secmodt.h which as per 3.14 are provided by nss-devel
  - Update the licence to MPLv2.0


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-4
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Fix the required nspr version to be 4.10.6


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-36
changelog:
  - add ldap backend (#455350)
  - skip sshd init's rsa1 creation in fips mode (#672870)
  - improve audit session key destroy (#642792)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-71
changelog:
  - enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI (#756929)
  - add CAVS test driver for the aes-ctr ciphers (#782091)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-73
changelog:
  - remove openssh-4.3p2-no-v6only.patch (#732955)
  - adjust Linux out-of-memory killer (#744236)
  - fix sshd init script - check existence of crypto (#797384)
  - add RequiredAuthentications[12] (#657378)
  - run privsep slave process as the users SELinux context (#798241)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-82
changelog:
  - check return value of PK11_Authenticate in ssh-add -n (#782912)
  - document available methods to RequiredAuthentications[12] (#821641)
  - fix ssh-copy-id (#836650)
  - fix segmentation fault in ssh client (#836655)
  - update pam_ssh_agent_auth to 0.9.3 upstream version
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running (#834404)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-85
changelog:
  - fix chroot logging issue (#872169)
  - change the bad key permissions error message (#880575)
  - fix a race condition in ssh-agent (#896561)
  - backport support for PKCS11 from openssh-5.4p1 (#908038)
  - add a KexAlgorithms knob to the client and server configuration (#951704)
  - fix parsing logic of ldap.conf file (#954094)
  - Add HMAC-SHA2 algorithm support (#969565)
  - store krb5 credentials after a pam session is created (#974096)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-86
changelog:
  - Add support for certificate key types for users and hosts (#906872)
  - Apply RFC3454 stringprep to banners when possible (#955792)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-87
changelog:
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A (#993577)
  - fixed an issue with broken 'ssh -I pkcs11' (#908038)
  - abort non-subsystem sessions to forced internal sftp-server (#993509)
  - reverted 'store krb5 credentials after a pam session is created (#974096)'


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-90
changelog:
  - change default value of MaxStartups - CVE-2010-5107 - #908707
  - add -fips subpackages that contains the FIPS module files (#1001565)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-95
changelog:
  - adjust the key echange DH groups and ssh-keygen according to SP800-131A (#993580)
  - log failed integrity test if /etc/system-fips exists (#1020803)
  - backport ECDSA and ECDH support (#1028335)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-96
changelog:
  - prevent a server from skipping SSHFP lookup (#1081338) CVE-2014-2653
  - ignore environment variables with embedded '=' or '\0' characters CVE-2014-2532
  - backport ControlPersist option (#953088)
  - log when a client requests an interactive session and only sftp is allowed (#997377)
  - don't try to load RSA1 host key in FIPS mode (#1009959)
  - restore Linux oom_adj setting when handling SIGHUP to maintain behaviour over restart
    (#1010429)
  - ssh-keygen -V - relative-specified certificate expiry time should be relative to current time
    (#1022459)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-97
changelog:
  - x11 forwarding - be less restrictive when can't bind to one of available addresses
    (#1027197)
  - better fork error detection in audit patch (#1028643)
  - fix openssh-5.3p1-x11.patch for non-linux platforms (#1100913)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-98
changelog:
  - add possibility to autocreate only RSA key into initscript (#1111568)
  - fix several issues reported by coverity


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - changed /dev/cdrom default user permissions back to 0600 in console.perms
    because some cdrom players open O_RDWR.


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - fixed glob/regexp confusion in pam_console, added kbd and fixed fb devices
  - added pam_xauth module


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - many bug fixes in pam_xauth
  - pam_console can now handle broken applications that do not set
    the PAM_TTY item.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.72
  - fix pam_unix password-changing bug
  - fix pam_unix's cracklib support
  - change package URL


author: Elliot Lee <sopwith@redhat.com>
changelog:
  - Add a patch to accept 'pts/N' in /etc/securetty as a match for tty '5'
    (which is what other pieces of the system think it is). Fixes bug #7641.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add new pam_stack module.
  - Install pwdb_chkpwd and unix_chkpwd as the current user for non-root builds


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add system-auth control file
  - let gethostname() call in pam_access.c be implicitly declared to avoid
    conflicting types if unistd.c declares it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add account management wrappers for pam_listfile, pam_nologin, pam_securetty,
    pam_shells, and pam_wheel


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - symlink libpam.so to libpam.so.%{version}, and likewise for libpam_misc
  - reverse order of checks in _unix_getpwnam for pam_unix


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix installation of pam_xauth man pages (#12417)
  - forcibly strip helpers (#12430)
  - try to make pam_console a little more discriminating


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_console's extra checks disableable
  - simplify extra check to just check if the device owner is root
  - add a debug log when pam_stack comes across a NULL item
  - have pam_stack hand items up to the parent from the child


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - need to make pam_console's checking a little stronger
  - only pass data up from pam_stack if the parent didn't already define it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a broken_shadow option to pam_unix
  - add all module README files to the documentation list (#16456)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move pam_filter modules to /lib/security/pam_filter (#16111)
  - add pam_tally's application to allow counts to be reset (#16456)
  - move README files to the txts subdirectory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - give users /dev/cdrom* instead of /dev/cdrom in console.perms (#16768)
  - add nvidia control files to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix problems when looking for headers in /usr/include (#17236)
  - clean up a couple of compile warnings


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modify the files list to make sure #16456 stays fixed
  - make pam_stack track PAM_AUTHTOK and PAM_OLDAUTHTOK items
  - add pam_chroot module
  - self-hosting fixes from the -devel split
  - update generated docs in the tree


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch from Dmitry V. Levin to have pam_stack propagate the PAM fail_delay
  - roll back the README for pam_xauth to actually be the right one
  - tweak pam_stack to use the parent's service name when calling the substack


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak pre script to be called in all upgrade cases
  - get pam_unix to only care about the significant pieces of passwords it checks
  - add /usr/include/db1/db.h as a build prereq to pull in the right include
    files, no matter whether they're in glibc-devel or db1-devel
  - pam_userdb.c: include db1/db.h instead of db.h


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add RLIMIT_LOCKS to pam_limits (patch from Jes Sorensen) (#20542)
  - link pam_userdb to Berkeley DB 2.x to match 6.2's setup correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix similar() function in pam_cracklib (#14740)
  - fix example in access.conf (#21467)
  - add conditional compilation for building for 6.2 (for pam_userdb)
  - tweak post to not use USESHADOW any more


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix handling of "nis" when changing passwords by adding the checks for the
    data source to the password-updating module in pam_unix
  - add the original copyright for pam_access (fix from Michael Gerdts)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge to 0.74
  - make console.perms match perms set by MAKEDEV, and add some devfs device names
  - add 'sed' to the buildprereq list (#24666)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually time out when attempting to lckpwdf() (#25889)
  - include time.h in pam_issue (#25923)
  - update the default system-auth to the one generated by authconfig 4.1.1
  - handle getpw??? and getgr??? failures more gracefully (#26115)
  - get rid of some extraneous {set,end}{pw,gr}ent() calls


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: change the documented default config file to reflect the defaults
  - pam_limits: you should be able to log in a total of maxlogins times, not
    (maxlogins - 1)
  - handle group limits on maxlogins correctly (#25690)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - own /etc/security
  - be more descriptive when logging messages from pam_limits
  - pam_listfile: remove some debugging code (#28346)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add pam_console_apply
  - /dev/pilot's usually a serial port (or a USB serial port), so revert its
    group to 'uucp' instead of 'tty' in console.perms
  - change pam_console's behavior wrt directories -- directories which are
    mount points according to /etc/fstab are taken to be synonymous with
    their device special nodes, and directories which are not mount points
    are ignored


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: error out on undefined classes in pam_console config file
  - console.perms: actually change the permissions on the new device classes
  - pam_console: add an fstab= argument, and -f and -c flags to pam_console_apply
  - pam_console: use g_log instead of g_critical when bailing out
  - console.perms: logins on /dev/vc/* are also console logins, from Douglas
    Gilbert via Tim Waugh


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: make 'trust' and 'deny' work together correctly
  - pam_wheel: also check the user's primary gid
  - pam_group: also initialize groups when called with PAM_REINITIALIZE_CRED


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove /dev/dri from console.perms -- XFree86 munges it, so it's outside of
    our control (reminder from Daryll Strauss)
  - add /dev/3dfx to console.perms


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - merge up to 0.75
  - pam_unix: temporarily ignore SIGCHLD while running the helper
  - pam_pwdb: temporarily ignore SIGCHLD while running the helper
  - pam_dispatch: default to uncached behavior if the cached chain is empty


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_access: compare IP addresses with the terminating ".", as documented
    (patch from Carlo Marcelo Arenas Belon, I think) (#16505)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: add apm_bios to the list of devices the console owner can use
  - console.perms: add beep to the list of sound devices


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - console.perms: change js* to js[0-9]*
  - include pam_aconf.h in more modules (patches from Harald Welte)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: fix logic bug when changing permissions on single
    file and/or lists of files
  - pam_console: return the proper error code (reported and patches
    for both from Frederic Crozat)
  - change deprecated Copyright: tag in .spec file to License:


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_wheel: don't error out if the group has no members, but is the user's
    primary GID (reported by David Vos)
  - pam_unix: preserve permissions on files which are manipulated (#43706)
  - pam_securetty: check if the user is the superuser before checking the tty,
    thereby allowing regular users access to services which don't set the
    PAM_TTY item (#39247)
  - pam_access: define NIS and link with libnsl (#36864)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_console: use /var/run/console instead of /var/lock/console for lock files
  - pam_issue: read the right number of bytes from the file


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-10
changelog:
  - pam_xauth: fix errors due to uninitialized data structure (fix from Tse Huong
    Choo)
  - pam_xauth: random cleanups
  - pam_console: use /var/run/console instead of /var/lock/console at install-time
  - pam_unix: fix preserving of permissions on files which are manipulated


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_stack: perform deep copy of conversation structures
  - include the static libpam in the -devel subpackage (#52321)
  - move development .so and .a files to %{_libdir}
  - pam_unix: don't barf on empty passwords (#51846)
  - pam_unix: redo compatibility with "hash,age" data wrt bigcrypt (#42394)
  - console.perms: add usb camera, scanner, and rio devices (#15528)
  - pam_cracklib: initialize all options properly (#49613)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - modules: use getpwnam_r and friends instead of non-reentrant versions
  - pam_console: clear generated .c and .h files in "clean" makefile target


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-12
changelog:
  - noreplace configuration files in /etc/security
  - pam_console: update pam_console_apply and man pages to reflect
    /var/lock -> /var/run move


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_unix: use crypt() instead of bigcrypt() when salted field is less than
    the critical size which lets us know it was generated with bigcrypt()
  - use a wrapper to handle ERANGE errors when calling get....._r functions:
    defining PAM_GETPWNAM_R and such (for getpwnam, getpwuid, getgrnam,
    getgrgid, and getspnam) before including _pam_macros.h will cause them
    to be implemented as static functions, similar to how defining PAM_SM_xxx
    is used to control whether or not PAM declares prototypes for certain
    functions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_userdb: fix the key_only flag so that the null-terminator of the
    user-password string isn't expected to be part of the key in the db file,
    matching the behavior of db_load 3.2.9


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: rewrite to skip refcounting and just use a temporary file
    created using mkstemp() in /tmp


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_xauth: close a possible DoS due to use of dotlock-style locking in
    world-writable directories by relocating the temporary file to the target
    user's home directory
  - general: include headers local to this tree using relative paths so that
    system headers for PAM won't be pulled in, in case include paths don't
    take care of it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add cracklib as a buildprereq
  - pam_wheel: don't ignore out if the user is attempting to switch to a
    unprivileged user (this lets pam_wheel do its thing when users attempt
    to get to system accounts or accounts of other unprivileged users)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_mkhomedir: recurse into subdirectories properly
  - pam_mkhomedir: handle symlinks
  - pam_mkhomedir: skip over special items in the skeleton directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_limits: don't just return if the user is root -- we'll want to set the
    priority (it could be negative to elevate root's sessions)
  - pam_issue: fix off-by-one error allocating space for the prompt string


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_tally: don't try to read past the end of faillog -- it probably contains
    garbage, which if written into the file later on will confuse /usr/bin/faillog


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_rhosts: allow "+hostname" as a synonym for "hostname" to jive better
    with the hosts.equiv(5) man page
  - use the automake install-sh instead of the autoconf install-sh, which
    disappeared somewhere between 2.50 and now


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-15
changelog:
  - reorder patches so that the reentrancy patch is applied last -- we never
    came to a consensus on how to guard against the bugs in calling applications
    which this sort of change addresses, and having them last allows for dropping
    in a better strategy for addressing this later on


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-16
changelog:
  - pam_xauth: always return PAM_SUCCESS or PAM_SESSION_ERR instead of PAM_IGNORE,
    matching the previous behavior (libpam treats PAM_IGNORE from a single module
    in a stack as a session error, leading to false error messages if we just
    return PAM_IGNORE for all cases)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-19
changelog:
  - fix a bug in the getpwnam_r wrapper which sometimes resulted in false
    positives for non-existent users


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-20
changelog:
  - pam_stack: fix some memory leaks (reported by Fernando Trias)
  - pam_chroot: integrate Owl patch to report the more common causes of failures


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-31
changelog:
  - libpam_misc: fix possible infinite loop in misc_conv (#62195)
  - pam_xauth: fix cases where DISPLAY is "localhost:screen" and the xauth
    key is actually stored using the system's hostname (#61524)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-36
changelog:
  - pam_timestamp: chown intermediate directories when creating them
  - pam_timestamp_check: add -d flag to poll


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-40
changelog:
  - pam_timestamp_check: check that stdio descriptors are open before we're
    invoked
  - add missing chroot.conf


author: Elliot Lee <sopwith@redhat.com> 0.75-42
changelog:
  - Since cracklib-dicts location will not be correctly detected without 
    that package being installed, add buildreq for cracklib-dicts.
  - Add patch57: makes configure use $LIBNAME when searching for cracklib 
    dicts, and error out if not found.


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-44
changelog:
  - fix syntax errors in pam_console's yacc parser which newer bison chokes on
  - forcibly set FAKEROOT at make install time


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-45
changelog:
  - create /lib/security, even if it isn't /%{_lib}/security, because we
    can't locate /lib/security/$ISA without it (noted by Arnd Bergmann)
  - clear out the duplicate docs directory created during %install


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-46
changelog:
  - pam_xauth: reintroduce ACL support, per the original white paper
  - pam_xauth: default root's export ACL to none instead of everyone


author: Nalin Dahyabhai <nalin@redhat.com> 0.75-49
changelog:
  - modify calls to getlogin() to check the directory of the current TTY before
    searching for an entry in the utmp/utmpx file (#98020, #98826, CAN-2003-0388)


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-0
changelog:
  - update to 0.77 upstream release
    - pam_limits: limits now affect root as well
    - pam_nologin: returns PAM_IGNORE instead of PAM_SUCCESS unless "successok"
      is given as an argument
    - pam_userdb: correctly return PAM_AUTH_ERR instead of PAM_USER_UNKNOWN when
      invoked with the "key_only" argument and the database has an entry of the
      form "user-<wrongpassword>"
  - use a bundled libdb for pam_userdb.so because the system copy uses threads,
    and demand-loading a shared library which uses threads into an application
    which doesn't is a Very Bad Idea


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pam_succeed_if: fix thinko in argument parsing which would walk past the
    end of the argument list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make pam_pwdb.so link with libnsl again so that it loads (#107093)
  - remove now-bogus buildprereq on db4-devel (we use a bundled copy for
    pam_userdb to avoid symbol collisions with other db libraries in apps)


author: Nalin Dahyabhai <nalin@redhat.com> 0.77-15
changelog:
  - don't install _pam_aconf.h -- apps don't use it, other PAM headers which
    are installed don't use it, and its contents may be different for arches
    on a multilib system
  - check for linkage problems in modules at %install-time (kill #107093 dead)
  - add buildprereq on flex (#101563)


author: Dan Walsh <dwalsh@redhat.com> 0.77-19.sel
changelog:
  - Change unix_chkpwd to handle unix_passwd and unix_acct
  - This eliminates the need for pam modules to have read/write access to /etc/shadow.


author: Tomas Mraz <tmraz@redhat.com> 0.77-56
changelog:
  - #75454 fixed locking when changing password
  - #127054 
  - #125653 removed unnecessary getgrouplist call
  - #124979 added quiet option to pam_succeed_if


author: Tomas Mraz <tmraz@redhat.com> 0.77-61
changelog:
  - #129328 pam_env shouldn't abort on missing /etc/environment
  - #126985 pam_stack should always copy the conversation function 
  - #127524 add /etc/security/opasswd to files


author: Tomas Mraz <tmraz@redhat.com> 0.77-63
changelog:
  - Fix checking of group %group syntax in pam_limits
  - Drop fencepost patch as it was already fixed 
    by upstream change from 0.75 to 0.77
  - Fix brokenshadow patch


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - #87628 pam_timestamp remembers authorization after logout
  - #116956 fixed memory leaks in pam_stack


author: Tomas Mraz <tmraz@redhat.com> 0.77-66
changelog:
  - #77646 log failures when renaming the files when changing password
  - Log failure on missing /etc/security/opasswd when remember option is present


author: Tomas Mraz <tmraz@redhat.com> 0.78-1
changelog:
  - update to Linux-PAM-0.78
  - #140451 parse passwd entries correctly and test for failure
  - #137802 allow using pam_console for authentication


author: Tomas Mraz <tmraz@redhat.com> 0.78-5
changelog:
  - echo why tests failed when rebuilding
  - fixed some warnings and errors in pam_console for gcc4 build
  - improved parsing pam_console config file


author: Tomas Mraz <tmraz@redhat.com> 0.78-6
changelog:
  - add functionality for running handler executables from pam_console
    when console lock was obtained/lost
  - removed patches merged to pam-redhat


author: Tomas Mraz <tmraz@redhat.com> 0.78-8
changelog:
  - remove ownership and permissions handling from pam_console call
    pam_console_apply as a handler instead


author: Tomas Mraz <tmraz@redhat.com> 0.78-9
changelog:
  - fix wrong logging in pam_console handlers
  - add executing ainit handler for alsa sound dmix
  - #147879, #112777 - change permissions for dri devices


author: Tomas Mraz <tmraz@redhat.com> 0.79-3
changelog:
  - make pam_unix LSB 2.0 compliant even when SELinux enabled
  - #88127 - change both local and NIS passwords to keep them in sync,
    also fix a regression in passwd functionality on NIS master server


author: Tomas Mraz <tmraz@redhat.com> 0.79-5
changelog:
  - added auditing patch by Steve Grubb
  - added cleanup patches for bugs found by Steve Grubb
  - don't clear the shadow option of pam_unix if nis option used


author: Tomas Mraz <tmraz@redhat.com> 0.79-7
changelog:
  - pam_xauth: unset the XAUTHORITY variable on error, fix
    potential memory leaks
  - modify path to IDE floppy devices in console.perms (#155560)


author: Tomas Mraz <tmraz@redhat.com> 0.79-9
changelog:
  - update the pam audit patch to support newest audit library,
    audit also pam_setcred calls (Steve Grubb)
  - don't use the audit_fd as global static variable
  - don't unset the XAUTHORITY when target user is root


author: Tomas Mraz <tmraz@redhat.com> 0.79-10
changelog:
  - add the Requires dependency on audit-libs (#159885)
  - pam_loginuid shouldn't report error when /proc/self/loginuid
    is missing (#159974)


author: Tomas Mraz <tmraz@redhat.com> 0.80-1
changelog:
  - upgrade to new upstream sources
  - removed obsolete patches
  - pam_selinux module shouldn't fail on broken configs unless
    policy is set to enforcing (Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.80-2
changelog:
  - fixed module tests so the pam doesn't require itself to build (#163502)
  - added buildprereq for building the documentation (#163503)
  - relaxed permissions of binaries (u+w)


author: Tomas Mraz <tmraz@redhat.com> 0.80-8
changelog:
  - process limit values other than RLIMIT_NICE correctly (#168790)
  - pam_unix: always honor nis flag on password change (by Aaron Hope)


author: Tomas Mraz <tmraz@redhat.com> 0.80-9
changelog:
  - don't include ps and pdf docs (#168823)
  - new common config file for configuration utilities
  - remove glib2 dependency (#166979)


author: Tomas Mraz <tmraz@redhat.com> 0.80-13
changelog:
  - fixed CAN-2005-2977 unix_chkpwd should skip user verification only if
    run as root (#168181)
  - link pam_loginuid to libaudit
  - support no tty in pam_access (#170467)
  - updated audit patch (by Steve Grubb)
  - the previous pam_selinux change was not applied properly
  - pam_xauth: look for the xauth binary in multiple directories (#171164)


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-1
changelog:
  - support netgroup matching in pam_succeed_if
  - upgrade to new release
  - drop pam_pwdb as it was obsolete long ago
  - we don't build static libraries anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.2.1-2
changelog:
  - fix dangling symlinks in -devel (#175929)
  - link libaudit only where necessary
  - actually compile in audit support


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-1
changelog:
  - new upstream version
  - updated db4 to 4.3.29
  - added module pam_tally2 with auditing support
  - added manual pages for system-auth and config-util (#179584)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-2
changelog:
  - added try_first_pass option to pam_cracklib
  - use try_first_pass for pam_unix and pam_cracklib in
    system-auth (#182350)


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-3
changelog:
  - added pam_namespace module written by Janak Desai (per-user /tmp
  support)
  - new pam-redhat modules version


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-4
changelog:
  - fixed console device class for irda (#189966)
  - make pam_console_apply fail gracefully when a class is missing


author: Tomas Mraz <tmraz@redhat.com> 0.99.3.0-5
changelog:
  - the namespace instance init script is now in /etc/security (#190148)
  - pam_namespace: added missing braces (#190026)
  - pam_tally(2): never call fclose twice on the same FILE (from upstream)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-1
changelog:
  - upgrade to new upstream version
  - make pam_console_apply not dependent on glib
  - support large uids in pam_tally, pam_tally2


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-2
changelog:
  - pam_console_apply shouldn't access /var when called with -r (#191401)
  - actually apply the large-uid patch
  - don't build hmactest in pam_timestamp so openssl-devel is not required
  - add missing buildrequires (#191915)


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-3
changelog:
  - use md5 implementation from pam_unix in pam_namespace
  - pam_namespace should call setexeccon only when selinux is enabled


author: Tomas Mraz <tmraz@redhat.com> 0.99.4.0-5
changelog:
  - updated pam_namespace with latest patch by Janak Desai
  - merged pam_namespace patches
  - added buildrequires libtool
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-1
changelog:
  - updated to a new upstream release
  - added service as value to be matched and list matching to
    pam_succeed_if
  - namespace.init was missing from EXTRA_DIST


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-3
changelog:
  - don't report error in pam_selinux for nonexistent tty (#188722)
  - add pam_keyinit to the default system-auth file (#198623)


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-6
changelog:
  - revoke keyrings properly when pam_keyinit called more than once (#201048)
    patch by David Howells


author: Tomas Mraz <tmraz@redhat.com> 0.99.5.0-7
changelog:
  - revoke keyrings properly when pam_keyinit called as root (#201048)
  - pam_succeed_if should return PAM_USER_UNKNOWN when getpwnam fails (#197748)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-1
changelog:
  - upgrade to new upstream version, as there are mostly bugfixes except
    improved documentation
  - add support for session and password service for pam_access and
    pam_succeed_if
  - system-auth: skip session pam_unix for crond service


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-2
changelog:
  - silence pam_succeed_if in default system-auth (#205067)
  - round the pam_timestamp_check sleep up to wake up at the start of the
    wallclock second (#205068)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-3.1
changelog:
  - preserve effective uid in namespace.init script (LSPP for newrole)
  - include /var/log/faillog and tallylog to filelist (#209646)
  - add ids to .xml docs so the generated html is always the same (#210569)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-4
changelog:
  - update internal db4 to 4.5.20 version
  - move setgid before setuid in pam_keyinit (#212329)
  - make username check in pam_unix consistent with useradd (#212153)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-5
changelog:
  - add select-context option to pam_selinux (#213812)
  - autoreconf won't work with autoconf-2.61 as configure.in is not yet adjusted
    for it


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-8
changelog:
  - properly include /var/log/faillog and tallylog as ghosts
    and create them in post script (#209646)
  - update gmo files as we patch some po files (#218271)
  - add use_current_range option to pam_selinux (#220487)
  - improve the role selection in pam_selinux
  - remove shortcut on Password: in ja locale (#218271)
  - revert to old euid and not ruid when setting euid in pam_keyinit (#219486)
  - rename selinux-namespace patch to namespace-level


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.0-1
changelog:
  - upgrade to new upstream version
  - drop pam_stack module as it is obsolete
  - some changes to silence rpmlint


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-1
changelog:
  - upgrade to new upstream version resolving CVE-2007-0003
  - pam_namespace: unmount poly dir for override users


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-3
changelog:
  - correctly relabel tty in the default case (#229542)
  - pam_unix: cleanup of bigcrypt support
  - pam_unix: allow modification of '*' passwords to root


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-4
changelog:
  - pam_console: always decrement use count (#230823)
  - pam_namespace: use raw context for poly dir name (#227345)
  - pam_namespace: truncate long poly dir name (append hash) (#230120)
  - we don't patch any po files anymore


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-5
changelog:
  - pam_selinux: improve context change auditing (#234781)
  - pam_namespace: fix parsing config file with unknown users (#234513)


author: Tomas Mraz <tmraz@redhat.com> 0.99.7.1-6
changelog:
  - pam_namespace: better document behavior on failure (#237249)
  - pam_unix: split out passwd change to a new helper binary (#236316)
  - pam_namespace: add support for temporary logons (#241226)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-3
changelog:
  - updated db4 to 4.6.18 (#249740)
  - added user and new instance parameters to namespace init
  - document the new features of pam_namespace
  - do not log an audit error when uid != 0 (#249870)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-5
changelog:
  - most devices are now handled by HAL and not pam_console (patch by davidz)
  - license tag fix
  - multifunction scanner device support (#251468)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-6
changelog:
  - do not ask for blank password when SELinux confined (#254044)
  - initialize homedirs in namespace init script (original patch by dwalsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-9
changelog:
  - do not preserve contexts when copying skel and other namespace.init
    fixes (#298941)
  - do not free memory sent to putenv (#231698)


author: Tomas Mraz <tmraz@redhat.com> 0.99.8.1-17
changelog:
  - test for setkeycreatecon correctly
  - add exclusive login mode of operation to pam_selinux_permit (original
    patch by Dan Walsh)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-1
changelog:
  - new upstream release
  - add default soft limit for nproc of 1024 to prevent
    accidental fork bombs (#432903)


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-2
changelog:
  - if shadow is readable for an user do not prevent him from
    authenticating any user with unix_chkpwd (#433459)
  - call audit from unix_chkpwd when appropriate


author: Tomas Mraz <tmraz@redhat.com> 0.99.10.0-4
changelog:
  - pam_namespace: fix problem with level polyinst (#438264)
  - pam_namespace: improve override checking for umount
  - pam_selinux: fix syslogging a context after free() (#438338)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-4
changelog:
  - pam_namespace: allow safe creation of directories owned by user (#437116)
  - pam_unix: fix multiple error prompts on password change (#443872)


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-1
changelog:
  - pam_loginuid: uids are unsigned (#460241)
  - new minor upstream release
  - use external db4
  - drop tests for not pulling in libpthread (as NPTL should
    be safe)


author: Tomas Mraz <tmraz@redhat.com> 1.0.2-2
changelog:
  - new password quality checks in pam_cracklib
  - report failed logins from btmp in pam_lastlog
  - allow larger groups in modutil functions
  - fix leaked file descriptor in pam_tally


author: Tomas Mraz <tmraz@redhat.com> 1.0.90-4
changelog:
  - fix parsing of config files containing non-ASCII characters
  - fix CVE-2009-0579 (mininimum days for password change ignored) (#487216)
  - pam_access: improve handling of hostname resolution


author: Tomas Mraz <tmraz@redhat.com> 1.0.91-6
changelog:
  - add password-auth, fingerprint-auth, and smartcard-auth
    for applications which can use them namely gdm (#494874)
    patch by Ray Strode


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-5
changelog:
  - do not change permissions with pam_console_apply
  - drop obsolete pam_tally module and the faillog file (#461258)


author: Tomas Mraz <tmraz@redhat.com> 1.1.0-7
changelog:
  - pam_console: fix memory corruption when executing handlers (patch by
    Stas Sergeev) and a few more fixes in the handler execution code (#532302)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-5
changelog:
  - fix insecure dropping of priviledges in pam_xauth, pam_env,
    and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335)
  - fix insecure executing of scripts with user supplied environment
    variables in pam_namespace - CVE-2010-3853 (#643043)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-6
changelog:
  - do not overwrite /var/log/tallylog on package update (#614766)
  - add support for uid and gid ranges in limits.conf (#622847)
  - add new pam_faillock module (#644971)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-7
changelog:
  - fix a few memory leaks in error paths and other mistakes
    found by a code review
  - add rhost and tty to auditing data in modules (#677664)


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-12
changelog:
  - add character sequence test to pam_cracklib
  - drop unused difignore option from pam_cracklib (#811243)
  - add enforce_for_root option to pam_cracklib (#588893)
  - mention limits.d in the limits.conf(5) manpage (#723297)
  - add ability to lock out inactive accounts to pam_lastlog
  - fix require_selinux option in pam_namespace (#750601)
  - add mntopts flag for tmpfs polyinstantiation method
  - preserve authtok_type in pam_get_authtok() (#811168)
  - fix username mismatch in pam_unix remember feature (#815516)
  - relax restriction of root in pam_pwhistory
  - relax soft nproc limit for root in 90-nproc.conf


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-18
changelog:
  - pam_cracklib: improve documentation (#889233)
  - unbreak authentication if ld.so.preload is not empty
  - correct off by one error in account expiration calculation (#947011)
  - pam_console_apply: do not print error if console.perms.d is empty
  - properly handle all cases where crypt() might return NULL (#1026203)
  - pam_limits: clarify documentation of maxsyslogins limit (#1028490)
  - pam_access: call DNS resolution only when necessary and cache
    results (#1029817)
  - pam_limits: nofile applies to file descriptors not files (#1040664)
  - pam_limits: check whether the utmp login entry is valid (#1054936)
  - correct URLs in spec file (#1071770)
  - pam_userdb: correct the example in man page (#1078779)
  - pam_selinux: canonicalize username for getseuser() (#1083981)
  - pam_access: fix netgroup matching and @user@@netgroup parsing (#740233)


author: Chris Feist <cfeist@redhat.com> - 0.9.26-6
changelog:
  - Added additional specific steps for configuring pcs on Red Hat Enterprise
    Linux 6
  - Resolves: rhbz#878682


author: Chris Feist <cfeist@redhat.com> - 0.9.26-9
changelog:
  - pcs now allows assigning constraints to group/clone/multistate resources
  - pcs no longer deletes resources from the lrm during resource removal
  - Resolves: rhbz#894174 rhbz#893221


author: Chris Feist <cfeist@redhat.com> - 0.9.26-10
changelog:
  - Removed one extra place where pcs incorrectly deleted resources from the lrm
  - Resolves: rhbz#893221


author: Chris Feist <cfeist@redhat.com> - 0.9.73-1
changelog:
  - Cluster name is now viewable on RHEL 6
  - Cluster.conf is now removed on destroy
  - Misc man page & usage updates
  - When removing the last resource from a group, remove any constraints still
    remaining on group


author: Chris Feist <cfeist@redhat.com> - 0.9.74-1
changelog:
  - pcs cluster edit should now work properly
  - Allow removal of group and resources inside group with
    pcs resource delete <group name>


author: Chris Feist <cfeist@redhat.com> - 0.9.75-1
changelog:
  - Removing a resource that is part of a resource set is now allowed
  - When you try to remove a group from a master that has more than one
    resource you now recieve a helpful error
  - Unclone works on clones where constraints have been added
  - Removing a group with constraints now works properly
  - Master/Slave groups now have constraints properly removed before being
    deleted


author: Chris Feist <cfeist@redhat.com> - 0.9.76-1
changelog:
  - Renamed resource group remove/delete to ungroup
  - Fixed moving resource masters
  - Allow cloing/mastering last resource in a group


author: Chris Feist <cfeist@redhat.com> - 0.9.77-1
changelog:
  - Fixed managing/unmanaging groups/clones/masters of resources
  - Fixed issue when using --group when creating a resource


author: Chris Feist <cfeist@redhat.com> - 0.9.78-1
changelog:
  - Fixed error codes and stdout/stderr output on errors from pcs resource
    enable/disable
  - Automatically add interval to operations which don't specify an interval


author: Chris Feist <cfeist@redhat.com> - 0.9.79-1
changelog:
  - Fixed OCF_CHECK_LEVEL operation setting in resource update
  - Return proper error codes when stopping/starting/enable/disabling resources
  - Return proper error code on auth


author: Chris Feist <cfeist@redhat.com> - 0.9.80-1
changelog:
  - More fixes for OCF_CHECK_LEVEL issues
  - Fix traceback when adding a resourcew with a provider that doesn't exist
  - Create proper two_node cluster when only two nodes are specified in cluster
    setup
  - Give useful error when bad options are used with 'op'


author: Chris Feist <cfeist@redhat.com> - 0.9.81-1
changelog:
  - Fix issues when updating resource with multiple operations with the same
    action
  - Fixed constraint rules and improved usage documentation


author: Chris Feist <cfeist@redhat.com> - 0.9.82-1
changelog:
  - Show constraint id when printing out location rules
  - Improve error messages when adding location rules with errors
  - Add ability to remove constraint rules
  - Allow move of master/slave resources if --master is present


author: Chris Feist <cfeist@redhat.com> - 0.9.87-1
changelog:
  - Allow two ordering constraints with same resources
  - Improved error messages when trying to master/clone resources
  - Updated error message when attempting to move a master/slave without
    --master


author: Chris Feist <cfeist@redhat.com> - 0.9.88-1
changelog:
  - Don't allow order/colocation constraints created for master primitives
  - Check in clones for stonith resources
  - Clarify 'constraint rule add' in man page/usage
  - Fixed minor usage issue with colocation sets


author: Chris Feist <cfeist@redhat.com> - 0.9.89-1
changelog:
  - Show location constraint role in pcs status/constraint
  - Disable resource before removing
  - Misc man/usage fixes


author: Chris Feist <cfeist@redhat.com> - 0.9.90-1
changelog:
  - Add ability to set node attributes
  - Fix issue setting meta attributes on a master when creating a resource


author: Chris Feist <cfeist@redhat.com> - 0.9.101-1
changelog:
  - Rebase for new features
  - Added ability to set uidgid in cluster.conf
  - Stonith level add now properly recognizes nodes
  - Resolves: rhbz#1025053 rhbz#1019410


author: Chris Feist <cfeist@redhat.com> - 0.9.101-3
changelog:
  - When creating a resource using --group/--clone/--master put the group
    inside the master/clone/group before putting it into the live CIB
  - Resolves: rhbz#1066927


author: Chris Feist <cfeist@redhat.com> - 0.9.118-2
changelog:
  - Re-synced to upstream sources
  - Fixed dependency on rubygems
  - Fixed pam long timeouts due to fprintd
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.120-2
changelog:
  - Use /usr/sbin/pcs for pcs instead of /sbin/pcs
  - Use Open4 instead of POpen4 for running commands
  - Fixed cluster setup for RHEL6
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.121-1
changelog:
  - Don't try to get metadata for fence_check, fence_tool & fence_node
  - Cloned M/S groups can now be deleted
  - Clone options can now follow --clone
  - Cloned resources with globally-unique=true can now be deleted
  - Resolves: rhbz#1102836


author: Chris Feist <cfeist@redhat.com> - 0.9.123-3
changelog:
  - Added ability to upgrade cluster cib and we auto upgrade cib if we're running
    an acl command (except show or help)
  - Resolves: rhbz#1112727


author: Chris Feist <cfeist@redhat.com> - 0.9.123-4
changelog:
  - Fixed resource delete for clones of groups with more than one resource
  - Fixed unclone of group so all resources are removed
  - Resolves: rhbz#1107612 rhbz#1108778


author: Chris Feist <cfeist@redhat.com> - 0.9.123-6
changelog:
  - Fixed issue with sync cluster.conf & adding uid/gid across cluster on RHEL6 w/ pcsd
  - Resolves: rhbz#1102836


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.138-1
changelog:
  - Rebased to latest upstream packages
  - Fixed creating default resource operations
  - Added support for RRP and corosync options for cman based clusters
  - Allowed scope=configuration in cib commands
  - Added support for configuring a cluster remotely using pcsd
  - Fixed globally-unique clone resources in pcsd
  - Added resource location to resources / stonith devices list
  - Fixed formatting of resource / fence agent description
  - Fence agent description now contains information about the agent
  - Parallelized cluster start and cluster stop
  - Added warning when nodes stop will cause a loss of the quorum
  - pcs status --full now displays Node attributes and Migration summary
  - Resolves: rhbz#1185738 rhbz#1031141 rhbz#1121769 rhbz#1126835 rhbz#1160359 rhbz#1168986 rhbz#1174244 rhbz#1174793 rhbz#1174798 rhbz#1174801 rhbz#1184763 rhbz#1184922


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-1
changelog:
  - Rebased to latest upstream packages
  - Fixed constraints removal and node standby/unstandby using remote GUI
  - Fixed displaying of fence / resource agent metadata in GUI
  - Added Pacemaker Resource defaults and Op defaults to 'pcs config' output
  - Fixed 'pcs resource clear' used on cloned group
  - Added support for scope option in cib commands
  - Added warning when creating a cluster with UDPU transport
  - Reload cluster.conf after node addition / removal
  - Resolves: rhbz#1185738 rhbz#1168982 rhbz#1174793 rhbz#1187488 rhbz#1190167 rhbz#1190168 rhbz#1191898 rhbz#1193433


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-9.el6_7.1
changelog:
  - Fixed session and cookies processing
  - Fixed command injection vulnerability
  - Resolves: rhbz#1253287 rhbz#1253291


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com>
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)


author: Joe Orton <jorton@redhat.com> - 5.3.2-6
changelog:
  - add security fixes for CVE-2010-1866, CVE-2010-2094, CVE-2010-1917,
    CVE-2010-2531, MOPS-2010-060 (#624469)


author: Joe Orton <jorton@redhat.com> - 5.3.3-1
changelog:
  - update to 5.3.3 (#645591)
  - add security fixes for CVE-2010-3709, CVE-2010-3710,
    CVE-2010-3870, CVE-2009-5016 (#651953)
  - prevent extract() cloberring $GLOBALS (#655118)
  - ensure correct mysql_config is used in biarch builds


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 5.3.3-6
changelog:
  - merge Joe's changes:
  - improve CVE-2011-1466 fix to cover CAL_GREGORIAN, CAL_JEWISH
  - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148,
    CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470,
    CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740732)


author: Joe Orton <jorton@redhat.com> - 5.3.3-11
changelog:
  - add security fixes for CVE-2012-0781, CVE-2011-4153, CVE-2012-0057,
    CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2386


author: Remi Collet <rcollet@redhat.com> - 5.3.3-15
changelog:
  - fix permission on source files (#676364)
  - fix negative keys with var_export (#771738)
  - fix setDate when DateTime created from timestamp (#812819)
  - add php(language) and missing provides (#837042)
  - use arch-specific requires (#833545)
  - fix possible buffer overflow in pdo_odbc (#836264)
  - fix possible segfault in pdo_mysql (#824199)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-16
changelog:
  - fix stream support in fileinfo (#858653)
  - fix imap_open DISABLE_AUTHENTICATOR param ignores array (#859371)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-22
changelog:
  - php-xml provides php-xmlreader and php-xmlwriter (#874987)
  - fix possible NULL derefence and buffer overflow (#879179)
  - fix zend garbage collector (#848186, #868375)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - fix buffer overflow in _pdo_pgsql_error (#969110)
  - fix double free when destroy_zend_class fails (#910466)
  - fix segfault in error_handler with
    allow_call_time_pass_reference = Off (#892158)
  - fix copy doesn't report failure on partial copy (#947428)
  - add rpm macros for packagers: %php_inidir,
    %php_incldir and %__php (#953814)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-29
changelog:
  - drop unneeded part of CVE-2006-724.patch and fileinfo.patch
    extension not provided or git binary patches (#1064027)
  - odbc: fix incompatible pointer type (#1053982)
  - mysqli: fix possible segfault in mysqli_stmt::bind_result
    php bug 66762 (#1069167)
  - mysql: fix php_mysql_fetch_hash writes long value into int
    php bug 52636 (#1054953)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-31
changelog:
  - soap: fixRFC2616 transgression (#1045019)
  - fix static calling in non-static method (#953786)
  - fix autoload called from closing session (#954027)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-34
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Jan Kaluza <jkaluza@redhat.com> - 5.3.3-35
changelog:
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480


author: Remi Collet <rcollet@redhat.com> - 5.3.3-36
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.3.3-37
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-38
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Kaj J. Niemi <kajtzu@fi.basen.net> 7.4-0.1
changelog:
  - 7.4
  - Fixed Patch #1 (now rpm-pgsql-7.4.patch)
  - Fixed Patch #2 (now rpm-multilib-7.4.patch):
  - Patch #4 is unnecessary (upstream)
  - Fixed Patch #6 (now postgresql-7.4-src-tutorial.patch)
  - Added Patch #8 (postgresql-7.4-com_err.patch) as com_err()
    is provided by e2fsprogs and CPPFLAGS gets lost somewhere
    inside configure (bad macro?)
  - No 7.4 PDF docs available yet (Source #17)
  - PyGreSQL is separated from the upstream distribution but
    we include it as usual (Source #18)
  - Default to compiling libpq and ECPG as fully thread-safe

  - 7.4 Origin.  See previous spec files for previous history. Adapted
  - from Red Hat and PGDG's 7.3.4 RPM, directly descended from 
  - postgresql-7.3.4-2 as shipped in Fedora Core 1.


author: Lamar Owen <lowen@pari.edu> <lamar.owen@wgcr.org>
changelog:
  - 7.4-0.1PGDG
  - Development JDBC jars in addition to the 7.3 jars; will replace the
  - 7.3 jars once 7.4 official jars are released.
  - Changed to use the bzip2 source to save a little size.
  - Removed some commented out portions of the specfile.
  - Removed the 7.3.4 PDF docs.  Will replace with 7.4 PDF's once they
  - are ready.


author: David Jee <djee@redhat.com> 7.4-4
changelog:
  - Add PyGreSQL patch for deprecated column pg_type.typprtlen [Bug #111263]
  - Add headers patch which moves ecpg headers to /usr/include/ecpg
    [Bug #111195]


author: Lamar Owen <lowen@pari.edu>
changelog:
  - 7.4.1-1PGDG
  - Merge Sander Steffann's changes up to 7.4-0.5PGDG
  - Proper 7.4.1 JDBC jars this time.
  - Patch for no pl/python from Alvaro


author: Tom Lane <tgl@redhat.com> 7.4.2-1
changelog:
  - Update to PostgreSQL 7.4.2; sync with community SRPM as much as possible.
  - Support PGOPTS from /etc/sysconfig/pgsql, per bug 111504.
  - Fix permissions on /etc/sysconfig/pgsql, per bug 115278.
  - SELinux patch in init file: always su </dev/null, per bug 117901.
  - Rebuilt


author: Tom Lane <tgl@redhat.com> 7.4.3-1
changelog:
  - Update to PostgreSQL 7.4.3.
  - Uninstalling server RPM stops postmaster first, per bug 114846.
  - Fix su commands to not assume PG user's shell is sh-like, per bug 124024.
  - Fix permissions on postgresql-python doc files, per bug 124822.
  - Minor postgresql.init improvements.


author: Tom Lane <tgl@redhat.com> 7.4.3-3
changelog:
  - Undo ill-considered chkconfig change that causes server to start
    immediately upon install.  Mea culpa (bug 127552).


author: Tom Lane <tgl@redhat.com> 7.4.5-1
changelog:
  - Update to PostgreSQL 7.4.5.
  - Update JDBC jars to driver build 215.
  - Add Obsoletes: entries for rh-postgresql packages, per bug 129278.


author: Tom Lane <tgl@redhat.com> 7.4.5-3
changelog:
  - Solve the stale lockfile problem (bugs 71295, 96981, 134090)
  - Use runuser instead of su for SELinux (bug 134588)


author: Tom Lane <tgl@redhat.com> 7.4.5-4
changelog:
  - Remove contrib/oidjoins stuff from installed fileset; it's of no use
    to ordinary users and has a security issue (bugs 136300, 136301)
  - adjust chkconfig priority (bug 128852)


author: Tom Lane <tgl@redhat.com> 7.4.6-1
changelog:
  - Update to PostgreSQL 7.4.6 (bugs 136947, 136949)
  - Make init script more paranoid about mkdir step of initializing a new
    database (bugs 136947, 136949)


author: Tom Lane <tgl@redhat.com> 7.4.6-3
changelog:
  - Update to PyGreSQL 3.6 (to fix bug #142711)
  - Adjust a few file permissions (bug #142431)
  - Assign %{_libdir}/pgsql to base package instead of -server (bug #74003)


author: Tom Lane <tgl@redhat.com> 8.0.0-1
changelog:
  - Update to PostgreSQL 8.0.0, PyGreSQL 3.6.1, pgtcl 1.5.2,
    and jdbc driver build 309.
  - Extensive cleanout of obsolete cruft in patch set.
  - Regression tests are run during RPM build (NOTE: cannot build as root when
    this is enabled).
  - Postmaster stderr goes someplace useful, not /dev/null (bz#76503, #103767)
  - Make init script return a useful exit status (bz#80782)
  - Move docs' tutorial directory to %{_libdir}/pgsql/tutorial, since it
    includes .so files that surely do not belong under /usr/share.
  - Remove useless .sgml files from docs RPM (bz#134450)
  - Put regression tests under /usr/lib64 on 64-bit archs, since .so files
    are not architecture-independent.


author: Tom Lane <tgl@redhat.com> 8.0.1-2
changelog:
  - Repair improper error message in init script when PGVERSION doesn't match.
  - Arrange for auto update of version embedded in init script.


author: Tom Lane <tgl@redhat.com> 8.0.1-4
changelog:
  - Attach Obsoletes: declarations for rh-postgresql to subpackages (bz#144435)
  - Make Requires: and Prereq: package linkages specify release not only
    version, as per recent mailing list discussion.


author: Tom Lane <tgl@redhat.com> 8.0.3-1
changelog:
  - Update to PostgreSQL 8.0.3 (includes security and data-loss fixes; see
    bz#156727, CAN-2005-1409, CAN-2005-1410)
  - Update to jdbc driver build 311
  - Recreate postgres user after superseding an rh-postgresql install (bug #151911)
  - Ensure postgresql server is restarted if running during an upgrade


author: Tom Lane <tgl@redhat.com> 8.0.4-1
changelog:
  - Update to PostgreSQL 8.0.4, PyGreSQL 3.6.2, and jdbc driver build 312
  - Adjust pgtcl link command to ensure it binds to correct libpq (bug #166665)
  - Remove obsolete Conflicts: against other python versions (bug #166754)
  - Add /etc/pam.d/postgresql (bug #167040)
  - Include contrib/xml2 in build (bug #167492)


author: Tom Lane <tgl@redhat.com> 8.1.0-1
changelog:
  - Update to PostgreSQL 8.1.0, PyGreSQL 3.7, and jdbc driver build 404
  - Fix PAM config file (must have account not only auth) (bug #167040)
  - Add BuildPrereq: libxslt-devel (bug #170141)
  - Sync with PGDG SRPM as much as feasible


author: Tom Lane <tgl@redhat.com> 8.1.1-1
changelog:
  - Update to PostgreSQL 8.1.1
  - Make pg_config.h architecture-independent for multilib installs;
    put the original pg_config.h into pg_config_$ARCH.h


author: Tom Lane <tgl@redhat.com> 8.1.1-3
changelog:
  - fix pg_config.h for 64-bit and ppc platforms
  - update Makefile.regress (needs to --load-language=plpgsql)


author: Tom Lane <tgl@redhat.com> 8.1.2-1
changelog:
  - Update to PostgreSQL 8.1.2
  - Repair extraneous quote in pgtcl configure script ... odd that bash
    didn't use to spit up on this.


author: Tom Lane <tgl@redhat.com> 8.1.3-1
changelog:
  - Update to PostgreSQL 8.1.3 (fixes bug #180617, CVE-2006-0553)
  - Update to jdbc driver build 405
  - Modify multilib header hack to not break non-RH arches, per bug #177564


author: Tom Lane <tgl@redhat.com> 8.1.4-1
changelog:
  - Update to PostgreSQL 8.1.4 (includes fixes for CVE-2006-2313, CVE-2006-2314;
    see bug #192173)
  - Update to PyGreSQL 3.8
  - Suppress noise from chcon, per bug #187744


author: Tom Lane <tgl@redhat.com> 8.2.0-1
changelog:
  - Update to PostgreSQL 8.2.0
  - Update to PyGreSQL 3.8.1
  - Fix chcon arguments in test/regress/Makefile
  Related: #201035
  - Adjust init script to not fool /etc/rc.d/rc
  Resolves: #161470
  - Change init script to not do initdb automatically, but require
    manual "service postgresql initdb" for safety.  Per upstream discussions.


author: Tom Lane <tgl@redhat.com> 8.2.1-1
changelog:
  - Update to PostgreSQL 8.2.1
  - Update to pgtcl 1.5.3
  - Be sure we link to libncurses, not libtermcap which is disappearing in Fedora


author: Tom Lane <tgl@redhat.com> 8.2.1-2
changelog:
  - Split -pl subpackage into three new packages to reduce dependencies
    and track upstream project's packaging.


author: Tom Lane <tgl@redhat.com> 8.2.4-2
changelog:
  - Fix oversight in postgresql-test makefile: pg_regress isn't a shell script
    anymore.  Per upstream bug 3398.


author: Tom Lane <tgl@redhat.com> 8.2.4-4
changelog:
  - Use tzdata package's data files instead of private copy, so that
    postgresql-server need not be turned for routine timezone updates
  - Don't remove postgres user/group during RPM uninstall, per Fedora
    packaging guidelines
  - Seems we need an explicit BuildRequires on gawk now
  - Rebuild to fix Fedora toolchain issues


author: Tom Lane <tgl@redhat.com> 8.2.4-5
changelog:
  - Use nicer solution for tzdata file substitution: upstream discussion
    concluded that hardwiring the path was better than a symlink after all.


author: Tom Lane <tgl@redhat.com> 8.2.6-1
changelog:
  - Update to PostgreSQL 8.2.6 to fix CVE-2007-4769, CVE-2007-4772,
    CVE-2007-6067, CVE-2007-6600, CVE-2007-6601
  - Make initscript and pam config files be installed unconditionally;
    seems new buildroots don't necessarily have those directories in place


author: Tom Lane <tgl@redhat.com> 8.3RC2-1
changelog:
  - Update to PostgreSQL 8.3RC2 (not waiting for 8.3.0 because Fedora 9 alpha
    should be 8.3-based not 8.2-based).
  - Update to pgtcl 1.6.2


author: Tom Lane <tgl@redhat.com> 8.3.1-2
changelog:
  - Clean up cross-subpackage Requires: to ensure that updating any one
    subpackage brings in the matching versions of others.
  Resolves: #444271


author: Tom Lane <tgl@redhat.com> 8.3.1-4
changelog:
  - Enable LDAP support
  Resolves: #445315
  - Use -Wl,--as-needed to suppress bogus dependencies for libraries that
    are really only needed by some of the subpackages


author: Tom Lane <tgl@redhat.com> 8.3.3-1
changelog:
  - Update to PostgreSQL 8.3.3.
  - Remove postgresql-prefer-ncurses.patch, no longer needed in recent
    Fedora releases because libtermcap is gone.


author: Tom Lane <tgl@redhat.com> 8.3.3-2
changelog:
  - Install Pgtcl in /usr/lib/tcl$TCL_VERSION, not directly in /usr/lib.
    Needed because tcl 8.5 no longer puts /usr/lib into its package search path.
    NOTE: do not back-port this change into branches using pre-8.5 tcl, because
    /usr/lib/tcl8.4 had been a symlink to /usr/share/tcl8.4, and /usr/share
    is exactly where we must not put Pgtcl.
  Resolves: #228263


author: Tom Lane <tgl@redhat.com> 8.3.5-1
changelog:
  - Update to PostgreSQL 8.3.5.
  - Improve display from init script's initdb action, per Michael Schwendt


author: Tom Lane <tgl@redhat.com> 8.3.6-1
changelog:
  - Update to PostgreSQL 8.3.6, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-6.html


author: Tom Lane <tgl@redhat.com> 8.3.6-4
changelog:
  - Prevent dependent packages from needing to include sys/sdt.h
    (unintended side effect of previous patch)
  - Use -O1 on alpha, per report from Oliver Falk; -O2 tickles gcc bugs


author: Tom Lane <tgl@redhat.com> 8.3.7-1
changelog:
  - Update to PostgreSQL 8.3.7, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-7.html
    notably the fix for CVE-2009-0922


author: Tom Lane <tgl@redhat.com> 8.4.0-1
changelog:
  - Update to PostgreSQL 8.4.0.  See release notes at
    http://www.postgresql.org/docs/8.4/static/release-8-4.html


author: Tom "spot" Callaway <tcallawa@redhat.com> 8.4.0-2
changelog:
  - update License tag to MIT (PostgreSQL calls it "BSD", but it is MIT)
  - Note: This changes nothing from a license compatibility perspective.


author: Tom Lane <tgl@redhat.com> 8.4.1-1
changelog:
  - Update to PostgreSQL 8.4.1, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-1.html
    including two security issues
  Related: #522085
  Related: #522092


author: Tom Lane <tgl@redhat.com> 8.4.2-4
changelog:
  - Sync with Fedora devel, including:
  - Update to PostgreSQL 8.4.2, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-2.html
    including two security issues
  Resolves: #552617
  - Remove the postgresql-python and postgresql-tcl subpackages.  These files
    are now broken out as their own packages (PyGreSQL and tcl-pgtcl,
    respectively), to reflect the now longstanding split of upstream projects.
  Related: #554431
  - Arrange for the postmaster, but not any of its child processes, to be run
    with oom_adj -17.  This compensates for the OOM killer not being smart about
    accounting for shared memory usage.
  - Remove static libraries (.a files) from package, per packaging guidelines
  - Change %define to %global, per packaging guidelines
  - Use -N not the obsolete -n in useradd call
  - Clean up specfile to eliminate rpmlint gripes, mainly by removing
    no-longer-needed provisions for superseding rh-postgresql
  - add sparc/sparc64 to multilib header support


author: Tom Lane <tgl@redhat.com> 8.4.2-5
changelog:
  - Latest version of systemtap needs the probes.o file to be built again
  Resolves: #557297
  - Provide script and instructions for building the documentation PDF


author: Tom Lane <tgl@redhat.com> 8.4.3-1
changelog:
  - Update to PostgreSQL 8.4.3, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-3.html
  Resolves: #565558
  - Bring init script into some modicum of compliance with Fedora/LSB standards
  Resolves: #561010
  - adjust license tag to reflect OSI decision


author: Tom Lane <tgl@redhat.com> 8.4.4-1
changelog:
  - Update to PostgreSQL 8.4.4, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-4.html
    including fixes for CVE-2010-1169 and CVE-2010-1170
  Resolves: #593033


author: Tom Lane <tgl@redhat.com> 8.4.4-2
changelog:
  - Add -p "$pidfile" to initscript's status call to improve corner cases.
    (Note: can't be fixed in Fedora until 595597 is fixed there.)
  Resolves: #561010


author: Tom Lane <tgl@redhat.com> 8.4.5-1
changelog:
  - Update to PostgreSQL 8.4.5, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-5.html
    including the fix for CVE-2010-3433
  Resolves: #640090
  - Duplicate COPYRIGHT in -libs subpackage, per revised packaging guidelines


author: Tom Lane <tgl@redhat.com> 8.4.7-1
changelog:
  - Update to PostgreSQL 8.4.7, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-7.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
    including the fix for CVE-2010-4015
  Resolves: #672635


author: Tom Lane <tgl@redhat.com> 8.4.7-2
changelog:
  - Add fix to make plpgsql cope with dropped columns in rowtypes
  Resolves: #694249
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines,
    and add explicit dependencies on the -libs subpackage to pacify rpmdiff


author: Tom Lane <tgl@redhat.com> 8.4.9-1
changelog:
  - Update to PostgreSQL 8.4.9, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-9.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-8.html
    including the fix for CVE-2011-2483
  Resolves: #740736


author: Tom Lane <tgl@redhat.com> 8.4.11-1
changelog:
  - Update to PostgreSQL 8.4.11, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-10.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #812082


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830726


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852021


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.0-14
changelog:
  - Merge Pacemaker cluster resource agents:
    * Add Source1.
    * Drop noarch. We have real binaries now.
    * Update BuildRequires.
    * Update all relevant prep/build/install/files/description sections.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.0-16
changelog:
  - Create an ldirectord package
  - Update Pacameker agents to upstream version: 2198dc90bec4
    + Build: Import ldirectord.
    + Ensure HA_VARRUNDIR has a value to substitute
    + High: Add findif tool (mandatory for IPaddr/IPaddr2)
    + High: IPv6addr: new nic and cidr_netmask parameters
    + High: postfix: new resource agent
    + Include license information
    + Low (LF 2159): Squid: make the regexp match more precisely output of netstat
    + Low: configure: Fix package name.
    + Low: ldirectord: add dependency on $remote_fs.
    + Low: ldirectord: add mandatory required header to init script.
    + Medium (LF 2165): IPaddr2: remove all colons from the mac address before passing it to send_arp
    + Medium: VirtualDomain: destroy domain shortly before timeout expiry
    + Medium: shellfuncs: Make the mktemp wrappers work.
    + Remove references to Echo function
    + Remove references to heartbeat shellfuncs.
    + Remove useless path lookups
    + findif: actually include the right header. Simplify configure.
    + ldirectord: Remove superfluous configure artifact.
    + ocf-tester: Fix package reference and path to DTD.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.3-3
changelog:
  - Update Pacameker agents to upstream version: 099c0e5d80db
    + Add the ha_parameter function back into .ocf-shellfuncs.
    + Bug bnc#534803 - Provide a default for MAILCMD
    + Fix use of undefined macro @HA_NOARCHDATAHBDIR@
    + High (LF 2138): IPsrcaddr: replace 0/0 with proper ip prefix (thanks to Michael Ricordeau and Michael Schwartzkopff)
    + Import shellfuncs from heartbeat as badly written RAs use it
    + Medium (LF 2173): nfsserver: exit properly in nfsserver_validate
    + Medium: RA: Filesystem: implement monitor operation
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable (addendum)
    + Medium: RA: iSCSILogicalUnit: use a 16-byte default SCSI ID
    + Medium: RA: iSCSITarget: be more persistent deleting targets on stop
    + Medium: RA: portblock: add per-IP filtering capability
    + Medium: mysql-proxy: log_level and keepalive parameters
    + Medium: oracle: drop spurious output from sqlplus
    + RA: Filesystem: allow configuring smbfs mounts as clones


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.4-2
changelog:
  - Update Pacameker agents to upstream version: e2338892f59f
    + High: send_arp - turn on unsolicited mode for compatibilty with the libnet version's exit codes
    + High: Trap sigterm for compatibility with the libnet version of send_arp
    + Medium: Bug - lf#2147: IPaddr2: behave if the interface is down
    + Medium: IPv6addr: recognize network masks properly
    + Medium: RA: VirtualDomain: avoid needlessly invoking "virsh define"


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.5-2
changelog:
  - Update Pacameker agents to upstream version: bc00c0b065d9
    + High: RA: introduce OCF_FUNCTIONS_DIR, allow it to be overridden (LF2239)
    + High: doc: add man pages for all RAs (LF2237)
    + High: syslog-ng: new RA
    + High: vmware: make meta-data work and several cleanups (LF 2212)
    + Medium: .ocf-shellfuncs: add ocf_is_probe function
    + Medium: Dev: make RAs executable (LF2239)
    + Medium: IPv6addr: ifdef out the ip offset hack for libnet v1.1.4 (LF 2034)
    + Medium: add mercurial repository version information to .ocf-shellfuncs
    + Medium: build: add perl-MailTools runtime dependency to ldirectord package (LF 1469)
    + Medium: iSCSITarget, iSCSILogicalUnit: support LIO
    + Medium: nfsserver: use check_binary properly in validate (LF 2211)
    + Medium: nfsserver: validate should not check if nfs_shared_infodir exists (thanks to eelco@procolix.com) (LF 2219)
    + Medium: oracle/oralsnr: export variables properly
    + Medium: pgsql: remove the previous backup_label if it exists
    + Medium: postfix: fix double stop (thanks to Dinh N. Quoc)
    + RA: LVM: Make monitor operation quiet in logs (bnc#546353)
    + RA: Xen: Remove instance_attribute "allow_migrate" (bnc#539968)
    + ldirectord: OCF agent: overhaul


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.6-1
changelog:
  - New rgmanager resource agents upstream release
  - spec file update:
    * use global instead of define
    * use new Source0 url
    * use resource-agents macro more aggressively


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.6-2
changelog:
  - Update Pacameker agents to upstream version: c76b4a6eb576
    + High: RA: VirtualDomain: fix forceful stop (LF 2283)
    + High: apache: monitor operation of depth 10 for web applications (LF 2234)
    + Medium: IPaddr2: CLUSTERIP/iptables rule not always inserted on failed monitor (LF 2281)
    + Medium: RA: Route: improve validate (LF 2232)
    + Medium: mark obsolete RAs as deprecated (LF 2244)
    + Medium: mysql: escalate stop to KILL if regular shutdown doesn't work


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.7-2
changelog:
  - Drop support for drbd and smb (PM-drop-support-for-drbd-and-smb-resource-agents.patch)
  - Explicitly list python as BuildRequires


author: Marek Grac <mgrac@redhat.com> - 3.0.7-4
changelog:
  - Checksum error occurs on HA-LVM
  - status on clusterfs "gfs" returned 1 (generic error)
  - Resolves rhbz#563555 rhbz#558664


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.9-1
changelog:
  - new upstream release
    Resolves: rhbz#569959
  - spec file update:
    * update spec file copyright date
    * use bz2 tarball


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-1
changelog:
  - Rebase on top of new upstream bug fix only release:
    * drop all bug fix patches.
    * refresh patches with official SHA1 git commits from RHEL6
      upstream branch:
      - drop_support_for_drbd_and_smb.patch
    * Addresses the follwing issues:
      from 3.0.12 release:
    Resolves: rhbz#582754, rhbz#582753, rhbz#585217, rhbz#583789
    * Rebase:
    Resolves: rhbz#582353
  - Stop build on ppc and ppc64.
    Resolves: rhbz#590997
  - Switch to file based Requires.
    Also address several other problems related to missing runtime
    components in different agents.
    With the current Requires: set, we guarantee all basic functionalities
    out of the box for lvm/fs/clusterfs/netfs/networking.
    Resolves: rhbz#584800
  - New pacemaker agents upstream release
    * Patched build process to correctly generate ldirectord man page
    + High: pgsql: properly implement pghost parameter
    + High: RA: mysql: fix syntax error
    + High: SAPInstance RA: do not rely on op target rc when monitoring clones (lf#2371)
    + High: set the HA_RSCTMP directory to /var/run/resource-agents (lf#2378)
    + High: RA: vmware: fix set_environment() invocation (LF 2342)
    + High: RA: vmware: update to version 0.2
    + Medium: IPaddr/IPaddr2: add a description of the assumption in meta-data
    + Medium: IPaddr: return the correct code if interface delete failed
    + Medium: nfsserver: rpc.statd as the notify cmd does not work with -v (thanks to Carl Lewis)
    + Medium: oracle: reduce output from sqlplus to the last line for queries (bnc#567815)
    + Medium: pgsql: implement "config" parameter
    + Medium: RA: iSCSITarget: follow changed IET access policy
    + Medium: Filesystem: prefer /proc/mounts to /etc/mtab for non-bind mounts (lf#2388)
    + Medium: IPaddr2: don't bring the interface down on stop (thanks to Lars Ellenberg)
    + Medium: IPsrcaddr: modify the interface route (lf#2367)
    + Medium: ldirectord: Allow multiple email addresses (LF 2168)
    + Medium: ldirectord: fix setting defaults for configfile and ldirectord (lf#2328)
    + Medium: meta-data: improve timeouts in most resource agents
    + Medium: nfsserver: use default values (lf#2321)
    + Medium: ocf-shellfuncs: don't log but print to stderr if connected to a terminal
    + Medium: ocf-shellfuncs: don't output to stderr if using syslog
    + Medium: oracle/oralsnr: improve exit codes if the environment isn't valid
    + Medium: RA: iSCSILogicalUnit: fix monitor for STGT
    + Medium: RA: make sure that OCF_RESKEY_CRM_meta_interval is always defined (LF 2284)
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: VirtualDomain: bail out early if config file can't be read during probe (Novell 593988)
    + Medium: RA: VirtualDomain: fix incorrect use of __OCF_ACTION
    + Medium: RA: VirtualDomain: improve error messages
    + Medium: RA: VirtualDomain: spin on define until we definitely have a domain name
    + Medium: Route: add route table parameter (lf#2335)
    + Medium: sfex: don't use pid file (lf#2363,bnc#585416)
    + Medium: sfex: exit with success on stop if sfex has never been started (bnc#585416)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-2
changelog:
  - Drop Requires on xfsprogs since package moved to another channel
    Resolves: rhbz#593433
  - Fix HALVM: lvm agent incorrectly reports vg is in volume_list
    (halvm_lvm_agent_incorrectly_reports_vg_in_volume_list.patch)
    Resolves: rhvz#593108


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.12-4
changelog:
  - Add missing man pages
    (Add Source2: ocf-tester.8 and Source3: sfex_init.8)
    Resolves: rhbz#594332


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-5
changelog:
  - Fix incorrect default for VM.sh agent
    (resolve_incorrect_default_for_vm_agent.patch)
    Resolves: rhbz#599643


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-6
changelog:
  - Add missing documentation for resource agents
    (add_missing_resource_docs.patch)
  - Clean up recursion in scheman output and documentation
    (clean_up_recursion_and_documentation.patch)
    Resolves: rhbz#606470


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-7
changelog:
  - Make vm.sh honor start and stop timeouts
    (Make_vm.sh_use_stop_start_timeouts.patch)
    Resolves: rhbz#606754


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-8
changelog:
  - Make fs-lib resolve links before checking for block devices
    (fix_incorrect_link_resolution_in_fs_lib.patch)
    Resolves: rhbz#609579


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-9
changelog:
  - Add NFSv4 server support
    (add_nfsv4_support.patch)
    (install_nfsv4_agent.patch)
    Resolves: rhbz#595547
  - Fix migration mapping behavior
    (fix_migration_mapping_behavior.patch)
    Resolves: rhbz#596918


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-10
changelog:
  - Fix changelog for 3.0.12-9 date
  - Add RHEVM status program
    (add_rhevm_status_program.patch)
    Resolves: rhbz#609497


author: Marek Grac <mgrac@redhat.com> - 3.0.12-12
changelog:
  - postgres RA will fail to stop gracefully if there 
    is active client connected
    (sigquit_if_sigterm_was_not_fast_enough.patch)
    Resolves: rhbz#612165
  - new RA for tomcat6
    (resource_agent_tomcat-6.patch)
    (tomcat-6_change_build_system.patch)
    Resolves: rhbz#593721


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-13
changelog:
  - Allow other values for "yes" in fs-lib when unmounting
    file systems
    (fs-lib_allow_other_values_for_yes.patch)
    Resolves: rhbz#614421


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-14
changelog:
  - resource-agents: Drop tomcat-5 from build
    (drop_tomcat_5_from_build.patch)
    Resolves: rhbz#593721


author: Marek Grac <mgrac@redhat.com> - 3.0.12-15
changelog:
  - postgresql RA does not work correctly with netmask
    (psql_does_not_work_correctly_with_netmask.patch)
    Resolves: rhbz#614457


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-16
changelog:
  - resource-agents: fix utility to obtain data from ccs_tool
    (fix_utility_to_obtain_data_from_ccs_tool.patch)
    Resolves: rhbz#631943


author: Marek Grac <mgrac@redhat.com> - 3.0.12-17
changelog:
  - fix resource agent for named
    (resource-agents-fix-resource-agent-for-named.patch)
    Resolves: rhbz#648897


author: Marek Grac <mgrac@redhat.com> - 3.0.12-18
changelog:
  - Disable updates to static routes by RHCS IP tooling
    (resource-agents-Add-option-disable_rdisc-to-ip.sh.patch)
    Resolves: rhbz#621538


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-19
changelog:
  - resource-agents: Add multi-instance Oracle database agents
    (add_multi_instance_oracle_database_agents.patch)
    Resolves: rhbz#629275
  - resource-agents: Stop using '-' as 1st char of log messages
    (stop_using_as_1st_char_of_log_messages.patch)
    Resolves: rhbz#633856
  - resource-agents: Use literal quotes for tr calls
    (use_literal_quotes_for_tr_calls.patch)
    Resolves: rhbz#639252
  - resource-agents: Fix migrateuriopt setting
    (fix_migrateuriopt_setting.patch)
    Resolves: rhbz#660337
  - resource-agents: Support convalesce w/ central_processing
    (support_convalesce_w_central_processing.patch)
    rgmanager: Add failure tolerances to resources.rng
    (add_failure_tolerances_to_resources_rng.patch)
    Resolves: rhbz#674710


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-20
changelog:
  - resource-agents: fs-lib: fix do_monitor device mapping
    (fs_lib_fix_do_monitor_device_mapping.patch)
    Resolves: rhbz#669832


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-21
changelog:
  - Mirror dev failure in HA LVM can cause service failur
    (fix_bug_683213_mirror_dev_failure_in_ha_lvm_can_cause_service_failure.patch)
    Resolves: rhbz#683213


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12.1-1
changelog:
  - Rebase package on top of new upstream:
    resource-agents: Improve LD_LIBRARY_PATH handling by SAP*
    resource-agents: Add resource type to logging
    oracledb.sh resource script should attempt a clean shutdown first
    resource-agent does not remove nfs service temp dirs when using nfslock=1
    Listen line in generated httpd.conf incorrect
    Include rhev-check upstream
  - spec file update:
    * drop all patches
    * resync with upstream spec file. See top section for local deltas
    Resolves: rhbz#707127, rhbz#705763, rhbz#667217
  - Move rgmanager S/Lang from resource-agents to rgmanager:
    * Add versioned Conflicts on rgmanager to avoid file conflicts
    Resolves: rhbz#693518


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-1
changelog:
  - Rebase package on top of new upstream
    * ship xsl and rng files required to build relaxng schema
    * drop local copy of sfex_init.8
    * drop bz711852-Fix-ASEHAagent-to-allow-for-multiple-ASEHA-agents-on.patch
      included upstream
  - spec file update:
    add %post to generate new relaxng schema
    Resolves: rhbz#707127


author: Chris Feist <cfeist@redhat.com> - 3.9.2-2
changelog:
  - Postgres-8 resource agent now properly detects if postgresql was started
  - fs.sh resource agent now returns the proper response code when a device
    does not yet exist.
  - Resolves: rhbz#709400 rhbz#694816


author: Chris Feist <cfeist@redhat.com> - 3.9.2-3
changelog:
  - Main rgmanager resource agents now use proper return codes for use with
    pacemaker.
  - NFS mounts now unmount faster when the network is lost.
  - Resolves: rhbz#678497 rhbz#727643


author: Chris Feist <cfeist@redhat.com> - 3.9.2-4
changelog:
  - Create a link for the modified dtd for rgmanager
  - Fix ocf-tester so rgmanager agents requiring bash don't cause syntax errors
  - Resolves: rhbz#727643


author: Chris Feist <cfeist@redhat.com> - 3.9.2-9
changelog:
  - More SAPDatabase updates to fix SAP workloads
  - Allow rgmanager SAP resource agent to manage SAP Webdispatcher & TREX
  - Resolves: rhbz#726500 rhbz#746996


author: Chris Feist <cfeist@redhat.com> - 3.9.2-10
changelog:
  - Fix to prevent /dev/shm being filled up by ocf_log debug messages
  - NFS client resource are now recovered properly when they are missing in
    /var/lib/nfs/etab
  - Resolves: rhbz#797922 rhbz#749713


author: Chris Feist <cfeist@redhat.com> - 3.9.2-11
changelog:
  - In LVM HA agent, remove missing PVs before attempting to remove the tag
  - Rgmanager now properly detects when clvmd is not running when using HA LVM
  - vm.sh now supports a 'tunnelled' option
  - Resource agent script now have common directory set properly
  - Fixed apache resource agent configuration with IPv6
  - fs-lib.sh now will now properly work with all return codes of mount
  - netfs now allows you to have the same NFS export mounted in different locations
  - The timeout in rhev-check has been increased to 90 seconds
  - Resolves: rhbz#772773 rhbz#729481 rhbz#712174 rhbz#784357 rhbz#742859 rhbz#728086 rhbz#799998 rhbz#727546


author: Chris Feist <cfeist@redhat.com> - 3.9.2-12
changelog:
  - Fix for LVM HA agent for service relocation after leg failure (we now
    properly remove tag).
  - Resolves: rhbz#772773


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-13
changelog:
  - Add nfsrestart option to fs and clustefs agents as last resource to umount the filesystem
  - Resolves: rhbz#822053


author: Chris Feist <cfeist@redhat.com> - 3.9.2-14
changelog:
  - Fixed issue causing fs.sh to fail when a device is still mounted
  - Fixed random servie failures when starting multiple HA LVM services
  - Tomcat resource now uses the proper defaults
  - The pacemaker SAPInstance and SAPDatabase resources were updated to their
    latest version
  - Updated lvm resource agent to not produce errors when used with pacemaker
  - oracledb.sh script now properly checks the status of the Oracle database
  - HA-LVM now supports RAID logical volumes
  - ip.sh now properly assignes the ip address to the correct interface on
    hosts with multiple interfaces on the same network
  - Stopping a filesystem when a device doesn't exist no longer results in
    failure
  - Log output from the 'status' action from netfs is now properly logged
  - In HA LVM clusters using tags, changing the lvm.conf file is now possible
  - Using rg_test with HA LVM resources no longer results in a
    "too many arguments" error 
  - Resolves: rhbz#728365 rhbz#714156 rhbz#853249 rhbz#843049 rhbz#817550 rhbz#729812 rhbz#839181 rhbz#824153 rhbz#822244 rhbz#860328 rhbz#847335 rhbz#834293


author: Chris Feist <cfeist@redhat.com> - 3.9.2-15
changelog:
  - Fixes issue with rgmanager not recognizing a mounted cifs share due to
    trailing slashes
  - Resolves: rhbz#848642


author: Chris Feist <cfeist@redhat.com> - 3.9.2-16
changelog:
  - Add support for 'volume group per service HA-LVM support for RAID logical
    volumes'
  - Resolves: rhbz#824153


author: Chris Feist <cfeist@redhat.com> - 3.9.2-17
changelog:
  - HA LVM is now able to properly shutdown when device failures cause LVs
    to go missing which allows the service to migrate to another machine
  - Resolves: rhbz#860981


author: Chris Feist <cfeist@redhat.com> - 3.9.2-19
changelog:
  - Better error messages for the script resource have been added to aid
    debugging
  - Resolves: rhbz#773478


author: Chris Feist <cfeist@redhat.com> - 3.9.2-20
changelog:
  - Update the rgmanager SAPInstance agent so resource limits configured in
    /usr/sap/services are properly applied.
  - Resolves: rhbz#869695


author: Chris Feist <cfeist@redhat.com> - 3.9.2-21
changelog:
  - Fixed missing '$' in lvm_by_vg.sh script
  - Retry VG shutdown to cope with udev collisions
  - Resolves: rhbz#729812


author: David Vossel <dvossel@redhat.com> - 3.9.2-25
changelog:
  - fast filesystem mounts
  - properly handle NFS v4 mounts
  - fix uppercase ipv6 addresses
  - named transfer source options
  - fix restart postgres
  - fix honor self fence option
  - fix mount log level
  - fix wrong selinux context for nfs directory

    Resolves: rhbz#919231
    Resolves: rhbz#851188
    Resolves: rhbz#895075
    Resolves: rhbz#711586
    Resolves: rhbz#871659
    Resolves: rhbz#908457
    Resolves: rhbz#948730
    Resolves: rhbz#959520


author: David Vossel <dvossel@redhat.com> - 3.9.2-31
changelog:
  - Fixes lvm agent unncessarily removing PVs/LVs when some
    PVs in VG fail.

    Resolves: rhbz#884326


author: David Vossel <dvossel@redhat.com> - 3.9.2-35
changelog:
  - Fixes invalid return statement in LVM retry clvmd activation
  - Adds ability to disable findmnt to avoid autofs complications
    for fs-util based rgmanager agents.

    Resolves: rhbz#974941
    Resolves: rhbz#989284


author: David Vossel <dvossel@redhat.com> - 3.9.2-37
changelog:
  - Fixes lvm metadata corruption caused when activating by lv
    using tags.

    Resolves: rhbz#1009772


author: David Vossel <dvossel@redhat.com> - 3.9.2-38
changelog:
  - Removes usage of fuser -kvm from fs-lib.sh based agents.
    This resolves issue with fuser blocking netfs mounts.
  - tomcat-6.sh, Do not fail on stop if config validation fails.
  - tomcat-6.sh, Set tomcat usr correctly.

    Resolves: rhbz#981717 
    Resolves: rhbz#983273
    Resolves: rhbz#1014298


author: David Vossel <dvossel@redhat.com> - 3.9.2-39
changelog:
  - Fixes issue with mysql agent not being able to set transient
    attributes on local node correctly.

    Resolves: rhbz#989284


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-40.2
changelog:
  - Fix netnfs unmount self_fence integration in netfs.sh
  - Ship send_ua helper binary to allow IPaddr2 to manage IPv6 addresses

    Resolves: rhbz#1027410
    Resolves: rhbz#1027412


author: David Vossel <dvossel@redhat.com> - 3.9.2-41
changelog:
  - Add no_unmount functionality back into netfs.sh agent
  - Use crm_node instead of uname -n when referencing cluster nodes.
  - Adds Delay agent back into package.
  - Drops nginx rsyslog mysql-proxy tomcat and slapd agents.

    Resolves: rhbz#993329
    Resolves: rhbz#1023340
    Resolves: rhbz#1028421
    Resolves: rhbz#1022793


author: David Vossel <dvossel@redhat.com> - 3.9.2-42
changelog:
  - High: fs-lib.sh: Fixes failure to unmount local fs
    when process runs with cwd inside fs mount.

    Resolves: rhbz#1051115


author: David Vossel <dvossel@redhat.com> - 3.9.2-44
changelog:
  - New 'httpd' option for rgmanager apache.sh agent that allows
    custom httpd binary path to be set.
  - Fixes issue with pending sm-notify processes preventing
    nfs-server instances from stopping.
  - Fixes issue reported by coverity. 
  - Fixes syntax error in some log error messages in the LVM agent
  - Optimize fs-lib based agent's monitor operation
  - Allow monitoring of kvm based virtual machines using the
    VirtualDomain agent without requiring libvirtd.
  - Allows named to run as user other than root.

    Resolves: rhbz#952132
    Resolves: rhbz#974239
    Resolves: rhbz#999537
    Resolves: rhbz#1022277
    Resolves: rhbz#1023099
    Resolves: rhbz#1054327
    Resolves: rhbz#1067023


author: David Vossel <dvossel@redhat.com> - 3.9.2-46
changelog:
  - Updates the ocf:heartbeat:tomcat agent so it can be used
    in rhel6 with Pacemaker.

    Resolves: rhbz#1022792


author: David Vossel <dvossel@redhat.com> - 3.9.2-47
changelog:
  - Allow vm.sh to monitor kvm domains without requiring libvirtd
  - Adds 'no_kill' option to vm.sh to prevent force killing vm
    during stop operation after timeout expires.

    Resolves: rhbz#853698
    Resolves: rhbz#1079039


author: David Vossel <dvossel@redhat.com> - 3.9.2-48
changelog:
  - Configurable startup_wait timeout for rgmanager's 
    postgres-8.sh resource-agent
  - Allow non rhel builds to included unsupported agents.
  - Add bind-mount.sh rgmanager resource-agent.
  - Add 'statdport' option to nfsserver resource.

    Resolves: rhbz#1035380
    Resolves: rhbz#1069621
    Resolves: rhbz#1094789
    Resolves: rhbz#918315


author: David Vossel <dvossel@redhat.com> - 3.9.5-1
changelog:
  - Package cleanup. This change is a no-op. The heartbeat
    agents were updated to the 3.9.5 upstream release in this
    package months ago. The release number is now being
    incremented to reflect this.

    Resolves: rhbz#993431


author: David Vossel <dvossel@redhat.com> - 3.9.5-3
changelog:
  - Fix usage of findmnt in fs-lib.sh based rgmanager agents.
  - When executing force kill of processes using a mountpoint,
    take into account those processes accessing shared memory.
  - Add force_unount=safe option to avoid blocking Filesystem
    agent during the stop operation.
  - Do not fail during stop if oracle listener is already down. 
  - Correctly detect oracledb and orainstanch.sh shutdown.
  - Remove unused patches left over from before patches were
    consolidated into the new source files.

    Resolves: rhbz#1038474
    Resolves: rhbz#1089004
    Resolves: rhbz#1095943
    Resolves: rhbz#1047999
    Resolves: rhbz#960186
    Resolves: rhbz#993431


author: David Vossel <dvossel@redhat.com> - 3.9.5-5
changelog:
  - Add support for pacemaker db2 agent
  - Fix syntax error in nfsserver.sh
  - Updates pacemaker nfs server agents. Adds support for
    nfsnotify agent.

    Resolves: rhbz#1059981
    Resolves: rhbz#1091102
    Resolves: rhbz#974239


author: David Vossel <dvossel@redhat.com> - 3.9.5-7
changelog:
  - Update force_unmount=safe option so it does not process
    duplicate process ids.

    Resolves: rhbz#1095943


author: David Vossel <dvossel@redhat.com> - 3.9.5-8
changelog:
  - Revert accidental modification of exportfs's
    unlock_on_stop option.
  - Add on/off as valid value for ip.sh monitor_link

    Resolves: rhbz#1091102
    Resolves: rhbz#1039119


author: David Vossel <dvossel@redhat.com> - 3.9.5-9
changelog:
  - When signalling pids accessing a mount_point to exit,
    make sure to only signal each pid once.

    Resolves: rhbz#1089004


author: David Vossel <dvossel@redhat.com> - 3.9.5-11
changelog:
  - Updates required, unique, and primary fields in bind-mount.sh
    metadata

    Resolves: rhbz#1094789


author: David Vossel <dvossel@redhat.com> - 3.9.5-14
changelog:
  - For lv_by_vg, only strip tag on stop if we are owner.
  - NFS custom port config options
  - Fixes typo preventing passing "noload" or "data=..." mount options
  - Fixes undefined variable warning in fs-lib
  - Fixes mysql not stopped if data fs unavailable
  - Fixes postgres agent not detected correct user group
  - Handle nfs path ending in '/' correctly

    Resolves: rhbz#1161727
    Resolves: rhbz#1096376
    Resolves: rhbz#1096990
    Resolves: rhbz#1134960
    Resolves: rhbz#1150702
    Resolves: rhbz#1159018
    Resolves: rhbz#1173128


author: David Vossel <dvossel@redhat.com> - 3.9.5-16
changelog:
  - Fixes unreliable detection of nic device in IPaddr2
  - Fix fs-lib.sh regression in is_alive write test failure detection
  - Fix properly handle mysql when alternate user is specified.

    Resolves: rhbz#1181187
    Resolves: rhbz#1183735
    Resolves: rhbz#1183148


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Fixes rgmanager lvm agent's ability to exclusively activate
    volume groups on nodes with aliases

    Resolves: rhbz#1085109


author: Sherry Yu <syu@redhat.com> - 0.91
changelog:
  - Naming change from sap_prepare to sap-prepare
  - Detailed log output
  - In function virtrpms: for RHEV Hypervisor, recommend to check SAP Note
    1400911 for setting up host monitoring on RHEV
  - New function check_utilrpms: install utility rpms used in the sap-prepare
    script, e.g. syslinux rpm for gethostid()
  - Add one section Recommendations at the end of the log file, containing
    recommended changes that have to be carried out manually
  - Add a Recommendations section at the end of the log file, for CHECK_ONLY
    mode, that contains the recommended settings
  - Add command-line argument "-h" for Help Message
  - Move java rpms to variable JAVARPMS, as IBM JDK becomes obsolete on Oct. 2012
  - Add global variable VIRTRPMS
  - Remove [-f config] argument in usage - recommended configurations are not to
    be changed
  - In check_fqdn: keep the backup file as
    /etc/sysconfig/network.sap-prepare-<timestamp>
  - In check_security add: if SELINUX=disabled in /etc/sysconfig/selinux, give
    recommendation to set it to Permissive. If SELINUX=permissive but getenforce
    returns 1, setenforce 0. For SELINUX=enforcing, to update the config file,
    keep backup file as /etc/sysconfig/selinux.sap-prepare-<timestamp>; if
    CHECK_ONLY==1, give recommendations
  - Split check_rhn into check_rhn, check_rpms, check_ibmjdk, and check_links
  - Add a variable SAP_NOTE_RHEL6
  - Remove check_users which is not used to keep the script clean
  - Remove variable VERBOSE
  - Rename prepare_environment to check_env, to be consistent with the naming
    convention
  - Move the code of setting kernel parameters from main body to check_env
  - Add SYB_VARS
  - In check_env add the setting of kernel parameters for Sybase
  - In check_ntp ntpdate is removed as ntpd is preferred
  - Remove update_limits_conf because it's no longer needed in RHEL6


author: Sherry Yu <syu@redhat.com> - 0.92
changelog:
  - Changed the name to sapconf
  - Move kernel parameters to /etc/sysconfig/sap, other than /etc/sysctl.conf
  - Add /etc/rc.d/init.d/sapconf and S99sapconf links in /etc/rc2.d, /etc/rc3.d,
    and /etc/rc5.d
  - Removed check_utilrpms() and defined the util rpms as dependency in the rpm
    spec file
  - Removed check_ibmjdk()


author: Frank Danapfel <fdanapfe@redhat.com> - 0.93
changelog:
  - removed /etc/init.d/sapconf service, since this is now done via tuned
  - cleaned up requirements section in spec file
  - added changelog to spec file


author: Frank Danapfel <fdanapfe@redhat.com> - 0.93
changelog:
  - replaced vhostmd with vm-dump-metrics for KVM guest installs
  - re-added function to set user/process limits
  - changed check_ntp to only check if ntpd is running


author: Nils Philippsen <nils@redhat.com> - 0.93-1
changelog:
  - remove obsolete tuned patch
  - fix changelog dates
  - require specific tuned version, prep for upcoming RHEL versions
  - clean up script header
  - don't mess around with SELinux settings, just report
  - use bzipped tarball


author: Nils Philippsen <nils@redhat.com> - 0.95-1
changelog:
  - ignore whitespace and empty lines when checking /etc/hosts
  - use mktemp to create temporary host file
  - add release numbers to changelog entries


author: Jan Grulich <jgrulich@redhat.com> - 0.98-1
changelog:
  - add Man-Page
  - correctly detect VMware virtual guest
  - do not write to /etc/security/limits.conf directly
  - correctly edit /etc/hosts


author: Jan Grulich <jgrulich@redhat.com> - 0.98-5
changelog:
  - add information about KVM to manpage 
    resolves: bz#1123917
  - set correct vm.max_map_count value
    resolves: bz#1168422
  - do not wait for input from keyboard and read from file instead
    resolves: bz#1173861
  - add information about sapconf version
    resolves: bz#1174321


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-23
changelog:
  - Add cmirrord policy
  - Fixes for accountsd policy
  - Fixes for boinc policy
  - Allow cups-pdf to set attributes on fonts cache directory
  - Allow radiusd to setrlimit
  - Allow nscd sys_ptrace capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-24
changelog:
  - Add support for /dev/vhost-net
  - Allow psad to read files in /usr
  - Allow systat to use nscd socket
  - Fixes for boinc policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-25
changelog:
  - Fixes for cmirrord policy
  - Dontaudit xauth to list inotifyfs filesystem.
  - Allow xserver to translate contexts.
  - Allow kdumpgui domain sys_admin capability
  - Allow vpnc to relabelfrom tun_socket
  - Allow prelink_cron_system_t to signal
  - Fixes for gitolite
  - Allow virt domain to read symbolic links in device directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-26
changelog:
  - Allow krb5kdc to write krb5kdc_principal_t file
  - Allow hald to send generic signal to dhcp client
  - Fix dev_rw_vhost interface
  - Add /var/run/abrt.socket label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-27
changelog:
  - Allow ftpd ipc_lock capability
  - Allow audisp-remote to getcap and setcap
  - Allow iscsid to read and write raw memory devices
  - Fixes for bitlbee policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-30
changelog:
  - Allow sysadm to run ncftool
  - Fixes for cobbler policy
  - Allow Network Manager to transition to ipsec_mgmt domain
  - Add label for /usr/libexec/nm-openswan-service
  - Add label for /dev


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-31
changelog:
  - Remove daemons dontaudit to search all dirs 
  - Add support for epylog
  - All all domains to read lib files
  - Allow denyhosts to send syslog messages
  - Allow mysql-safe setrlimit
  - Allow rpm to execute rpm_tmp_t
  - Allow dmesg to appen abrt_var_cache files
  - Fixed label for abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-32
changelog:
  - Allow sectool to connect to users over unix stream socket
  - Add label for /var/spool/abrt-upload
  - Add audio_home_t type for homedir/Music files
  - Allow aiccu to read network config files
  - Allow qpidd to setsched
  - Allow virt domains to manage svirt_image_t fifo files
  - Fixes for NM-openswan
  - Fixes for admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-36
changelog:
  - Allow netutils to read and write USB monitor devices
  - Fix label for /rhev
  - Add user_setrlimit boolean
  - Allow initrc to manage virt lib files
  - Add support for ebtables
  - Add label for /bin/mksh
  - Dontaudit aiccu sys_tty_config capability
  - Add httpd_setrlimit boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-37
changelog:
  - Redefine hi_reserved_port_t to include ports from 512 to 599 
  - Add label for /sbin/sushell
  - Fixes for munin plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-38
changelog:
  - Allow xdm_t to manage gnome homedir content
  - Allow s-c-firewall to read and write virtual memory sysctls
  - Fixes for logwatch policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-39
changelog:
  - Allow munin_system_plugin to read files in /usr
  - Do not audit insmod attempts to write virt daemon unnamed pipes
  - Allow corosync to read ricci lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-40
changelog:
  - Fixes for puppetmaster
  - Fix label for kadmin init script
  - Fixes for logwatch-mail policy
  - Allow arpwatch to request the kernel to load modules
  - Allow cron jobs to run with context of user that started them


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-41
changelog:
  - Allow logwatch_mail to read read the networking state information.
  - Add label for /usr/bin/dosbox
  - Allow systat sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-42
changelog:
  - Allow kdump to read information from the debugging filesystem
  - Update boinc policy
  - Fixes for logwatch-mail policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-43
changelog:
  - Allow ncftool to run brctl
  - Fixes for ricci-modclusterd policy
  - Allow uucpd to execute ssh client
  - Add label for dayplanner
  - Allow sandbox_xserver execstack


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-45
changelog:
  - Fixes for cgroup policy
  - Fixes for ncftool policy
  - Add ncftool_read_user_content boolean
  - Fix label for boinc init script
  - Fix label for fence_tool
  - Allow vhostmd to write virt content
  - Allow ricci domtrans ot shutdown


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-47
changelog:
  - Fixes for boinc-project policy
  - Allow swat to read nmbd pid file
  - Allow fail2ban to read BIND log files
  - Fix cert handling from Dan 
  - Remove transition from unconfined to ncftool domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-48
changelog:
  - Fixes for shorewall policy
  - Allow sssd chown capability
  - Fix label for /usr/bin/mutter
  - Label dead.letter as mail_home_t
  - Allow pcscd to read  hardware state information 
  - Fixes for ulogd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-49
changelog:
  - Add label for /var/cache/rpcbind directory
  - Add chrome_role for xguest
  - Fix amavis_read_spool_files interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-55
changelog:
  - Add cluster_var_lib_t type and label for /var/lib/cluster
  - Add labeling for /root/.debug
  - Remove permissive from cmirrord domain
  - Dontaudit cmirrord_t sys_tty_config capability
  - Allow virtd to read from processes up to its clearance
  - Allow dovecot-deliver to create tmp files
  - Allow tor to send signals to itself
  - Handle /var/db/sudo
  - Remove allow_corosync_rw_tmpfs boolean
  Resolves: #631564


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-56
changelog:
  - Allow smartd to read usr files
  - Allow devicekit-power transition to dhcpc
  - Add label for /etc/timezone
  - Remove transition from unconfined_t to iptables_t
  - Allow domains with different mcs levels to send each other signals as long as they are not identified as mcsconstrainproc
  Resolves: #634945
  - Allow nrpe to send signal and sigkill to the plugins
  - Fix up xguest to allow it to read hwdata and gconf_etc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-57
changelog:
  - Allow system_mail_t to append ~/dead.letter
  - Allow mount to communicate with gfs_controld
  Resolves: #636683
  - Dontaudit hal leaks in setfiles
  - gpm needs to use the user terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-58
changelog:
  - Fix httpd_setrlimit boolean to allow sys_resource capability
  - Fix label for ip6tables.save
  - Allow ssh_t to exec ssh_exec_t
  - Dontaudit init leaks
  Resolves: #639083


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-59
changelog:
  - Allow cdrecord setrlimiit
  Resolves: #615731
  - Define debugfs_t as mountpoint
  Resolves: #646856
  - Fix fenced_can_network_connect boolean description
  Resolves: #650136
  - Add label for /var/run/faillock
  - Add dirsrv and dirsrv-admin policy
  Resolves: #655206
  - Fixes for cobbler policy
  - Allow certmonger to manage dirsrv config
  Resolves: #658591


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-60
changelog:
  - Fixes for certmonger
  - Backport passenger policy
  - Allow run_init to read console_device
  Resolves: #657568
  - Add label for /var/lib/dkim-milter
  - Fixes for munin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-61
changelog:
  - Fixes for passenger policy
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  Resolves: #663054


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-64
changelog:
  - Add namespace policy
  - Allow udev to stream connect to init
  Resolves: #667370
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-69
changelog:
  - Make Spacewalk to work with selinux-policy
  Resolves: #673112
  - Fix /root/.ssh labeling
  Resolves: #637109	
  - Fix for the spec file


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-71
changelog:
  - Allow cmirrord to create physical disk devices in /dev
  - Allow cluster domains to use the system bus and send each other dbus messages
  - Add label for /dev/tgt


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-74
changelog:
  - Add virt_home_ type files located in ~/.libvirt directory
  - virt creates monitor sockets in the users home dir
  - Allow lvm setfscreate
  Resolves: #680388
  - Make lsusb and lsblk working on MLS
  Resolves: #680426


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-75
changelog:
  - Allow svirt to manage sock_file in ~/.libvirt directory
  - Allow sysamd to run udev in udev_t domain
  - Remove capability from svirt
  - Add lvm_exec_t label for kpartx


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-76
changelog:
  - Fixes for ssh_keygen policy
  - Allow sysadm_t to run ssh-keygen in ssh_keygen_t domain
  - Backport spice vdagent policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-79
changelog:
  - Fixes for sandbox/seunshare policy 
  Resolves:#684919
  - Allow ssh_keygen_t dac_override
  - Add matahari policy 
  - Add label for /etc/securetty 
  - Fixes for pirahna-pulse policy
  - Fixes for radius, samba, dirsrv, kerberos policies 
  - Allow console login on MLS
  - Fix file context to show several labels as SystemHigh
  - Add port definition for dogtag, matahari, movaz ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-80
changelog:
  - Add support for a new cluster service - foghorn
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - Add support for vdsm
  - Allow syslogd setrlimit, sys_nice
  Resolves: #689431
  - ipsec_mgmt_t wants to cause ipsec_t to dump core, needs to be allowed


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-81
changelog:
  - Add allow_sysadm_manage_security boolean
  - Add label for /dev/dlm.*
  - Allow auditadm_screen_t and secadm_screen_t dac_override capability
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Fixes for nslcd policy
  Resolves: #693368
  - Allow qpidd to manage pid and lib matahari files
  - Allow rgmanager to send the kill signal to all users


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-83
changelog:
  - Add label for matahari-broker.pid file
  - Allow foghor to read snmp lib files
  - Make sysadm security admin
  - Fix ssh_sysadm_login boolean
  Resolves: #694551


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-87
changelog:
  - Allow $1_sudo_t to read default SELinux context
  - Allow tgtd to create a sock file
  - Allow initrc_t to manage faillock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-95
changelog:
  - Allow secadm to manage selinux config files
  - Allow apache to use jboss management port
  - Add fenced_can_ssh boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-97
changelog:
  - Allow postfix-pickup to write files and directories regardless of their MCS category set.
  - Make xinetd trusted to write outbound packets regardless of the network's or node's MLS range
  Resolves: #705772


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-104
changelog:
  - Allow puppet to Check access to the passwd executable
  - Add label for /var/www/html/logs directory
  - Add label for /var/lib/squeezeboxserver directory
  - Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-107
changelog:
  - Make new domains as unconfined
  - Add abrt_handle_event_t domain for ABRT event script
  - Add selinux_mysql man page
  - Fix httpd selinux man page
  - Fix interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-108
changelog:
  - Add squid man page
  - Add git man page
  - Make puppet working with passenger
  - Allow procmail to execute hostname command


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-110
changelog:
  - Add label for passwd.adjunct
  - Allow pulse to execute  /usr/sbin/fos
  - Fix labeling for passenger
  - Add selinux policy support for IP-in-SSH tunnelling
  - Allow sulogin to write /dev/pts/0 in single user mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-111
changelog:
  - Add git_cgit_read_gitosis_content boolean
  - Add support for cma port
  - Add virt_use_sanlock boolean and make sanlock working together libvirt
  - Make passenger and puppet working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-112
changelog:
  - Fix description of allow_* booleans
  - Allow sanlock to manage libvirt lib files
  - Fix bug in lsassd policy
  - Add label for /var/run/luci
  - move port 18001 from http_port_t to jboss_management_port_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-114
changelog:
  - Fix httpd_selinux man page
  - Add corenet_packet() interface
  - Add support for Clustered Samba commands


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-115
changelog:
  - Add unlabelednet policy module
  - Add chrome role for xguest
  - Fix for vdagent policy
  - Add fix to allow confined apps to execmod on chrome


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-118
changelog:
  - Fix label for /root/.hushlogin
  - Allow domain to send/recv unlabeled packet
  - Allow sshd to relabel tun socket
  - Allow puppetmasterd to relabel puppet config files
  - Add label for lvs.conf
  - Fix labeling for matahari-netd agents


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-123
changelog:
  - MLS Overrides needed for a user running at a level to be able to use sudo and talk to sssd
  - Allow initrc_t to manage dirsrv pid files with disabled unconfined module
  - Fixed for deltacloudd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-125
changelog:
  - Change the postinstall to load_policy separately from the semodule command
  - This will put the proper files in place even if the kernel rejects the policy.
  - Allow login programs to connect to the pki_ca_port
  - Allow vhostmd to read /dev/rand and signal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-128
changelog:
  - Add cronjob_role for sysadm
  - Change label for /var/spool/cron
  - Add interface to allow exec of mongod


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-131
changelog:
  - Fixes for rhev policy
  - Make ssh-keygen as unconfined domain
  - Add sanlock_use_nfs boolean
  - Add ssh_dontaudit_search_user_home_dir interface
  - namespace_init and MLS fix


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-132
changelog:
  - Fixes for nagios policy
  - Add a new interface for libra
  - Fix spec file to be testing SELinux status correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-134
changelog:
  - Backport ABRT policy
  - Backport matahari policy
  - Add interfaces for libra
  - Add jboss_dubeg port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-135
changelog:
  - Add fixes for qpidd policy, support for tmpfs_t
  Resolves:#769352
  - Add fixes for mcelog policy, for new location of pid,sock files
  - Make sendmail and postfix working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-136
changelog:
  - backport mozilla_plugin policy
  - backport sandbox policy to support nacl
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow system cronjobs to read kernel network state
  - Allow corosync to read and write to qpidd shared memory
  - More fixes for qpidd
  Resolves:#769352
  - Add policy for quota-nld


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-137
changelog:
  - Remove nfs_* booleans because nfs runs in kernel_t domain
  Resolves:#760405
  - Add httpd_manage_ipa boolean
  - Dontaudit sys_ptrace for matahari-netd
  - Allow vhostmd to getattr on virtd
  - Allow snmpd to connect to the ricci_modcluster
  - qpidd should be allowed to connect to the amqp port


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-138
changelog:
  - Add new policy for cfengine
  - Add new policy for sge gridengine jobs
  - Add support for nagios eventhandlers
  - Make system cron jobs run in the proper domain
  - Add policy to support privsep ssh process running in user domain
  - Add fixes relates to nss/FIPS
  - Add new rsync_use_* booleans
  - Allow qpidd to connect to matahari ports
  - Allow sysadm_u to read system_r in MLS
  - Remove razor labeling because we treat razor with spam policy
  - Add support for matahari-qmf-sysconfig-consoled, clean up matahari policy
  - Fixes for interfaces
  Resolves:#791294
  Resolves:#796351


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-139
changelog:
  - Allow nfsd_t to getattr on all fs
  Resolves:#738628
  - Make mailx working together with cron without unconfined module
  - Allow sssd sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-140
changelog:
  - Add additional fixes for nagios handlers
  Resolves:#749311
  - Add 7600 and 4447 as jboss_management ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-141
changelog:
  - Add man pages for apps, services
  - Allow nagios to use user terminals
  Resolves:#782325
  - Add support for unconfined certmonger scripts
  - Add support for matahari-qmf-rpcd service
  - Allow chsh to use PAM
  - Allow rpc.statd to execute sm-notify which has bin_t label
  - Make sure files which are created by /usr/bin/R get proper label in home directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-142
changelog:
  - Fixes for man pages
  - Allow rpcd to execute sm-notify
  Resolves:#802247
  - Add support for matahari-qmf-rpcd
  - Add support matahari vios-proxy-* apps
  - Allow quota-check to create files on nonxattr filesystems
  - Add support for ~/Maildir
  - Allow unconfined dyntransition
  - Fixes for certmonger_unconfined and certmonger
  - Fixes for certmonger policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-144
changelog:
  - Fixes for cfengine policy
    * changed labeling for /var/cfengine/outputs from var_log to cfengine_var_log_t
    * re-arranged policy to use template and cfengine_domain 
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Bacport libvirt-qmf policy for Fedora
  - Remove labeling for postmaster.pid file 
  - Fix for virtual network which looses network connection
  - Add man pages for SELinux users
  - cgconfig needs to use getpw calls
  - Allow lvm and fsadm to write sysfs_t
  - Allow rpc.mounted to list user tmp files
  - Fix permissivedomains declarations
  Resolves:#806220
  - Fix spec file to instal minimum policy properly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-146
changelog:
  - Add sysadm_secadm policy module to separate in secadm_r, sysadm_r
  Resolves:#787413
  - Fixes for libvirt-qmf
  - Add label for package-cleanup 
  - Add support for zfs
  - Make cfengine domains as unconfined
  Resolves:#753184
  - Allow sshd_t to dyntransition to sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-147
changelog:
  - Fix man pages for SELinux users
  - Allow all user domains to setexec
  - Allow cobblerd to get SELinux status and booleans
  - Add labeling for /etc/zipl.conf
  Resolves:#813803
  - Allow fenced to read SNMP lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-149
changelog:
  - Add labeling for /usr/sbin/matahari-dbus-sysconfigd
  - Add additional labeling for zarafa
  - Allow guest_t to fix labeling
  - Corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - squashfs does not support xattr in RHEL6
  Resolves:#815898
  - Remove pyzor labeling and move it to spamassassin.fc
  - Fix config.tgz


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-151
changelog:
  - Add openstack-nova, openstack-keystone, openstack-glance, openstack-quantum policies
  - Allow sysadm_t to create other crontabs
  - Allow nfsd_t to read defaul_t link files
  - Fix labeling for /var/run/heartbeat
  - Fixes for admin_template() interface to make sysadm_secadm.pp module working correctly
  - More fixes for condor policy
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Fix auth_role() interface
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-152
changelog:
  - Add label for condor_starter
  Resolves:#807682
  - Dontaudit sys_module for brctl
  - Allow winbind to send signull to smbd
  - Add jacorb port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-154
changelog:
  - Allow fenced to manage snmpd lib files
  - Allow certmonger to get attributes on init script files
  Resolves:#790967
  - Fix labeling for Firefox plugins
  Resolves:#747993
  - Add mta_signal_user_agent() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-155
changelog:
  - Allow setroubleshootd to execute rpm
  Resolves:#833053
  - Add labeling for /usr/lib/flash-plugin/libflashplayer.so


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-156
changelog:
  - Allow user to login using ssh with random MLS range
  Resolves:#837815
  - Allow virtd_t to create mtab with the proper labeling
  - Add support for check_icmp nagios plugin
  - Make chkconfig working on MLS for sysadm_t
  - Allow dovecot to manage mail_home_rw_t
  - Add support for fsav
  - Allow clamscan to use amavisd-new
  - Add support for rhnsd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-157
changelog:
  - Allow procmail to manage mail home data
  - We should only block MCS node_bind on mcsuntrustedproc
  - Fixes for amavis
  Resolves:#837815


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-159
changelog:
  - Allow munin_stats to read munin logs
  - Allow updpwd to write all MLS levels
  - Make piranha_web_t as nsswitch domain
  - Allow munin mail plugins to read exim log files
  - Backport sanlock policy from Fedora
  Resolves:#831908
  - Allos dac_override, sys_nice for sasl
  - Add labeling for /var/named/chroot/usr/lib64
  - Add support for gitolite3
  - Allow confined users to send mail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-160
changelog:
  - Add named_bind_http_port boolean
  - Add port definition for 8953/tcp
  - spice-vdagent(d)'s are going to log over to syslog
  - Fix labeling for /usr/sbin/rpc.* binaries to label them as rpcd_exec_t
  - Add sensord policy
  - Allow oddjob_mkhomedir to write on nfs share
  - Add virt_bridgehelper policy
  - Allow clamd to write/delete own pid file with clamd_var_run_t label
  - Add support for wdmd tmpfs
  - Add initrc_domain attribute 
  - Add bcfg2 policy
  - Modify ssh_chroot_rw_homedirs boolean to allow manage apache system r/w content if for /var/www as home
  - Add pacemaker policy
  - Allow snmpd to connect to corosync over unix stream socket
  - Allow crontab to read NFS
  - Add new type selinux_login_config_t for /etc/selinux/TYPE/logins directory and allow sssd to manage files in this directory
  Resolves:#843814
  - Add labeling for /opt/sartest directory
  - Add initrc_domain attribute to allow domains to work as initrc_t domain
  - heartbeat should be running as rgmanager_t instead of corosync_t
  - Add glusterd policy
  - Add l2tpd policy
  - Add numad policy
  Resolves:#801493


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-162
changelog:
  - Add pkcslotd policy
  Resolves:#851483
  - Allow cyrus-imapd init script to write cyrus data
  - Fix labeling for /dev/twa


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-166
changelog:
  - More fixes for openshift and add support for opeshift labeling instead of stickshift
  - /etc/selinux/<type>/logins should be owned by the policy package
  Resolves:#855889
  - Add labeling for /var/tmp/DNS_25      
  - Allow postfix_local_t to execute files on nfs_t
  - Add fixes for kadmind
  - Add rhnsd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-167
changelog:
  - Allow postfix_locat to search stickshift lib files
  - Dontaudit sys_ptrace cap for httpd if httpd_stickshift is on
  - Allow openshift domains change process identity
  - SELinux is reporting that openshift domains are trying to write into their proc directories
  Resolves:#855889


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-168
changelog:
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - pppd wants to read /usr/share/radiusclient-ng/dictionary
  - Add ssh_chroot_manage_apache_content and ssh_chroot_full_access booleans
  - snmp wants to also manage snmp dirs for amavisd-snmp support
  - Add labeling for virsh_fenced
  - Allow nmbd_t to crate dirs with samba_var_t labeling
  - Add clamscan_can_scan_system boolean
  - Allow all domains to getattr on prelink_exec_t
  - Add postgresql_can_rsync boolean
  - Allow pulse to domain transition to iptables
  - Allow nslcd sys_nice capability
  - Allow corosync to connect to saphostctrl ports
  - Allow passwd to read generic /tmp dirs
  - Add policy for qemu-qa
  - Add new antivirus policy module for antivirus programs
  Resolves:#838260


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-169
changelog:
  - Fix spec file to silent restorecon errors on files which do not exist
  - Fix passenger backport
  Resolves:#839831


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-172
changelog:
  - Update httpd_runstickshift boolean
  - Remove transition from sysadm_t to fsadm_t
  Resolves:#852763
  - Make vmware-host as unconfined domain
  - Allow all domains to read usr_t
  - Fix labeling for all log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-173
changelog:
  - syslogd_t now support kerberos
  Resolves:#867001
  - Fix openshift labeling for binaries
  - Allow passwd to read usr_t links/files
  - Add labeling for /var/lib/sss/mc


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-174
changelog:
  - openshift user domains wants to r/w ssh tcp sockets
  - Allow mount to relabelfrom unlabeled file systems
  - Additional fix for syslog/kerberos
  Resolves:#867001


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-175
changelog:
  - Add initial openswitch policy. Domains are unconfined
  Resolves:#845417
  - Add labeling for /usr/sbin/mcollectived
  - Allow openshift domains to read /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-177
changelog:
  - Allow dnsmasq to manage virt run files
  Resolves:#843543
  - Allow setroubleshootd to read /proc/irq
  - Backport fixes for virt_use_* booleans
  - Allow qemu-ga to use ttyS0
  - Allow dhcpc to manage dhclient-eth0.pid labeled as virt_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-178
changelog:
  - Fix labeling for OpenShift binaries
  - Add samba_portmapper boolean and labeling for /var/run/samba
  Resolves:#871816
  - Backport dspam policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-180
changelog:
  - Allow openshift domains to execute tmux
  - Allow wdmd to getattr on tmpfs_t
  Resolves:#831908
  - Add labeling for /var/nmbd/unexpected
  - Allow winbind to create samba pid dir
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes for syslogd
  - Fenced communicates with libvirt
  - Fix labeling for libflashplayer.so
  - Add labeling for /var/lib/zarafa-webapp
  - Allow dspam to read localization
  - Add labeling for Z-Push
  - Allow rpc.svcgssd to search nfsd_fs_t dirs
  - Allo cgred to read all sysctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-181
changelog:
  - Allow kdumpgui to read/write to zipl.conf
  Resolves:#877108
  - Add /proc/numactl support for confined users
  - Make proc_numa_t an MLS Trusted Object
  - Make ccs_tool and cman_tool labeled as rgmanager_exec_t
  - Fix cron_admin_role interface
  - Add support for opendkim


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-182
changelog:
  - Fix labeling for /var/named/chroot/usr/lib
  Resolves:#843732
  - Allow amavis to stream connect to snmpd
  Resolves:#839250
  - Additional fixes for log files related to logrotate
  - Allow all domains to read base etc_t file type
  - Allow logrotate to list root home directory
  - Fix labeling for /var/log/z-push
  - Allow cyrus init scriptu to manage cyrus data files
  - Dontaudit leaks of locks or generic log files to systemprocesses
  - Allow ricci-modrpm to send syslog msgs
  - Allow munin to have kill capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-184
changelog:
  - Add support for tcp/10026 port as dspam_port_t
  - Allow dspam to connect/bind to dspam_port_t
  - Add uconfined_munin_plugin_exec_t for all plugins which are not covered by munin plugins policy
  - Allow domains that can read sssd_public_t files to also list the directory
  Resolves:#881413
  - Allow programs to run in fips_mode using fips_mode boolean
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow sshd to look into the mysql home directory for authorized_keys
  - Make rsync as homemanager which allows to manage CIFS/NFS	  
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-185
changelog:
  - Apache is sending sinal to openshift_initrc_t now
  -  Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Allow winbind to manage samba_var_t sock files
  - Allow git-daemon and httpd to serve the same dir
  Resolves:#883143
  - Allow dac_override for nrpe


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-186
changelog:
  - Allow virtd to manage dnsmasq pid files
  - Allow all samba domains to create samba directory in var_t directory
  - Dontaudit attempts by openshift to read apache logs
  - Add labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-187
changelog:
  - Add missing labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432
  - Add labeling for /var/nmbd
  - apache/drupal can run clamscan on uploaded content


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-188
changelog:
  - Allow rpcd_t to read /var/run/utmp
  - Make glance domains as permissive instead of just glance_t
  - Allow kill capability for ftpd
  - Add labeling for prespawn helper script
  Resolves:#886619
  - Allow winbind to stream connect to nmbd
  - Allow transition from virt domains to bridgehelper domain
  - Add support for watchdog script from sanlock
  - Add labeling for tmp-inst
  - Fix rhev policy
  - Update virt_qemu_ga policy
  - Backport wm_domain policy
  - Backport virtd_lxc_t and make it as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-189
changelog:
  - Allow virt_qemu_ga to execute shutdown
  - sssd needs to connect to kerberos password port if a user changes his password
  - More fixes for the dspam domain
  - Allow dovecot to execute bash
  - Additional fixes for passenger
  Resolves:#886619
  - Add labeling for /var/run/checkquorum-timer


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-190
changelog:
  - Allow virtd to settattr on virt image dirs in MLS
  Resolves:#885045
  - Allow all postfix domains to connect to mysql stream
  - Call init_daemon_domain for rsync_t
  - Add labeling for /var/lib/pgsql/ssh 
  - Allow certmonger to send signal to itself
  - Allow rsyslog to read user tmp files using logging_syslog_can_read_tmp boolean
  - Add support for 1228/tcp and 1228/udp ports and allow corosync touse them
  - Allow corosync to read wdmd tmpfs
  - Allow wdmd to execute consoletype
  - Update man pages using sepolicy from Fedora
  - Fix admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-191
changelog:
  - Remove pam_selinux due to conflict
  - Add labeling for /etc/multipath - lvm_metadata_t
  Resolves:#880407
  - Add additional gitolite3 labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-192
changelog:
  - Label /usr/lib/yaboot/addnote as bin_t
  - Allow postfix_local to read/write /var/spool/postfix/active
  - Allow postfix domains to list /tmp
  - Allow wdmd to transition to kdump
  Resolves:#887793
  - Add labeling for /var/named/chroot/etc/localtime


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-193
changelog:
  - Fix ssh_sysadm_login boolean for MLS
  Resolves:#865759
  - Allow rpm_script_t to dbus communicate with certmonger_t
  - More fixes for qemu-ga to make "guest-fsfreeze-freeze" working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-194
changelog:
  - qdiskd needs to read usr_t/bin_t files
  - Allow dpsam to connect/bind to spamd ports
  - Allow munin services plugins to bind to generic node
  Resolves:#865759


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-195
changelog:
  - Make matahari domains as unconfined
  - Allow nscd to connect to nmbd
  Resolves:#901565
  - Allow setcap/getcap for syslogd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-196
changelog:
  - Backport openshfit fixes
  - Allow cgred to use notify 
  Resolves:#913673
  - Allow mount to transition to gluster 
  - Fix tuned policy to make it working with the lastet tuned package


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-197
changelog:
  - Fix /etc/dhcp labeling
  - Back port openshift fixes
  - Make dirsrv-admin server restarted from console working
  - Add ftpd_use_fusefs boolean
  Resolves:#913673
  - openshift_cron_t needs dac_override


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-198
changelog:
  - Allow dirsrv-admin script to exec apache modules
  - Add labeling for dirsrv-admin lock file
  - Add labeling for /var/lib/owncloud
  - Add labeling for /var/www/moodle
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-199
changelog:
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow dovecot-auth to execute bin_t
  - Allow mysqld-safe to execute bin_t
  - Allow procmail to manage user tmp files
  - Allow sanlock to kill svirt_t
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-203
changelog:
  - Allow dnsmasq to stream connect to quantum
  - Allow ifconfig domtrans to iptables and execute ldconfig
  Resolves:#966106
  - Make openshift_initrc_t as initrc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-204
changelog:
  - Allow iptables to read and write quantum inherited pipes
  - Allow iptables to send sigchld to quantum
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-205
changelog:
  - Remove domtrans for quantum which needs to stay in the same domain
  - Allow qemu to manage nova lib files
  - Allow hald to read svirt images
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-208
changelog:
  - Merge cluster administrative domains to cluster_t. Back ported from Fedora
  Resolves:#915151
  - Aadd additinal rules for disk plugins
  - Allow setuid/setgid caps for syslogd_t
  - Dontaudit sendmail to  write dovecote-deliver tmp files
  - Add suppport for /var/lib/openvpn
  - /var/spool/snmptt is a directory which snmdp needs to write to


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-210
changelog:
  - Allow nrpe to list /var
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Add support for strongswan
  - Fix description of ftpd_use_fusefs boolean
  - Allow kdumpgui to write dos files for /boot/efi/EFI/fedora/grub.cfg
  - Back port tgtd fixes from Fedora to allow sys_rawio cap
  - Add support for OpenDMARCD
  Resolves:#983551
  - Allow openvpn to run unconfined scripts
  - Allow amavis to execute shell
  Resolves:#979421
  - man pages should be owned only by selinux-policy-doc package
  - Fix fs_manage_nfs_files and fs_manage_nfs_dirs boolean to allow to search autofs
  - Allow mysqld-safe sys_nice/sys_resource caps
  Resolves:#975921
  - Add labeling for /boot/etc/yaboot.conf
  Resolves:#973156
  - /var/log/syslog-ng should be labeled var_log_t
  - Back port munin-cgi fixes
  - Fix ftp_home_dir boolean 
  - Allow kdump to read kcore on MLS system
  - Add support for svn ports
  - Add labels for /dev/ptp*
  - Add labels for /etc/security/opasswd
  - Fix labeling for /etc/localtime lnk file
  - Add  tftp booleans for NFS/CIFS access
  - Merge amavis,clamd,clamscan,freshclam policies to antivirus policy
  - Label all nagios plugins as nagios_unconfined_plugin_exec_t by default
  - Add additional ports as mongod_port_t
  - Allow sandbox domains to use inherted terminals
  - Allow pegasus to execute mount in pegasus_t domain
  - Fix *_admin interfaces  and interface descriptions
  - Allow yppasswdd to use NIS
  - Allow nagios to manage nagios spool files
  - Allow ABRT to domtrans to prelink
  Resolves:#921234
  - Fix labeling for /var/lib/dspam/
  Resolves:#919456
  - Label postfix-policyd-spf-perl as bin_t
  - Allow nrpe to run sudo
  - Label /usr/bin/yum-builddep as rpm_exec_t
  - Label /usr/local/bin/x11vnc as xserver_exec_t
  - Allow logwatch to domtrans to mdadm
  - Allow postfix-master to list /tmp dir
  - Add lldpad policy and make it as unconfined domain
  - Allow sysadm to admin postfix
  - ALlow postfix_virtual to stream connect to mysql
  - Update zabbix policy
  - Activate watchod policy and make it as unconfined
  - Add httpd_serve_cobbler_files boolean
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add oracleasm policy
  - Add support for pand
  - Add awstats_purge_apache_log_files boolean
  - Back port smstools policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-212
changelog:
  - Update rules for antivirus domains
  Resolves:#999471
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow chroot_user_t to read/write inherited user domain pty
  - Allow to start guest while the libvirtd is started with valgrind
  - Allow lldpad to talk with fcoemon
  - Allow chronyd sched_setscheduler


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-213
changelog:
  - Add openhpid policy
  Resolves:#1000521
  - Fix rhcs_domain_template to allow cluster_t to create socket in /var/run with correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-214
changelog:
  - Allow git daemons to read localization
  - Allow tgtd_t to connect to isns ports
  Resolves:#1003571
  - Cleanup antivirus policy and add additional fixes
  - Fix labeling for munin CGI scripts
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Fix fs_search_auto_mountpoints to allow search automount tmp dirs
  Resolves:#990661


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-215
changelog:
  - Add port definition of pka_ca to port 829 for openshift
  - Rename quantum to neutron
  - Allow rpcd to request the kernel to load a module
  - Allow ovsdb-server to create dirs/files in /tmp directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-216
changelog:
  - Remove transition from virtd_t to qemu_t to stay in virtd_t if selinux_driver is None in qemu.conf
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-217
changelog:
  - Fix virtd_lxc_t to be able to communicate with hal
  - Allow NM and wireless working together
  Resolves:#1009661
  - Allow my_print_default to read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-218
changelog:
  - Add support for /var/log/qemu-ga directory
  - Regenerate man pages for domains
  Resolves:#880728
  - Allow setgid capability for ipsec_t
  - Allow ipsec to send signull to itself
  - Add tcp/9000 as http_port_t
  - Allow dirsrv_t to create tmpfs_t directories
  - Fix git_role() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-219
changelog:
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Allow tzdate to unlink etc_t lnk files
  - Allow jabberd to connect to jabber_interserver port
  - Fix description for logging_syslog_can_read_tmp boolean
  - Update ipsec rules and labels
  Resolves:#986883
  - Allow pegasus transition to mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-220
changelog:
  - Allow cobblerd to stream connect to MySQL
  - Allow cobblerd to execute ldconfig
  - Allow openstack-glance to access to amqp
  - Add labeling for /var/run/charon.*
  - Make munin "df" plugins working
  Resolves:#908095


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-221
changelog:
  - Fix /var/run/charon labeling
  - More fix for strongswant and ipsec.secretes
  - Allow sandbox domain to use inherited user terminals


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-223
changelog:
  - Fix dovecot_rw_pipes() interface
  - Allow piranha_pulse_t to search tmpfs
  - Allow sysadm to stream connect to postfix-master process
  - Label /usr/sbin/fence_sanlockd as fenced_exec_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-225
changelog:
  - Re-write rules to create tmpfs for all piranha tmpfs files/dirs
  - Allow piranha-lvs to manage piranha_tmpfs_t
  Resolves:#1018306


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-226
changelog:
  - Label /usr/sbin/fence_scsi as fenced_exec_t
  - Fix cluster domains to create dirs in /var/run/cluster as var_run_t to make resource scripts working
  Resolves:#915151


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-227
changelog:
  - Resource agents needs to manage /etc/cluster to place own config files
  Resolves:#915151
  - tgtd needs ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-228
changelog:
  - Add daemons_enable_cluster_mode boolean and turn on it by default until RHEL6.6
  Resolves:#915151
  - Add tcp/8893 as milter port
  - Allow antivirus domain to read localization without the boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-229
changelog:
  - Add bootloader_exec_t labeling for /sbin/grubby
  Resolves:#915729
  - Add etc_runtime_t label for zipl.conf
  - Allow daemons to manage cluster lib files if daemons_enable_cluster_mode is enabled


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-231
changelog:
  - Add named_cache_t label for /var/lib/unbound
  - Fix puppet_domtrans_master() interface to make passenger working correctly if it wants to read puppet config files
  - Allow anitvirus domains to manage own log dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-232
changelog:
  - Add more fixes for zabbix-agent
  - Fix neutron labeling
  - Allow all domains to read sysfs_t due to glibc change
  - Allow ping to read inherited zabbix tmp files
  Resolves:#1039851
  - Allow hostname to read/write inherited rpm script files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-233
changelog:
  - Add support for OpenShift syslog plugin
  - Allow snmpd to getattr on removeable and fixed disks
  - Add shmemnetgrp and getnetgrp to access_vectors
  Resolves:#1025758


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-235
changelog:
  - Add support for nginx
  Resolves:#1045041
  - Change shutdown_t to also read wtmp
  - Added support for hypervkvpd
  - Add preupgrade policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-236
changelog:
  - Added conman policy
  - Added label for conman port
  - Added support for mip6d policy
  - Added support for isns
  - Added rtas_errd policy
  - Added support for keepalived policy
  - Add label samba_spool_t for /var/spool/samba
  - Allow httpd_t to bind preupgrade port if httpd_run_preupgrade boolean is enabled
  - Allow openshift_cron_t to append to openshift log files
  - dontaudit sudo domains listing /dev
  - Allow read/write to login records
  - Allow auditctl getattr access on blk_file
  - Allow nova-scheduler to read utmp
  - Added stapserver policy
  - Added support for freeipmi services
  - Added lsm policy
  - Added support for pcp service
  - Added chown capability to dhcpd_t domain
  - Add boolean to allow openshift domains nfs access
  - Allow abrt to read man pages and getcap
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Dontaudit smbd_t sending out random signuls
  - Backport all zabbix changes
  - Allow mcelog write access to nscd socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-237
changelog:
  - Fixes for mirrormanager
  - Fix swift interface
  - Allow lsmd_plugin_t to read localization
  - Allow keepalived read snmp libs, Allow keepalived connect to agentx port
  - Allow keepalived read localization
  - Added setuid capability to lsm service
  - Added some swift rules to rsync policy
  - Remove duplicate line entry in .fc
  - Do not send/receive packets when ftpd_use_passive_mode is disabled
  - Add mirrormanager policy to RHEL6 Fixes Bug 1042864
  - Update permissivedomains by mirrormanager
  - Add mirrormanager policy
  - Added support for openwsmand
  - Added policy for swift
  - Added support for sblim
  - label also 64bit heartbeat libs
  - Allow kill capability on varnish
  - Added haveged policy
  - Add missing kernel_rw_stream_socket_perms
  - Label tcp/udp port no. 3052 as apc, Allow apcups to bind on apc port
  - Allow logwatch stream connect to courier service
  - Fix mcelog policy
  - Back port rsyslog fixes from RHEL7 for rsyslog7
  - Fix whitespace
  - Add support for osad
  - Fix automount policy
  - Added policy for bacula
  - add radvd_read_pid_files inteface
  - Add missing syslog-conn port
  - Allow httpd_t write to kernel keyring
  - Allow httpd_sys_script_t domain to send system log messages 
  - Allow passwd_t to write to ipa trusted user files in /tmp 
  - Boolean to allow mcelog use all the user ttys 
  - Allow icecast to use any tcp ports 
  - Define oracleasm_t as a device node 
  - Allow sudomain to getattr of kernel interface
  - Add squid directory in /var/run
  - Allow automount read nfs symlinks
  - Allow asterisk to connect to the apache ports
  - allow abrt to read mcelog log file 
  - allow udev to search radvd files under the /run dir 
  - allow auditctl getattr access on blk_file 
  Resolves:#1080555
  - Allow ssh to manage nfs links


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-238
changelog:
  - Allow domain to read an append inherited tmp files
  - Dontauit leaks of var_t into ifconfig_t
  - Allow fsdaemon_t to read/write device_t char files 
  Resolves:#1035363
  - Remove sblim_filetrans_named_content in RHEL6
  - We don't have systemd in RHEL6.
  - one more fix for bacula_admin()
  - fix bacula_run_admin()
  - Remove shadow_t label from /etc/security/opasswd 
  - Fix logrotate_use_nfs boolean
  - Allow userdom to read inherited users files in /tmp 
  - Allow certmonger_t read puppet libs
  - Allow in logging_inherit_append_all_logs also ioctl and append
  - Label pacemaker_remoted as cluster_exec_t
  - Tag some conman exec files
  - Allow conman to read localization
  - Should use rw_socket_perms rather then sock_file on a unix_stream_socket
  - Added conman fixes
  - Allow apache to manage passenger sock_files
  - Allow bacula to bind on 9103 tcp port
  - Allow postfix stream connect to antivirus
  - Allow osad to read localization


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-239
changelog:
  - Fixed lsmd_plugin_t
  Resolves:#1111619
  - Added glusterd_conf_t alias glusterd_etc_t
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory 
  Resolves:#982160
  - Label zabbix-proxy files
  Resolves:#1018211
  - allow sshd to write to all process levels in order to change passwd when running at a level
  Resolves:#837616
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range 
  Resolves:#837616
  - Rename quantum port to neutron 
  Resolves:#1024927
  - Added zarafa_read_lib_files interface
  - Added dont audit list non security files in xdm_t 
  Resolves:#1030760
  - Added more fixes relates to 
  Resolves:#1060656
  - Added dontaudit rules to xdm_t 
  Resolves:#1030760
  - Allow procmail to run zarafa-degent 
  Resolves:#1060656
  - Add userdom_user_application_domain in xauth 
  Resolves:#1013832
  - Allow dmesg read raw memory 
  Resolves:#1030762
  - Allow communication between postfix and cyrus 
  Resolves:#1057307


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-240
changelog:
  - Allow nagios to stream connect to postgresqlBZ #1015708
  Resolves:#1015708
  - Allow hypervkvp read localization
  - Fix postfix_admin()
  - Add lldpad policy for MLS


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-241
changelog:
  - Remove deny_ptrace from interfaces
  - Add setpgid procces to mip6d_t
  - Added support for hv_vss_daemon
  - Allow keepalived also managed snmp lib dirs
  - Allow chroot_user_t unconfined shell domtrans
  Resolves:#1082183
  - Label swift-object-expirer as swift_exec_t
  - Allow keepalived manage snmp files, dontaudit list tmp files
  Resolves:#1053450
  - Additional fix for calling postfix interfaces in sysadm.te to make postfix_admin() working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-243
changelog:
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-244
changelog:
  - Add support for vdsm 
  Resolves:#1064270
  - Allow userdomain role to access prelink_mask_t
  - Rename module glusterfs to glusterd 
  Resolves:#1052206
  - Allow gfs_controld_t to getattr on all file systems 
  Resolves:#1110886
  - Allow apache to manage pid sock files 
  Resolves:#1042864
  - Bind TCP/UDP sockets to the nfs port
  - The /var/run/tuned directory is not a regular file 
  Resolves:#1117685
  - Allow utilize winbind for authentication to AD. 
  Resolves:#1084177
  - Dont audit access on /etc/init.d/mcollective for kdump_t
  - FIx labeling in networkmanager.fc
  - Allow passenger to connect to MySQL
  - ALlow passenger to read locales
  - Dontaudit relabelfrom/relabelto for all variablefiles for prelink_map_t
  - Change all var_lib_t types to have also variablestatefile attribute
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-245
changelog:
  - Allow setpgid for all sandbox domains.
  - Allow sandbox domains read all mountpoint symlinks to make symlinked homedirs working with sandbox.
  - One more fix for osad.te
  - Back port osad changes from RHEL7.
  - Rename svirt_lxc_file_t to svirt_sandbox_file_t.
  - Label nginx init script as httpd_initrc_exec_t 
  Resolves:#1045041
  - Allow postfix_smtpd to stream connect to antivirus 
  Resolves:#1105889
  - Label init thttpd file as httpd_initrc_exec_t 
  Resolves:#1069843
  - Allow httpd to setattr on httpd_log files
  Resolves:#1111581
  - Add tomcat
  - Allow zabbix to read system network state
  - Allow ndc to read random and urandom device 
  Resolves:#1110397
  - Add kerberos support for radiusd.
  - Allow procmail to ioctl on zarafa-deliver executable.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-246
changelog:
  - Add boolean to allow user login programs access to /etc/shadow
  - Use old icecast_connect_any boolean name and dontaudit list /tmp with tmp_t labeling
  - Remove unused interface rtas_errd_systemctl 
  Resolves:#1121169
  - Allow prelink_mask to use user terminals and dontaudit relabel tmpfiles.
  - Dontaudit r/w inherited lockfiles/tmpfiles for prelink_mask_t.
  - Allow prelink_mask to append all log files.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-247
changelog:
  - Add all login domain auth_can_read_shadow_passwords attribute.
  - Added support for dhcrelay service
  Resolves: #1123338
  - We need to call auth_tunable_read_shadow in auth_shadow boolean.
  - Move authlogin_shadow to authlogin.if.
  - Add filetrans also for bacula log files.
  - Dontaudit kdumpgui to read openshift_initrc_exec_t
  Resolves: #1023336
  - Allow squid to manage squid_var_run_t sock_file
  Resolves: #1102346
  - Alloe bacula manage bacula_log_t dirs
  Resolves: #1122545
  - Added sys_ptrace cap. to stapserver_t
  Resolves: #811366
  - Label also /var/run/glusterd.socket file as glusterd_var_run_t
  Resolves: #1052206
  - Added support for collectd daemon
  Resolves: #1024715
  - Label conmans pid file as conman_var_run_t, Resolves: #1122106
  - Fix authlogin_shadow boolean to have it for all login_pgm domains
  - Dontaudit r/w inherited all log files for prelink_mask_t
  - Label zabbix_var_lib_t directories
  Resolves: #1053205
  - Allow all sblim domain to read localization data
  Resolves:##1122022


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-248
changelog:
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift 
  Resolves: #1034206
  - Do not send/receive packets when ftpd_use_passive_mode is disabled 
  Resolves: #1105544
  - Allow qemu-ga domtrans to hwclock 
  Resolves: #1062384
  - Allow sshd read access to files on ftp directory 
  Resolves: #1097387
  - dontaudit r/w inherited certs for prelink_mask_t.
  - Allow sblim_gatherd_t to search all mountpoints. This is caused by ps. Should not be needed in Fedora.
  - Fix labeling in dhcpc.fc.
  - Add labels also for glusterd sockets.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-249
changelog:
  - Add support for luci.
  - Add support for rhsmd and treat it with rhsmcertd_t.
  - Make zabbix_agent_t as unconfined domain for rhel6.6.
  - Allow chroot_user_t to change process identity.
  Resolves:#1082183
  - Revert "Remove shadow_t label from /etc/security/opasswd
  - Dontaudit relabel lib_t files for prelink_mask_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-250
changelog:
  - Dontaudit read/write/setattr all pipes for prelink domains on all domains
  Resolves:#1103674
  - Allow chroot_user_t to change the role.
  - Add sys_time caps for virt_qemu_ga_t
  - Add label for /usr/sbin/luci


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-251
changelog:
  - Allow tgtd service to read kernel network state
  Resolves: 1130040
  - Allow mail-servers policies to read pcp libs
  Resolves: 1130934
  - Allow passwd_t to read/write stream sockets
  Resolves: #1129296
  - Add support for zabbix external scripts for which zabbix_script_t domain has been created. This domain is unconfined by default and user needs to run 'semodule -d unconfined' to make system running without unconfined domains. 
  - Dontaudit zebra to read getattr for all files and dirs
  Resolves: 1122031
  - Allow zebra to read /dev/urandom
  Resolves: #1122031
  - Label /var/lib/asterisk/agi-bin as bin_t
  - Added to lldpad policy sys_resource cap. and allow read localization 
  Resolves:1021984
  - Fix path to luci(/usr/sbin/luci) 
  Resolves:1023202
  - Add auth_can_read_shadow_passwords for rlogind.
  - Add authlogin_shadow boolean for all login domains.
  - Dontaudit rw all non security leaks.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-252
changelog:
  - Allow aide_t to read /dev/random and /dev/urandom.
  - Allow sysadm to talk with lldpad over unix dgram socket.
  - Allow sysadm to send/recv with unix dgram socket.
  - Allow crond_t to read lastlog.
  - Allow xdm_t to read plymouthd_spool_t files
  Resolves:#1131195
  - Allow hald to rpm dbus chat
  - Additional dontaudits for prelink_mask_t.
  - Add samba_domain attribute also for smbcontrol_t and winbind_helper_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-253
changelog:
  - Add additional dontaudits for prelink_mask_t
  Resolves:#1103674
  - Allow local_login_t and xdm_t to manage shadow_t because of PAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-254
changelog:
  - Dontaudit to read/write all dev nodes for prelink_mask_t.
  - Add label for path /var/lib/ctdb
  - Allow escd access to /var/run/pcscd.events directory
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-255
changelog:
  - Allow couriertcpd to read /var/spool/courier dir.
  - Allow prelink domain to rea /dev/mem.
  - ALlow transition to prelink_t instead of prelink_mask_t to ABRT domains/rpm.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-257
changelog:
  - Add fixes for sblim_sfcbd to make libvirt-cim working.
  - Allow keepalived stream connect to snmpd
  - Allow local_login_t and xdm_t to manage etc_t if authlogin_can_shadow boolean.
  - Allow prelink_transition_domain to send signal to prelink_mask_t.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-258
changelog:
  - Allow unlink lib_t located in /tmp for prelink_mask_t.
  Resolves:#1103674
  - Add support for pnp4nagios
  - Allow mysql to read all domain state
  - Allow sblim_sfcbd_t to search virt images
  - Revert "Remove shadow_t label from /etc/security/opasswd "


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260
changelog:
  - Add virt_getattr_images and call it for sblim_sfcbd_t.
  - We also need to call virt_search_images for sblim.
  Resolves:#1140614


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-261
changelog:
  - Allow sys_ptrace and dac_override caps for collectd.
  - Add labeling for /etc/rc\.d/init\.d/htcacheclean.
  - Allow /usr/sbin/sfcbd to send audit msgs.
  - Allow postdrop to connect to master process over unix stream socket.
  - Allow ssh_t to connect to all unreserved ports.
  - Allow setfiles domain to access files with admin_home_t. semanage -i /root/testfile.
  - Don't relabel files under /dev/shm/
  - Allow munin_disk_plugin_t getattr access on blk_file 
  - Allow xauth_t and sshd_t to search automount_tmp_t if use_nfs_home_dirs boolean.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow antivirus domains to read all dirs/files regardless of their MCS category set.
  - Add labeling for mariadb log/pid files/dirs.
  - Allow rsyslogd to read /proc/sys/vm/overcommit_memory file.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Remove ftpd_use_passive_mode boolean. It does not make sense due to ephemeral port handling.
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it.
  - Allow qpidd to read network state and sysctls dirs
  Resolves:#1171275
  - Add labeling for /var/bacula directory.
  - mcelog runs as a daemon domain 
  - Allow shutdown to r/w iherited rhev-agetnd pipes.
  - Allow sshd to seind signull itself.
  - Add the 'base_ro_file_type' and 'base_file_type' attributes to RHEL6.
  - Allow prelink_mask_t getattr on filesystems that support xattrs
  - Allow radious to connect to apache ports to do OCSP check.
  - remove transition from unconfined user to auditctl.
  - Backport RHEL7 sblim-sfcb fixes.
  - Add bacula fixes related to unconfined scripts based on ssekidde@redhat.com patch.
  - Allow zebra to communicate with sssd 
  - Add interfaces fixes.
  - Added some optional blogs from timemaster policy to chronyd.
  - Added linuxptp policy
  - Add interface to read mysql db link files
  - Added cinder policy
  - Make munin yum plugin as unconfined by default.
  - Allow bitlbee connections to the system DBUS.
  - Allow hv_vss_daemon to call ioctl(FIFREEZE) on /boot.
  - Add rsync_server boolean to don't have a transition from initrc by default.
  - Dontaudit to r/w inherited pipes from httpd because of certmonger unconfined scripts.
  - Backport all capabilities for cvs from RHEL7.
  - Allow dccproc to execute bash.
  - Fix labeling for /usr/libexec/nm-dispatcher.action.
  - Allow logrotate to manage virt_cache.
  - Allow osad to execute rhn_check.
  - Make osad_t as unconfined domain.
  - Allow osad connect to jabber client port.
  - Allow rhev-agentd to access /dev/.udev/db/block:sr0.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-262
changelog:
  - Allow lsmd_t getattr all exec.
  Resolves:#1141719
  - Update afs policy
  Resolves:#1136396
  - Add support for /usr/sbin/named-sdb.
  - Add support for mongos service.
  - Allow cyrus to use tcp/2005 port.
  - More service wants to auth_use_nsswitch.
  - Allow apps that need to read sysctl_vm_overcommit_t be able to read it.
  - Update passenger rules from RHEL7.
  - Allow smartd to manage generich devices if they are created with wrong label.
  - Allow sblim-sfcb to execute itself.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-263
changelog:
  - Allow userdomain to manage pcscd pid fifo files.
  - Allow prelink domain access to /dev/console 
  Resolves:#1145662
  - Allow httpd search access on tomcat6 directory
  - Allow apcupsd to get attributes of filesystems with xattrs
  - Allow qemu-ga getattr access of all filesystems
  - Allow abrt to read network state information
  - Make collectd_t as unconfined domain.
  - Make rpcbind as nsswitch domain.
  - Back port labeling for /etc/my.cnf.d dir.
  - Allow dhcpd kill capability.
  - Allow cachefilesd to create cachefilesd_var_t
  - cvs_home backport from RHEL7.
  - Add support for new fence agent fence_mpath which is executed by fence_node
  - Allow lsmd plugin to run with configured SSSD.
  - Allow bacula access to tape devices
  - Allow sblim-sfcb setuid.
  - Allow sblim domain to read sysctls.
  - Allow ntp to read localtime and allow timemaster send a signal to ntpd.
  - Add cobblerd_t fixes
  - Allow mysqld_t to use pam
  - Dontaudit xguest_t communication with avahi_t via dbus
  - Allow cobblerd_t to communicate with sssd
  - Allow pmwebd to send and receive messages from avahi over dbus
  - Allow conman_t to commmunicate with sssd
  - Allow mysqld_t to send audit messages
  - Allow load_policy rw access to inherited sssd pipes
  - Update label for /etc/mcelog/.* files
  - Allow bacula_t to connect to psql via tcp/unix socket
  - Remove type to only match directories on /boot
  - Add more labels for ownCloud
  - Dontaudit net_admin capability for munin


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-264
changelog:
  - Allow qpidd to read own init script file.
  - Allow passenger to accept connection
  - Back port hypervkvp fixes from RHEL7
  - ALlow load_policy to list inotifyfs filesystem
  - Allow cluster domain to execute ldconfig and update lvm_read_config() interface
  -  Allow sssd_t to connect to samba TCP port
  - Allow NetworkManager to run arping
  Resolves:#1209854
  - Backport RHEL7 redis policy
  - Add apache log and lib labels for roundcubemail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-265
changelog:
  - Allow redis to create /var/run/redis/redis.sock
  - Allow fence_mpathpersist to run mpathpersist which requires sys_admin capability.
  Resolves:#1206244
  - Allow rhn_check running as rpm to domtrans to shutdown domain
  - openshift_cache_t does exist


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-266
changelog:
  - Add audit_access permissions
  - Allow cupsd_t access to files in /etc dir
  - Allow hplip to dbus chat with all users.
  - Allow sblim-gathered sys_ptrace capability.
  - Allow sys_admin capability for gfs_controld
  - Add more cobbler labels to /var/lib/tftpboot/
  - Add new smbd_tmpfs_t type.
  - Add more fixes related to timemaster+ntp+ptp4l.
  - Fix cgdcbxd_admin() interface.
  - Add labeling for /var/tmp/kadmin_0 and /var/tmp/kiprop_0.
  - Dontaudit read access on admin_home_t for load_policy.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-267
changelog:
  - Allow ctdb to create rawip socket.
  - ALlow nmbd_t to crate nmbd_var_run_t dir under smbd_var_run_t.
  - Make ctdbd as userdom_home_reader.
  - Allow ctdbd to bind  smbd port.
  Resolves:#1219317


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-268
changelog:
  - Add labeling for /var/run/ctdb and allow samba domains to connect to ctdbd.
  Resolves:#1221929
  - Allow glusterd to read/write samba config files.
  - Update mysqld rules related to mysqld log files.
  - Add fixes for hypervkvp realed to ifdown/ifup scripts.
  - Update netlink_route_socket for ptp4l.
  - Allow sosreport to dbus chat with NM.
  - Allow glusterd to connect to /var/run/dbus/system_bus_socket.
  - ALlow glusterd to have sys_ptrace capability. Needed by gluster+samba configuration.
  - Add new boolean samba_load_libgfapi to allow smbd load libgfapi from gluster. Allow smbd to read gluster config files by default.
  - Allow gluster to transition to smbd. It is needed for smbd+gluster configuration.
  - Allow glusterd to read /dev/random.
  - Label all gluster hooks in /var/lib/gluster as bin_t. Thy are not created on the fly.
  - Update nagios_run_sudo boolean to allow run chkpwd.
  - Add labeling for /usr/sbin/kpropd.
  - Add nagios_run_sudo boolean
  - Allow ctdb to create rawip socket.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-269
changelog:
  - Fix labeling for /var/tmp/kiprop_0 to kadmind_tmp_t.
  - Allow postdrop runinng as postfix_postdrop_t to access /var/spool/postfix/public/pickup socket.
  - Allow gluster hooks scripts to transition to ctdbd_t.
  - Update policy rules for afs_fserver_t to allow connectto on unix_stream_socket.
  - Allow gluster transition to smbd_t also using samba init script.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-270
changelog:
  - Update policy rules for afs_fserver_t to allow connectto on unix_stream_socket instead of afs_t.
  - Allow smbd to access /var/lib/ctdb/persistent/secrets.tdb.0.
  - Allow glusterd to execute consoletype.
  - Glusterd wants to manage samba config files if they are setup together.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-271
changelog:
  - Remove ctdbd_manage_var_files() interface which is not used and is declared for the wrong type.
  Resolves:#1221929


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-272
changelog:
  - Allow hypervkvp to read default SELinux contexts.
  - Allow hypervkvp to write to /etc directories.
  - Update all man pages for RHEL6.7 SELinux domains/roles using the latest sepolicy-manpage from RHEL7.
  - Fix labeling for /var/lib/graphite-web
  - ALlow kpropd to connect to tcp/754 port.
  Resolves:#1220691
  - Allow php-fpm write access to /var/run/redis/redis.sock
  - Update fs_rw_inherited_nfs_files() to allow search auto mountpoints.
  - Dontaudit rpm leaks for prelink_mask_t.
  - Allow sysctl to have running under hypervkvp_t domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-273
changelog:
  - Fix redis_stream_connect interface.
  Resolves:#1220691
  - Allow kadmind to bind to kprop port.
  - Add new man pages for bacula


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have mknod capability. It creates a special file using mknod in a brick.
   - Update rules related to glusterd_brick_t.
   - Allow glusterd to execute lvm tools in the lvm_t target domain.
   - Allow glusterd to execute xfs_growfs in the target domain.
   - Add support for /usr/sbin/xfs_growfs.
   - Allow glusterd to create samba config files if it is started by service script and running with unconfined_u.
  Resolves:#1228109
  - Fix description for ftpd_use_passive_mode boolean.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have transition to insmod.
  - Allow glusterd to use geo-replication gluster tool.
  - Remove gluster from permissive domains.
  Resolves:#1229605


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-276
changelog:
  - Allow gluster to manage own log files.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  - Label gluster python hooks also as bin_t.
  - Allow samba_t net_admin capability to make CIFS mount working.
  Resolves:#1229605
  - Allow ssh_keygen_t to manage keys located in /var/lib/gluster.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-278
changelog:
  - Allow logrotate get attributes of all unallocated tty device nodes.
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  - Allow glusterd to connect to init.
  Resolves:#1230371
  - Allow gluster do dbus chat with domain running as initrc_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.1
changelog:
  - Backport gluster fixes from RHEL7
   - execute showmount in own domain
  Resolves:#1248520
   - execute nsfd in own domain
   - allow gluster to connect to all ports
   - Add support for /usr/sbin/ctdbd_wrapper.
   - nrpe needs kill capability to make gluster moniterd nodes working.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.2
changelog:
  - Allow nmbd to create pids files/dirs under /var/run/samba with correct labeling.
  Resolves:#1248520


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
  - remove absolute path names from the PAM configuration, ensuring that the
    right modules get used for whichever arch we're built for
  - don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
  - Enhance sesh.c to fork/exec children itself, to avoid
    having sudo reap all domains.
  - Only reinstall default signal handlers immediately before
    exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
  - new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
  - Remove selinux patch.  It has been decided that the SELinux patch for sudo is
  - no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
  - We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
  - fix #198755 - make login processes (sudo -i) initialise session keyring
    (thanks for PAM config files to David Howells)
  - add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
  - adjust audit patch, do not scream when kernel is
    compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
  - fixed building with new libtool
  - fix for incorrect handling of groups in Runas_User
  - added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
  - moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
  - epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
  - new upstream version
    Resolves: rhbz#554321
  - drop *.pod man page duplicates from docs
  - commented out unused aliases in sudoers to make visudo happy (#550239)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-5
changelog:
  - added patch that fixes insufficient environment sanitization issue (#598154)
    Resolves: rhbz#598383


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-7
changelog:
  - move the sudo_end* calls before closefrom()
  - close audit_fd before exec
  - fixed typo in Makefile.in
    Resolves: rhbz#569313


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-1
changelog:
  - rebase to latest stable version
  - sudo now uses /var/db/sudo for timestamps
  - new command available: sudoreplay
  - use native audit support
  - sync configuration paths with the nss_ldap package
    Resolves: rhbz#615087
    Resolves: rhbz#652726
    Resolves: rhbz#634159
    Resolves: rhbz#603823


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-6
changelog:
  - removed the --with-ldap-*conf options
  - added RELRO flags
    Resolves: rhbz#709235
    Resolves: rhbz#709859


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-8
changelog:
  - created a separate ldap configuration file, sudo-ldap.conf
  - visudo: mark unused aliases as warnings, not errors
  - backported signal handling from 1.7.5
  - don't disable coredumping from the code, rely on /proc/sys/fs/suid_dumpable
  - use correct SELinux context when editing files with sudoedit
  - fixed visudo syntax checks
  - fixed typos and inconsistencies in documentation
  - switched to an updated -getgrouplist patch to fix sudo -l -U <user> behavior 
    Resolves: rhbz#760843
    Resolves: rhbz#736030
    Resolves: rhbz#697775
    Resolves: rhbz#726634
    Resolves: rhbz#708515
    Resolves: rhbz#736653
    Resolves: rhbz#667120
    Resolves: rhbz#769701
    Resolves: rhbz#751680
    Resolves: rhbz#604297
    Resolves: rhbz#797511


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-9
changelog:
  - fixed uninitialized value warning introduced with the sudoedit-selinux patch
    Resolves: rhbz#806386


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-10
changelog:
  - fixed bug in Runas_Spec group matching (#810147)
  - disable `sudo -l' output word wrapping if the output
    is piped (#810326)
  - fixed `sudo -i' command escaping (#806095)
    Resolves: rhbz#806095
    Resolves: rhbz#810147
    Resolves: rhbz#810326


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-10.1
changelog:
  - backported ldap code modifications that fix an issue with tls_checkpeer (#810372)
    Resolves: rhbz#810372


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p5-11
changelog:
  - use SIG_SETMASK when resetting signal mask instead of SIG_UNBLOCK (#821976)
    Resolves: rhbz#821976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-1
changelog:
  - rebase to 1.8.6p3
  - new -devel subpackage
  - new configuration file: /etc/sudo.conf
    Resolves: rhbz#852045 - ulimit -c got Operation not permitted
    Resolves: rhbz#804123 - sudo does not call pam_close_session() or pam_end()
    Resolves: rhbz#828707 - sudo fails to report error correctly when execv(3) fails
    Resolves: rhbz#844691 - Cannot set RLIMIT_NPROC to unlimited via pam_limits when running sudo
    Resolves: rhbz#759480 - Rebase sudo to 1.8 in RHEL 6.4
    Resolves: rhbz#846117 - Sudo interpretation of wildcard command arguments is more lenient providing a security risk
    Resolves: rhbz#789937 - [RFE] Add ability to treat files authoritatively in sudoers.ldap
    Resolves: rhbz#836242 - sudo -s -u USERNAME can't change ulimit -c


