# changelog

author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-35
changelog:
  - tuned wants to getattr on all filesystems
  - tuned needs also setsched. The build is needed for test day


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-36
changelog:
  - Allow semanage to verify types
  - Allow sudo domain to execute user home files
  - Allow session_bus_type to transition to user_tmpfs_t
  - Add dontaudit caused by yum updates
  - Implement pki policy but not activated


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-37
changelog:
  - Allow xdm to search all file systems
  - Add interface to allow the config of all files
  - Add rngd policy
  - Remove kgpg as a gpg_exec_t type
  - Allow plymouthd to block suspend
  - Allow systemd_dbus to config any file
  - Allow system_dbus_t to configure all services
  - Allow freshclam_t to read usr_files
  - varnishd requires execmem to load modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-39
changelog:
  - Add interfaces to read kernel_t proc info
  - Missed this version of exec_all
  - Allow anyone who can load a kernel module to compromise kernel
  - Add oddjob_dbus_chat to openshift apache policy
  - Allow chrome_sandbox_nacl_t to send signals to itself
  - Add unit file support to usbmuxd_t
  - Allow all openshift domains to read sysfs info
  - Allow openshift domains to getattr on all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-40
changelog:
  - Additional requirements for disable unconfined module when booting
  - Fix label of systemd script files
  - semanage can use -F /dev/stdin to get input
  - syslog now uses kerberos keytabs
  - Allow xserver to compromise_kernel access
  -  Allow nfsd to write to mount_var_run_t when running the mount command
  - Add filename transition rule for bin_t directories
  - Allow files to read usr_t lnk_files
  - dhcpc wants chown
  - Add support for new openshift labeling
  - Clean up for tunable+optional statements
  - Add labeling for /usr/sbin/mkhomedir_helper
  - Allow antivirus domain to managa amavis spool files
  - Allow rpcbind_t to read passwd 
  - Allow pyzor running as spamc to manage amavis spool


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-41
changelog:
  - Allow mount to relabelfrom unlabeled file systems
  - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working
  - Add label to get bin files under libreoffice labeled correctly
  - Fix interface to allow executing of base_ro_file_type
  - Add fixes for realmd
  - Update pki policy
  - Add tftp_homedir boolean
  - Allow blueman sched_setscheduler
  - openshift user domains wants to r/w ssh tcp sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-42
changelog:
  - pki is leaking which we dontaudit until a pki code fix
  - Allow setcap for arping
  - Update man pages
  - Add labeling for /usr/sbin/mcollectived
  - pki fixes
  - Allow smokeping to execute fping in the netutils_t domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-44
changelog:
  - Change default label of all files in /var/run/rpcbind
  - Allow sandbox domains (java) to read hugetlbfs_t
  - Allow awstats cgi content to create tmp files and read apache log files
  - Allow setuid/setgid for cupsd-config
  - Allow setsched/sys_nice pro cupsd-config
  -  Fix /etc/localtime sym link to be labeled locale_t
  - Allow sshd to search postgresql db t since this is a homedir
  - Allow xwindows users to chat with realmd
  - Allow unconfined domains to configure all files and null_device_t service


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-45
changelog:
  - Add new selinuxuser_use_ssh_chroot boolean
  - dbus needs to be able to read/write inherited fixed disk device_t passed through it
  - Cleanup netutils process allow rule
  - Dontaudit leaked fifo files from openshift to ping
  - sanlock needs to read mnt_t lnk files
  - Fail2ban needs to setsched and sys_nice


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-46
changelog:
  - Allow loging programs to dbus chat with realmd
  - Make apache_content_template calling as optional
  - realmd is using policy kit


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-47
changelog:
  - Allow getty to setattr on usb ttys
  - Allow sshd to search all directories for sshd_home_t content
  - Allow staff domains to send dbus messages to kdumpgui
  - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t
  - Dontaudit setfiles reading urand
  - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched
  - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir
  - Allow systemd-timedated to read /dev/urandom
  - Allow entropyd_t to read proc_t (meminfo)
  - Add unconfined munin plugin
  - Fix networkmanager_read_conf() interface
  - Allow blueman to list /tmp which is needed by sys_nic/setsched
  - Fix label of /etc/mail/aliasesdb-stamp
  - numad is searching cgroups
  - realmd is communicating with networkmanager using dbus
  - Lots of fixes to try to get kdump to work


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-48
changelog:
  - Fix label on /etc/group.lock
  - Allow gnomeclock to create lnk_file in /etc
  - label /root/.pki as a home_cert_t
  - Add interface to make sure rpcbind.sock is created with the correct label
  - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules
  - opendkim should be a part of milter
  - Allow libvirt to set the kernel sched algorythm
  - Allow mongod to read sysfs_t
  - Add authconfig policy
  - Remove calls to miscfiles_read_localization all domains get this
  - Allow virsh_t to read /root/.pki/ content
  - Add label for log directory under /var/www/stickshift


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-49
changelog:
  - Add smsd policy
  - Add support for OpenShift sbin labelin
  - Add boolean to allow virt to use rawip
  - Allow mozilla_plugin to read all file systems with noxattrs support
  - Allow kerberos to write on anon_inodefs fs
  - Additional access required by fenced
  - Add filename transitions for passwd.lock/group.lock
  - UPdate man pages
  - Create coolkey directory in /var/cache with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-50
changelog:
  - Allow all domains to read /proc/sys/vm/overcommit_memory
  - Make proc_numa_t an MLS Trusted Object
  - Add /proc/numactl support for confined users
  - Allow ssh_t to connect to any port > 1023
  - Add openvswitch domain
  - Pulseaudio tries to create directories in gnome_home_t directories
  - New ypbind pkg wants to search /var/run which is caused by sd_notify
  - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans
  - Allow sanlock to read /dev/random
  - Treat php-fpm with httpd_t
  - Allow domains that can read named_conf_t to be able to list the directories
  - Allow winbind to create sock files in /var/run/samba


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-51
changelog:
  - Add port defintion for tcp/9000
  - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd
  - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory
  - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API
  - Allow shorewall_t to create netlink_socket
  - Allow krb5admind to block suspend
  - Fix labels on /var/run/dlm_controld /var/log/dlm_controld
  - Allow krb5kdc to block suspend
  - gnomessytemmm_t needs to read /etc/passwd
  - Allow cgred to read all sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-52
changelog:
  - Define usbtty_device_t as a term_tty
  - Allow svnserve to accept a connection
  - Allow xend manage default virt_image_t type
  - Allow prelink_cron_system_t to overide user componant when executing cp
  - Add labeling for z-push
  - Gnomeclock sets the realtime clock
  - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd
  - Allow lxc domains to use /dev/random and /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-53
changelog:
  - Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file
  - Dontaudit setfiles reading /dev/random
  - On initial boot gnomeclock is going to need to be set buy gdm
  - Fix tftp_read_content() interface
  - Random apps looking at kernel file systems
  - Testing virt with lxc requiers additional access for virsh_t
  - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container
  - Allow MPD to read /dev/radnom
  - Allow sandbox_web_type to read logind files which needs to read pulseaudio
  - Allow mozilla plugins to read /dev/hpet
  - Add labeling for /var/lib/zarafa-webap
  - Allow BOINC client to use an HTTP proxy for all connections
  - Allow rhsmertd to domain transition to dmidecod
  -  Allow setroubleshootd to send D-Bus msg to ABRT


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-54
changelog:
  - Fix filetrans interface definitions
  - Dontaudit xdm_t to getattr on BOINC lib files
  - Add systemd_reload_all_services() interface
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes 
  - Only stop mcsuntrustedproc from relableing files
  - Allow accountsd to dbus chat with gdm
  - Allow realmd to getattr on all fs
  - Allow logrotate to reload all services
  - Add systemd unit file for radiusd
  - Allow winbind to create samba pid dir
  - Add labeling for /var/nmbd/unexpected
  - Allow chrome and mozilla plugin to connect to msnp ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-55
changelog:
  - Fix userhelper_console_role_template()
  - Allow enabling Network Access Point service using blueman
  - Make vmware_host_t as unconfined domain
  - Allow authenticate users in webaccess via squid, using mysql as backend
  - Allow gathers to get various metrics on mounted file systems
  - Allow firewalld to read /etc/hosts
  - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t
  - Allow kdumpgui to read/write to zipl.conf
  - Commands needed to get mock to build from staff_t in enforcing mode
  - Allow mdadm_t to manage cgroup files
  - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files
  - dontaudit ifconfig_t looking at fifo_files that are leaked to it
  - Add lableing for Quest Authentication System


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-56
changelog:
  - Allow syslogd to request the kernel to load a module
  - Allow syslogd_t to read the network state information
  - Allow xdm_dbusd_t connect to the system DBUS
  - Add support for 7389/tcp port
  - Allow domains to read/write all inherited sockets
  - Allow staff_t to read kmsg
  - Add awstats_purge_apache_log boolean
  - Allow ksysguardproces to read /.config/Trolltech.conf
  - Allow passenger to create and append puppet log files
  - Add puppet_append_log and puppet_create_log interfaces
  - Add puppet_manage_log() interface
  - Allow tomcat domain to search tomcat_var_lib_t
  - Allow pki_tomcat_t to connect to pki_ca ports
  - Allow pegasus_t to have net_admin capability
  - Allow pegasus_t to write /sys/class/net/<interface>/flags
  - Allow mailserver_delivery to manage mail_home_rw_t lnk_files
  - Allow fetchmail to create log files
  - Allow gnomeclock to manage home config in .kde
  - Allow bittlebee to read kernel sysctls
  - Allow logrotate to list /root


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-57
changelog:
  - Add support for 4567/tcp port
  - Random fixes from Tuomo Soini
  - xdm wants to get init status
  - Allow programs to run in fips_mode
  - Add interface to allow the reading of all blk device nodes
  - Allow init to relabel rpcbind sock_file
  - Fix labeling for lastlog and faillog related to logrotate
  - ALlow aeolus_configserver to use TRAM port
  - Add fixes for aeolus_configserver
  - Allow snmpd to connect to snmp port
  - Allow spamd_update to create spamd_var_lib_t directories
  - Allow domains that can read sssd_public_t files to also list the directory
  - Remove miscfiles_read_localization, this is defined for all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-58
changelog:
  - Add back consolekit policy
  - Silence bootloader trying to use inherited tty
  - Silence xdm_dbusd_t trying to execute telepathy apps
  - Fix shutdown avcs when machine has unconfined.pp disabled
  - The host and a virtual machine can share the same printer on a usb device
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow abrt_watch_log_t to execute bin_t
  - Allow chrome sandbox to write content in ~/.config/chromium
  - Dontaudit setattr on fontconfig dir for thumb_t
  - Allow lircd to request the kernel to load module
  - Make rsync as userdom_home_manager
  - Allow rsync to search automount filesystem
  - Add fixes for pacemaker


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-60
changelog:
  - Add openshift_initrc_signal() interface
  - Fix typos
  - dspam port is treat as spamd_port_t
  - Allow setroubleshoot to getattr on all executables
  - Allow tuned to execute profiles scripts in /etc/tuned
  - Allow apache to create directories to store its log files
  - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6
  - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM
  - Add filename transition for /etc/tuned/active_profile
  - Allow condor_master to send mails
  - Allow condor_master to read submit.cf
  - Allow condor_master to create /tmp files/dirs
  - Allow condor_mater to send sigkill to other condor domains
  - Allow condor_procd sigkill capability
  - tuned-adm wants to talk with tuned daemon
  - Allow kadmind and krb5kdc to also list sssd_public_t
  - Allow accountsd to dbus chat with init
  - Fix git_read_generic_system_content_files() interface
  - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler"
  - Fix mozilla_plugin_can_network_connect to allow to connect to all ports
  - Label all munin plugins which are not covered by munin plugins policy  as unconfined_munin_plugin_exec_t
  - dspam wants to search /var/spool for opendkim data
  - Revert "Add support for tcp/10026 port as dspam_port_t"
  - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6
  - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain
  - Allow systemd_tmpfiles_t to setattr on mandb_cache_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-61
changelog:
  - Label /var/lib/pgsql/.ssh as ssh_home_t
  - Add labeling for /usr/bin/pg_ctl
  - Allow systemd-logind to manage keyring user tmp dirs
  - Add support for 7389/tcp port
  - gems seems to be placed in lots of places
  - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus
  - Add back tcp/8123 port as http_cache port
  - Add ovirt-guest-agent\.pid labeling
  - Allow xend to run scsi_id
  - Allow rhsmcertd-worker to read "physical_package_id"
  - Allow pki_tomcat to connect to ldap port
  - Allow lpr to read /usr/share/fonts
  - Allow open file from CD/DVD drive on domU
  - Allow munin services plugins to talk to SSSD
  - Allow all samba domains to create samba directory in var_t directories
  - Take away svirt_t ability to use nsswitch
  - Dontaudit attempts by openshift to read apache logs
  - Allow apache to create as well as append _ra_content_t
  - Dontaudit sendmail_t reading a leaked file descriptor
  - Add interface to have admin transition /etc/prelink.cache to the proper label
  - Add sntp support to ntp policy
  - Allow firewalld to dbus chat with devicekit_power
  - Allow tuned to call lsblk
  - Allow tor to read /proc/sys/kernel/random/uuid
  - Add tor_can_network_relay boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-62
changelog:
  - Fix MCS Constraints to control ingres and egres controls on the network.
  - Change name of svirt_nokvm_t to svirt_tcg_t
  - Allow tuned to request the kernel to load kernel modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-63
changelog:
  - Add label for efivarfs
  - Allow certmonger to send signal to itself
  - Allow plugin-config to read own process status
  - Add more fixes for pacemaker
  - apache/drupal can run clamscan on uploaded content
  - Allow chrome_sandbox_nacl_t to read pid 1 content


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-65
changelog:
  - Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch
  - Add additional labeling for /var/www/openshift/broker
  - Fix rhev policy
  - Allow openshift_initrc domain to dbus chat with systemd_logind
  - Allow httpd to getattr passenger log file if run_stickshift
  - Allow consolehelper-gtk to connect to xserver
  - Add labeling for the tmp-inst directory defined in pam_namespace.conf
  - Add lvm_metadata_t labeling for /etc/multipath


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-66
changelog:
  - Allow munin disk plugins to get attributes of all directories
  - Allow munin disk plugins to get attributes of all directorie
  - Allow logwatch to get attributes of all directories
  - Fix networkmanager_manage_lib() interface
  - Fix gnome_manage_config() to allow to manage sock_file
  - Fix virtual_domain_context
  - Add support for dynamic DNS for DHCPv6


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-67
changelog:
  - systemd_logind_t is looking at all files under /run/user/apache
  - Allow systemd to manage all user tmp files
  - Add labeling for /var/named/chroot/etc/localtime
  - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6
  - Keystone is now using a differnt port
  - Allow xdm_t to use usbmuxd daemon to control sound
  - Allow passwd daemon to execute gnome_exec_keyringd
  - Fix chrome_sandbox policy
  - Add labeling for /var/run/checkquorum-timer
  - More fixes for the dspam domain, needs back port to RHEL6
  - More fixes for the dspam domain, needs back port to RHEL6
  - sssd needs to connect to kerberos password port if a user changes his password
  - Lots of fixes from RHEL testing of dspam web
  - Allow chrome and mozilla_plugin to create msgq and semaphores
  - Fixes for dspam cgi scripts
  - Fixes for dspam cgi scripts
  - Allow confine users to ptrace screen
  - Backport virt_qemu_ga_t changes from RHEL
  - Fix labeling for dspam.cgi needed for RHEL6
  - We need to back port this policy to RHEL6, for lxc domains
  - Dontaudit attempts to set sys_resource of logrotate
  - Allow corosync to read/write wdmd's tmpfs files
  - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set
  - Allow cron jobs to read bind config for unbound
  - libvirt needs to inhibit systemd
  - kdumpctl needs to delete boot_t files
  - Fix duplicate gnome_config_filetrans
  - virtd_lxc_t is using /dev/fuse
  - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift
  - apcupsd can be setup to listen to snmp trafic
  - Allow transition from kdumpgui to kdumpctl
  - Add fixes for munin CGI scripts
  - Allow deltacloud to connect to openstack at the keystone port
  - Allow domains that transition to svirt domains to be able to signal them
  - Fix file context of gstreamer in .cache directory
  - libvirt is communicating with logind
  - NetworkManager writes to the systemd inhibit pipe


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-68
changelog:
  - Allow setroubleshoot_fixit to execute rpm
  - zoneminder needs to connect to httpd ports where remote cameras are listening
  - Allow firewalld to execute content created in /run directory
  - Allow svirt_t to read generic certs
  - Dontaudit leaked ps content to mozilla plugin
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - init scripts are creating systemd_unit_file_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-69
changelog:
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Add labeling for /var/named/chroot/etc/localtim


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-2
changelog:
  - Remove all mcs overrides and replace with t1 != mcs_constrained_types
  - Add attribute_role for iptables
  - mcs_process_set_categories needs to be called for type
  - Implement additional role_attribute statements
  - Sodo domain is attempting to get the additributes of proc_kcore_t
  - Unbound uses port 8953
  - Allow svirt_t images to compromise_kernel when using pci-passthrough
  - Add label for dns lib files
  - Bluetooth aquires a dbus name
  - Remove redundant files_read_usr_file calling
  - Remove redundant files_read_etc_file calling
  - Fix mozilla_run_plugin()
  - Add role_attribute support for more domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-3
changelog:
  - Allow gnomeclock to talk to puppet over dbus
  - Allow numad access discovered by Dominic
  - Add support for HOME_DIR/.maildir
  - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain
  - Allow udev to relabel udev_var_run_t lnk_files
  - New bin_t file in mcelog


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-4
changelog:
  - Allow systemd-tmpfiles to relabel lpd spool files
  - Ad labeling for texlive bash scripts
  - Add xserver_filetrans_fonts_cache_home_content() interface
  - Remove duplicate rules from *.te
  - Add support for /var/lock/man-db.lock
  - Add support for /var/tmp/abrt(/.*)?
  - Add additional labeling for munin cgi scripts
  - Allow httpd_t to read munin conf files
  - Allow certwatch to read meminfo
  - Fix nscd_dontaudit_write_sock_file() interfac
  - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t
  - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-5
changelog:
  - Fix systemd_manage_unit_symlinks() interface
  - Call systemd_manage_unit_symlinks(() which is correct interface
  - Add filename transition for opasswd
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow sytstemd-timedated to get status of init_t
  - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t
  - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow gpg_t to manage all gnome files
  - Stop using pcscd_read_pub_files
  - New rules for xguest, dontaudit attempts to dbus chat
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - run unbound-chkconf as named_t, so it can read dnssec
  - Colord is reading xdm process state, probably reads state of any apps that sends dbus message
  - Allow mdadm_t to change the kernel scheduler
  - mythtv policy
  - Update mandb_admin() interface
  - Allow dsspam to listen on own tpc_socket
  - seutil_filetrans_named_content needs to be optional
  - Allow sysadm_t to execute content in his homedir
  - Add attach_queue to tun_socket, new patch from Paul Moore
  - Change most of selinux configuration types to security_file_type.
  - Add filename transition rules for selinux configuration
  - ssh into a box with -X -Y requires ssh_use_ptys
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated
  - New allow rules found by Tom London for systemd_hostnamed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-6
changelog:
  - kde gnomeclock wants to write content to /tmp
  - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde
  - Allow blueman_t to rwx zero_device_t, for some kind of jre
  - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre
  - Ftp full access should be allowed to create directories as well as files
  - Add boolean to allow rsync_full_acces, so that an rsync server can write all
  - over the local machine
  - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6
  - Add missing vpnc_roles type line
  - Allow stapserver to write content in /tmp
  - Allow gnome keyring to create keyrings dir in ~/.local/share
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Add interface to colord_t dbus_chat to allow it to read remote process state
  - Allow colord_t to read cupsd_t state
  - Add mate-thumbnail-font as thumnailer
  - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.
  - Allow qpidd to list /tmp. Needed by ssl
  - Only allow init_t to transition to rsync_t domain, not initrc_t.  This should be back ported to F17, F18
  - - Added systemd support for ksmtuned
  - Added booleans
   	ksmtuned_use_nfs
   	ksmtuned_use_cifs
  - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm.  Would like to clean this up but for now we will allow
  - Looks like qpidd_t needs to read /dev/random
  - Lots of probing avc's caused by execugting gpg from staff_t
  - Dontaudit senmail triggering a net_admin avc
  - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port
  - Logwatch does access check on mdadm binary
  - Add raid_access_check_mdadm() iterface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-7
changelog:
  - mount.glusterfs executes glusterfsd binary
  - Allow systemd_hostnamed_t to stream connect to systemd
  - Dontaudit any user doing a access check
  - Allow obex-data-server to request the kernel to load a module
  - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info)
  - Allow gpg-agent to read /proc/sys/crypto/fips_enabled
  - Add new types for antivirus.pp policy module
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Allow NM rawip socket
  - files_relabel_non_security_files can not be used with boolean
  - Add interface to thumb_t dbus_chat to allow it to read remote process state
  - ALlow logrotate to domtrans to mdadm_t
  - kde gnomeclock wants to write content to /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-8
changelog:
  - Change ssh_use_pts to use macro and only inherited sshd_devpts_t
  - Allow confined users to read systemd_logind seat information
  - libmpg ships badly created libraries
  - Add support for strongswan.service
  - Add labeling for strongswan
  - Allow l2tpd_t to read network manager content in /run directory
  - Allow rsync to getattr any file in rsync_data_t
  - Add labeling and filename transition for .grl-podcasts


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-9
changelog:
  - boinc_cliean wants also execmem as boinc projecs have
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow antivirus domain to read net sysctl
  - Dontaudit attempts from thumb_t to connect to ssd
  - Dontaudit attempts by readahead to read sock_files
  - Dontaudit attempts by readahead to read sock_files
  - Create tmpfs file while running as wine as user_tmpfs_t
  - Dontaudit attempts by readahead to read sock_files
  - libmpg ships badly created librarie


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-10
changelog:
  - Fix smartmontools
  - Fix userdom_restricted_xwindows_user_template() interface
  - Add xserver_xdm_ioctl_log() interface
  - Allow Xusers to ioctl lxdm.log to make lxdm working
  - Add MLS fixes to make MLS boot/log-in working
  - Add mls_socket_write_all_levels() also for syslogd
  - fsck.xfs needs to read passwd
  - Fix ntp_filetrans_named_content calling in init.te
  - Allow postgresql to create pg_log dir
  - Allow sshd to read rsync_data_t to make rsync <backuphost> working
  - Change ntp.conf to be labeled net_conf_t
  - Allow useradd to create homedirs in /run.  ircd-ratbox does this and we should just allow it
  - Allow xdm_t to execute gstreamer home content
  - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp
  - New policy for openstack swift domains
  - More access required for openshift_cron_t
  - Use cupsd_log_t instead of cupsd_var_log_t
  - rpm_script_roles should be used in rpm_run
  - Fix rpm_run() interface
  - Fix openshift_initrc_run()
  - Fix sssd_dontaudit_stream_connect() interface
  - Fix sssd_dontaudit_stream_connect() interface
  - Allow LDA's job to deliver mail to the mailbox
  - dontaudit block_suspend for mozilla_plugin_t
  - Allow l2tpd_t to all signal perms
  - Allow uuidgen to read /dev/random
  - Allow mozilla-plugin-config to read power_supply info
  - Implement cups_domain attribute for cups domains
  - We now need access to user terminals since we start by executing a command outside the tty
  - We now need access to user terminals since we start by executing a command outside the tty
  - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen
  - Add containment of openshift cron jobs
  - Allow system cron jobs to create tmp directories
  - Make userhelp_conf_t a config file
  - Change rpm to use rpm_script_roles
  - More fixes for rsync to make rsync <backuphost> wokring
  - Allow logwatch to domtrans to mdadm
  - Allow pacemaker to domtrans to ifconfig
  - Allow pacemaker to setattr on corosync.log
  - Add pacemaker_use_execmem for memcheck-amd64 command
  - Allow block_suspend capability
  - Allow create fifo_file in /tmp with pacemaker_tmp_t
  - Allow systat to getattr on fixed disk
  - Relabel /etc/ntp.conf to be net_conf_t
  - ntp_admin should create files in /etc with the correct label
  - Add interface to create ntp_conf_t files in /etc
  - Add additional labeling for quantum
  - Allow quantum to execute dnsmasq with transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-11
changelog:
  - Allow gpg to read fips_enabled
  - Add support for /var/cache/realmd
  - Add support for /usr/sbin/blazer_usb and systemd support for nut
  - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t
  - bitlbee wants to read own log file
  - Allow glance domain to send a signal itself
  - Allow xend_t to request that the kernel load a kernel module
  - Allow pacemaker to execute heartbeat lib files
  - cleanup new swift policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-12
changelog:
  - Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file
  - Add missing files_rw_inherited_tmp_files interface
  - Add additional interface for ecryptfs
  - ALlow nova-cert to connect to postgresql
  - Allow keystone to connect to postgresql
  - Allow all cups domains to getattr on filesystems
  - Allow pppd to send signull
  - Allow tuned to execute ldconfig
  - Allow gpg to read fips_enabled
  - Add additional fixes for ecryptfs
  - Allow httpd to work with posgresql
  - Allow keystone getsched and setsched


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-13
changelog:
  - virsh now does a setexeccon call
  - Additional rules required by openshift domains
  - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work
  - Allow spamd_update_t to search spamc_home_t
  - Avcs discovered by mounting an isci device under /mnt
  - Allow lspci running as logrotate to read pci.ids
  - Additional fix for networkmanager_read_pid_files()
  - Fix networkmanager_read_pid_files() interface
  - Allow all svirt domains to connect to svirt_socket_t
  - Allow virsh to set SELinux context for a process.
  - Allow tuned to create netlink_kobject_uevent_socket
  - Allow systemd-timestamp to set SELinux context
  - Add support for /var/lib/systemd/linger
  - Fix ssh_sysadm_login to be working on MLS as expected


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-14
changelog:
  - Allow gluster to get attrs on all fs
  - New access required for virt-sandbox
  - Allow dnsmasq to execute bin_t
  - Allow dnsmasq to create content in /var/run/NetworkManager
  - Fix openshift_initrc_signal() interface
  - Dontaudit openshift domains doing getattr on other domains
  - Allow consolehelper domain to communicate with session bus
  - Mock should not be transitioning to any other domains,  we should keep mock_t as mock_t
  - Update virt_qemu_ga_t policy
  - Allow authconfig running from realmd to restart oddjob service
  - Add systemd support for oddjob
  - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd
  - Add labeling for gnashpluginrc
  - Allow chrome_nacl to execute /dev/zero
  - Allow condor domains to read /proc
  - mozilla_plugin_t will getattr on /core if firefox crashes
  - Allow condor domains to read /etc/passwd
  - Allow dnsmasq to execute shell scripts, openstack requires this access
  - Fix glusterd labeling
  - Allow virtd_t to interact with the socket type
  - Allow nmbd_t to override dac if you turned on sharing all files
  - Allow tuned to created kobject_uevent socket
  - Allow guest user to run fusermount
  - Allow openshift to read /proc and locale
  - Allow realmd to dbus chat with rpm
  - Add new interface for virt
  - Remove depracated interfaces
  - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket
  - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t
  - Remove some more unconfined_t process transitions, that I don't believe are necessary
  - Stop transitioning uncofnined_t to checkpc
  - dmraid creates /var/lock/dmraid
  - Allow systemd_localed to creatre unix_dgram_sockets
  - Allow systemd_localed to write kernel messages.
  - Also cleanup systemd definition a little.
  - Fix userdom_restricted_xwindows_user_template() interface
  - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t
  - User accounts need to dbus chat with accountsd daemon
  - Gnome requires all users to be able to read /proc/1/


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-16
changelog:
  - Fix authconfig.py labeling
  - Make any domains that write homedir content do it correctly
  - Allow glusterd to read/write anyhwere on the file system by default
  - Be a little more liberal with the rsync log files
  - Fix iscsi_admin interface
  - Allow iscsid_t to read /dev/urand
  - Fix up iscsi domain for use with unit files
  - Add filename transition support for spamassassin policy
  - Allow web plugins to use badly formated libraries
  - Allow nmbd_t to create samba_var_t directories
  - Add filename transition support for spamassassin policy
  - Add filename transition support for tvtime
  - Fix alsa_home_filetrans_alsa_home() interface
  - Move all userdom_filetrans_home_content() calling out of booleans
  - Allow logrotote to getattr on all file sytems
  - Remove duplicate userdom_filetrans_home_content() calling
  - Allow kadmind to read /etc/passwd
  - Dontaudit append .xsession-errors file on ecryptfs for  policykit-auth
  - Allow antivirus domain to manage antivirus db links
  - Allow logrotate to read /sys
  - Allow mandb to setattr on man dirs
  - Remove mozilla_plugin_enable_homedirs boolean
  - Fix ftp_home_dir boolean
  - homedir mozilla filetrans has been moved to userdom_home_manager
  - homedir telepathy filetrans has been moved to userdom_home_manager
  - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd()
  - Might want to eventually write a daemon on fusefsd.
  - Add policy fixes for sshd [net] child from plautrba@redhat.com
  - Tor uses a new port
  - Remove bin_t for authconfig.py
  - Fix so only one call to userdom_home_file_trans
  - Allow home_manager_types to create content with the correctl label
  - Fix all domains that write data into the homedir to do it with the correct label
  - Change the postgresql to use proper boolean names, which is causing httpd_t to
  - not get access to postgresql_var_run_t
  - Hostname needs to send syslog messages
  - Localectl needs to be able to send dbus signals to users
  - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default
  - Allow user_home_manger domains to create spam* homedir content with correct labeling
  - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling
  - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working
  - Declare userdom_filetrans_type attribute
  - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute
  - fusefsd is mounding a fuse file system on /run/user/UID/gvfs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-19
changelog:
  - Allow postgresql to manage rgmanager pid files
  - Allow postgresql to read ccs data
  - Allow systemd_domain to send dbus messages to policykit
  - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them
  - All systemd domains that create content are reading the file_context file and setfscreate
  - Systemd domains need to search through init_var_run_t
  - Allow sshd to communicate with libvirt to set containers labels
  - Add interface to manage pid files
  - Allow NetworkManger_t to read /etc/hostname
  - Dontaudit leaked locked files into openshift_domains
  - Add fixes for oo-cgroup-read - it nows creates tmp files
  - Allow gluster to manage all directories as well as files
  - Dontaudit chrome_sandbox_nacl_t using user terminals
  - Allow sysstat to manage its own log files
  - Allow virtual machines to setrlimit and send itself signals.
  - Add labeling for /var/run/hplip


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-20
changelog:
  - Adopt swift changes from lhh@redhat.com
  - Add rhcs_manage_cluster_pid_files() interface
  - Allow screen domains to configure tty and setup sock_file in ~/.screen directory
  - ALlow setroubleshoot to read default_context_t, needed to backport to F18
  - Label /etc/owncloud as being an apache writable directory
  - Allow sshd to stream connect to an lxc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-21
changelog:
  - Fix log transition rule for cluster domains
  - Start to group all cluster log together
  - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update
  - cups uses usbtty_device_t devices
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Allow domains to transiton using httpd_exec_t
  - Allow svirt domains to manage kernel key rings
  - Allow setroubleshoot to execute ldconfig
  - Allow firewalld to read generate gnome data
  - Allow bluetooth to read machine-info
  - Allow boinc domain to send signal to itself
  - Fix gnome_filetrans_home_content() interface
  - Allow mozilla_plugins to list apache modules, for use with gxine
  - Fix labels for POkemon in the users homedir
  - Allow xguest to read mdstat
  - Dontaudit virt_domains getattr on /dev/*
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Need to back port this to RHEL6 for openshift
  - Add tcp/8891 as milter port
  - Allow nsswitch domains to read sssd_var_lib_t files
  - Allow ping to read network state.
  - Fix typo
  - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-22
changelog:
  - Allow nagios to manage nagios spool files
  - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6
  - Add swift_alias.* policy files which contain typealiases for swift types
  - Add support for /run/lock/opencryptoki
  - Allow pkcsslotd chown capability
  - Allow pkcsslotd to read passwd
  - Add rsync_stub() interface
  - Allow systemd_timedate also manage gnome config homedirs
  - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t
  - Fix filetrans rules for kdm creates .xsession-errors
  - Allow sytemd_tmpfiles to create wtmp file
  - Really should not label content  under /var/lock, since it could have labels on it different from var_lock_t
  - Allow systemd to list all file system directories
  - Add some basic stub interfaces which will be used in PRODUCT policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-23
changelog:
  - Allow localectl to read /etc/X11/xorg.conf.d directory
  - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors""
  - Allow mount to transition to systemd_passwd_agent
  - Make sure abrt directories are labeled correctly
  - Allow commands that are going to read mount pid files to search mount_var_run_t
  - label /usr/bin/repoquery as rpm_exec_t
  - Allow automount to block suspend
  - Add abrt_filetrans_named_content so that abrt directories get labeled correctly
  - Allow virt domains to setrlimit and read file_context


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-24
changelog:
  - Add labeling for /usr/share/pki
  - Allow programs that read var_run_t symlinks also read var_t symlinks
  - Add additional ports as mongod_port_t for  27018, 27019, 28017, 28018 and 28019 ports
  - Fix labeling for /etc/dhcp directory
  - add missing systemd_stub_unit_file() interface
  - Add files_stub_var() interface
  - Add lables for cert_t directories
  - Make localectl set-x11-keymap working at all
  - Allow abrt to manage mock build environments to catch build problems.
  - Allow virt_domains to setsched for running gdb on itself
  - Allow thumb_t to execute user home content
  - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000
  - Allow certwatch to execut /usr/bin/httpd
  - Allow cgred to send signal perms to itself, needs back port to RHEL6
  - Allow openshift_cron_t to look at quota
  - Allow cups_t to read inhered tmpfs_t from the kernel
  - Allow yppasswdd to use NIS
  - Tuned wants sys_rawio capability
  - Add ftpd_use_fusefs boolean
  - Allow dirsrvadmin_t to signal itself


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-25
changelog:
  - Allow realmd to create tmp files
  - FIx ircssi_home_t type to irssi_home_t
  - Allow adcli running as realmd_t to connect to ldap port
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Make openshift_initrc_t an lxc_domain
  - Allow gssd to manage user_tmp_t files
  - Fix handling of irclogs in users homedir
  - Fix labeling for drupal an wp-content in subdirs of /var/www/html
  - Allow abrt to read utmp_t file
  - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6
  - fix labeling for (oo|rhc)-restorer-wrapper.sh
  - firewalld needs to be able to write to network sysctls
  - Fix mozilla_plugin_dontaudit_rw_sem() interface
  - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains
  - Add mozilla_plugin_dontaudit_rw_sem() interface
  - Allow svirt_lxc_t to transition to openshift domains
  - Allow condor domains block_suspend and dac_override caps
  - Allow condor_master to read passd
  - Allow condor_master to read system state
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Lots of access required by lvm_t to created encrypted usb device
  - Allow xdm_t to dbus communicate with systemd_localed_t
  - Label strongswan content as ipsec_exec_mgmt_t for now
  - Allow users to dbus chat with systemd_localed
  - Fix handling of .xsession-errors in xserver.if, so kde will work
  - Might be a bug but we are seeing avc's about people status on init_t:service
  - Make sure we label content under /var/run/lock as <<none>>
  - Allow daemon and systemprocesses to search init_var_run_t directory
  - Add boolean to allow xdm to write xauth data to the home directory
  - Allow mount to write keys for the unconfined domain
  - Add unconfined_write_keys() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-26
changelog:
  - Try to label on controlC devices up to 30 correctly
  - Add mount_rw_pid_files() interface
  - Add additional mount/umount interfaces needed by mock
  - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk
  - Fix tabs
  - Allow initrc_domain to search rgmanager lib files
  - Add more fixes which make mock working together with confined users
    * Allow mock_t to manage rpm files
    * Allow mock_t to read rpm log files
    * Allow mock to setattr on tmpfs, devpts
    * Allow mount/umount filesystems
  - Add rpm_read_log() interface
  - yum-cron runs rpm from within it.
  - Allow tuned to transition to dmidecode
  - Allow firewalld to do net_admin
  - Allow mock to unmont tmpfs_t
  - Fix virt_sigkill() interface
  - Add additional fixes for mock. Mainly caused by mount running in mock_t
  - Allow mock to write sysfs_t and mount pid files
  - Add mailman_domain to mailman_template()
  - Allow openvswitch to execute shell
  - Allow qpidd to use kerberos
  - Allow mailman to use fusefs, needs back port to RHEL6
  - Allow apache and its scripts to use anon_inodefs
  - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7
  - Realmd needs to connect to samba ports, needs back port to F18 also
  - Allow colord to read /run/initial-setup-
  - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock
  - Add virt_kill() interface
  - Add rgmanager_search_lib() interface
  - Allow wdmd to getattr on all filesystems. Back ported from RHEL6


author: Dan Walsh <dwalsh@redhat.com> 3.12.1-28
changelog:
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Allow consolehelper more access discovered by Tom London
  - Allow fsdaemon to send signull to all domain
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-29
changelog:
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Don't audit attempts to write to stream socket of nscld by thumbnailers
  - Allow git_system_t to read network state
  - Allow pegasas to execute mount command
  - Fix desc for drdb_admin
  - Fix condor_amin()
  - Interface fixes for uptime, vdagent, vnstatd
  - Fix labeling for moodle in /var/www/moodle/data
  - Add interface fixes
  - Allow bugzilla to read certs
  - /var/www/moodle needs to be writable by apache
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Fix sys_nice for cups_domain
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Kernel_t needs mac_admin in order to support labeled NFS
  - Fix systemd_dontaudit_dbus_chat() interface
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Allow consolehelper domain to write Xauth files in /root
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-30
changelog:
  - Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms...
  - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets
  - Fix deny_ptrace boolean, certain ptrace leaked into the system
  - Allow winbind to manage kerberos_rcache_host
  - Allow spamd to create spamd_var_lib_t directories
  - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs
  - Fix vmware_role() interface
  - Fix cobbler_manage_lib_files() interface
  - Allow nagios check disk plugins to execute bin_t
  - Allow quantum to transition to openvswitch_t
  - Allow postdrop to stream connect to postfix-master
  - Allow quantum to stream connect to openvswitch
  - Add xserver_dontaudit_xdm_rw_stream_sockets() interface
  - Allow daemon to send dgrams to initrc_t
  - Allow kdm to start the power service to initiate a reboot or poweroff


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-31
changelog:
  - Fix description of deny_ptrace boolean
  - Remove allow for execmod lib_t for now
  - Allow quantum to connect to keystone port
  - Allow nova-console to talk with mysql over unix stream socket
  - Allow dirsrv to stream connect to uuidd
  - thumb_t needs to be able to create ~/.cache if it does not exist
  - virtd needs to be able to sys_ptrace when starting and stoping containers


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-32
changelog:
  - Allow realmd to run ipa, really needs to be an unconfined_domain
  - Allow sandbox domains to use inherted terminals
  - Allow pscd to use devices labeled svirt_image_t in order to use cat cards.
  - Add label for new alsa pid
  - Alsa now uses a pid file and needs to setsched 
  - Fix oracleasmfs_t definition
  - Add support for sshd_unit_file_t
  - Add oracleasmfs_t
  - Allow unlabeled_t files to be stored on unlabeled_t filesystems


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-33
changelog:
  - Fix mozilla specification of homedir content
  - Allow certmonger to read network state
  - Allow tmpwatch to read tmp in /var/spool/{cups,lpd}
  - Label all nagios plugin as unconfined by default
  - Add httpd_serve_cobbler_files()
  - Allow mdadm to read /dev/sr0 and create tmp files
  - Allow certwatch to send mails
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-35
changelog:
  - Fix lockdev_manage_files()
  - Allow setroubleshootd to read var_lib_t to make email_alert working
  - Add lockdev_manage_files()
  - Call proper interface in virt.te
  - Allow gkeyring_domain to create /var/run/UID/config/dbus file
  - system dbus seems to be blocking suspend
  - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Allow mpd getattr on file system directories
  - Make sure realmd creates content with the correct label
  - Allow systemd-tty-ask to write kmsg
  - Allow mgetty to use lockdev library for device locking
  - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Make sure init.fc files are labeled correctly at creation
  - File name trans vconsole.conf
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-37
changelog:
  - Allow lvm to create its own unit files
  - Label /var/lib/sepolgen as selinux_config_t
  - Add filetrans rules for tw devices
  - Add transition from cupsd_config_t to cupsd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-38
changelog:
  - Allow thumbnails to share memory with apps which run thumbnails
  - Allow postfix-postqueue block_suspend
  - Add lib interfaces for smsd
  - Add support for nginx
  - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t
  - Allow pki apache domain to create own tmp files and execute httpd_suexec
  - Allow procmail to manger user tmp files/dirs/lnk_files
  - Add virt_stream_connect_svirt() interface
  - Allow dovecot-auth to execute bin_t
  - Allow iscsid to request that kernel load a kernel module
  - Add labeling support for /var/lib/mod_security
  - Allow iw running as tuned_t to create netlink socket
  - Dontaudit sys_tty_config for thumb_t
  - Add labeling for nm-l2tp-service
  - Allow httpd running as certwatch_t to open tcp socket
  - Allow useradd to manager smsd lib files
  - Allow useradd_t to add homedirs in /var/lib
  - Fix typo in userdomain.te
  - Cleanup userdom_read_home_certs
  - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t
  - Allow staff to stream connect to svirt_t to make gnome-boxes working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-39
changelog:
  - Allow tcpd to execute leafnode
  - Allow samba-net to read realmd cache files
  - Dontaudit sys_tty_config for alsactl
  - Fix allow rules for postfix_var_run
  - Allow cobblerd to read /etc/passwd
  - Allow pegasus to read exports
  - Allow systemd-timedate to read xdm state
  - Allow mout to stream connect to rpcbind
  - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-41
changelog:
  - Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly
  - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t
  - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid
  - Allow virsh to read xen lock file
  - Allow qemu-ga to create files in /run with proper labeling
  - Allow glusterd to connect to own socket in /tmp
  - Allow glance-api to connect to http port to make glance image-create working
  - Allow keystonte_t to execute rpm


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-42
changelog:
  - Allow samba-net to also read realmd tmp files
  - Allow NUT to use serial ports
  - realmd can be started by systemctl now


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-43
changelog:
  - Transition directories and files when in a user_tmp_t directory
  - Change certwatch to domtrans to apache instead of just execute
  - Allow virsh_t to read xen lib files
  - update policy rules for pegasus_openlmi_account_t
  - Add support for svnserve_tmp_t
  - Activate account openlmi policy
  - pegasus_openlmi_domain_template needs also require pegasus_t
  - One more fix for policykit.te
  - Call fs_list_cgroups_dirs() in policykit.te
  - Allow nagios service plugin to read mysql config files
  - Add labeling for /var/svn
  - Fix chrome.te
  - Fix pegasus_openlmi_domain_template() interfaces
  - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks
  - Fix location of google-chrome data
  - Add support for chome_sandbox to store content in the homedir
  - Allow policykit to watch for changes in cgroups file system
  - Add boolean to allow  mozilla_plugin_t to use spice
  - Allow collectd to bind to udp port
  - Allow collected_t to read all of /proc
  - Should use netlink socket_perms
  - Should use netlink socket_perms
  - Allow glance domains to connect to apache ports
  - Allow apcupsd_t to manage its log files
  - Allow chrome objects to rw_inherited unix_stream_socket from callers
  - Allow staff_t to execute virtd_exec_t for running vms
  - nfsd_t needs to bind mountd port to make nfs-mountd.service working
  - Allow unbound net_admin capability because of setsockopt syscall
  - Fix fs_list_cgroup_dirs()
  - Label /usr/lib/nagios/plugins/utils.pm as bin_t
  - Remove uplicate definition of fs_read_cgroup_files()
  - Remove duplicate definition of fs_read_cgroup_files()
  - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd
  - Additional interfaces needed to list and read cgroups config
  - Add port definition for collectd port
  - Add labels for /dev/ptp*
  - Allow staff_t to execute virtd_exec_t for running vms


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-44
changelog:
  - Make sure users and unconfined domains create .hushlogin with the correct label
  - Allow pegaus to chat with realmd over DBus
  - Allow cobblerd to read network state
  - Allow boicn-client to stat on /dev/input/mice
  - Allow certwatch to read net_config_t when it executes apache
  - Allow readahead to create /run/systemd and then create its own directory with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-45
changelog:
  - Add additional fixes for #948073 bug
  - Allow sge_execd_t to also connect to sge ports
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files
  - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files
  - Add networkmanager_stream_connect()
  - Make gnome-abrt wokring with staff_t
  - Fix openshift_manage_lib_files() interface
  - mdadm runs ps command which seems to getattr on random log files
  - Allow mozilla_plugin_t to create pulseaudit_home_t directories
  - Allow qemu-ga to shutdown virtual hosts
  - Add labelling for cupsd-browsed
  - Add web browser plugins to connect to aol ports
  - Allow nm-dhcp-helper to stream connect to NM
  - Add port definition for sge ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-46
changelog:
  - Dontaudit to getattr on dirs for dovecot-deliver
  - Allow raiudusd server connect to postgresql socket
  - Add kerberos support for radiusd
  - Allow saslauthd to connect to ldap port
  - Allow postfix to manage postfix_private_t files
  - Add chronyd support for #965457
  - Fix labeling for HOME_DIR/\.icedtea
  - CHange squid and snmpd to be allowed also write own logs
  - Fix labeling for /usr/libexec/qemu-ga
  - Allow virtd_t to use virt_lock_t
  - Allow also sealert to read the policy from the kernel
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content
  - Dontaudit listing of users homedir by sendmail Seems like a leak
  - Allow passenger to transition to puppet master
  - Allow apache to connect to mythtv
  - Add definition for mythtv ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-47
changelog:
  - Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime
  - with the proper label.
  - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files
  - Allow systemd-timedated to create adjtime
  - Add clock_create_adjtime()
  - Additional fix ifconfing for #966106
  - Allow kernel_t to create boot.log with correct labeling
  - Remove unconfined_mplayer for which we don't have rules
  - Rename interfaces
  - Add userdom_manage_user_home_files/dirs interfaces
  - Fix files_dontaudit_read_all_non_security_files
  - Fix ipsec_manage_key_file()
  - Fix ipsec_filetrans_key_file()
  - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t
  - Fix labeling for ipse.secrets
  - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid
  - Add files_dontaudit_read_all_non_security_files() interface
  - /var/log/syslog-ng should be labeled var_log_t
  - Make ifconfig_var_run_t a mountpoint
  - Add transition from ifconfig to dnsmasq
  - Allow ifconfig to execute bin_t/shell_exec_t
  - We want to have hwdb.bin labeled as etc_t
  - update logging_filetrans_named_content() interface
  - Allow systemd_timedate_t to manage /etc/adjtime
  - Allow NM to send signals to l2tpd
  - Update antivirus_can_scan_system boolean
  - Allow devicekit_disk_t to sys_config_tty
  - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories
  - Make printing from vmware working
  - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes
  - Add virt_qemu_ga_data_t for qemu-ga
  - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both
  - Fix typo in virt.te
  - Add virt_qemu_ga_unconfined_t for hook scripts
  - Make sure NetworkManager files get created with the correct label
  - Add mozilla_plugin_use_gps boolean
  - Fix cyrus to have support for net-snmp
  - Additional fixes for dnsmasq and quantum for #966106
  - Add plymouthd_create_log()
  - remove httpd_use_oddjob for which we don't have rules
  - Add missing rules for httpd_can_network_connect_cobbler
  - Add missing cluster_use_execmem boolean
  - Call userdom_manage_all_user_home_type_files/dirs
  - Additional fix for ftp_home_dir
  - Fix ftp_home_dir boolean
  - Allow squit to recv/send client squid packet
  - Fix nut.te to have nut_domain attribute
  - Add support for ejabberd; TODO: revisit jabberd and rabbit policy
  - Fix amanda policy
  - Add more fixes for domains which use libusb
  - Make domains which use libusb working correctly
  - Allow l2tpd to create ipsec key files with correct labeling and manage them
  - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files
  - Allow rabbitmq-beam to bind generic node
  - Allow l2tpd to read ipse-mgmt pid files
  - more fixes for l2tpd, NM and pppd from #967072


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-48
changelog:
  - Fix openshift_search_lib
  - Add support for abrt-uefioops-oops
  - Allow colord to getattr any file system
  - Allow chrome processes to look at each other
  - Allow sys_ptrace for abrt_t
  - Add new policy for gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - openshift_net_type is interface not template
  - Dontaudit pppd to search gnome config
  - Update openshift_search_lib() interface
  - Add fs_list_pstorefs()
  - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18
  - Better labels for raspberry pi devices
  - Allow init to create devpts_t directory
  - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18
  - Allow sysadm_t to build kernels
  - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18
  - Allow userdomains to stream connect to gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - Allow xserver to read /dev/urandom
  - Add additional fixes for ipsec-mgmt
  - Make SSHing into an Openshift Enterprise Node working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-49
changelog:
  - Fix courier_domain_template() interface
  - Allow blueman to write ip_forward
  - Allow mongodb to connect to mongodb port
  - Allow mongodb to connect to mongodb port
  - Allow java to bind jobss_debug port
  - Fixes for *_admin interfaces
  - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality
  - Need to assign attribute for courier_domain to all courier_domains
  - Fail2ban reads /etc/passwd
  - postfix_virtual will create new files in postfix_spool_t
  - abrt triggers sys_ptrace by running pidof
  - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it
  - Add passenger fixes needed by foreman
  - Remove dup interfaces
  - Add additional interfaces for quantum
  - Add new interfaces for dnsmasq
  - Allow  passenger to read localization and send signull to itself
  - Allow dnsmasq to stream connect to quantum
  - Add quantum_stream_connect()
  - Make sure that mcollective starts the service with the correct labeling
  - Add labels for ~/.manpath
  - Dontaudit attempts by svirt_t to getpw* calls
  - sandbox domains are trying to look at parent process data
  - Allow courior auth to create its pid file in /var/spool/courier subdir
  - Add fixes for beam to have it working with couchdb
  - Add labeling for /run/nm-xl2tpd.con
  - Allow apache to stream connect to thin
  - Add systemd support for amand
  - Make public types usable for fs mount points
  - Call correct mandb interface in domain.te
  - Allow iptables to r/w quantum inherited pipes and send sigchld
  - Allow ifconfig domtrans to iptables and execute ldconfig
  - Add labels for ~/.manpath
  - Allow systemd to read iscsi lib files
  - seunshare is trying to look at parent process data


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-50
changelog:
  - Allow wine to manage wine home content
  - Make amanda working with socket actiovation
  - Add labeling for /usr/sbin/iscsiadm
  - Add support for /var/run/gssproxy.sock
  - dnsmasq_t needs to read sysctl_net_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-51
changelog:
  - accountservice watches when accounts come and go in wtmp
  - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket
  - Add httpd_use_sasl boolean
  - Allow net_admin for tuned_t
  - iscsid needs sys_module to auto-load kernel modules
  - Allow blueman to read bluetooth conf
  - Add nova_manage_lib_files() interface
  - Fix mplayer_filetrans_home_content()
  - Add mplayer_filetrans_home_content()
  - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t
  - Revert "Allow thumb_t to append inherited xdm stream socket"
  - Add iscsi_filetrans_named_content() interface
  - Allow to create .mplayer with the correct labeling for unconfined
  - Allow iscsiadmin to create lock file with the correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-52
changelog:
  - Add labeling for /dev/tgt
  - Dontaudit leak fd from firewalld for modprobe
  - Allow runuser running as rpm_script_t to create netlink_audit socket
  - Allow mdadm to read BIOS non-volatile RAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-53
changelog:
  - Make vdagent able to request loading kernel module
  - Add support for cloud-init make it as unconfined domain
  - Allow snmpd to run smartctl in fsadm_t domain
  - remove duplicate openshift_search_lib() interface
  - Allow mysqld to search openshift lib files
  - Allow openshift cgroup to interact with passedin file descriptors
  - Allow colord to list directories inthe users homedir
  - aide executes prelink to check files
  - Make sure cupsd_t creates content in /etc/cups with the correct label
  - Lest dontaudit apache read all domains, so passenger will not cause this avc
  - Allow gssd to connect to gssproxy
  - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS
  - Allow systemd-tmpfiles to relabel also lock files
  - Allow useradd to add homdir in /var/lib/openshift
  - Allow setfiles and semanage to write output to /run/files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-54
changelog:
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow ntop to read usbmon devices
  - Add labeling for new polcykit authorizor
  - Dontaudit access checks from fail2ban_client
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream
  - Fix labeling for all /usr/bim/razor-lightdm-* binaries
  - Add filename trans for /dev/md126p1


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-55
changelog:
  - condor_collector uses tcp/9000
  - Label /usr/sbin/virtlockd as virtd_exec_t for now
  - Allow cobbler to execute ldconfig
  - Allow NM to execute ssh
  - Allow mdadm to read /dev/crash
  - Allow antivirus domains to connect to snmp port
  - Make amavisd-snmp working correctly
  - Allow nfsd_t to mounton nfsd_fs_t
  - Add initial snapper policy
  - We still need to have consolekit policy
  - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow dirsrv to read network state
  - Fix pki_read_tomcat_lib_files
  - Add labeling for /usr/libexec/nm-ssh-service
  - Add label cert_t for /var/lib/ipa/pki-ca/publish
  - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant
  - Allow nfsd_t to mounton nfsd_fs_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow passwd_t to change role to system_r from unconfined_r


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-56
changelog:
  - Allow lvm_t to create default targets for filesystem handling
  - Fix labeling for razor-lightdm binaries
  - Allow insmod_t to read any file labeled var_lib_t
  - Add policy for pesign
  - Activate policy for cmpiLMI_Account-cimprovagt
  - Allow isnsd syscall=listen
  - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler
  - Allow ctdbd to use udp/4379
  - gatherd wants sys_nice and setsched
  - Add support for texlive2012
  - Allow NM to read file_t (usb stick with no labels used to transfer keys for example)
  - Allow cobbler to execute apache with domain transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-57
changelog:
  - Make DSPAM to act as a LDA working
  - Allow ntop to create netlink socket
  - Allow policykit to send a signal to policykit-auth
  - Allow stapserver to dbus chat with avahi/systemd-logind
  - Fix labeling on haproxy unit file
  - Clean up haproxy policy
  - A new policy for haproxy and placed it to rhcs.te
  - Add support for ldirectord and treat it with cluster_t
  - Make sure anaconda log dir is created with var_log_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-58
changelog:
  - Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. 
  - Allow bootloader to manage generic log files 
  - Allow ftp to bind to port 989 
  - Fix label of new gear directory 
  - Add support for new directory /var/lib/openshift/gears/ 
  - Add openshift_manage_lib_dirs() 
  - allow virtd domains to manage setrans_var_run_t 
  - Allow useradd to manage all openshift content 
  - Add support so that mozilla_plugin_t can use dri devices 
  - Allow chronyd to change the scheduler 
  - Allow apmd to shut downthe system 
  - Devicekit_disk_t needs to manage /etc/fstab


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-59
changelog:
  - Add prosody policy written by Michael Scherer
  - Allow nagios plugins to read /sys info
  - ntpd needs to manage own log files
  - Add support for HOME_DIR/.IBMERS
  - Allow iptables commands to read firewalld config
  - Allow consolekit_t to read utmp
  - Fix filename transitions on .razor directory
  - Add additional fixes to make DSPAM with LDA working
  - Allow snort to read /etc/passwd
  - Allow fail2ban to communicate with firewalld over dbus
  - Dontaudit openshift_cgreoup_file_t read/write leaked dev
  - Allow nfsd to use mountd port
  - Call th proper interface
  - Allow openvswitch to read sys and execute plymouth
  - Allow tmpwatch to read /var/spool/cups/tmp
  - Add support for /usr/libexec/telepathy-rakia
  - Add systemd support for zoneminder
  - Allow mysql to create files/directories under /var/log/mysql
  - Allow zoneminder apache scripts to rw zoneminder tmpfs
  - Allow httpd to manage zoneminder lib files
  - Add zoneminder_run_sudo boolean to allow to start zoneminder
  - Allow zoneminder to send mails
  - gssproxy_t sock_file can be under /var/lib
  - Allow web domains to connect to whois port.
  - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
  - We really need to add an interface to corenet to define what a web_client_domain is and
  - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.
  - Add labeling for cmpiLMI_LogicalFile-cimprovagt
  - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules
  - Update policy rules for pegasus_openlmi_logicalfile_t
  - Add initial types for logicalfile/unconfined OpenLMI providers
  - mailmanctl needs to read own log
  - Allow logwatch manage own lock files
  - Allow nrpe to read meminfo
  - Allow httpd to read certs located in pki-ca
  - Add pki_read_tomcat_cert() interface
  - Add support for nagios openshift plugins
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-60
changelog:
  - Allow nsd_t to read /dev/urand
  - Allow mdadm_t to read framebuffer
  - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t
  - Allow mozilla_plugin_config_t to create tmp files
  - Cleanup openvswitch policy
  - Allow mozilla plugin to getattr on all executables
  - Allow l2tpd_t to create fifo_files in /var/run
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory
  - Allow mdadm to connecto its own unix_stream_socket
  - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.
  - Allow apache to access smokeping pid files
  - Allow rabbitmq_beam_t to getattr on all filesystems
  - Add systemd support for iodined
  - Allow nup_upsdrvctl_t to execute its entrypoint
  - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch
  - add labeling for ~/.cache/libvirt-sandbox
  - Add interface to allow domains transitioned to by confined users to send sigchld to screen program
  - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab
  - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service
  - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition,  I can see no case where this is  a bad thing, and elminiates a whole class of AVCs.
  - Allow staff to getsched all domains, required to run htop
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-61
changelog:
  - Allow mdamd to execute systemctl
  - Allow mdadm to read /dev/kvm
  - Allow ipsec_mgmt_t to read l2tpd pid content


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-64
changelog:
  - Add support for gluster ports
  - Make sure that all keys located in /etc/ssh/ are labeled correctly
  - Make sure apcuspd lock files get created with the correct label
  - Use getcap in gluster.te
  - Fix gluster policy
  - add additional fixes to allow beam.smp to interact with couchdb files
  - Additional fix for #974149
  - Allow gluster to user gluster ports
  - Allow glusterd to transition to rpcd_t and add additional fixes for #980683
  - Allow tgtd working when accessing to the passthrough device
  - Fix labeling for mdadm unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-65
changelog:
  - Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t
  - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1
  - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown
  - consolekit needs to be able to shut down system
  - Move around interfaces
  - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything
  - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints
  - Allow gconf-defaults-m to read /etc/passwd
  - Fix pki_rw_tomcat_cert() interface to support lnk_files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-66
changelog:
  - Allow systemd-tmpfile to handle tmp content in print spool dir
  - Allow systemd-sysctl to send system log messages
  - Add support for RTP media ports and fmpro-internal
  - Make auditd working if audit is configured to perform SINGLE action on disk error
  - Add interfaces to handle systemd units
  - Make systemd-notify working if pcsd is used
  - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t
  - Instead of having all unconfined domains get all of the named transition rules,
  - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.
  - Add definition for the salt ports
  - Allow xdm_t to create link files in xdm_var_run_t
  - Dontaudit reads of blk files or chr files leaked into ldconfig_t
  - Allow sys_chroot for useradd_t
  - Allow net_raw cap for ipsec_t
  - Allow sysadm_t to reload services
  - Add additional fixes to make strongswan working with a simple conf
  - Allow sysadm_t to enable/disable init_t services
  - Add additional glusterd perms
  - Allow apache to read lnk files in the /mnt directory
  - Allow glusterd to ask the kernel to load a module
  - Fix description of ftpd_use_fusefs boolean
  - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t
  - Allow glusterds to request load a kernel module
  - Allow boinc to stream connect to xserver_t
  - Allow sblim domains to read /etc/passwd
  - Allow mdadm to read usb devices
  - Allow collectd to use ping plugin
  - Make foghorn working with SNMP
  - Allow sssd to read ldap certs
  - Allow haproxy to connect to RTP media ports
  - Add additional trans rules for aide_db
  - Add labeling for /usr/lib/pcsd/pcsd
  - Add labeling for /var/log/pcsd
  - Add support for pcs which is a corosync and pacemaker configuration tool


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-67
changelog:
  - Add support for cmpiLMI_Service-cimprovagt
  - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t
  - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t
  - Add support for pycmpiLMI_Storage-cimprovagt
  - Add support for cmpiLMI_Networking-cimprovagt
  - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working
  - Allow virtual machines and containers to run as user doains, needed for virt-sandbox
  - Allow buglist.cgi to read cpu info


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-68
changelog:
  - Allow xdm_t to act as a dbus client to itsel
  - Allow fetchmail to resolve host names
  - Allow gnupg apps to write to pcscd socket
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  -httpd_t does access_check on certs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-69
changelog:
  - Add more aliases in pegasus.te
  - Add more fixes for *_admin interfaces
  - Add interface fixes
  - Allow nscd to stream connect to nmbd
  - Allow gnupg apps to write to pcscd socket
  - Add more fixes for openlmi provides. Fix naming and support for additionals
  - Allow fetchmail to resolve host names
  - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  - Fix corecmd_exec_chroot()
  - Fix logging_relabel_syslog_pid_socket interface
  - Fix typo in unconfineduser.te
  - Allow system_r to access unconfined_dbusd_t to run hp_chec


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-70
changelog:
  - selinux_set_enforce_mode needs to be used with type
  - Add append to the dontaudit for unix_stream_socket of xdm_t leak
  - Allow xdm_t to create symlinks in log direcotries
  - Allow login programs to read afs config
  - Label 10933 as a pop port, for dovecot
  - New policy to allow selinux_server.py to run as semanage_t as a dbus service
  - Add fixes to make netlabelctl working on MLS
  - AVCs required for running sepolicy gui as staff_t
  - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC
  - New dbus server to be used with new gui
  - After modifying some files in /etc/mail, I saw this needed on the next boot
  - Loading a vm from /usr/tmp with virt-manager
  - Clean up oracleasm policy for Fedora
  - Add oracleasm policy written by rlopez@redhat.com
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add label for /var/crash
  - Allow fenced to domtrans to sanclok_t
  - Allow nagios to manage nagios spool files
  - Make tfptd as home_manager
  - Allow kdump to read kcore on MLS system
  - Allow mysqld-safe sys_nice/sys_resource caps
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Allow crond to transition to named_t, for use with unbound
  - Allow crond to look at named_conf_t, for unbound
  - Allow mozilla_plugin_t to transition its home content
  - Allow dovecot_domain to read all system and network state
  - Allow httpd_user_script_t to call getpw
  - Allow semanage to read pid files
  - Dontaudit leaked file descriptors from user domain into thumb
  - Make PAM authentication working if it is enabled in ejabberd
  - Add fixes for rabbit to fix ##992920,#992931
  - Allow glusterd to mount filesystems
  - Loading a vm from /usr/tmp with virt-manager
  - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device
  - Add fix for pand service
  - shorewall touches own log
  - Allow nrpe to list /var
  - Mozilla_plugin_roles can not be passed into lpd_run_lpr
  - Allow afs domains to read afs_config files
  - Allow login programs to read afs config
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow smokeping to send its process signals
  - Allow fetchmail to setuid
  - Add kdump_manage_crash() interface
  - Allow abrt domain to write abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-71
changelog:
  - Allow boinc to connect to  @/tmp/.X11-unix/X0
  - Allow beam.smp to connect to tcp/5984
  - Allow named to manage own log files
  - Add label for /usr/libexec/dcc/start-dccifd  and domtrans to dccifd_t
  - Add virt_transition_userdomain boolean decl
  - Allow httpd_t to sendto unix_dgram sockets on its children
  - Allow nova domains to execute ifconfig
  - bluetooth wants to create fifo_files in /tmp
  - exim needs to be able to manage mailman data
  - Allow sysstat to getattr on all file systems
  - Looks like bluetoothd has moved
  - Allow collectd to send ping packets
  - Allow svirt_lxc domains to getpgid
  - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff
  - Allow frpintd_t to read /dev/urandom
  - Allow asterisk_t to create sock_file in /var/run
  - Allow usbmuxd to use netlink_kobject
  - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket
  - More cleanup of svirt_lxc policy
  - virtd_lxc_t now talks to dbus
  - Dontaudit leaked ptmx_t
  - Allow processes to use inherited fifo files
  - Allow openvpn_t to connect to squid ports
  - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files
  - Allow user roles to connect to the journal socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-72
changelog:
  - Add policy for lsmd
  - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory
  - Update condor_master rules to allow read system state info and allow logging
  - Add labeling for /etc/condor and allow condor domain to write it (bug)
  - Allow condor domains to manage own logs
  - Allow glusterd to read domains state
  - Fix initial hypervkvp policy
  - Add policy for hypervkvpd
  - Fix redis.if summary


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-73
changelog:
  0 
  - Allow rhsmcertd to read init state
  - Allow fsetid for pkcsslotd
  - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service
  - Allow fetchmail to create own pid with correct labeling
  - Fix rhcs_domain_template()
  - Allow roles which can run mock to read mock lib files to view results
  - Allow rpcbind to use nsswitch
  - Fix lsm.if summary
  - Fix collectd_t can read /etc/passwd file
  - Label systemd unit files under dracut correctly
  - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh
  - Add support for .Xauthority-n
  - Label umount.crypt as lvm_exec_t
  - Allow syslogd to search psad lib files
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-75
changelog:
  - Also sock_file trans rule is needed in lsm
  - Fix labeling for fetchmail pid files/dirs
  - Add additional fixes for abrt-upload-watch
  - Fix polipo.te
  - Fix transition rules in asterisk policy
  - Add fowner capability to networkmanager policy
  - Allow polipo to connect to tor ports
  - Cleanup lsmd.if
  - Cleanup openhpid policy
  - Fix kdump_read_crash() interface
  - Make more domains as init domain
  - Fix cupsd.te
  - Fix requires in rpm_rw_script_inherited_pipes
  - Fix interfaces in lsm.if
  - Allow munin service plugins to manage own tmpfs files/dirs
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Make ktalk as init domain
  - Fix to define ktalkd_unit_file_t correctly
  - Fix ktalk.fc
  - Add systemd support for talk-server
  - Allow glusterd to create sock_file in /run
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout
  - Add fixes for hypervkvp policy
  - Add logwatch_can_sendmail boolean
  - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-76
changelog:
  - Cleanup related to init_domain()+inetd_domain fixes
  - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
  - svirt domains neeed to create kobject_uevint_sockets
  - Lots of new access required for sosreport
  - Allow tgtd_t to connect to isns ports
  - Allow init_t to transition to all inetd domains:
  - openct needs to be able to create netlink_object_uevent_sockets
  - Dontaudit leaks into ldconfig_t
  - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
  - Move kernel_stream_connect into all Xwindow using users
  - Dontaudit inherited lock files in ifconfig o dhcpc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-77
changelog:
  - Split out rlogin ports from inetd
  - Treat files labeld as usr_t like bin_t when it comes to transitions
  - Allow staff_t to read login config
  - Allow ipsec_t to read .google authenticator data
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()
  - Call the correct interface - corenet_udp_bind_ktalkd_port()
  - Allow all domains that can read gnome_config to read kde config
  - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work
  - Allow mdadm to getattr any file system
  - Allow a confined domain to executes mozilla_exec_t via dbus
  - Allow cupsd_lpd_t to bind to the printer port
  - Dontaudit attempts to bind to ports < 1024 when nis is turned on
  - Allow apache domain to connect to gssproxy socket
  - Allow rlogind to bind to the rlogin_port
  - Allow telnetd to bind to the telnetd_port
  - Allow ktalkd to bind to the ktalkd_port
  - Allow cvs to bind to the cvs_port


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-78
changelog:
  - Allow xdm_t to transition to itself
  - Call neutron interfaces instead of quantum
  - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t
  - Make sure directories in /run get created with the correct label
  - Make sure /root/.pki gets created with the right label
  - try to remove labeling for motion from zoneminder_exec_t to bin_t
  - Allow inetd_t to execute shell scripts
  - Allow cloud-init to read all domainstate
  - Fix to use quantum port
  - Add interface netowrkmanager_initrc_domtrans
  - Fix boinc_execmem
  - Allow t-mission-control to read gabble cache home
  - Add labeling for ~/.cache/telepathy/avatars/gabble
  - Allow memcache to read sysfs data
  - Cleanup antivirus policy and add additional fixes
  - Add boolean boinc_enable_execstack
  - Add support for couchdb in rabbitmq policy
  - Add interface couchdb_search_pid_dirs
  - Allow firewalld to read NM state
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-79
changelog:
  - Allow block_suspend cap for samba-net
  - Allow t-mission-control to manage gabble cache files
  - Allow nslcd to read /sys/devices/system/cpu
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-80
changelog:
  - Allow ldconfig to write to kdumpctl fifo files
  - allow neutron to connect to amqp ports
  - Allow kdump_manage_crash to list the kdump_crash_t directory
  - Allow glance-api to connect to amqp port
  - Allow virt_qemu_ga_t to read meminfo
  - Add antivirus_home_t type for antivirus date in HOMEDIRS
  - Allow mpd setcap which is needed by pulseaudio
  - Allow smbcontrol to create content in /var/lib/samba
  - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec
  - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts
  - amanda_exec_t needs to be executable file
  - Allow block_suspend cap for samba-net
  - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t
  - Allow init_t to run crash utility
  - Treat usr_t just like bin_t for transitions and executions
  - Add port definition of pka_ca to port 829 for openshift
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-81
changelog:
  - Dontaudit attempts by sosreport to read shadow_t
  - Allow browser sandbox plugins to connect to cups to print
  - Add new label mpd_home_t
  - Label /srv/www/logs as httpd_log_t
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add labels for apache logs under miq package
  - Allow irc_t to use tcp sockets
  - fix labels in puppet.if
  - Allow tcsd to read utmp file
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys
  - Define svirt_socket_t as a domain_type
  - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t
  - Fix label on pam_krb5 helper apps


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-82
changelog:
  - wine_tmp is no longer needed
  - Allow setroubleshoot to look at /proc
  - Allow telepathy domains to dbus with systemd logind
  - Fix handling of fifo files of rpm
  - Allow mozilla_plugin to transition to itself
  - Allow certwatch to write to cert_t directories
  - New abrt application
  - Allow NetworkManager to set the kernel scheduler
  - Make wine_domain shared by all wine domains
  - Allow mdadm_t to read images labeled svirt_image_t
  - Allow amanda to read /dev/urand
  - ALlow my_print_default to read /dev/urand
  - Allow mdadm to write to kdumpctl fifo files
  - Allow nslcd to send signull to itself
  - Allow yppasswd to read /dev/urandom
  - Fix zarafa_setrlimit
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add additional alias for user_tmp_t because wine_tmp_t is no longer used
  - More handling of ther kernel keyring required by kerberos
  - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-84
changelog:
  - Fix labeling for /usr/libexec/kde4/kcmdatetimehelper
  - Allow tuned to search all file system directories
  - Allow alsa_t to sys_nice, to get top performance for sound management
  - Add support for MySQL/PostgreSQL for amavis
  - Allow openvpn_t to manage openvpn_var_log_t files.
  - Allow dirsrv_t to create tmpfs_t directories
  - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label
  - Dontaudit leaked unix_stream_sockets into gnome keyring
  - Allow telepathy domains to inhibit pipes on telepathy domains
  - Allow cloud-init to domtrans to rpm
  - Allow abrt daemon to manage abrt-watch tmp files
  - Allow abrt-upload-watcher to search /var/spool directory
  - Allow nsswitch domains to manage own process key
  - Fix labeling for mgetty.* logs
  - Allow systemd to dbus chat with upower
  - Allow ipsec to send signull to itself
  - Allow setgid cap for ipsec_t
  - Match upstream labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-86
changelog:
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Add additional fixes forpegasus_openlmi_account_t
  - Allow mdadm to read /dev/urand
  - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it
  - Add label/rules for /etc/mdadm.conf
  - Allow pegasus_openlmi_storage_t to transition to fsadm_t
  - Fixes for interface definition problems
  - Dontaudit dovecot-deliver to gettatr on all fs dirs
  - Allow domains to search data_home_t directories
  - Allow cobblerd to connect to mysql
  - Allow mdadm to r/w kdump lock files
  - Add support for kdump lock files
  - Label zarafa-search as zarafa-indexer
  - Openshift cgroup wants to read /etc/passwd
  - Add new sandbox domains for kvm
  - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on
  - Fix labeling for /usr/lib/systemd/system/lvm2.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*
  - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules
  - Add sshd_keygen_t policy for sshd-keygen
  - Fix alsa_home_filetrans interface name and definition
  - Allow chown for ssh_keygen_t
  - Add fs_dontaudit_getattr_all_dirs()
  - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys
  - Fix up patch to allow systemd to manage home content
  - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled
  - Allow getty to exec hostname to get info
  - Add systemd_home_t for ~/.local/share/systemd directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-87
changelog:
  - init reload  from systemd_localed_t
  - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd
  - Allow systemd_localed_t to ask systemd to reload the locale.
  - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory
  - Allow readahead to read /dev/urand
  - Fix lots of avcs about tuned
  - Any file names xenstored in /var/log should be treated as xenstored_var_log_t
  - Allow tuned to inderact with hugepages
  - Allow condor domains to list etc rw dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-88
changelog:
  - Add auth_exec_chkpwd interface
  - Fix port definition for ctdb ports
  - Allow systemd domains to read /dev/urand
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Add label for /var/run/charon.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service
  - Fix for nagios_services plugins
  - Fix some bugs in zoneminder policy
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - glusterd binds to random unreserved ports
  - Additional allow rules found by testing glusterfs
  - apcupsd needs to send a message to all users on the system so needs to look them up
  - Fix the label on ~/.juniper_networks
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Allow polipo_daemon to connect to flash ports
  - Allow gssproxy_t to create replay caches
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-89
changelog:
  - Fix gnome_read_generic_data_home_files()
  - allow openshift_cgroup_t to read/write inherited openshift file types
  - Remove httpd_cobbler_content * from cobbler_admin interface
  - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container
  - Allow httpd_t to read also git sys content symlinks
  - Allow init_t to read gnome home data
  - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.
  - Allow virsh to execute systemctl
  - Fix for nagios_services plugins
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - Fix hypervkvp.te
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Fix logging policy
  - Allow syslog to bind to tls ports
  - Update labeling for /dev/cdc-wdm
  - Allow to su_domain to read init states
  - Allow init_t to read gnome home data
  - Make sure if systemd_logind creates nologin file with the correct label
  - Clean up ipsec.te


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-91
changelog:
  - Allow mailserver_domains to manage and transition to mailman data
  - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands
  - Allow mailserver_domains to manage and transition to mailman data
  - Allow svirt_domains to read sysctl_net_t
  - Allow thumb_t to use tmpfs inherited from the user
  - Allow mozilla_plugin to bind to the vnc port if running with spice
  - Add new attribute to discover confined_admins and assign confined admin to it
  - Fix zabbix to handle attributes in interfaces
  - Fix zabbix to read system states for all zabbix domains
  - Fix piranha_domain_template()
  - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.
  - Allow lldpad sys_rouserce cap due to #986870
  - Allow dovecot-auth to read nologin
  - Allow openlmi-networking to read /proc/net/dev
  - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t
  - Add zabbix_domain attribute for zabbix domains to treat them together
  - Add labels for zabbix-poxy-* (#1018221)
  - Update openlmi-storage policy to reflect #1015067
  - Back port piranha tmpfs fixes from RHEL6
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Add postfix_rw_spool_maildrop_files interface
  - Call new userdom_admin_user_templat() also for sysadm_secadm.pp
  - Fix typo in userdom_admin_user_template()
  - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey
  - Add new attribute to discover confined_admins
  - Fix labeling for /etc/strongswan/ipsec.d
  - systemd_logind seems to pass fd to anyone who dbus communicates with it
  - Dontaudit leaked write descriptor to dmesg


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-93
changelog:
  - Allow sshd_t to read openshift content, needs backport to RHEL6.5
  - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t
  - Make sur kdump lock is created with correct label if kdumpctl is executed
  - gnome interface calls should always be made within an optional_block
  - Allow syslogd_t to connect to the syslog_tls port
  - Add labeling for /var/run/charon.ctl socket
  - Add kdump_filetrans_named_content()
  - Allo setpgid for fenced_t
  - Allow setpgid and r/w cluster tmpfs for fenced_t
  - gnome calls should always be within optional blocks
  - wicd.pid should be labeled as networkmanager_var_run_t
  - Allow sys_resource for lldpad


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-94
changelog:
  - Allow sysadm_t to read login information
  - Allow systemd_tmpfiles to setattr on var_log_t directories
  - Udpdate Makefile to include systemd_contexts
  - Add systemd_contexts
  - Add fs_exec_hugetlbfs_files() interface
  - Add daemons_enable_cluster_mode boolean
  - Fix rsync_filetrans_named_content()
  - Add rhcs_read_cluster_pid_files() interface
  - Update rhcs.if with additional interfaces from RHEL6
  - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t
  - Allow glusterd_t to mounton glusterd_tmp_t
  - Allow glusterd to unmout al filesystems
  - Allow xenstored to read virt config
  - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label
  - Allow mozilla_plugin_t to mmap hugepages as an executable


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-95
changelog:
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Add file transition rules for content created by f5link
  - Rename quantum_port information to neutron
  - Allow all antivirus domains to manage also own log dirs
  - Rename quantum_port information to neutron
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-97
changelog:
  - Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.
  - Label /etc/yum.repos.d as system_conf_t
  - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t
  - Allow dac_override for sysadm_screen_t
  - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.
  - Allow netlabel-config to read meminfo
  - Add interface to allow docker to mounton file_t
  - Add new interface to exec unlabeled files
  - Allow lvm to use docker semaphores
  - Setup transitons for .xsessions-errors.old
  - Change labels of files in /var/lib/*/.ssh to transition properly
  - Allow staff_t and user_t to look at logs using journalctl
  - pluto wants to manage own log file
  - Allow pluto running as ipsec_t to create pluto.log
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd
  - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.
  - Additional access for docker
  - Added more rules to sblim policy
  - Fix kdumpgui_run_bootloader boolean
  - Allow dspam to connect to lmtp port
  - Included sfcbd service into sblim policy
  - rhsmcertd wants to manaage /etc/pki/consumer dir
  - Add kdumpgui_run_bootloader boolean
  - Add support for /var/cache/watchdog
  - Remove virt_domain attribute for virt_qemu_ga_unconfined_t
  - Fixes for handling libvirt containes
  - Dontaudit attempts by mysql_safe to write content into /
  - Dontaudit attempts by system_mail to modify network config
  - Allow dspam to bind to lmtp ports
  - Add new policy to allow staff_t and user_t to look at logs using journalctl
  - Allow apache cgi scripts to list sysfs
  - Dontaudit attempts to write/delete user_tmp_t files
  - Allow all antivirus domains to manage also own log dirs
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-98
changelog:
  - Add files_relabel_base_file_types() interface
  - Allow netlabel-config to read passwd
  - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling
  - Allow pegasus to domtrans to mount_t
  - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts
  - Add support for unconfined watchdog scripts
  - Allow watchdog to manage own log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-99
changelog:
  - Add support for yubikey in homedir
  - Add support for upd/3052 port
  - Allow apcupsd to use PowerChute Network Shutdown
  - Allow lsmd to execute various lsmplugins
  - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too
  - Update gluster_export_all_rw boolean to allow relabel all base file types
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-100
changelog:
  - Fix passenger_stream_connect interface
  - setroubleshoot_fixit wants to read network state
  - Allow procmail_t to connect to dovecot stream sockets
  - Allow cimprovagt service providers to read network states
  - Add labeling for /var/run/mariadb
  - pwauth uses lastlog() to update system's lastlog
  - Allow account provider to read login records
  - Add support for texlive2013
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - Allow passwd_t to connect to gnome keyring to change password
  - Update mls config files to have cronjobs in the user domains
  - Remove access checks that systemd does not actually do


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-102
changelog:
  - Fix files_dontaudit_unmount_all_mountpoints()
  - Add support for 2608-2609 tcp/udp ports
  - Should allow domains to lock the terminal device
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - We need to require passwd rootok
  - Fix zebra.fc
  - Fix dnsmasq_filetrans_named_content() interface
  - Allow all sandbox domains create content in svirt_home_t
  - Allow zebra domains also create zebra_tmp_t files in /tmp
  - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.
  - Fix labeling on neutron and remove transition to iconfig_t
  - abrt needs to read mcelog log file
  - Fix labeling on dnsmasq content
  - Fix labeling on /etc/dnsmasq.d
  - Allow glusterd to relabel own lib files
  - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd
  - Allow ipc_lock for abrt to run journalctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-104
changelog:
  - Allow watchdog to read /etc/passwd
  - Allow browser plugins to connect to bumblebee
  - New policy for bumblebee and freqset
  - Add new policy for mip6d daemon
  - Add new policy for opensm daemon
  - Allow condor domains to read/write condor_master udp_socket
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift
  - Add back file_pid_filetrans for /var/run/dlm_controld
  - Allow smbd_t to use inherited tmpfs content
  - Allow mcelog to use the /dev/cpu device
  - sosreport runs rpcinfo
  - sosreport runs subscription-manager
  - Allow staff_t to run frequency command
  - Allow systemd_tmpfiles to relabel log directories
  - Allow staff_t to read xserver_log file
  - Label hsperfdata_root as tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-105
changelog:
  - Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.
  - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on
  - Add lsmd_plugin_t for lsm plugins
  - Allow dovecot-deliver to search mountpoints
  - Add labeling for /etc/mdadm.conf
  - Allow opelmi admin providers to dbus chat with init_t
  - Allow sblim domain to read /dev/urandom and /dev/random
  - Allow apmd to request the kernel load modules
  - Add glusterd_brick_t type
  - label mate-keyring-daemon with gkeyringd_exec_t
  - Add plymouthd_create_log()
  - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
  - Allow sssd to request the kernel loads modules
  - Allow gpg_agent to use ssh-add
  - Allow gpg_agent to use ssh-add
  - Dontaudit access check on /root for myslqd_safe_t
  - Allow ctdb to getattr on al filesystems
  - Allow abrt to stream connect to syslog
  - Allow dnsmasq to list dnsmasq.d directory
  - Watchdog opens the raw socket
  - Allow watchdog to read network state info
  - Dontaudit access check on lvm lock dir
  - Allow sosreport to send signull to setroubleshootd
  - Add setroubleshoot_signull() interface
  - Fix ldap_read_certs() interface
  - Allow sosreport all signal perms
  - Allow sosreport to run systemctl
  - Allow sosreport to dbus chat with rpm
  - Add glusterd_brick_t files type
  - Allow zabbix_agentd to read all domain state
  - Clean up rtas.if
  - Allow smoltclient to execute ldconfig
  - Allow sosreport to request the kernel to load a module
  - Fix userdom_confined_admin_template()
  - Add back exec_content boolean for secadm, logadm, auditadm
  - Fix files_filetrans_system_db_named_files() interface
  - Allow sulogin to getattr on /proc/kcore
  - Add filename transition also for servicelog.db-journal
  - Add files_dontaudit_access_check_root()
  - Add lvm_dontaudit_access_check_lock() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-108
changelog:
  - Allow sosreport to send a signal to ABRT
  - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t
  - Label /usr/sbin/htcacheclean as httpd_exec_t
  Resolves:#1037529
  - Added support for rdisc unit file
  - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
  - Allow runuser running as logrotate connections to system DBUS
  - Label bcache devices as fixed_disk_device_t
  - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
  - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-109
changelog:
  - Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t
  Resolves:#1039879
  - Add labeling for /usr/lib/systemd/system/mariadb.service
  - Allow hyperv_domain to read sysfs
  - Fix ldap_read_certs() interface to allow acess also link files
  - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
  - Allow tuned to run modprobe
  - Allow portreserve to search /var/lib/sss dir
  - Add SELinux support for the teamd package contains team network device control daemon.
  - Dontaudit access check on /proc for bumblebee
  - Bumblebee wants to load nvidia modules
  - Fix rpm_named_filetrans_log_files and wine.te
  - Add conman policy for rawhide
  - DRM master and input event devices are used by  the TakeDevice API
  - Clean up bumblebee policy
  - Update pegasus_openlmi_storage_t policy
  - Add freeipmi_stream_connect() interface
  - Allow logwatch read madm.conf to support RAID setup
  - Add raid_read_conf_files() interface
  - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
  - add rpm_named_filetrans_log_files() interface
  - Allow dkim-milter to create files/dirs in /tmp
  - update freeipmi policy
  - Add policy for freeipmi services
  - Added rdisc_admin and rdisc_systemctl interfaces
  - opensm policy clean up
  - openwsman policy clean up
  - ninfod policy clean up
  - Added new policy for ninfod
  - Added new policy for openwsman
  - Added rdisc_admin and rdisc_systemctl interfaces
  - Fix kernel_dontaudit_access_check_proc()
  - Add support for /dev/uhid
  - Allow sulogin to get the attributes of initctl and sys_admin cap
  - Add kernel_dontaudit_access_check_proc()
  - Fix dev_rw_ipmi_dev()
  - Fix new interface in devices.if
  - DRM master and input event devices are used by  the TakeDevice API
  - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
  - Added support for default conman port
  - Add interfaces for ipmi devices


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-110
changelog:
  - Allow freeipmi_ipmidetectd_t to use freeipmi port
  - Update freeipmi_domain_template()
  - Allow journalctl running as ABRT to read /run/log/journal
  - Allow NM to read dispatcher.d directory
  - Update freeipmi policy
  - Type transitions with a filename not allowed inside conditionals
  - Allow tor to bind to hplip port
  - Make new type to texlive files in homedir
  - Allow zabbix_agent to transition to dmidecode
  - Add rules for docker
  - Allow sosreport to send signull to unconfined_t
  - Add virt_noatsecure and virt_rlimitinh interfaces
  - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port
  - Add sysadm_u_default_contexts
  - Add logging_read_syslog_pid()
  - Fix userdom_manage_home_texlive() interface
  - Make new type to texlive files in homedir
  - Add filename transitions for /run and /lock links
  - Allow virtd to inherit rlimit information
  Resolves:#975358


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-111
changelog:
  - Add labeling for /var/lib/servicelog/servicelog.db-journal
  - Add support for freeipmi port
  - Add sysadm_u_default_contexts
  - Make new type to texlive files in homedir
  - Allow subscription-manager running as sosreport_t to manage rhsmcertd
  - Additional fixes for docker.te
  - Remove ability to do mount/sys_admin by default in virt_sandbox domains
  - New rules required to run docker images within libivrt
  - Add label for ~/.cvsignore
  - Change mirrormanager to be run by cron
  - Add mirrormanager policy
  - Fixed bumblebee_admin() and mip6d_admin()
  - Add log support for sensord
  - Fix typo in docker.te
  - Allow amanda to do backups over UDP
  - Allow bumblebee to read /etc/group and clean up bumblebee.te
  - type transitions with a filename not allowed inside conditionals
  - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7
  - Make new type to texlive files in homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-112
changelog:
  - Allow sshd to write to all process levels in order to change passwd when running at a level
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
  - Allow apcuspd_t to status and start the power unit file
  - Allow udev to manage kdump unit file
  - Added new interface modutils_dontaudit_exec_insmod
  - Allow cobbler to search dhcp_etc_t directory
  - systemd_systemctl needs sys_admin capability
  - Allow sytemd_tmpfiles_t to delete all directories
  - passwd to create gnome-keyring passwd socket
  - Add missing zabbix_var_lib_t type
  - Fix filename trans for zabbixsrv in zabbix.te
  - Allow fprintd_t to send syslog messages
  - Add  zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
  - Allow mozilla plugin to chat with policykit, needed for spice
  - Allow gssprozy to change user and gid, as well as read user keyrings
  - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
  - Allow polipo to connect to http_cache_ports
  - Allow cron jobs to manage apache var lib content
  - Allow yppassword to manage the passwd_file_t
  - Allow showall_t to send itself signals
  - Allow cobbler to restart dhcpc, dnsmasq and bind services
  - Allow certmonger to manage home cert files
  - Add userdom filename trans for user mail domains
  - Allow apcuspd_t to status and start the power unit file
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Allow smbd_t to signull cluster
  - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
  - Add label for /var/spool/cron.aquota.user
  - Allow sandbox_x domains to use work with the mozilla plugin semaphore
  - Added new policy for speech-dispatcher
  - Added dontaudit rule for insmod_exec_t  in rasdaemon policy
  - Updated rasdaemon policy
  - Allow system_mail_t to transition to postfix_postdrop_t
  - Clean up mirrormanager policy
  - Allow virt_domains to read cert files, needs backport to RHEL7
  - Allow sssd to read systemd_login_var_run_t
  - Allow irc_t to execute shell and bin-t files:
  - Add new access for mythtv
  - Allow rsync_t to manage all non auth files
  - allow modemmanger to read /dev/urand
  - Allow sandbox apps to attempt to set and get capabilties


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-114
changelog:
  - Add default lvm_var_run_t label for /var/run/multipathd
  Resolves:#1051430
  - Fix log labeling to have correct default label for them after logrotate
  - Add files_write_root_dirs
  - Add new openflow port label for 6653/tcp and 6633/tcp
  - Add xserver_manage_xkb_libs()
  - Label tcp/8891 as milter por
  - Allow gnome_manage_generic_cache_files also create cache_home_t files
  - Fix aide.log labeling
  - Fix log labeling to have correct default label for them after logrotate
  - Allow mysqld-safe write access on /root to make mysqld working
  - Allow sosreport domtrans to prelikn
  - Allow OpenvSwitch to connec to openflow ports
  - Allow NM send dgram to lldpad
  - Allow hyperv domains to execute shell
  - Allow lsmd plugins stream connect to lsmd/init
  - Allow sblim domains to create /run/gather with correct labeling
  - Allow httpd to read ldap certs
  - Allow cupsd to send dbus msgs to process with different MLS level
  - Allow bumblebee to stream connect to apmd
  - Allow bumblebee to run xkbcomp
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Allow docker to getattr on itself
  - Additional rules needed for sandbox apps
  - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
  - httpd should be able to send signal/signull to httpd_suexec_t
  - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-116
changelog:
  - Add missing files_create_var_lib_dirs()
  - Fix typo in ipsec.te
  - Allow passwd to create directory in /var/lib
  - Add filename trans also for event21
  - Allow iptables command to read /dev/rand
  - Add sigkill capabilityfor ipsec_t
  - Add filename transitions for bcache devices
  - Add additional rules to create /var/log/cron by syslogd_t with correct labeling
  - Add give everyone full access to all key rings
  - Add default lvm_var_run_t label for /var/run/multipathd
  - Fix log labeling to have correct default label for them after logrotate
  - Labeled ~/.nv/GLCache as being gstreamer output
  - Allow nagios_system_plugin to read mrtg lib files
  - Add mrtg_read_lib_files()
  - Call rhcs_rw_cluster_tmpfs for dlm_controld
  - Make authconfing as named_filetrans domain
  - Allow virsh to connect to user process using stream socket
  - Allow rtas_errd to read rand/urand devices and add chown capability
  - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
  Resolves:#1051497
  - Add also chown cap for abrt_upload_watch_t. It already has dac_override
  - Allow sosreport to manage rhsmcertd pid files
  - Add rhsmcertd_manage_pid_files()
  - Allow also setgid cap for rpc.gssd
  - Dontaudit access check for abrt on cert_t
  - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-118
changelog:
  - Allow init_t to work on transitient and snapshot unit files
  - Add logging_manage_syslog_config()
  - Update sysnet_dns_name_resolve() to allow connect to dnssec por
  - Allow pegasus_openlmi_storage_t to read hwdata
  Resolves:#1031721
  - Fix rhcs_rw_cluster_tmpfs()
  - Allow fenced_t to bind on zented udp port
  - Added policy for vmtools
  - Fix mirrormanager_read_lib_files()
  - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
  - Allow ctdb to create sock files in /var/run/ctdb
  - Add sblim_filetrans_named_content() interface
  - Allow rpm scritplets to create /run/gather with correct labeling
  - Allow gnome keyring domains to create gnome config dirs
  - Dontaudit read/write to init stream socket for lsmd_plugin_t
  - Allow automount to read nfs link files
  - Allow lsm plugins to read/write lsmd stream socket
  - Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
  - Add also labeling for /var/run/ctdb
  - Add missing labeling for /var/lib/ctdb
  - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
  - Dontaudit hypervkvp to search homedirs
  - Dontaudit hypervkvp to search admin homedirs
  - Allow hypervkvp to execute bin_t and ifconfig in the caller domain
  - Dontaudit xguest_t to read ABRT conf files
  - Add abrt_dontaudit_read_config()
  - Allow namespace-init to getattr on fs
  - Add thumb_role() also for xguest
  - Add filename transitions to create .spamassassin with correct labeling
  - Allow apache domain to read mirrormanager pid files
  - Allow domains to read/write shm and sem owned by mozilla_plugin_t
  - Allow alsactl to send a generic signal to kernel_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-119
changelog:
  - Add cron unconfined role support for uncofined SELinux user
  - Call corenet_udp_bind_all_ports() in milter.te
  - Allow fence_virtd to connect to zented port
  - Fix header for mirrormanager_admin()
  - Allow dkim-milter to bind udp ports
  - Allow milter domains to send signull itself
  - Allow block_suspend for yum running as mock_t
  - Allow beam.smp to manage couchdb files
  - Add couchdb_manage_files()
  - Add labeling for /var/log/php_errors.log
  - Allow bumblebee to stream connect to xserver
  - Allow bumblebee to send a signal to xserver
  - gnome-thumbnail to stream connect to bumblebee
  - Allow xkbcomp running as bumblebee_t to execute  bin_t
  - Allow logrotate to read squid.conf
  - Additional rules to get docker and lxc to play well with SELinux
  - Allow bumbleed to connect to xserver port
  - Allow pegasus_openlmi_storage_t to read hwdata


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-120
changelog:
  - Allow apache to write to the owncloud data directory in /var/www/html...
  - Allow consolekit to create log dir
  - Add support for icinga CGI scripts
  - Add support for icinga
  - Allow kdumpctl_t to create kdump lock file
  Resolves:#1055634
  - Allow kdump to create lnk lock file
  - Allow nscd_t block_suspen capability
  - Allow unconfined domain types to manage own transient unit file
  - Allow systemd domains to handle transient init unit files
  - Add interfaces to handle transient


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-121
changelog:
  - Allow gdm to create /var/gdm with correct labeling
  - Allow domains to append rkhunterl lib files. #1057982
  - Allow systemd_tmpfiles_t net_admin to communicate with journald
  - Add interface to getattr on an isid_type for any type of file
  - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
  - Allow initrc_t domtrans to authconfig if unconfined is enabled
  - Allow docker and mount on devpts chr_file
  - Allow docker to transition to unconfined_t if boolean set
  - init calling needs to be optional in domain.te
  - Allow uncofined domain types to handle transient unit files
  - Fix labeling for vfio devices
  - Allow net_admin capability and send system log msgs
  - Allow lldpad send dgram to NM
  - Add networkmanager_dgram_send()
  - rkhunter_var_lib_t is correct type
  - Back port pcp policy from rawhide
  - Allow openlmi-storage to read removable devices
  - Allow system cron jobs to manage rkhunter lib files
  - Add rkhunter_manage_lib_files()
  - Fix ftpd_use_fusefs boolean to allow manage also symlinks
  - Allow smbcontrob block_suspend cap2
  - Allow slpd to read network and system state info
  - Allow NM domtrans to iscsid_t if iscsiadm is executed
  - Allow slapd to send a signal itself
  - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
  - Fix plymouthd_create_log() interface
  - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
  - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
  - Allow postfix and cyrus-imapd to work out of box
  - Allow fcoemon to talk with unpriv user domain using unix_stream_socket
  - Dontaudit domains that are calling into journald to net_admin
  - Add rules to allow vmtools to do what it does
  - snapperd is D-Bus service
  - Allow OpenLMI PowerManagement to call 'systemctl --force reboot'
  - Add haproxy_connect_any boolean
  - Allow haproxy also to use http cache port by default
  Resolves:#1058248


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-122
changelog:
  - Update snapper policy
  - Allow domains to append rkhunter lib files
  - Allow snapperd to getattr on all fs
  - Allow xdm to create /var/gdm with correct labeling
  - Add label for snapper.log
  - Allow fail2ban-client to read apache log files
  - Allow thumb_t to execute dbus-daemon in thumb_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-123
changelog:
  - Turn on bacula, rhnsd policy
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl
  - Fixes for *_admin interfaces
  - Add pegasus_openlmi_storage_var_run_t type def
  - Add support for /var/run/openlmi-storage
  - Allow tuned to create syslog.conf with correct labeling
  - Add httpd_dontaudit_search_dirs boolean
  - Add support for winbind.service
  - ALlow also fail2ban-client to read apache logs
  - Allow vmtools to getattr on all fs
  - Add support for dey_sapi port
  - Add logging_filetrans_named_conf()
  - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-124
changelog:
  - Added osad policy
  - Allow postfix to deliver to procmail
  - Allow bumblebee to seng kill signal to xserver
  - Allow vmtools to execute /usr/bin/lsb_release
  - Allow docker to write system net ctrls
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix pcp.te
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-125
changelog:
  - Addopt corenet rules for unbound-anchor to rpm_script_t
  - Allow runuser to send send audit messages.
  - Allow postfix-local to search .forward in munin lib dirs
  - Allow udisks to connect to D-Bus
  - Allow spamd to connect to spamd port
  - Fix syntax error in snapper.te
  - Dontaudit osad to search gconf home files
  - Allow rhsmcertd to manage /etc/sysconf/rhn director
  - Fix pcp labeling to accept /usr/bin for all daemon binaries
  - Fix mcelog_read_log() interface
  - Allow iscsid to manage iscsi lib files
  - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
  - Make tuned_t as unconfined domain for RHEL7.0
  - Allow ABRT to read puppet certs
  - Add sys_time capability for virt-ga
  - Allow gemu-ga to domtrans to hwclock_t
  - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
  - Fix some AVCs in pcp policy
  - Add to bacula capability setgid and setuid and allow to bind to bacula ports
  - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
  - Add access rhnsd and osad to /etc/sysconfig/rhn
  - drbdadm executes drbdmeta
  - Fixes needed for docker
  - Allow epmd to manage /var/log/rabbitmq/startup_err file
  - Allow beam.smp connect to amqp port
  - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
  - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
  - Allow systemd_tmpfiles_t to manage all non security files on the system
  - Added labels for bacula ports
  - Fix label on /dev/vfio/vfio
  - Add kernel_mounton_messages() interface
  - init wants to manage lock files for iscsi


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-126
changelog:
  - Add lvm_read_metadata()
  - Allow auditadm to search /var/log/audit dir
  - Add lvm_read_metadata() interface
  - Allow confined users to run vmtools helpers
  - Fix userdom_common_user_template()
  - Generic systemd unit scripts do write check on /
  - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
  - Add additional fixes needed for init_t and setup script running in generic unit files
  - Allow general users to create packet_sockets
  - added connlcli port
  - Add init_manage_transient_unit() interface
  - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
  - Fix userdomain.te to require passwd class
  - devicekit_power sends out a signal to all processes on the message bus when power is going down
  - Dontaudit rendom domains listing /proc and hittping system_map_t
  - Dontauit leaks of var_t into ifconfig_t
  - Allow domains that transition to ssh_t to manipulate its keyring
  - Define oracleasm_t as a device node
  - Change to handle /root as a symbolic link for os-tree
  - Allow sysadm_t to create packet_socket, also move some rules to attributes
  - Add label for openvswitch port
  - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
  - Allow postfix_local to read .forward in pcp lib files
  - Allow pegasus_openlmi_storage_t to read lvm metadata
  - Add additional fixes for pegasus_openlmi_storage_t
  - Allow bumblebee to manage debugfs
  - Make bumblebee as unconfined domain
  - Allow snmp to read etc_aliases_t
  - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
  - Allow pegasus_openlmi_storage_t to read /proc/1/environ
  - Dontaudit read gconf files for cupsd_config_t
  - make vmtools as unconfined domain
  - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
  - Allow collectd_t to use a mysql database
  - Allow ipa-otpd to perform DNS name resolution
  - Added new policy for keepalived
  - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
  - Add additional fixes new pscs-lite+polkit support
  - Add labeling for /run/krb5kdc
  - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
  - Allow pcscd to read users proc info
  - Dontaudit smbd_t sending out random signuls
  - Add boolean to allow openshift domains to use nfs
  - Allow w3c_validator to create content in /tmp
  - zabbix_agent uses nsswitch
  - Allow procmail and dovecot to work together to deliver mail
  - Allow spamd to execute files in homedir if boolean turned on
  - Allow openvswitch to listen on port 6634
  - Add net_admin capability in collectd policy
  - Fixed snapperd policy
  - Fixed bugsfor pcp policy
  - Allow dbus_system_domains to be started by init
  - Fixed some interfaces
  - Add kerberos_keytab_domain attribute
  - Fix snapperd_conf_t def


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-127
changelog:
  - Add snapperd_home_t for HOME_DIR/.snapshots directory
  - Make sosreport as unconfined domain
  - Allow sosreport to execute grub2-probe
  - Allow NM to manage hostname config file
  - Allow systemd_timedated_t to dbus chat with rpm_script_t
  - Allow lsmd plugins to connect to http/ssh/http_cache ports by default
  - Add lsmd_plugin_connect_any boolean
  - Allow mozilla_plugin to attempt to set capabilities
  - Allow lsdm_plugins to use tcp_socket
  - Dontaudit mozilla plugin from getattr on /proc or /sys
  - Dontaudit use of the keyring by the services in a sandbox
  - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
  - Allow rabbitmq_beam to connect to jabber_interserver_port
  - Allow logwatch_mail_t to transition to qmail_inject and queueu
  - Added new rules to pcp policy
  - Allow vmtools_helper_t to change role to system_r
  - Allow NM to dbus chat with vmtools
  - Fix couchdb_manage_files() to allow manage couchdb conf files
  - Add support for /var/run/redis.sock
  - dontaudit gpg trying to use audit
  - Allow consolekit to create log directories and files
  - Fix vmtools policy to allow user roles to access vmtools_helper_t
  - Allow block_suspend cap2 for ipa-otpd
  - Allow pkcsslotd to read users state
  - Add ioctl to init_dontaudit_rw_stream_socket
  - Add systemd_hostnamed_manage_config() interface
  - Remove transition for temp dirs created by init_t
  - gdm-simple-slave uses use setsockopt
  - sddm-greater is a xdm type program


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-128
changelog:
  - Make snapperd as unconfined domain and add additional fixes for it
  - Remove nsplugin.pp module on upgrade


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-129
changelog:
  - Allow block_suspend cap2 for systemd-logind and rw dri device
  - Add labeling for /usr/libexec/nm-libreswan-service
  - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
  - Add xserver_rw_xdm_keys()
  - Allow rpm_script_t to dbus chat also with systemd-located
  - Fix ipa_stream_connect_otpd()
  - update lpd_manage_spool() interface
  - Allow krb5kdc to stream connect to ipa-otpd
  - Add ipa_stream_connect_otpd() interface
  - Allow vpnc to unlink NM pids
  - Add networkmanager_delete_pid_files()
  - Allow munin plugins to access unconfined plugins
  - update abrt_filetrans_named_content to cover /var/spool/debug
  - Label /var/spool/debug as abrt_var_cache_t
  - Allow rhsmcertd to connect to squid port
  - Make docker_transition_unconfined as optional boolean
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-130
changelog:
  - Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
  - Add sysnet_filetrans_named_content_ifconfig() interface
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow kerberos keytab domains to manage sssd/userdomain keys"
  - Allow to run ip cmd in neutron_t domain


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-131
changelog:
  - Added pcp rules
  - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
  - clean up ctdb.te
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-132
changelog:
  - Modify xdm_write_home to allow create files/links in /root with xdm_home_
  - Allow virt domains to read network state
  Resolves:#1072019


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-133
changelog:
  - Allow numad to write scan_sleep_millisecs
  - Turn on entropyd_use_audio boolean by default
  - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
  - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
  - Fix label on irclogs in the homedir
  - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
  - Allow postgresql to use ldap
  - Add missing syslog-conn port
  - Add support for /dev/vmcp and /dev/sclp
  Resolves:#1069310


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-134
changelog:
  - Allow unpriv SELinux users to dbus chat with firewalld
  - Add lvm_write_metadata()
  - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
  - Allow pegasus_openlmi_storage_t to write lvm metadata
  - Add hide_broken_symptoms for kdumpgui because of systemd bug
  - Make kdumpgui_t as unconfined domain
  Resolves:#1044299
  - Allow docker to connect to tcp/5000


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-137
changelog:
  - Allow vmtools_helper_t to execute bin_t
  - Add support for /usr/share/joomla
  - /var/lib/containers should be labeled as openshift content for now
  - Allow docker domains to talk to the login programs, to allow a process to login into the container
  - Allow install_t do dbus chat with NM
  - Fix interface names in anaconda.if
  - Add install_t for anaconda. A new type is a part of anaconda policy
  - sshd to read network sysctls


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-138
changelog:
  - Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
  - Allow net_admin cap for fence_virtd running as fenced_t
  - Make  abrt-java-connector working
  - Make cimtest script 03_defineVS.py of ComputerSystem group working
  - Fix git_system_enable_homedirs boolean
  - Allow munin mail plugins to read network systcl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-139
changelog:
  - Allow collectd to talk to libvirt
  - Allow chrome_sandbox to use leaked unix_stream_sockets
  - Dontaudit leaks of sockets into chrome_sandbox_t
  - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
  - Run vmtools as unconfined domains
  - Allow snort to manage its log files
  - Allow systemd_cronjob_t to be entered via bin_t
  - Allow procman to list doveconf_etc_t
  - allow keyring daemon to create content in tmpfs directories
  - Add proper labelling for icedtea-web
  - vpnc is creating content in networkmanager var run directory
  - Label sddm as xdm_exec_t to make KDE working again
  - Allow postgresql to read network state
  - Allow java running as pki_tomcat to read network sysctls
  - Fix cgroup.te to allow cgred to read cgconfig_etc_t
  - Allow beam.smp to use ephemeral ports
  - Allow winbind to use the nis to authenticate passwords


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-140
changelog:
  - Allow docker to read tmpfs_t symlinks
  - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-142
changelog:
  - Add support for /var/spool/rhsm/debug
  - Make virt_sandbox_use_audit as True by default
  - Allow svirt_sandbox_domains to ptrace themselves


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-143
changelog:
  - Add additional fixes for rtas_errd
  - Fix transitions for tmp/tmpfs in rtas.te
  - Allow rtas_errd to readl all sysctls


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-144
changelog:
  - allow anaconda to dbus chat with systemd-localed
  - Add fixes for haproxy based on bperkins@redhat.com
  - Allow cmirrord to make dmsetup working
  - Allow NM to execute arping
  - Allow users to send messages through talk
  - Add userdom_tmp_role for secadm_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-145
changelog:
  - Allow also unpriv user to run vmtools
  - Allow secadm to read /dev/urandom and meminfo
  Resolves:#1079250
  - Add booleans to allow docker processes to use nfs and samba
  - Add mdadm_tmpfs support
  - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
  - Allow vmware-user-sui to use user ttys
  - Allow talk 2 users logged via console too
  - Allow ftp services to manage xferlog_t
  - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
  - allow anaconda to dbus chat with systemd-localed


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-146
changelog:
  - add gnome_append_home_config()
  - Allow thumb to append GNOME config home files
  - Allow rasdaemon to rw /dev/cpu//msr
  - fix /var/log/pki file spec
  - make bacula_t as auth_nsswitch domain
  - Identify pki_tomcat_cert_t as a cert_type
  - Define speech-dispater_exec_t as an application executable
  - Add a new file context for /var/named/chroot/run directory
  - update storage_filetrans_all_named_dev for sg* devices
  - Allow auditctl_t  to getattr on all removeable devices
  - Allow nsswitch_domains to stream connect to nmbd
  - Allow unprivusers to connect to memcached
  - label /var/lib/dirsrv/scripts-INSTANCE as bin_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-147
changelog:
  - Back port fixes for pegasus_openlmi_admin_t from rawhide
  Resolves:#1080973
  - Add labels for ostree
  - Add SELinux awareness for NM
  - Label /usr/sbin/pwhistory_helper as updpwd_exec_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-148
changelog:
  - Allow kdm to send signull to remote_login_t process
  - Add gear policy
  - Turn on gear_port_t
  - Allow cgit to read gitosis lib files by default
  - Allow vdagent to read xdm state
  - Allow NM and fcoeadm to talk together over unix_dgram_socket


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-149
changelog:
  - Allow xauth_t to read user_home_dir_t lnk_file
  - Add labeling for lightdm-data
  - Allow certmonger to manage ipa lib files
  - Add support for /var/lib/ipa
  - Allow pegasus to getattr virt_content
  - Added some new rules to pcp policy
  - Allow chrome_sandbox to execute config_home_t
  - Add support for ABRT FAF


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-151
changelog:
  - varnishd wants chown capability
  - update ntp_filetrans_named_content() interface
  - Add additional fixes for neutron_t. #1083335
  - Dontaudit getattr on proc_kcore_t
  - Allow pki_tomcat_t to read ipa lib files
  - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
  - Allow init_t run /sbin/augenrules
  - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
  - Allow unpriv SELinux user to use sandbox
  - Add default label for /tmp/hsperfdata_root


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-152
changelog:
  - Fix Multiple same specifications for /var/named/chroot/dev/zero
  - Add labels for /var/named/chroot_sdb/dev devices
  - Add support for strongimcv
  - Use kerberos_keytab_domains in auth_use_nsswitch
  - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
  - Allow net_raw cap for neutron_t and send sigkill to dnsmasq
  - Fix ntp_filetrans_named_content for sntp-kod file
  - Add httpd_dbus_sssd boolean
  - Dontaudit exec insmod in boinc policy
  - Rename kerberos_keytab_domain to kerberos_keytab_domains
  - Add kerberos_keytab_domain()
  - Fix kerberos_keytab_template()
  - Make all domains which use kerberos as kerberos_keytab_domain
  Resolves:#1083670
  - Allow kill capability to winbind_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-154
changelog:
  - Add support for us_cli ports
  - Fix labeling for /var/run/user/<UID>/gvfs
  - add support for tcp/9697
  - Additional rules required by openstack,  needs backport to F20 and RHEL7
  - Additional access required by docker
  - ALlow motion to use tcp/8082 port
  - Allow init_t to setattr/relabelfrom dhcp state files
  - Dontaudit antivirus domains read access on all security files by default
  - Add missing alias for old amavis_etc_t type
  - Allow block_suspend cap for haproxy
  - Additional fixes for  instack overcloud
  - Allow OpenStack to read mysqld_db links and connect to MySQL
  - Remove dup filename rules in gnome.te
  - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
  - Allow iscsid to handle own unit files
  - Add iscsi_systemctl()
  - Allow mongod to create also sock_files in /run with correct labeling
  - Allow httpd to send signull to apache script domains and don't audit leaks
  - Allow rabbitmq_beam to connect to httpd port
  - Allow aiccu stream connect to pcscd
  - Allow dmesg to read hwdata and memory dev
  - Allow all freeipmi domains to read/write ipmi devices
  - Allow sblim_sfcbd to use also pegasus-https port
  - Allow rabbitmq_epmd to manage rabbit_var_log_t files
  - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
  - Allow docker to status any unit file and allow it to start generic unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-2
changelog:
  - Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
  - Label /usr/lib/erlang/erts.*/bin files as bin_t
  - Add files_dontaudit_access_check_home_dir() inteface.
  - Allow udev_t mounton udev_var_run_t dirs #(1128618)
  - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
  - Add init_dontaudit_read_state() interface.
  - Add label for ~/.local/share/fonts
  - Allow unconfined_r to access unconfined_service_t.
  - Allow init to read all config files
  - Add new interface to allow creation of file with lib_t type
  - Assign rabbitmq port.
  - Allow unconfined_service_t to dbus chat with all dbus domains
  - Add new interfaces to access users keys.
  - Allow domains to are allowed to mounton proc to mount on files as well as dirs
  - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
  - Add a port definition for shellinaboxd
  - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
  - Allow userdomains to stream connect to pcscd for smart cards
  - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
  - Update to rawhide-contrib changes
  Resolves:#1123844


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-3
changelog:
  - Add back kill permisiion for system class
  - Allow iptables read fail2ban logs.
  - Fix radius labeled ports
  - Add userdom_manage_user_tmpfs_files interface
  - Allow libreswan to connect to VPN via NM-libreswan.
  - Label 4101 tcp port as brlp port
  - fix dev_getattr_generic_usb_dev interface
  - Allow all domains to read fonts
  - Make sure /run/systemd/generator and system is labeled correctly on creation.
  - Dontaudit aicuu to search home config dir. 
  - Make keystone_cgi_script_t domain. 
  Resolves:#1138424
  - Fix bug in drbd policy, 
  - Added support for cpuplug. 
  - ALlow sanlock_t to read sysfs_t.
  - Added sendmail_domtrans_unconfined interface
  - Fix broken interfaces
  - radiusd wants to write own log files.
  - Label /usr/libexec/rhsmd as rhsmcertd_exec_t
  - Allow rhsmcertd send signull to setroubleshoot. 
  - Allow rhsmcertd manage rpm db. 
  - Added policy for blrtty. 
  - Fix keepalived policy
  - Allow rhev-agentd dbus chat with systemd-logind.
  - Allow keepalived manage snmp var lib sock files.
  - Add support for /var/lib/graphite-web
  - Allow NetworkManager to create Bluetooth SDP sockets
  - It's going to do the the discovery for DUN service for modems with Bluez 5.
  - Allow swift to connect to all ephemeral ports by default.
  - Allow sssd to read selinux config to add SELinux user mapping.
  - Allow lsmd to search own plguins.
  - Allow abrt to read /dev/memto generate an unique machine_id and uses  sosuploader's algorithm based off dmidecode[1] fields.
  - ALlow zebra for user/group look-ups.
  - Allow nova domains to getattr on all filesystems.
  - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
  - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
  - Allow rhnsd_t to manage also rhnsd config symlinks.
  - ALlow user mail domains to create dead.letter.
  - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. 
  - Allow pki-tomcat to change SELinux object identity.
  - Allow radious to connect to apache ports to do OCSP check
  - Allow git cgi scripts to create content in /tmp
  - Allow cockpit-session to do GSSAPI logins.
  - Allow sensord read in /proc 
  - Additional access required by usbmuxd


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-5
changelog:
  - Add back kill permisiion for service class
  Resolves:#1150011
  - Make rhsmcertd_t also as dbus domain.
  - Allow named to create DNS_25 with correct labeling.
  - Add cloudform_dontaudit_write_cloud_log()
  - Call auth_use_nsswitch to apache to read/write cloud-init keys.
  - Allow cloud-init to dbus chat with certmonger.
  - Fix path to mon_statd_initrc_t script.
  - Allow all RHCS services to read system state.
  - Allow dnssec_trigger_t to execute unbound-control in own domain.
  - kernel_read_system_state needs to be called with type. Moved it to antivirus.if.
  - Added policy for mon_statd and mon_procd services. BZ (1077821)
  - Allow opensm_t to read/write /dev/infiniband/umad1.
  - Allow mongodb to manage own log files.
  - Allow neutron connections to system dbus.
  - Add support for /var/lib/swiftdirectory.
  - Allow nova-scheduler to read certs.
  - Allow openvpn to access /sys/fs/cgroup dir.
  - Allow openvpn to execute  systemd-passwd-agent in  systemd_passwd_agent_t to make openvpn working with systemd.
  - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.
  - Add auth_use_nsswitch for portreserve to make it working with sssd.
  - automount policy is non-base module so it needs to be called in optional block.
  - ALlow sensord to getattr on sysfs.
  - Label /usr/share/corosync/corosync as cluster_exec_t.
  - Allow lmsd_plugin to read passwd file. BZ(1093733)
  - Allow read antivirus domain all kernel sysctls.
  - Allow mandb to getattr on file systems
  - Allow nova-console to connect to mem_cache port.
  - Make sosreport as unconfined domain.
  - Allow mondogdb to  'accept' accesses on the tcp_socket port.
  - ALlow sanlock to send a signal to virtd_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-7
changelog:
  - Allow modemmanger to connectto itself
  Resolves:#1120152 
  - Allow pki_tomcat to create link files in /var/lib/pki-ca.
  Resolves:#1121744 
  - varnishd needs to have fsetid capability
  Resolves:#1125165
  - Allow snapperd to dbus chat with system cron jobs.
  Resolves:#1152447
  - Allow dovecot to create user's home directory when they log into IMAP 
  Resolves:#1152773   
  - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.
  - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. 
  - Allow nslcd to execute netstat.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow nslcd to read /dev/urandom.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-8
changelog:
  - Allow guest to connect to libvirt using unix_stream_socket.
  - Allow all bus client domains to dbus chat with unconfined_service_t.
  - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
  - Make opensm as nsswitch domain to make it working with sssd.
  - Allow brctl to read meminfo.
  - Allow winbind-helper to execute ntlm_auth in the caller domain.
  Resolves:#1160339
  - Make plymouthd as nsswitch domain to make it working with sssd.
  Resolves:#1160196
  - Make drbd as nsswitch domain to make it working with sssd.
  - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
  - Add support for /var/lib/sntp directory.
  - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc
  - Allow winbind to read usermodehelper
  - Allow telepathy domains to execute shells and bin_t
  - Allow gpgdomains to create netlink_kobject_uevent_sockets
  - Allow mongodb to bind to the mongo port and mongos to run as mongod_t
  - Allow abrt to read software raid state.
  - Allow nslcd to execute netstat.
  - Allow dovecot to create user's home directory when they log into IMAP.
  - Allow login domains to create kernel keyring with different level.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-9
changelog:
  - Dontaudit access check on setfiles/load_policy for sssd_t.
  Resolves:#1140106
  - Add kdump_rw_inherited_kdumpctl_tmp_pipes()
  Resolves:#1156442
  - Make linuxptp services as unconfined.
  - Added new policy linuxptp.
  Resolves:#1149693
  - Label keystone cgi files as keystone_cgi_script_exec_t.
  Resolves:#1138424
  - Make tuned as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-10
changelog:
  - Label /etc/strongimcv as ipsec_conf_file_t.
  - Add support for /usr/bin/start-puppet-ca helper script
  Resolves:#1160727
  - Allow rpm scripts to enable/disable transient systemd units.
  Resolves:#1154613 
  - Make kpropdas nsswitch domain
  Resolves:#1153561
  - Make all glance domain as nsswitch domains
  Resolves:#1113281
  - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active
  - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t
  Resolves:#1140106


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-11
changelog:
  - Allow radius to bind tcp/1812 radius port.
  - Dontaudit list user_tmp files for system_mail_t.
  - Label virt-who as virtd_exec_t.
  - Allow rhsmcertd to send a null signal to virt-who running as virtd_t.
  - Add missing alias for _content_rw_t.
  Resolves:#1089177
  - Allow spamd to access razor-agent.log.
  - Add fixes for sfcb from libvirt-cim TestOnly bug.
  - Allow NetworkManager stream connect on openvpn.
  - Make /usr/bin/vncserver running as unconfined_service_t.
  - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
  - Label /etc/docker/certs.d as cert_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-12
changelog:
  - Add seutil_dontaudit_access_check_semanage_module_store() interface
  Resolves:#1140106
  - Update to have all _systemctl() interface also init_reload_services().
  - Dontaudit access check on SELinux module store for sssd.
  - Add labeling for /sbin/iw.
  - Allow named_filetrans_domain to create ibus directory with correct labeling.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-13
changelog:
  - Remove old pkcsslotd.pp from minimum package
  - Allow rlogind to use also rlogin ports.
  - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
  - Allow bacula to connect also to postgresql.
  - Label /usr/libexec/tomcat/server as tomcat_exec_t
  - Add support for /usr/sbin/ctdbd_wrapper
  - Add support for /usr/libexec/ppc64-diag/rtas_errd
  - Allow rpm_script_roles to access system_mail_t
  - Allow brltty to create /var/run/brltty
  - Allow lsmd plugin to access netlink_route_socket
  - Allow smbcontrol to read passwd
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
  Resolves:#1140106
  - Allow osad to execute rhn_check
  - Allow load_policy to rw inherited sssd pipes because of selinux_child
  - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
  - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
  - Add additional booleans substitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-14
changelog:
  - Allow virt_qemu_ga_t to execute kmod.
  - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
  - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
  Resolves:#1113725
  - Enable OpenStack cinder policy
  - Add support for /usr/share/vdsm/daemonAdapter
  - Add support for /var/run/gluster


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-15
changelog:
  - Fix bugs in interfaces discovered by sepolicy.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Allow lsm plugins to connect to tcp/18700 by default.
  - Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
  - Fix pcp_domain_template() interface.
  - Fix conman.te.
  - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
  - Allow glance-scrubber to connect tcp/9191.
  - Add missing setuid capability for sblim-sfcbd.
  - Allow pegasus ioctl() on providers.
  - Add conman_can_network.
  - Allow chronyd to read chrony conf files located in /run/timemaster/.
  - Allow radius to bind on tcp/1813 port.
  - dontaudit block suspend access for openvpn_t 
  - Allow conman to create files/dirs in /tmp.
  - Update xserver_rw_xdm_keys() interface to have 'setattr'.
  Resolves:#1172291 
  - Allow sulogin to read /dev/urandom and /dev/random.
  - Update radius port definition to have also tcp/18121
  - Label prandom as random_device_t.
  - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-16
changelog:
  - Allow sssd to send dbus all user domains.
  Resolves:#1172291
  - Allow lsm plugin to read certificates.
  - Fix labeling for keystone CGI scripts.
  - Make snapperd back as unconfined domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-17
changelog:
  - Allow ipsec to execute _updown.netkey script to run unbound-control.
  - Allow neutron to read rpm DB.
  - Add additional fixes for hyperkvp
   * creates new ifcfg-{name} file
   * Runs hv_set_ifconfig.sh, which does the following
   * Copies ifcfg-{name} to /etc/sysconfig/network-scripts
  - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
  - Add labeling for pacemaker.log.
  - Allow radius to connect/bind radsec ports.
  - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
  - Allow  virt_qemu_ga to dbus chat with rpm.
  - Update virt_read_content() interface to allow read also char devices.
  - Allow glance-registry to connect to keystone port.
  Resolves:#1181818


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-18
changelog:
  - Add auditing support for ipsec.
  Resolves:#1182524
  - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
  - Allow netutils chown capability to make tcpdump working with -w


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-21
changelog:
  - pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
  - Allow fowner capability for sssd because of selinux_child handling.
  - ALlow bind to read/write inherited ipsec pipes
  - Allow hypervkvp to read /dev/urandom and read  addition states/config files.
  - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
  - Add glusterd_filetrans_named_pid() interface
  - Allow radiusd to connect to radsec ports.
  - Allow setuid/setgid for selinux_child
  - Allow lsmd plugin to connect to tcp/5988 by default.
  - Allow lsmd plugin to connect to tcp/5989 by default.
  - Update ipsec_manage_pid() interface.
  Resolves:#1184978


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23
changelog:
  - Update seutil_manage_config() interface.
  Resolves:#1185962
  - Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
  - Turn on docker_transition_unconfined by default


author: Erik Troan <ewt@redhat.com>
changelog:
  - added patch for XOPEN oddities in glibc headers
  - check for ut_user before checking for ut_name -- this works around some
    confusion on glibc 2.1 due to the utmpx header not defining the ut_name
    compatibility stuff. I used a gross sed hack here because I couldn't make
    automake work properly on the sparc (this could be a glibc 2.0.99 problem
    though). The utuser patch works fine, but I don't apply it.
  - sleep after running autoconf


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the spec file
  - updated the patch so that new accounts created on shadowed system won't
    confuse pam_pwdb anymore ('!!' default password instead on '!')
  - fixed a bug that made useradd -G segfault
  - the check for the ut_user is now patched into configure


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - Note that /usr/sbin/mkpasswd conflicts with /usr/bin/mkpasswd;
    one of these (I think /usr/sbin/mkpasswd but other opinions are valid)
    should probably be renamed.  In any case, mkpasswd.8 from this package
    needs to be installed. (problem #823)


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - have userdel remove user private groups when it is safe to do so
  - allow -f to force user removal even when user appears busy in utmp


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - Serial: 1 because now we are using 19990827 (why the heck can't they have
    a normal version just like everybody else?!)
  - ported all patches to the new code base


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix usermod patch to check for shadow before doing any shadow-specific stuff
    and merge it into the pwlock patch


author: Matt Wilson <msw@redhat.com>
changelog:
  - use mandir for FHS
  - added patches in src/ and po/ to honor DESTDIR
  - use make install DESTDIR=$RPM_BUILD_ROOT


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change symlinked man pages to includers
  - require /usr/bin/newgrp (util-linux) so that /usr/bin/sg isn't left dangling


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Remove a fixed-size buffer that caused problems when adding a huge number
    of users to a group (>8192 bytes) (Bugs #3809, #11930)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - take LOG_CONS out of the openlog() call so that we don't litter the
    screen during text-mode upgrades


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't overwrite user dot files in useradd (#19982)
  - truncate new files when moving overwriting files with the contents of other
    files while moving directories (keeps files from looking weird later on)
  - configure using %{_prefix} as the prefix


author: Bernhard Rosenkraenzer <bero@redhat.com> 20000902-1
changelog:
  - Create an empty mailspool when creating a user so non-setuid/non-setgid
    MDAs (postfix+procmail) can deliver mail (#41811)
  - 20000902
  - adapt patches


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-4
changelog:
  - use -O0 instead of -O on ia64
  - build in source directory
  - don't leave lock files on the filesystem when useradd creates a group for
    the user (#50269)
  - fix the -o option to check for duplicate UIDs instead of login names (#52187)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-12
changelog:
  - force .mo files to be regenerated with current gettext to flush out possible
    problems
  - fixup non-portable encodings in translations
  - make sv translation header non-fuzzy so that it will be included (#71281)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-13
changelog:
  - prevent libshadow from being built more than once, to keep automake happy
  - change how md5 and md5crypt are enabled, to keep autoconf happy
  - remove unpackaged files after %install


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-6
changelog:
  - adjust mailspool patch to complain if no group named "mail" exists, even
    though that should never happen


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-14
changelog:
  - lastlog: don't pass a possibly-smaller field to localtime (#109648)
  - configure: call AC_SYS_LARGEFILE to get large file support


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-15
changelog:
  - don't convert man pages to UTF-8 for RHEL 3, conditionalized using macro
  - fixup dangling man page references


author: Dan Walsh <dwalsh@redhat.com> 4.0.3-23
changelog:
  - Add get_enforce checks
  - Clean up patch for potential upstream submission
  - Add removemalloc patch to get it to build on 3.4


author: Adrian Havill <havill@redhat.com> 2:4.0.3-31
changelog:
  - check for non-standard legacy place for ncsd HUP (/var/run/nscd.pid) and
    then the std FHS place (/var/run/nscd.pid) (#125421)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-33
changelog:
  - allow for mixed case and dots in usernames (#135401)
  - all man pages to UTF-8, not just Japanese (#133883)
  - add Polish blurb for useradd -n man page option (#82177)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-35
changelog:
  - make the limit for the group name the same as the username (determined
    by the header files, rather than a constant) (#56850)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-4
changelog:
  - use newgrp binary
  - newgrp don't ask for password if user's default GID = group ID,
    ask for password if there is some in /etc/gshadow
    and in /etc/group is 'x' (#149997)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-5
changelog:
  - fix memory leak, and CPU spinning when grp_update() and
    duplicate group entries in /etc/group (#151484)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.17-6
changelog:
  - fix regression. Permissions on user* group* binaries
    should be 0750, because of CAPP/LSPP certification
  - fix groupdel man page


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.18.1-2
changelog:
  - improve audit logging (#211659)
  - improve "-l" option. Do not reset faillog if it's used (#213450).


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-8
changelog:
  - groupmems: check username for valid character (#455603)
  - groupmems: don't segfault on nonexistent group (#456088)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-11
changelog:
  - fix license tag (#226416)
  - get rid of tabs in spec file (#226416)
  - convert HOWTO to UTF8 (#226416)


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-5
changelog:
  - newusers man page more informative
  - userdel should not need to run semanage
    Resolves: #586330 #586408


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-9
changelog:
  - fix gshadow functions from shadow utils
  - make shadow utils use gshadow functions from glibc
    Resolves: #665780


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-10
changelog:
  - do not use  gshadow functions from glibc, there is a bug
    in glibc sgetsgent(#674361)
    Resolves: #674234


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-11
changelog:
  - useradd man page (-m option)
  - create home directory on fs with noacl
  - remove faillog app (pam_tally.so is no longer shipped)
    Resolves: #523265, #622320


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.3-5
changelog:
  - userdel option to remove Linux login <-> SELinux login mapping (#639900)
  - useradd special exit value if SELinux user mapping is invalid (#639975)
  - usermod special exit value if SELinux user mapping is invalid (#639976)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-6
changelog:
  - report error to stdout when SELinux context for home directory
    cannot be determined (#973647)
  - audit the changing home directory owner (#885797)
  - do not set the default SELinux MLS range (#852676)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-8
changelog:
  - slightly more meaningful error messages if crypt() returns NULL (#988184)
  - explicit suid permissions


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-16
changelog:
  - update auditing to cover more events and fix some incorrect audit
    records - patch by Steve Grubb (#1151580)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.8.3-1
changelog:
  - update to 0.8.3 to also notice and reflect changes caused by internal
    add/modify/modrdn/delete operations


author: Nalin Dahyabhai <nalin@redhat.com> - 0.8.4-1
changelog:
  - update to 0.8.4 to fix:
    - problems updating references, particularly those for %referred() (#474478)
    - inability to notice internal add/modify/modrdn/delete operations (really
      this time) (#474426)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.8.5-2
changelog:
  - make the example nsslapd-pluginpath values the same on 32- and 64-bit
    systems, because we can depend on the directory server "knowing" which
    directory to search for the plugins


author: Nalin Dahyabhai <nalin@redhat.com> - 0.15-1
changelog:
  - fix %deref and %referred to fail rather than return a valid-but-empty
    result when they fail to evaluate (reported by Rob Crittenden)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.16-1
changelog:
  - fix NIS server startup problem when no port is explicitly configured and
    we're using portmap instead of rpcbind (#500903)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.17-3
changelog:
  - change buildreq from fedora-ds-base-devel to 389-ds-base-devel, which
    should avoid multilib conflicts from installing both arches of the new
    package (#511504)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.18-1
changelog:
  - update to 0.18
    - add a deref_rf function
    - schema-compat: don't respond to search requests for which there's no backend
    - schema-compat: add the ability to do standalone compat containers


author: Nalin Dahyabhai <nalin@redhat.com> - 0.21-1
changelog:
  - update to 0.21
    - schema-compat: don't look at standalone compat containers for a search,
      since we'll already have looked at the group container


author: Nalin Dahyabhai <nalin@redhat.com> - 0.21-2
changelog:
  - make sure we always pull in nss-devel and nspr-devel, and the right
    ldap toolkit for the Fedora or RHEL version


author: Nalin Dahyabhai <nalin@redhat.com> - 0.24-1
changelog:
  - carry our own yp.x, so that we don't get bitten if libc doesn't include
    yp client routines
  - we need rpcgen at build-time now


author: Nalin Dahyabhai <nalin@redhat.com> - 0.25-1
changelog:
  - speed up building compat entries which reference thousands of other entries
    (more of #692690)
  - 389-ds-base is apparently exclusive to x86_64 and %{ix86} on EL, so we have
    to be, too


author: Nalin Dahyabhai <nalin@redhat.com> - 0.26-1
changelog:
  - when building for 389-ds, use libpthread's read-write locks instead of
    NSPR's (part of #730394/#730403)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.27-1
changelog:
  - when building for 389-ds, use Slapi_RWLocks if they appear to be available
    (the rest of #730394/#730403)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.28-1
changelog:
  - when configured with --with-ldap=openldap, link with -lldap_r rather
    than -lldap (rmeggins, #769107)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.29-1
changelog:
  - add regmatchi/regsubi formatting functions which work like regmatch/regsub,
    but do matching in a case-insensitive manner
  - update NIS map defaults to match {CRYPT} userPassword values in a
    case-insensitive manner so that we also use {crypt} userPassword values
  - fix inconsistencies in the NIS service stemming from using not-normalized DNs
    in some places where it should have used normalized DNs


author: Nalin Dahyabhai <nalin@redhat.com> - 0.30-1
changelog:
  - skip recalculations when the attributes which changed don't factor into
    our calculations (part of #771493)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.33-1
changelog:
  - get more aggressive about skipping unnecessary calculations (most of
    the problem in #771444, though not the approach described there)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.34-1
changelog:
  - do entry comparisons ourselves, albeit less throughly, to avoid the worst
    case in pathological cases (more of #771444)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.35-1
changelog:
  - add mmatch/mregmatch[i]/mregsub[i] formatting functions which work like
    match/regmatch[i]/regsub[i], but which can handle and return lists of
    zero or more results (part of #783274)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.36-1
changelog:
  - take steps to avoid making yp_first/yp_next clients loop indefinitely
    when a single LDAP entry produces multiple copies of the same NIS key
    for a given map


author: Nalin Dahyabhai <nalin@redhat.com> - 0.37-1
changelog:
  - fix a compile error on systems where LDAP_SCOPE_SUBORDINATE isn't defined
    (reported by Christian Neuhold)
  - conditionalize whether we have a build dependency on tcp_wrappers (older
    releases) or tcp_wrappers-devel (newer releases)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.39-1
changelog:
  - add a "default" function for trying to evaluate one expression, then
    another, then another... (part of #767372)
  - when creating a compat entry based on a real entry, set an entryUSN based on
    the source entry or the rootDSE (freeipa #864); the "scaffolding" entries
    won't have them


author: Nalin Dahyabhai <nalin@redhat.com> - 0.40-1
changelog:
  - treat padding values passed to the "link" function as expressions to be
    evaluated rather than simply as literal values (part of #767372)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.41-1
changelog:
  - log errors evaluating pad expressions in %link rather than continuing on
    until we hit an arithmetic exception (#810258)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix a leak due to us assuming that slapi_mods_add_smod() not taking ownership
    of an smod along with its contents, when it just keeps the contents


author: Nalin Dahyabhai <nalin@redhat.com> - 0.43-1
changelog:
  - reintroduce support for directory server transactions (nhosoi, IPA#3046)
  - control transaction support at run-time, deciding when to do things based
    on the value of the nsslapd-pluginbetxn attribute in the plugin's entry
  - NIS: add default settings for shadow.byname and passwd.adjunct.byname maps


author: Nalin Dahyabhai <nalin@redhat.com> - 0.44-1
changelog:
  - add missing newline to a couple of debug log messages
  - note whether or not betxn support is compiled in as part of the
    nsslapd-pluginVersion value we report to the server
  - register callbacks in the same order in both plugins, so that
    their log messages are logged in the same order


author: Nalin Dahyabhai <nalin@redhat.com> - 0.44-2
changelog:
  - set betxn support to be disabled by default on Fedora 17 or EL 5 or older,
    which have versions of IPA < 3.0, per mkosek on freeipa-devel


author: Nalin Dahyabhai <nalin@redhat.com> - 0.46-1
changelog:
  - when checking if we can skip processing for a given change, pay attention to
    whether or not the changes cause the entry to need to be added or removed
    from a map (#912673)
  - check SLAPI_PLUGIN_OPRETURN in post-change hooks, in case the backend failed
    to update things but the server called us anyway


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.5-1
changelog:
  - merge Alexander Bokovoy's patches to
    - teach the schema compatibility plugin to optionally serve user and group
      information retrieved from libc as part of a set of compat entries
    - handle simple bind requests for those entries by calling out to PAM
    - to rewrite the DN of incoming bind requests to compat entries to point
      at the source entries, instead of returning a referral which most clients
      won't handle
  - include IPA-specific docs as docs


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.6-1
changelog:
  - only buildrequire libsss_nss_idmap-devel on releases that included SSSD
    version 1.10 or later, where it first appeared


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.7-1
changelog:
  - fix building against versions of directory server older than 1.3.0, which
    first introduced slapi_escape_filter_value()


author: Nalin Dahyabhai <nalin@redhat.com> - 0.48-1
changelog:
  - try to gracefully handle failures obtaining internal locks
  - fix locating-by-name of entries with names that require escaping
  - add self-tests for nsswitch and PAM functionality
  - make nsswitch mode properly handle user and group names with commas in them
  - handle attempts to PAM authenticate to compat groups (i.e., with failure)
  - drop the "schema-compat-origin" attribute


author: Nalin Dahyabhai <nalin@redhat.com> - 0.49-1
changelog:
  - add {nis,schema-compat}-ignore-subtree and -restrict-subtree settings,
    which should let us avoid deadlocks when tasks are modifying data in
    the backend database (#1007451)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.50-1
changelog:
  - if we get an EPIPE while registering with rpcbind, try to reconnect and
    retransmit before giving up


author: Nalin Dahyabhai <nalin@redhat.com> - 0.51-1
changelog:
  - fix another request argument memory leak in NIS server (#1040159)
  - fix miscellaneous items found by static analysis


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-1
changelog:
  - correctly reflect whether or not we're built with transaction support in
    the module's nsslapd-pluginVersion attribute
  - fix a couple of should've-used-memmove()-instead-of-memcpy() cases which
    would hit when removing maps or groups of maps (#1043546/#1043638)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-3
changelog:
  - remove ExclusiveArch if %{rhel} is 7 or higher, because 389-ds-base gets
    built for everything now (#1055711)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-5
changelog:
  - backport correction to the default settings for hosts.byname and
    hosts.byaddr NIS maps, so that their data items start with the host's
    address rather than a name (#1090948)


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-1
changelog:
  - Add support for IDM's ID views
  - Allow searching SSSD-provided users as memberUid case-insensitevly
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-2
changelog:
  - Complete ID views support to BIND operation
  - Ignore ID views outside schema-compat subtrees
  - Use 389-ds API compatible with RHEL 7.0
  - Resolves: #1151436


author: Ondrej Kozina <okozina@redhat.com> - 0.1.0-1.20121026git1aaa372
changelog:
  - removed python binding since python can use dbus interface instead
  - removed btrfs-progs and LVM dependecies (#852174)
  - patch: do not build zypp plugin
  - patch: avoid abrt when 'diff' command is executed without arguments
  - patch: do not check for btrfs-progs binary
  - patch: do not allow 'create-config' command on non-thin LVM volumes (#852174)
  - edit libtool script to link with: '-Wl, --as-needed'
  - spec file polishing


author: Ondrej Kozina <okozina@redhat.com> - 0.1.2-1.20130211git676556f
changelog:
  - updated to latest upstream version
  - fixed wrong include: "auto_ptr.h" -> <memory>
  - moved diffutils dependency to client


author: Ondrej Kozina <okozina@redhat.com> - 0.1.3-1.20130418git7ca81a2
changelog:
  - updatet to latest upstream version
  - add support to compare extended attributes ('xadiff' command)
  - add support to revert modificiations in file's extended attributes
  - patch: avoid useless build dependency on libattr-devel


author: Ondrej Kozina <okozina@redhat.com> - 0.1.5-1
changelog:
  - updated to latest upstream
  - allow whitespace in ALLOW_USERS and ALLOW_GROUPS in snapper's config
  - enable new pam module
  - patch: pam module installed in proper libdir


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-3
changelog:
  - enable btrfs compare using send/receive in libbtrfs
  - patch: adapt sources to change in libtrfs API (btrfs_read_and_process_send_stream)
  - Resolves: #1055579


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-5
changelog:
  - patch: Fix failure in invoking btrfs internal comparison of subvolumes
  - patch: Remove references to missing programs from man pages
  - Resolves: #1060806, #1063844


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-6
changelog:
  - patch: Add norecovery option mounting XFS read-only snapshot
  - patch: Fix ACL modification failure with XFS filesystem
  - patch: Sync SELinux context of .snapshots subvolume (btrfs only)
  - Resolves: #1064111, #1065969, #1069312


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-7
changelog:
  - patch: fix empty-pre-post cleanup algorithm
  - patch: add conditionals for btrfs library versions
  - Resolves: #1071973 #1142954


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2
changelog:
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for epel6 softhsm-v1 installs)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package which is not built on all arches
  - Enable hardened build
  - Add upstream official source url
  - Add devel package
  - Excluding i686/ppc (make check fails and we are a leave package)
  - (thanks to Petr for jumping in for the initial build while I was too busy)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)


author: Adam Stokes <ajs at redhat dot com> = 1.8-21
changelog:
  - more sanitizing options for log files
  - rhbz fixes from RHEL version merged into trunk
  - progressbar update


author: Adam Stokes <ajs at redhat dot com> = 1.9-1
changelog:
  - version bump 1.9
  - replaced compression utility with xz
  - strip threading/multiprocessing
  - simplified progress indicator
  - pylint update
  - put global vars in class container
  - unittests
  - simple profiling
  - make use of xgettext as pygettext is deprecated


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-3
changelog:
  - Fix cluster plugin dlm lockdump for el6
  - Add sssd plugin to collect configuration and logs
  - Collect /etc/anacrontab in system plugin
  - Correct handling of redhat-release for el6


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-4
changelog:
  - Fix collection of logs and config files in sssd.py
  - Add support for collecting entitlement certificates in rhn.py


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-6
changelog:
  - Fix collection of chkconfig output in startup.py
  - Collect /etc/dhcp in dhcp.py plugin
  - Collect dmsetup ls --tree output in devicemapper.py
  - Collect lsblk output in filesys.py


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-9
changelog:
  - Collect yum repository list by default
  - Add basic Infiniband plugin
  - Add plugin for scsi-target-utils iSCSI target
  - Fix autofs plugin LC_ALL usage
  - Fix collection of lsusb and add collection of -t and -v outputs
  - Extend data collection by qpidd plugin
  - Add ethtool pause, coalesce and ring (-a, -c, -g) options to network plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-10
changelog:
  - Fix collection of data from LVM2 reporting tools in devicemapper plugin
  - Add /proc/vmmemctl collection to vmware plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-11
changelog:
  - Truncate files that exceed specified size limit
  - Add support for collecting Red Hat Subscrition Manager configuration
  - Collect /etc/init on systems using upstart
  - Don't strip whitespace from output of external programs
  - Collect ipv6 neighbour table in network module
  - Collect basic cgroups configuration data


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-15
changelog:
  - Fix brctl collection when a bridge contains no interfaces
  - Fix up2dateclient path in hardware plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-16
changelog:
  - Fix execution of RHN hardware.py from hardware plugin
  - Fix hardware plugin to support new lsusb path


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-18
changelog:
  - Collect fence_virt.conf in cluster module
  - Fix collection of /proc/net directory tree
  - Gather output of cpufreq-info when present
  - Fix brctl showstp output when bridges contain multiple interfaces
  - Add /etc/modprobe.d to kernel module
  - Ensure relative symlink targets are correctly handled when copying
  - Fix satellite and proxy package detection in rhn plugin
  - Collect stderr output from external commands
  - Collect /proc/cgroups in the cgroups module
    Resolve: bz784874
  - Collect /proc/irq in the kernel module
  - Fix installed-rpms formatting for long package names
  - Add symbolic links for truncated log files
  - Collect non-standard syslog and rsyslog log files
  - Use correct paths for tomcat6 in RHN module
  - Obscure root password if present in anacond-ks.cfg
  - Do not accept embedded forward slashes in RHN usernames
  - Add new sunrpc module to collect rpcinfo for gluster systems


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-19
changelog:
  - Collect additional diagnostic information for realtime systems
  - Improve sanitization of RHN user and case number in report name
  - Fix verbose output and debug logging
  - Add basic support for CloudForms data collection
  - Add support for Subscription Asset Manager diagnostics


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-22
changelog:
  - Correct aeolus debug invocation in CloudForms module
  - Update gluster module for gluster-3.3
  - Add additional command output to gluster module
  - Add support for collecting gluster configuration and logs


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-29
changelog:
  - Collect the swift configuration directory in gluster module
  - Update IPA module and related plug-ins


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-31
changelog:
  - Avoid calling volume status when collecting gluster statedumps
  - Use a default report name if --name is empty
  - Quote tilde characters passed to shell in RPM module
  - Collect KDC and named configuration in ipa module
  - Sanitize hostname characters before using as report path
  - Collect /etc/multipath in device-mapper module
  - New plug-in for PostgreSQL
  - Add OpenStack module
  - Avoid deprecated sysctls in /proc/sys/net
  - Fix error logging when calling external programs
  - Use ip instead of ifconfig to generate network interface lists


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-32
changelog:
  - Collect /proc/pagetypeinfo in memory module
  - Strip trailing newline from command output
  - Add sanlock module
  - Do not collect archived accounting files in psacct module
  - Call spacewalk-debug from rhn module to collect satellite data


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-33
changelog:
  - Add Red Hat Update Infrastructure module
  - Collect /proc/iomem in hardware module
  - Collect subscription-manager output in general module
  - Collect rhsm log files in general module
  - Fix exception in gluster module on non-gluster systems
  - Fix exception in psql module when dbname is not given


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-35
changelog:
  - Report --name and --ticket values as defaults
  - Fix device-mapper command execution logging
  - Fix data collection and rename PostreSQL module to pgsql


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-3
changelog:
  - Add crm_report support to cluster plug-in
    Resolves: bz839342
  - Fix rhel_version() usage in cluster and s390 plug-ins
    Resolves: bz916705
  - Strip trailing newline from command output
    Resolves: bz971420


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-4
changelog:
  - Do not attempt to read RPC pseudo files in networking plug-in
    Resolves: bz996992, bz996994
  - Restrict wbinfo collection to the current domain
    Resolves: bz997101
  - Add obfuscation of luci secrets to cluster plug-in
    Resolves: bz997090
  - Add XFS plug-in
    Resolves: bz997094
  - Fix policy class handling of --tmp-dir
    Resolves: bz997083
  - Do not set batch mode if stdin is not a TTY
    Resolves: bz1002943
  - Attempt to continue when reading bad input in interactive mode
    Resolves: bz1002943


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-5
changelog:
  - Include /etc/yaboot.conf in boot plug-in
    Resolves: bz1001966
  - Fix collection of brctl output in networking plug-in
    Resolves: bz1019235
  - Verify limited set of RPM packages by default
    Resolves: bz1019863
  - Do not strip newlines from command output
    Resolves: bz1019338
  - Limit default sar data collection
    Resolves: bz1001599


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-6
changelog:
  - Remove version checks in gluster plug-in
    Resolves: bz1015606
  - Check for usable temporary directory
    Resolves: bz1019517
  - Fix --alloptions command line option
    Resolves: bz1019356
  - Fix configuration fail regression
    Resolves: bz1019516


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-7
changelog:
  - Add domainname output to NIS plug-in
    Resolves: bz1026906
  - Collect /var/log/squid in squid plug-in
    Resolves: bz1026829
  - Collect mountstats and mountinfo in filesys plug-in
    Resolves: bz1026869
  - Add PowerPC plug-in from upstream
    Resolves: bz1025236


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-9
changelog:
  - Restore --build command line option
    Resolves: bz1015599
  - Collect saved vmcore-dmesg.txt files
    Resolves: bz1026959
  - Normalize temporary directory paths
    Resolves: bz829069


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-10
changelog:
  - Add nfs client plug-in
    Resolves: bz1028072
  - Fix traceback when sar module force-enabled
    Resolves: bz1028125


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-12
changelog:
  - Fix typo in yum plug-in add_forbidden_paths
    Resolves: bz829297
  - Add krb5 plug-in and drop collection of krb5.keytab
    Resolves: bz1028150


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-15
changelog:
  - Remove debug statements from logs plugin
    Resolves: bz1030042
  - Make ethernet interface detection more robust
    Resolves: bz1030824
  - Fix specifying multiple plugin options on the command line
    Resolves: bz1031124
  - Make log and message levels match previous versions
    Resolves: bz1031126
  - Log a warning message when external commands time out
    Resolves: bz1034956
  - Remove --upload command line option
    Resolves: bz1028484
  - Update sos UI text to match upstream
    Resolves: bz1034970


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-16
changelog:
  - Add new plugin to collect OpenHPI configuration
    Resolves: bz1028121
  - Fix cluster plugin crm_report support
    Resolves: bz1030553
  - Fix file postprocessing in ldap plugin
    Resolves: bz1030602
  - Remove collection of anaconda-ks.cfg from general plugin
    Resolves: bz1034865


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-17
changelog:
  - Fix get_option use in cluster plugin
    Resolves: bz1030553
  - Fix debug logging to file when given '-v'
    Resolves: bz1031126
  - Always treat rhevm plugin's vdsmlogs option as a string
    Resolves: bz1030617
  - Run the rhsm-debug script from yum plugin
    Resolves: bz1039036


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-18
changelog:
  - Prevent file descriptor leaks when using Popen
    Resolves: bz1051009
  - Disable zip archive creation when running rhsm-debug
    Resolves: bz1039036
  - Include volume geo-replication status in gluster plugin
    Resolves: bz1036752


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-19
changelog:
  - Fix generation of volume names in gluster plugin
    Resolves: bz1036752
  - Add distupgrade plugin
    Resolves: bz1059760


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-3
changelog:
  - [pam] add pam_tally2 and faillock support
    Resolves: bz1127631
  - [postgresql] obtain db password from the environment
    Resolves: bz1126001
  - [pcp] add Performance Co-Pilot plugin
    Resolves: bz1119833
  - [nfsserver] collect /etc/exports.d
    Resolves: bz1118921
  - [sosreport] handle --compression-type correctly
    Resolves: bz1118152
  - [anaconda] redact passwords in kickstart configurations
    Resolves: bz1112175
  - [haproxy] add new plugin
    Resolves: bz1107865
  - [keepalived] add new plugin
    Resolves: bz1105247
  - [lvm2] set locking_type=0 when calling lvm commands
    Resolves: bz1102285
  - [tuned] add new plugin
    Resolves: bz1095447
  - [cgroups] collect /etc/sysconfig/cgred
    Resolves: bz1083677
  - [plugins] ensure doc text is always displayed for plugins
    Resolves: bz1065473
  - [sosreport] fix the distribution version API call
    Resolves: bz1028111
  - [docker] add new plugin
    Resolves: bz1084990
  - [openstack_*] include broken-out openstack plugins
    Resolves: bz1140756
  - [mysql] support MariaDB
    Resolves: bz1106600
  - [openstack] do not collect /var/lib/nova
    Resolves: bz1106423
  - [grub2] collect grub.cfg on UEFI systems
    Resolves: bz1086648
  - [sosreport] handle out-of-space errors gracefully
    Resolves: bz1087977
  - [firewalld] new plugin
    Resolves: bz1100505
  - [networking] collect NetworkManager status
    Resolves: bz1100505
  - [kpatch] new plugin
    Resolves: bz1110918
  - [global] update to upstream 3.2 release
    Resolves: bz1026962


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-4
changelog:
  - [yum] call rhsm-debug with --no-subscriptions
    Resolves: bz1116349
  - [powerpc] allow PowerPC plugin to run on ppc64le
    Resolves: bz1140427
  - [package] add Obsoletes for sos-plugins-openstack
    Resolves: bz1140756


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-5
changelog:
  - [corosync] add postprocessing for corosync-objctl output
    Resolves: bz1087515
  - [ovirt_hosted_engine] fix exception when force-enabled
    Resolves: bz1148551


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-6
changelog:
  - [tomcat] add support for tomcat7 and default log size limits
    Resolves: bz1148375
  - [mysql] obtain database password from the environment
    Resolves: bz1126001


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-8
changelog:
  - [kpatch] do not attempt to collect data if kpatch is not installed
    Resolves: bz1110918
  - [archive] drop support for Zip archives
    Resolves: bz1118152


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-9
changelog:
  - [navicli] catch exceptions if stdin is unreadable
    Resolves: bz1166039
  - [docs] update man page for new options
    Resolves: bz1171658
  - [sosreport] make all utf-8 handling user errors=ignore
    Resolves: bz1164267


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-11
changelog:
  - [sosreport] do not make logging calls after OSError
    Resolves: bz1087977
  - [sosreport] catch OSError exceptions in SoSReport.execute()
    Resolves: bz1087977
  - [anaconda] make useradd password regex tolerant of whitespace
    Resolves: bz1112175


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-12
changelog:
  - [plugin] limit path names to PC_NAME_MAX
    Resolves: bz1026962
  - [squid] collect files from /var/log/squid
    Resolves: bz1026962
  - [sosreport] log plugin exceptions to a file
    Resolves: bz1026962
  - [ctdb] fix collection of /etc/sysconfig/ctdb
    Resolves: bz1026962
  - [sosreport] fix silent exception handling
    Resolves: bz1026962


author: Theo Van Dinter <felicity@kluge.net>
changelog:
  - Updates for 2.01 release
  - Fixed rc file
  - RPM now buildable as non-root
  - fixed post_service errors
  - fixed provides to include perl modules
  - use file find instead of manually specifying files


author: Theo Van Dinter <felicity@kluge.net>
changelog:
  - Updated for 2.20 release
  - made /etc/mail/spamassassin a config directory so local.cf doesn't get wiped out
  - added a patch to remove findbin stuff


author: Chip Turner <cturner@redhat.com>
changelog:
  - better control of service level, improvement in %post script.
  - (contribs from schirmer@taytron.net)


author: Tim Powers <timp@redhat.com> 2.43-6
changelog:
  - don't use rpms internal dep generator
  - buildrequire perl-Time-HiRes instead of perl(Time:HiRes) so we can satisfy build deps in the build system


author: Warren Togami <wtogami@redhat.com> 2.62-2
changelog:
  - upgrade to 2.62
  - Prereq -> Requires, former is deprecated
  - Require current version of perl
  - Remove urban myth clean test
  - TODO: Get rid of prefix


author: Warren Togami <wtogami@redhat.com> 2.62-3
changelog:
  - Ville Skyttä's fixes from #113596 including:
  - Fix buildroot traces
  - enable openssl
  - Trailing slash to DESTDIR (bug 90202 comment 14).
  - export optflags so they're honored, affects spamc only.


author: Ville Skyttä <ville.skytta@iki.fi> - 2.63-8
changelog:
  - #122233
  - Require perl(:MODULE_COMPAT_*).
  - Use %{_mandir} and %{_initrddir}.
  - Fix License tag and include License in docs.
  - Backslashify multiline init script description.


author: Warren Togami <wtogami@redhat.com> - 3.0-svn20040524
changelog:
  - #123432 do not start service by default
  - #122488 remove CRLF's
  - #123706 correct license
  - svn snapshot 20040524
  - svn snapshot 20040518


author: Warren Togami <wtogami@redhat.com> - 3.0-svn20040530
changelog:
  - svn snapshot 20040530
  - #124870 prevent service startup failure due to old -a option
  - #124871 more docs
  - #124872 unowned directories


author: Warren Togami <wtogami@redhat.com> - 3.0.2-9
changelog:
  - SA#4191 uri_to_domain() is broken for urls with empty port
    SA#4232 multipart message with 0 parts -> uninitialized in m//
    SA#4121 Score for user defined rules become ignored
    SA#3944 get_envelope_from not handling received header


author: Warren Togami <wtogami@redhat.com>
changelog:
  - Options for RHEL4
      * spamc/spamd cannot connect over IPv6 or SSL
      * sa-update is disabled
    The above functionality requires perl modules not included in RHEL4.
    You may still use them if you get those perl modules from elsewhere.
    RHEL5 ships these perl modules.


author: Warren Togami <wtogami@redhat.com> - 3.3.0-0.2.alpha1
changelog:
  - Include default rules to prevent mass confusion and complaints.
    You should really use sa-update though.  Really.
    Edit /etc/cron.d/sa-update to automate it.


author: Warren Togami <wtogami@redhat.com> - 3.3.3-0.14.svn816416
changelog:
  - 3.3.0 svn816416 snapshot, pre-alpha3
    Upstream just fixed important bug SA#6206.  Many other bugs fixed since alpha2.


author: Warren Togami <wtogami@redhat.com> - 3.3.3-0.18.svn816416
changelog:
  - Enable SOUGHT ruleset in nightly sa-update http://wiki.apache.org/spamassassin/SoughtRules
    You must enable the sa-update cron job manually in /etc/cron.d/sa-update
  - Custom channels may be specified in these config files:
        /etc/mail/spamassassin/sa-update-channels.txt
        /etc/mail/spamassassin/sa-update-keys.txt


author: Warren Togami <wtogami@redhat.com> - 3.3.0-0.27.rc1
changelog:
  - sa-update runs in cron automatically if spamd or amavisd is running
    If you use neither, you may force sa-update by editing /etc/sysconfig/sa-update


author: Nick Bebout <nb@fedoraproject.org> - 3.3.2-0.4.svn1071394
changelog:
  - replace @@VERSION@@ with current saversion
  - restart spampd after sa-update cronjob runs
  - update to svn1071394


author: Kevin Fenzi <kevin@scrye.com> - 3.3.2-12
changelog:
  - Fix sa-update not detecting spamd running. Fixes bug #755644
  - Add restart=always to systemd file to work around upstream bug. Bug #812359


author: Petr Lautrbach <plautrba@redhat.com> 3.3.2-17
changelog:
  - document rawbody's split into chunks (#892350)
  - avoid using array of cleaned uris <fkrska@redhat.com> (#892348)


author: Petr Lautrbach <plautrba@redhat.com> 3.4.0-1
changelog:
  - update to 3.4.0
  - Apply fix for amavisd and spampd reloading after rules updates. Fixes bug #1145654


author: Adam Jackson <ajax@redhat.com> 0.7.39-2
changelog:
  - Rebuild to break bogus libpng dependency
  - Fix summaries for gtk3 subpackages to not talk about gtk2


author: Hans de Goede <hdegoede@redhat.com> - 0.11-4
changelog:
  - Add missing BuildRequires: usbutils, so that we get proper USB device
    descriptions in the USB device selection menu


author: Christophe Fergeau <cfergeau@redhat.com> - 0.11-5
changelog:
  - Fix build on PPC
  - Remove ExclusiveArch. While spice-gtk will build on ARM and PPC, it
    hasn't been tested on these arch, so there may be some bugs.


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.22-1
changelog:
  - Rebase to 0.22
    Resolves: rhbz#1109397
  - Fix screenshot of secondary displays
    Resolves: rhbz#1029761
  - Fix potential crash when freeing primary surface.
    Resolves: rhbz#1082555
  - Add RHEL-only SPICE_NOSCALE to disable display scaling.
    Resolves: rhbz#1067346
  - Fix connection to RHEL5 Spice server
    Resolves: rhbz#1017862
  - Fix coroutine leak
    Resolves: rhbz#1007841
  - Fix clipboard hang on clipboard loop
    Resolves: rhbz#1073364


author: Jonathon Jongsma <jjongsma@redhat.com> - 0.22-2
changelog:
  - Additional display pop out when restarting service spice-vdagentd in guest
    Resolves: rhbz#1043782
  - Coverity scan fixes
    Resolves: rhbz#885719
  - Send data message for file copy of 0 size
    Resolves: rhbz#1135104
  - add spice_channel_get_error()
    Resolves: rhbz#1116048
  - Prefix proxy lookup errors
    Resolves: rhbz#1116048


author: Hans de Goede <hdegoede@redhat.com> 0.8.0-2
changelog:
  - Make the per session agent process automatically reconnect to the system
    spice-vdagentd when the system daemon gets restarted


author: Hans de Goede <hdegoede@redhat.com> - 0.10.0-1
changelog:
  - New upstream release 0.10.0
  - This supports using systemd-logind instead of console-kit (rhbz#756398)


author: Hans de Goede <hdegoede@redhat.com> - 0.12.0-1
changelog:
  - New upstream release 0.12.0
  - This moves the tmpfiles.d to /usr/lib/tmpfiles.d (rhbz#840194)
  - This adds a systemd .service file (rhbz#848102)


author: Hans de Goede <hdegoede@redhat.com> - 0.12.0-2
changelog:
  - Fix setting of mode on non arbitrary resolution capable X driver
  - Fix wrong mouse coordinates on vms with multiple qxl devices


author: Hans de Goede <hdegoede@redhat.com> - 0.14.0-1
changelog:
  - New upstream release 0.14.0
  - Adds support for file transfers from client to guest
  - Adds manpages for spice-vdagent and spice-vdagentd


author: Hans de Goede <hdegoede@redhat.com> - 0.14.0-3
changelog:
  - Advertise clipboard line-endings for copy and paste line-ending conversion
  - Build spice-vdagentd as pie + relro


author: Hans de Goede <hdegoede@redhat.com> - 0.14.0-5
changelog:
  - Silence session agent error logging when not running in a vm (rhbz#999804)
  - Release guest clipboard ownership on client disconnect (rhbz#1003977)


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-8
changelog:
  - Fix copy and paste issues with vncclient
    Resolves: rhbz#1130218
  - Make vdagent more robust against xrandr failures
    Resolves: rhbz#1066422
  - Fix autostart of vdagent in gdm
    Resolves: rhbz#1052172


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-9
changelog:
  - Don't install rsyslog config file. This can cause duplicate logging
    to syslog in rhel6->rhel7 upgrades, and is not really useful anyway
    as the same functionality can be achieved with journald
    Resolves: rhbz#1136881


author: Christophe Fergeau <cfergeau@redhat.com> 2.8-7
changelog:
  - Adjust selinux policy to allow use of USB redirection
    Resolves: rhbz#1075173
  - Add test page to package
    Resolves: rhbz#959194


author: Gerd Hoffmann <kraxel@redhat.com> - 0.5.2-2
changelog:
  - Fix license: LGPL.
  - Cleanup specfile, drop bits not needed any more with
    recent rpm versions (F13+).
  - Use optflags as-is.
  -


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-2
changelog:
  - Various bugfixes from upstream git:
    - Make spicec work together with the Firefox XPI for RHEV-M
    - Make sure the spicec window gets properly raised when first shown


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-3
changelog:
  - Log to ~/.spicec/cegui.log rather then to CEGUI.log in the cwd, this
    fixes spicec from aborting when run in a non writable dir (#650253)


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-4
changelog:
  - Fix the info layer not showing when used through the XPI
  - Do not let the connection gui flash by when a hostname has been specified
    on the cmdline
  - Fix spice client locking up when dealing with XIM input (#654265)
  - Fix modifier keys getting stuck (#655048)
  - Fix spice client crashing when dealing with XIM ibus input (#655836)
  - Fix spice client only showing a white screen in full screen mode


author: Hans de Goede <hdegoede@redhat.com> - 0.8.0-2
changelog:
  - Fix being unable to send ctrl+alt+key when release mouse is bound to
    ctrl+alt (which can happen when used from RHEV-M)


author: Alon Levy <alevy@redhat.com>
changelog:
  - Fix mjpeg memory leak and bad behavior.
  - Add usbredir to list of channels for security purposes. (#819484)


author: Soren Sandmann <ssp@redhat.com> - 0.11.3-1
changelog:
  - Add capability patches
  - Add capability patches to the included copy of spice-protocol

      Please see the comment above Patch6 and Patch7
      regarding this situation.


author: Yonit Halperin <yhalperi@redhat.com> 0.12.4-1
changelog:
  - New upstream release 0.12.4
  - Require libjpeg-turbo-devel instead of libjpeg-devel
  - Remove "BuildRequires: spice-protocol" from spice-server
  - Add "Requires: spice-protocol" to spice-server-devel.


author: Hans de Goede <hdegoede@redhat.com> - 0.12.4-1
changelog:
  - Add patches from upstream git to fix sound-channel-free crash (rhbz#986407)
  - Add Obsoletes for dropped spice-client sub-package


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-5
changelog:
  - Fix qemu crash during migration with reboot
    Resolves: rhbz#1016795
  - Monitor whether the client is alive
    Resolves: rhbz#1016790


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-7
changelog:
  - Fix assert in mjpeg_encoder_adjust_params_to_bit_rate()
    Resolves: rhbz#1086823
  - Fix "Spice-ERROR **: reds.c:1464:reds_send_link_ack: assertion
    `link->link_mess->channel_type == SPICE_CHANNEL_MAIN' failed" assertion
    Resolves: rhbz#1058625
  - Lower a monitor-config warning to debug level
    Resolves: rhbz#1119220
  - mjpeg: Don't warn on unsupported image formats
    Resolves: rhbz#1070028


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-8
changelog:
  - Fix defects reported by Coverity
    Resolves: rhbz#885717
  - Validate surface bounding box sent from QXL driver
    Resolves: rhbz#1052856
  - Fix assertion sometimes happening during migration while a client is
    connected
    Resolves: rhbz#1035184
  - Fix crash when restarting VM with old client
    Resolves: rhbz#1145919


author: Bruno Wolff III <bruno@wolff.to> - 4.1-0.1.20100607
changelog:
  - Rebase to 4.1 prerelease with xz wrapper
  - Provides lzma compression as an option.
  - squashfs-fix-unsquashing-v3.patch is part of the 4.1 prerelease


author: Bruno Wolff III <bruno@wolff.to> - 4.1-0.3.20100803
changelog:
  - Rebase to latest upstream
  - Prevent warning message for xattr for virtual directory
  - Fix issue with large inodes - BZ 619020


author: Bruno Wolff III <bruno@wolff.to> - 4.1-0.4.20100827
changelog:
  - Rebase to latest upstream.
  - The main reason is to pick up a fix for large xattr similar to the large inode fix. This doesn't need to get backported as 4.0 doesn't have xattr support.
  - An option was added to build without xattr support.
  - Various source cleanups have been done as well.


author: Bruno Wolff III <bruno@wolff.to> - 4.2-0.1.20101223
changelog:
  - Switch to 4.2 development snapshot to get new XZ support
  - LZMA and XZ (LZMA2) support are now different


author: Bruno Wolff III <bruno@wolff.to> - 4.2-0.2.20101231
changelog:
  - Pull latest upstream snapshot
  - Includes check for matching compression type when adding to an existing image
  - Sample cvs command now includes timezone and specifies when on the date to use for the snapshot


author: Bruno Wolff III <bruno@wolff.to> - 4.2-1
changelog:
  - 4.2 is released.
  - Bugfix for bad data causing crash.
  - Include doc files added for release.
  - Big endian patch is now upstream.
  - Buildroot tag isn't needed any more.
  - We can now specify CFLAGS on the make call.
  - Compressor options are now passed with the make call.


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.1.git0be606be
changelog:
  - Pre-release of 4.3 to get early testing
  - This update includes a bit of internal code infrastructure changes
  - There are lots of fixes to better handle bad data
  - The final release is expected sometime in December
  - Until the release only the README doc file is available


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.8.gitca6a1c90
changelog:
  - Latest pre 4.3 snapshot
  - New option to display compression options used
  - Some error message improvements


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.17.git5c6f0024
changelog:
  - Latest pre 4.3 snapshot
  - Includes fix for mksquashfs hangs
  - Switch to get pre-release updates from the stable branch at kernel.org


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.18.gitaae0aff4
changelog:
  - Latest pre 4.3 stable snapshot
  - A few minor bug fixes
  - Improvements in getting status info while running unsquashfs


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-5.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-2
changelog:
  - Apply several important fixes from upstream 1.10 branch
  - Related: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-3
changelog:
  - Resolves: #983580 - Netgroups should ignore the 'use_fully_qualified_names'
                        setting


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-4
changelog:
  - Resolves: #983587 - sss_debuglevel did not increase verbosity in
                        sssd_pac.log


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.1beta2
changelog:
  - New upstream release 1.11 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0beta2
  - Related: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-1
changelog:
  - New upstream release 1.11.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.0
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-1
changelog:
  - New upstream release 1.11.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.1
  - Resolves: rhbz#991065 - Rebase SSSD to 1.11.0


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.1-2
changelog:
  - Resolves: rhbz#1019882 - RHEL7 ipa ad trusted user lookups failed with
                             sssd_be crash
  - Resolves: rhbz#1002597 - ad: unable to resolve membership when user is
                             from different domain than group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2
  - Resolves: rhbz#991065


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-2
changelog:
  - Skip netgroups that don't provide well-formed triplets
  - Related: rhbz#991549 -  sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-3
changelog:
  - Resolves: rhbz#991549 - sssd fails to retrieve netgroups with multiple
                            CN attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-4
changelog:
  - Resolves: rhbz#1031562 - Incorrect mention of access_filter in sssd-ad
                             manpage


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-5
changelog:
  - Resolves: rhbz#1033084 - sssd_be segfaults if empty grop is resolved
                             using ad_matching_rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-6
changelog:
  - Resolves: rhbz#1028057 - Improve detection of the right domain when
                             processing group with members from several domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-7
changelog:
  - Resolves: rhbz#1036157 - sssd can't retrieve auto.master when using the
                             "default_domain_suffix" option in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-9
changelog:
  - Resolves: rhbz#1036758 - SSSD: Allow for custom attributes in RDN when
                             using id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-10
changelog:
  - Resolves: rhbz#1029631 - sssd_be crashes on manually adding a cleartext
                             password to ldap_default_authtok


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-11
changelog:
  - Resolves: rhbz#1038637 - If SSSD starts offline, subdomains list is
                             never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-13
changelog:
  - Resolves: rhbz#1023409 - Valgrind sssd "Syscall param
                             socketcall.sendto(msg) points to uninitialised
                             byte(s)"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-14
changelog:
  - Resolves: rhbz#1040969 - sssd_nss grows memory footprint when netgroups
                             are requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-15
changelog:
  - Resolves: rhbz#1033096 - tokenGroups do not work reliable with Global
                             Catalog
  - Resolves: rhbz#1030483 - Individual group search returned multiple
                             results in GC lookups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-16
changelog:
  - The AD provider is able to resolve group memberships for groups with
    Global and Universal scope
  - Related: rhbz#1033096 - tokenGroups do not work reliable with Global
                            Catalog


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-17
changelog:
  - Re-initialize subdomains after provider startup
  - Related: rhbz#1038637 - If SSSD starts offline, subdomains list is
                            never read


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-21
changelog:
  - Resolves: rhbz#1048184 - Group lookup does not return member with multiple
                             names after user lookup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-22
changelog:
  - Resolves: rhbz#1032983 - sssd_be crashes when ad_access_filter uses
                             FOREST keyword.
  - Fix two memory leaks in the PAC responder (Related: rhbz#991065)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-23
changelog:
  - Resolves: rhbz#1033133 - "System Error" when invalid ad_access_filter
                              is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-25
changelog:
  - Resolves: rhbz#1053106 - sssd ad trusted sub domain do not inherit
                             fallbacks and overrides settings


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-26
changelog:
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-28
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain
  - Fix return value when searching for AD domain flat names
  - Resolves: rhbz#1048102 - Access denied for users from gc domain when
                             using format DOMAIN\user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-29
changelog:
  - Resolves: rhbz#1051360 - [FJ7.0 Bug]: [REG] sssd_be crashes when
                             ldap_search_base cannot be parsed.
  - Fix a typo in the man page
  - Related: rhbz#1034920 - RHEL7 sssd not setting IPA AD trusted user homedir


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-30
changelog:
  - Resolves: rhbz#1037653 - Enabling ldap_id_mapping doesn't exclude
                             uidNumber in filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-31
changelog:
  - Resolves: rhbz#1054899 - explicitly suggest krb5_auth_timeout in a loud
                             DEBUG message in case Kerberos authentication
                             times out


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-32
changelog:
  - Resolves: rhbz#1054639 - sssd_be aborts a request if it doesn't match
                             any configured idmap domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-34
changelog:
  - Resolves: rhbz#877438 - sudoNotBefore/sudoNotAfter not supported by sssd
                            sudoers plugin


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-35
changelog:
  - Resolves: rhbz#1028039 - AD Enumeration reads data from LDAP while
                             regular lookups connect to GC


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-36
changelog:
  - Resolves: rhbz#1059253 - Man page states default_shell option supersedes
                             other shell options but in fact override_shell does.
  - Use the right domain for AD site resolution
  - Related: rhbz#743503 -  [RFE] sssd should support DNS sites


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-38
changelog:
  - Resolves: rhbz#1059753 - Warn with a user-friendly error message when
                             permissions on sssd.conf are incorrect


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-39
changelog:
  - Resolves: rhbz#872177 - [RFE] subdomain homedir template should be
                            configurable/use flatname by default


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-40
changelog:
  - Resolves: rhbz#1033081 - Implement heuristics to detect if POSIX attributes
                             have been replicated to the Global Catalog or not


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-41
changelog:
  - Resolves: rhbz#1064582 - sss_cache does not reset the SYSDB_INITGR_EXPIRE
                             attribute when expiring users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-43
changelog:
  - Resolves: rhbz#1068640 - 'IPA: Don't call tevent_req_post outside _send'
                             should be added to RHEL7


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-44
changelog:
  - Resolves: rhbz#1033069 - Configuring two different provider types might
                             start two parallel enumeration tasks


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-45
changelog:
  - Resolves: rhbz#1067476 - SSSD pam module accepts usernames with leading
                             spaces


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-48
changelog:
  - Resolves: rhbz#1064908 - MAN: Remove misleading memberof example from
                             ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-49
changelog:
  - Resolves: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                             manually, if ID mapping configuration changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-50
changelog:
  - Pull some follow up man page fixes from upstream
  - Related: rhbz#1060389 - Document that `sssd` cache needs to be cleared
                            manually, if ID mapping configuration changes
  - Related: rhbz#1064908 - MAN: Remove misleading memberof example from
                            ldap_access_filter example


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-51
changelog:
  - Fix idmap documentation
  - Bump idmap version info
  - Related: rhbz#1067361 - Check IPA idranges before saving them to the cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-52
changelog:
  - Resolves: rhbz#1068725 - Evaluate usage of sudo LDAP provider together
                             with the AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-53
changelog:
  - Resolves: rhbz#1071903 - ipa-server-mode: Use lower-case user name
                             component in home dir path


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-54
changelog:
  - Resolves: rhbz#1072067 - SSSD Does not cache SELinux map from FreeIPA
                             correctly


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-55
changelog:
  - Resolves: rhbz#1073631 - sssd fails to handle expired passwords
                             when OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-56
changelog:
  - Related: rhbz#1072995 -  AD group inconsistency when using AD provider
                             in sssd-1.11-40


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-57
changelog:
  - Related: rhbz#1066096 - not retrieving homedirs of AD users with
                            posix attributes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-58
changelog:
  - Related: rhbz#1073635 - IPA SELinux code looks for the host in the wrong
                            sysdb subdir when a trusted user logs in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-59
changelog:
  - Related: rhbz#1075621 - Add another Kerberos error code to trigger IPA
                            password migration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-60
changelog:
  - Resolves: rhbz#1075663 - SSSD should create the SELinux mapping file
                             with format expected by pam_selinux


author: Sumit Bose <sbose@redhat.com> - 1.11.2-63
changelog:
  - Resolves: rhbz#1078877 - Valgrind: Invalid read of int while processing
                             netgroup


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-64
changelog:
  - Resolves: rhbz#1077328 - other subdomains are unavailable when joined
                             to a subdomain in the ad forest


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-65
changelog:
  - Resolves: rhbz#1082191 - RHEL7 IPA selinuxusermap hbac rule not always
                             matching


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-66
changelog:
  - Resolves: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-67
changelog:
  - Fix a DEBUG message, backport two related fixes
  - Related: rhbz#1090653 - segfault in sssd_be when second domain tree
                             users are queried while joined to child domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-68
changelog:
  - Resolves: rhbz#1097286 - Expanding home directory fails when the request
                             comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-69
changelog:
  - Backport a patch to allow krb5-utils-test to run as root
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-70
changelog:
  - Squash in upstream review comments about the PAC patch
  - Related: rhbz#1097286 - Expanding home directory fails when the request
                            comes from the PAC responder


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-2
changelog:
  - Use libsemanage for SELinux label changes
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-3
changelog:
  - Add the low-level server changes for running as unprivileged user
  - Package the libsss_semange library needed for SELinux label changes
  - Related: rhbz#1113783 - sssd should run under unprivileged user 
  - Resolves: rhbz#1113784 - sssd should audit selinux user map changes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-4
changelog:
  - Fix regressions caused by views patches when SSSD is connected to a
    pre-4.0 IPA server
  - Related: rhbz#1109756 - Rebase SSSD to 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-5
changelog:
  - Amend the sssd-ldap man page with info about lockout setup
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137014 - Shell fallback mechanism in SSSD 
  - Resolves: rhbz#790854 - 4 functions with reference leaks within sssd (src/python/pyhbac.c)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-6
changelog:
  - Include the responder and packaging patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1153518 - service lookups returned in lowercase with
                             case_sensitive=preserving
  - Resolves: rhbz#1158809 - Enumeration shows only a single group multiple
                             times


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-8
changelog:
  - Support overriding SSH public keys with views
  - Support extended attributes via the extop plugin
  - Related: rhbz#1109756 - Rebase SSSD to 1.12
  - Resolves: rhbz#1137010 - disable midpoint refresh for netgroups if ptask
                             refresh is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-9
changelog:
  - Include the ldap_child and selinux_child patches for rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-10
changelog:
  - Fix two regressions in the new selinux_child process
  - Related: rhbz#1113783 - sssd should run under unprivileged user
  - Resolves: rhbz#1132365 - Remove password from the PAM stack if OTP is used


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-12
changelog:
  - Move adding the user from pretrans to pre, copy adding the user to
    sssd-krb5-common and sssd-ipa as well in order to work around yum
    ordering issue
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-15
changelog:
  - Resolves: rhbz#1153603 - Proxy Provider: Fails to lookup case sensitive
                             users and groups with case_sensitive=preserving


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-16
changelog:
  - Use upstreamed patches for the rootless sssd
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-17
changelog:
  - Update man page to clarify TGs should be disabled with a custom search base
  - Related: rhbz#1161741 - TokenGroups for LDAP provider breaks in corner cases


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-18
changelog:
  - Support views for IPA users
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-19
changelog:
  - Resolves: rhbz#1153593 - Manpage description of case_sensitive=preserving
                            is incomplete


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-20
changelog:
  - Resolves: rhbz#1163742 - "debug_timestamps = false" and "debug_microseconds
                             = true" do not work after enabling journald
                             with sssd.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-22
changelog:
  - Handle IPA group names returned from the extop plugin
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-23
changelog:
  - Add an option that describes where to put generated krb5 files to
  - Related: rhbz#1135043 - [RFE] Implement localauth plugin for MIT krb5 1.12


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-24
changelog:
  - Resolves: rhbz#1165794 - sssd does not work with custom value of option
                             re_expression


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-25
changelog:
  - Use alternatives for libwbclient
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-26
changelog:
  - Handle migrating clients between views
  - Related: rhbz#891984 - [RFE] ID Views: Support migration from the sync
                           solution to the trust solution


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-27
changelog:
  - Resolves: rhbz#1166727 - pam_sss domains option: Untrusted users from
                             the same domain are allowed to auth.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-28
changelog:
  - Fix typo in libwbclient-devel alternatives invocation
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-30
changelog:
  - krb5_child and ldap_child do not call Kerberos calls as root
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-31
changelog:
  - Resolves: rhbz#1169739 - selinuxusermap rule does not apply to trusted
                             AD users
  - Enable running unit tests without cmocka
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-32
changelog:
  - Resolves: rhbz#1124320 - [FJ7.0 Bug]: getgrent returns error because sss
                             is written in nsswitch.conf as default.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-34
changelog:
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Remove Coverity warnings in krb5_child code
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-35
changelog:
  - Rebuild to add several forgotten Patch entries
  - Resolves: rhbz#1173482 - MAN: Document that only user names are checked
                             for pam_trusted_users
  - Resolves: rhbz#1167324 - pam_sss domains option: User auth should fail
                             when domains=<emtpy value>


author: Sumit Bose <sbose@redhat.com> - 1.12.2-37
changelog:
  - Resolves: rhbz#1169459 - sssd-ad: The man page description to enable GPO HBAC
                             Policies are unclear
  - Related: rhbz#1113783 - sssd should run under unprivileged user


author: Sumit Bose <sbose@redhat.com> - 1.12.2-38
changelog:
  - Resolves: rhbz#1171215 - Crash in function get_object_from_cache
  - Resolves: rhbz#1171383 - getent fails for posix group with AD users after
                             login
  - Resolves: rhbz#1171382 - getent of AD universal group fails after group users
                             login
  - Resolves: rhbz#1170300 - Access is not rejected for disabled domain
  - Resolves: rhbz#1162486 - Error processing external groups with
                             getgrnam/getgrgid in the server mode
  - Resolves: rhbz#1168904 - gid is overridden by uid in default trust view


author: Sumit Bose <sbose@redhat.com> - 1.12.2-39
changelog:
  - Resolves: rhbz#1175408 - SSSD should not fail authentication when only allow
                             rules are used
  - Resolves: rhbz#1175705 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-40
changelog:
  - Resolves: rhbz#1177140 - gpo_child fails if "log level" is enabled in smb.conf
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-43
changelog:
  - Resolves: rhbz#1182183 - pam_sss(sshd:auth): authentication failure with
                             user from AD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-44
changelog:
  - Resolves: rhbz#1184140 - Users saved throug extop don't have the
                             originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-45
changelog:
  - Open socket to the PAC responder in krb5_child before dropping root
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-46
changelog:
  - Handle GID override in MPG domains
  - Handle views with mixed-case domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-48
changelog:
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-49
changelog:
  - Process ghost members only once
  - Fix processing of universal groups with members from different domains
  - Related: rhbz#1168904 - gid is overridden by uid in default trust view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-50
changelog:
  - Add a patch dependency
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-51
changelog:
  - Bump the release number
  - Related: rhbz#1184140 - Users saved throug extop don't have the
                            originalMemberOf attribute


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-53
changelog:
  - Resolves: rhbz#1187192 - IPA initgroups don't work correctly in
                             non-default view


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-55
changelog:
  - Fix endianess bug in fill_id()
  - Related: rhbz#1109331 - [RFE] Allow SSSD to be used with smbd shares


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.2-57
changelog:
  - Run the restart in sssd-common posttrans
  - Explicitly require libwbclient
  - Resolves: rhbz#1187113 - sssd deamon was not running after RHEL 7.1 upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib64 in specfile for the nss and
                        pam libraries


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.0-2
changelog:
  - Fixed initialization crash of IMV and IMC particularly
    attestation imv/imc as libstrongswas was not getting initialized.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-1
changelog:
  Resolves: #1049523
  Resolves: #1036846
  Resolves: #1007548
  - Modified spec file significantly to reflect the current state of
    the package, as this rebase enables several major modules: TNC
    client and server (IF-TNCCS), IMC-IMV (IF-M), PT-TLS (RFC 6876),
    SWID IMC/IMV, charon daemon and it related libs and modules,
    tnc-pdp, tnc-ifmap plugins.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-2
changelog:
  Resolves: #1049523
  Resolves: #1036846
  Resolves: #1007548
  - A typo caused a patch not being applied, so fixed that and
    bumping the number number.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-4
changelog:
  Resolves:#1067119
  - Fixed full hardening for strongswan (full relro and PIE).
    The previous macros had a typo and did not work
    (see bz#1067119).
  - Fixed files permissions for executables and config files to
    correctly reflect their intent.
  - Fixed tnc package description to eliminate rpmlint errors.
  - Fixed pki binary and moved it to /usr/libexece/strongswan as
    others binaries are there too to eliminate rpmlint errors.
  - Fixed systemd service name to "strongimv TNC".
  - Removed the dependency on gmp-devel


author: Avesh Agarwal <avagarwa@redhat.com> - 5.2.0-1
changelog:
  Resolves: #1120371
  - Rebase to new upstream release 5.2.0
  - IMA/TPM based remote attestation
  - Aikgen tool to generate an Attestation Identity Key bound
    to a TPM
  - PT-EAP transport protocol (RFC 7171) for TNC
  - Enabled support for acert for checking X509 attribute certificate
  - Updates local patches
  - Spec file update
  - openac tool replaced with pki --acert


author: William Poteat <wpoteat@redhat.com> 0.98.4-1
changelog:
  - 740788: Getting error with quantity subscribe using subscription-assitance
    page. (wpoteat@redhat.com)
  - 755130: add extra whitespace to classic warning (cduryee@redhat.com)
  - 759199: rhsmcertd is logging the wrong value for certFrequency
    (cduryee@redhat.com)
  - 758471: install-num-migrate-to-rhsm threw traceback when no instnum was
    found. (awood@redhat.com)
  - 752572: add interval logging statements back in on rhsmcertd startup
    (cduryee@redhat.com)
  - 756507: do not use output from "getlocale" as input for "setlocale"
    (cduryee@redhat.com)
  - 746259: Don't allow the user to pass in an empty string as an activation key
    (awood@redhat.com)
  - 705883: Fix error dialog modal issues. (dgoodwin@redhat.com)
  - 756173: Unexpected behavoir change in subscription-manager unregister
    (wpoteat@redhat.com)
  - 746732: Only use fallback locales for dates we need to parse
    (alikins@redhat.com)
  - 753093: The available subscriptions count does not show correctly in
    Subscription Manager GUI (wpoteat@redhat.com)
  - 749636: Client should not support users entering activation keys and existing
    consumer ids (bkearney@redhat.com)
  - 719743: Improved text output for successful pool subscription
    (bkearney@redhat.com)
  - 755541: Enhanced the message in the katello plugin to debug when the backend
    system does not support environments. (bkearney@redhat.com)
  - 755035: Migration script should work on RHEL 5.7 and up. (awood@redhat.com)
  - 749332: Normalize the error messages for not being registered
    (bkearney@redhat.com)
  - 754821: Default org of "Unknown" was not marked for gettext
    (alikins@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.98.6-1
changelog:
  - 755031: Update to Subscription Assistant quantity check in unlimited pool
    case. (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.98.8-1
changelog:
  - 755861: Fixed quantity selection issue due to older version of pygtk on 5.8.
    (mstead@redhat.com)
  - 765905: add man pages for subscription-manager-migration (cduryee@redhat.com)


author: Devan Goodwin <dgoodwin@redhat.com> 0.99.2-1
changelog:
  - Initial Fedora build. (dgoodwin@redhat.com)
  - 754425: Remove grace period logic (jbowes@redhat.com)
  - 766577: Fix error on "redeem" with multibyte lang (alikins@redhat.com)
  - Add README.Fedora to Fedora builds (cduryee@redhat.com)
  - 757697: report xen dom0 as host, not guest (cduryee@redhat.com)
  - 747014: Help icon was not working in RHEL 5. (awood@redhat.com)
  - 767754: Invalid certificate status when stacked entitlements have overlapping
    dates (wpoteat@redhat.com)
  - 745995: Ensure default quantity calc does not include future entitlements.
    (mstead@redhat.com)
  - 760017: Display a friendly message when an invalid installation number is
    encountered. (awood@redhat.com)
  - 758162: allow --force to override missing mappings (cduryee@redhat.com)
  - 759069: catch exception when enabling invalid repositories
    (cduryee@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.99.3-1
changelog:
  - 768983: don't purge future dated entitlements (jbowes@redhat.com)
  - 769642: confusing output from rhn-migrate-to-rhsm when autosubscribe fails
    (cduryee@redhat.com)
  - 769433: make rhel5 firstboot modules use bound gettext (alikins@redhat.com)
  - Custom facts should be loaded after hardware facts. (awood@redhat.com)
  - 745973: Fixed missing product icons for partially stacked future entitlement.
    (mstead@redhat.com)
  - 769433: Tag the module names as gettext (alikins@redhat.com)
  - 761478: Facts viewed in the GUI were getting out of date when system
    entitlement status changed. (awood@redhat.com)
  - 761133: Support fixing yellow state in compliance assistant.
    (dgoodwin@redhat.com)
  - 766577: use unicode strings for possible server errors (alikins@redhat.com)
  - 768415: remove hardcoded reference to x86_64 for extra channel enablement
    (cduryee@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.99.4-1
changelog:
  - 766778: Improvements on quantity spinner max value entry. (mstead@redhat.com)
  - 736465: "Product's Subscription Details" in the gui is neglecting stack
    subscriptions (wpoteat@redhat.com)
  - 772209: install-num-migrate-to-rhsm does not work on x86 arch
    (cduryee@redhat.com)
  - 761140: enable the help button in firstboot (jbowes@redhat.com)
  - 771726: Rename man manpage for rhsm-compliance-icon to rhsm-icon.
    (bkearney@redhat.com)
  - 758038: Guest's system facts displays "virt.uuid: Unknown"
    (wpoteat@redhat.com)
  - 767265: Always send up the list of packages on registration.
    (awood@redhat.com)
  - 768983: show future subs in list --consumed (jbowes@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.5-1
changelog:
  - Updated releasers.conf for rhel-6.3 (mstead@redhat.com)
  - Making return code from subscribe --pool consistent with subscribe --auto
    (awood@redhat.com)
  - 785018: Corrected help text for --no-auto. (awood@redhat.com)
  - 656944: List IPv6 information in facts. (awood@redhat.com)
  - 689608: Subscription failure should result in a return code of 1.
    (awood@redhat.com)
  - 772921: Do not show message dialog when multiple sub-man launches detected.
    (mstead@redhat.com)
  - 772921: Clicking notification icon shuts down subscription manager.
    (mstead@redhat.com)
  - 734533: Failure to import should result in a return code of 1.
    (awood@redhat.com)
  - 782549: Subscription manager throws exception when an expired cert exists.
    (mstead@redhat.com)
  - 772338: Subscription-manager-gui help documentation review
    (wpoteat@redhat.com)
  - 772338: subscription-manager-gui Help documentation needs a review
    (wpoteat@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - 781510: 'subscription-manager clean' should delete redhat.repo
    (awood@redhat.com)
  - 771726: Man page for rhsm-compliance-icon should be re-authored to rhsm-icon
    (wpoteat@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.99.6-1
changelog:
  - 783542: Return code for bad input to install-num-migrate-to-rhsm should be 1.
    (awood@redhat.com)
  - 773707: remove hard coded reference to /etc/pki/product (cduryee@redhat.com)
  - 783278: do not alter system facts on dry run (cduryee@redhat.com)
  - IPv4 and IPv6 facts that are undefined should return 'Unknown' instead of
    'None'. (awood@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.7-1
changelog:
  - Improve relevancy of details on my installed products tab.
    (dgoodwin@redhat.com)
  - 719743: Added better punctuation to one status message (bkearney@redhat.com)
  - Have client check sockets on non-stacked entitlements as well.
    (dgoodwin@redhat.com)
  - New date compare implemetation for determining start/end dates
    (mstead@redhat.com)
  - Add "zanata-pull" and "zanata-push" makefile targets (alikins@redhat.com)
  - as_IN seems busted on RHEL6, so skip it (alikins@redhat.com)
  - pep8/make stylish cleanups (alikins@redhat.com)
  - 741155: Fixed start/end date calculations for My Installed Software tab
    (mstead@redhat.com)
  - fixes for po files from zanata (alikins@redhat.com)
  - new po files from zanata (alikins@redhat.com)
  - 767620: Add manage_repos config option. (dgoodwin@redhat.com)
  - 784031: remove katello plugin (cduryee@redhat.com)
  - Make return code from import consistent with subscribe. (awood@redhat.com)
  - Add Fedora release target. (dgoodwin@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.99.8-1
changelog:
  - 790205: do not lay down install-num-migrate-to-rhsm on rhel6 systems
    (cduryee@redhat.com)
  - latest translations from zanata (alikins@redhat.com)
  - 795541: Change the environment filtering which is being done on the client
    side (bkearney@redhat.com)
  - Add consumer deleted on server detection. (jbowes@redhat.com)
  - Fix spec for both Fedora 15+ and RHEL 7+. (dgoodwin@redhat.com)
  - Fix Makefile for both Fedora 15+ and RHEL 7+. (dgoodwin@redhat.com)
  - Add service level to register and subscribe CLI commands.
    (dgoodwin@redhat.com)
  - Add service-level CLI command. (dgoodwin@redhat.com)
  - delete consumer on rhsmcertd checkin (jbowes@redhat.com)
  - pull out rhsmcertd python worker to its own file (jbowes@redhat.com)
  - clean up some compiler warnings in rhsmcertd (jbowes@redhat.com)
  - String cleanups (alikins@redhat.com)
  - 790217: install-num-migrate-to-rhsm shouldn't copy both Desktop and
    Workstation product certs. (awood@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.9-1
changelog:
  - Updating required version of python-rhsm (mstead@redhat.com)
  - fixes for po files (alikins@redhat.com)
  - latest translations from zanata (alikins@redhat.com)
  - 799394: Do not attempt to remove redhat.repo if it does not exist.
    (awood@redhat.com)
  - 800121: do not attempt to call UEP when system is unregistered
    (cduryee@redhat.com)
  - 799271: The usage string for service-levels contained the incorrect command
    name (bkearney@redhat.com)
  - 799271: The usage string for service-levels contained the incorrect command
    name (bkearney@redhat.com)
  - 704408: date field patch fixes per jbowes (cduryee@redhat.com)
  - 797243: make unregister finish updating repos (alikins@redhat.com)
  - 704408: allow users to clear the date box for contract searches
    (cduryee@redhat.com)
  - 799316: Re-add librsvg2 dependency (dgoodwin@redhat.com)
  - 797996: Add manage_repos setting to default rhsm.conf (dgoodwin@redhat.com)
  - 795564: Add a newline at the end of the options error (bkearney@redhat.com)
  - 752756: Cache the facts, and refresh the validity facts whenever they change.
    (bkearney@redhat.com)
  - Return a consistent scope for public IPv6 addresses across EL5 and EL6.
    (awood@redhat.com)
  - 737773: Do not show the forgotten password url as a link.
    (bkearney@redhat.com)
  - Fixing broken tests due to leap year. (mstead@redhat.com)
  - Explicitly define el5 macro in spec file. (dgoodwin@redhat.com)
  - 796730: Improve the clarity of the usage statement (bkearney@redhat.com)
  - 767790: Improve the messaging when a system is not registered.
    (bkearney@redhat.com)
  - 797294: Typo in commit caused execution error. (bkearney@redhat.com)
  - 796756: use only the basename for the usage string (bkearney@redhat.com)
  - 796756: The usage string should be less verbose to be more consistent with
    the other executable files (bkearney@redhat.com)
  - CLI service-levels touchups. (dgoodwin@redhat.com)
  - 656896: remove attribute 'swapped' (msuchy@redhat.com)
  - Release to Fedora 17 branch as well. (dgoodwin@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.10-1
changelog:
  - latest strings from zanata (alikins@redhat.com)
  - 801434: Add at-spi accessibility name to calendar selection widget.
    (awood@redhat.com)
  - 800917: Display service level and type in All Subs tab (dgoodwin@redhat.com)
  - Add support for "release" command (alikins@redhat.com)
  - 801517: Missed translating a label during the registration process
    (bkearney@redhat.com)
  - 801513: One translation had a copy/paste error (bkearney@redhat.com)
  - The migration script should write default proxy auth settings.
    (awood@redhat.com)
  - Revert "801513: A replacement variable was used in a translation file where
    it was not needed" (dgoodwin@redhat.com)
  - 801545: Break apart the string to make them easier for the translators
    (bkearney@redhat.com)
  - 801513: A replacement variable was used in a translation file where it was
    not needed (bkearney@redhat.com)
  - 798015: Migration script should play nicely with proxies. (awood@redhat.com)
  - 742033: Unsubscribe button is not greyed out when nothing is selected
    (wpoteat@redhat.com)
  - 783990: Handle network errors when migrating. (awood@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.11-1
changelog:
  - 805906: fix missing imports for firstboot (jbowes@redhat.com)
  - Fix RHEL6 firstboot attribute error (dgoodwin@redhat.com)
  - 772218: throw an error if unparsed command line options exist
    (cduryee@redhat.com)
  - Add missing imports to rhsm_login for error dialogs (jbowes@redhat.com)
  - 803386: Display product ID in GUI and CLI. (awood@redhat.com)
  - Fix specfile for el5 firstboot (jbowes@redhat.com)
  - 804227,804076,804228: Handle 404's from old candlepin servers without
    /release (alikins@redhat.com)
  - 803778: Updated the --servicelevel not supported messages for subscribe
    command (mstead@redhat.com)
  - 803778: Updated the --servicelevel not supported messages for register
    command (mstead@redhat.com)
  - 803756,803762: Updated error message for service-level command
    (mstead@redhat.com)
  - fixups for strings from zanata (alikins@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - 789007: Migration should fail early when attempted with non org admin user.
    (awood@redhat.com)
  - 805024: Hide extra separator along with redeem button. (awood@redhat.com)
  - 800999: Added --servicelevel arg to CLI list command (mstead@redhat.com)
  - 804227: Fix issues with repos --list (alikins@redhat.com)
  - Add proper back/forward logic for firstboot sla subscribe (jbowes@redhat.com)
  - 800933: Display service level and type in CLI list commands.
    (dgoodwin@redhat.com)
  - 789008: Print a more specific error message when Candlepin calls fail.
    (awood@redhat.com)
  - hook up sla firstboot to more registration cases (jbowes@redhat.com)
  - Define globals at module scope. (awood@redhat.com)
  - Remove firstboot subscriptions module (jbowes@redhat.com)
  - Fix broken tests for DST. Stop using time.time() (alikins@redhat.com)
  - Add error cases for firstboot autobind (jbowes@redhat.com)
  - Perform the actual entitlement bind on confirm subs screen
    (jbowes@redhat.com)
  - Set up shared state for AutobindController in firstboot (jbowes@redhat.com)
  - Extract a controller class for sla select logic (jbowes@redhat.com)
  - Break apart autobind first boot module (jbowes@redhat.com)
  - Add some autobind wizard button spacing. (dgoodwin@redhat.com)
  - Always update the icon and notification details on status change.
    (mstead@redhat.com)
  - Only add icon click listeners once. (mstead@redhat.com)
  - Adding notification nag icon support for Registration Required
    (mstead@redhat.com)
  - add firstboot rhsm_autobind to spec file (jbowes@redhat.com)
  - Autobind cancel during registration will now unregister you.
    (dgoodwin@redhat.com)
  - Update CLI to handle server that doesn't support service levels.
    (dgoodwin@redhat.com)
  - Move back/forward/cancel buttons in sla selection to parent
    (jbowes@redhat.com)
  - Revert "Update CLI to handle server that doesn't support service levels."
    (dgoodwin@redhat.com)
  - Update GUI to handle server that does not support service levels.
    (dgoodwin@redhat.com)
  - Update CLI to handle server that doesn't support service levels.
    (dgoodwin@redhat.com)
  - Add autobind screen to firstboot (jbowes@redhat.com)
  - Fix firstboot unregister import error. (dgoodwin@redhat.com)
  - Add missing spacers to main window toolbar. (dgoodwin@redhat.com)
  - Fix an error handling bug. (dgoodwin@redhat.com)
  - Get register screen working in el6 firstboot (jbowes@redhat.com)
  - Center wizard's error dialog on main window (mstead@redhat.com)
  - Removing commented out code in register dialog (mstead@redhat.com)
  - Add skip option instead of autobind in register dialog. (mstead@redhat.com)
  - Fix preferences dialog error when not registered. (dgoodwin@redhat.com)
  - Improved error handling for autobind wizard. (dgoodwin@rm-rf.ca)
  - Fix message window warnings. (dgoodwin@rm-rf.ca)
  - Fix alignment on select SLA screen. (dgoodwin@redhat.com)
  - Display the service level selected when confirming autobind subs (dgoodwin
    @rm-rf.ca)
  - Implement Cancel button on autobind wizard screens. (dgoodwin@redhat.com)
  - Allow setting service level from preferences dialog. (dgoodwin@redhat.com)
  - First cut at a preferences dialog. (dgoodwin@redhat.com)
  - Pack SLA's into a scrolled window. (dgoodwin@rm-rf.ca)
  - Handle any exception that happens when the autobind wizard is loaded.
    (mstead@redhat.com)
  - Setting parent window on AutobindDialog and add titles to screens.
    (mstead@redhat.com)
  - Integrating autobind wizard with register gui. (mstead@redhat.com)
  - Fix autobind wizard disappearing on window switch. (dgoodwin@redhat.com)
  - Do not set SLA until user hit's subscribe button. (dgoodwin@redhat.com)
  - Polish autobind glade UI (dgoodwin@redhat.com)
  - Set and use the system's service level. (dgoodwin@redhat.com)
  - Cleaning up Select SLA screen (mstead@redhat.com)
  - Added framework for back button support (mstead@redhat.com)
  - Handle no SLAs cover all installed products. (dgoodwin@rm-rf.ca)
  - Handle launching autobind when no entitlements needed. (dgoodwin@rm-rf.ca)
  - Set detected prod list in Select SLA screen (mstead@redhat.com)
  - Close autobind wizard once complete. (dgoodwin@redhat.com)
  - Hookup actual bind in autobind wizard. (dgoodwin@redhat.com)
  - SelectSLA now keeps track of selected SLA and pass to confirm dialog.
    (mstead@redhat.com)
  - Load the autobind glade file on wizard creation. (mstead@redhat.com)
  - Switch to more explicit screen switching. (dgoodwin@redhat.com)
  - Set screen title when screen is changed. (mstead@redhat.com)
  - Allow screens to pass custum data during wizard screen change.
    (mstead@redhat.com)
  - Hooking up button signals for selectsla (mstead@redhat.com)
  - Add callback to allow screen change in wizard (mstead@redhat.com)
  - Fixing broken tests due to leap year. (mstead@redhat.com)
  - Attempt to keep button bar right aligned. (mstead@redhat.com)
  - Removed the button bar form the wizard. (mstead@redhat.com)
  - Created AutobindWizardScreen to provide contract for AutobindWizard
    (mstead@redhat.com)
  - Display appropriate screen in SLA wizard. (mstead@redhat.com)
  - Fixed GtkWarning: IA__gtk_widget_reparent error when launchig dialog
    (mstead@redhat.com)
  - First cut at adding the Select SLA screen. (mstead@redhat.com)
  - Check if dry-run results cover required products. (dgoodwin@redhat.com)
  - Check dry run autobind results for each service level. (dgoodwin@redhat.com)
  - Sketch out an autobind wizard class. (dgoodwin@redhat.com)
  - Start sketching out the confirm subscriptions screen. (dgoodwin@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.12-1
changelog:
  - Don't skip past firstboot login page on invalid user/pass (jbowes@redhat.com)
  - 805690: Turn repo gpgcheck off if no gpgkey specified. (dgoodwin@redhat.com)
  - 795552: Put safe int conversions around certain fact checks.
    (bkearney@redhat.com)
  - 804100: display an error when candlepin doesn't support release
    (jbowes@redhat.com)
  - 804227: expect a Release object instead of a bare string (alikins@redhat.com)
  - Latest string files from zanata (bkearney@redhat.com)
  - 805450: display better error message when autosubscribing
    (cduryee@redhat.com)
  - 805594: Give each "Subscribe" button in the GUI a unique at-spi name.
    (awood@redhat.com)
  - 803374: Provide unambiguous at-spi names for widgets. (awood@redhat.com)
  - 805353: subscription-manager list --help should use consistent wording for
    servicelevel option. (awood@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.13-1
changelog:
  - latest strings into keys.pot and updated from zanata (alikins@redhat.com)
  - 809611: Fix undefined variable in installedtab for expired
    (alikins@redhat.com)
  - pep8/pyflakes cleanups (alikins@redhat.com)
  - Repolib now requires a UEP connection. (awood@redhat.com)
  - Use numeric index to access portion of URL. (awood@redhat.com)
  - 807785: use a better title on the autobind wizard (jbowes@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - Add release selection to preferences dialog (alikins@redhat.com)
  - 805415: handle entitlements for socket count of 0 (alikins@redhat.com)
  - 804201: Fix sla select in firstboot after back button (jbowes@redhat.com)
  - 807477: Delay attempt to connect to RHN until after basic error checks.
    (awood@redhat.com)
  - 803374: Change the 'Subscribe' button to read 'Auto-subscribe.'
    (awood@redhat.com)
  - 808217: Add a header to the release list (bkearney@redhat.com)
  - 807153: Provide a more informative error message when encountering repodata
    errors. (awood@redhat.com)
  - 807822: Allow setting release to '' (mstead@redhat.com)
  - 807036: Instruct users to go to All Subscriptions for all SLA failures
    (bkearney@redhat.com)
  - 807407: Subscripton Manager substitutes "" for $releasever when releaseVer
    not set on consumer (wpoteat@redhat.com)
  - 803756: Trap RemoteServerException as well as RestLibException (404) for
    service-level command (mstead@redhat.com)
  - 806941: Removed unknown swapped attribute from autobind.glade.
    (mstead@redhat.com)
  - 807360: Allow the repos command to work without being registered
    (bkearney@redhat.com)
  - 806457: Fix deletion of productids with yum localinstall (alikins@redhat.com)


author: Michael Stead <mstead@redhat.com> 1.0.1-1
changelog:
  - latest strings from zanata (alikins@redhat.com)
  - add test cases for autobind.py (alikins@redhat.com)
  - pep8 and pyflakes cleanups (jbowes@redhat.com)
  - 815563: Remove incorrect at-spi locators. (awood@redhat.com)
  - 795541: Environment command should omit the Library from katello
    (bkearney@redhat.com)
  - 806993: Tolerate the provision of a scheme with the proxy string.
    (awood@redhat.com)
  - remove remnants of subscription_assistant.py (alikins@redhat.com)
  - 811952: Don't try to unsubscribe old ents if we register (alikins@redhat.com)
  - 811952: Handle errors on unsubscribing ent certs (alikins@redhat.com)
  - 812929: Fix issue with selected sla not being in suitable_slas
    (mstead@redhat.com)
  - 812897: Use consistent casing for the word "Error" (awood@redhat.com)
  - Improve preferences dialog error message. (dgoodwin@redhat.com)
  - 811863: Handle unforseen errors in preferences dialog. (dgoodwin@redhat.com)
  - 811340: Select the first product in My Installed Software table by default.
    (awood@redhat.com)
  - 811594: The config, repos, and facts commands should default to --list if no
    options are provided. (awood@redhat.com)
  - 812104: add "release" and "service-level" to completion (alikins@redhat.com)
  - 801434: Add at-spi accessibility name to calendar widget. (awood@redhat.com)
  - updates to man pages (deon@deonlackey.com)
  - 811591: Use consistent messages for not being registered
    (bkearney@redhat.com)
  - Updated the --servicelevel option description (deon@deonlackey.com)
  - Use numeric index to access value returned by urlparse. (awood@redhat.com)
  - 790579: Show translations for errors thrown by installation number parsing.
    (awood@redhat.com)
  - adding --servicelevel option to list command (deon@deonlackey.com)
  - 810306: Improved messaging in firstboot (mstead@redhat.com)
  - 811337: unregister any time we return to rhsm_login (jbowes@redhat.com)
  - 807153: Allow more aggressive deletion of product certs. (awood@redhat.com)
  - 810399: require the latest rhn-setup-gnome for firstboot (alikins@redhat.com)
  - 810290: use correct calculation for "Next update" time in sm-gui
    (cduryee@redhat.com)
  - 810363: handle socket errors for bad proxy host in firstboot
    (alikins@redhat.com)
  - Latest man page and documentation (dlackey@redhat.com)
  - 809989: Add the shortened password url to the strings files.
    (bkearney@redhat.com)
  - 809989: Add a shorter URL to the registration screen (bkearney@redhat.com)
  - rev the zanata version to 1.0.X (alikins@redhat.com)
  - Incrementing version number after 6.3 branch. (mstead@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.0.2-1
changelog:
  - Updating strings from zanata (mstead@redhat.com)
  - Add new server setup GUI screen. (dgoodwin@redhat.com)
  - Add new server setup CLI options. (alikins@redhat.com)
  - 813296: Remove check for candlepin_version (jbowes@redhat.com)
  - Allow importing multiple subscriptions at once (jbowes@redhat.com)
  - 820170: Subscription Manager release --list should display "not supported"
    message for older candlepin. (wpoteat@redhat.com)
  - 817938: Make columns in subscription-manager tables sortable.
    (awood@redhat.com)
  - 812153: Release command should have a --show command which is the default.
    (wpoteat@redhat.com)
  - 820080: Fix "Configuration" spelling on firstboot page (alikins@redhat.com)
  - Set the parent window for the about dialog (mstead@redhat.com)
  - removing a sentence from the manpage about working on RHEL 5.8 and later,
    bz820765 (deon@deonlackey.com)
  - 821024: Properly handle ESC on preferences dialog (mstead@redhat.com)
  - Replaced toolbar with menubar. (mstead@redhat.com)
  - 820040,820037,820030: don't break multibyte help blurbs (alikins@redhat.com)
  - 817036: Add a version command to subscription-manager. (awood@redhat.com)
  - The unbindAll command now returns JSON. (awood@redhat.com)
  - Explain the conditional imports more accurately. (alikins@redhat.com)
  - Print different message when subscribing to no service level.
    (awood@redhat.com)
  - remove deprecated use of "md5" module (alikins@redhat.com)
  - Enable and disable available repos on client machine from Subscription
    Manager CLI (wpoteat@redhat.com)
  - 790939: Add SLA to rhn-migrate-classic-to-rhsm. (awood@redhat.com)
  - 812388: Show the number of entitlements unsubscribed from. (awood@redhat.com)
  - 818298: release --list should not display rhel-5 when only rhel-6 product is
    installed (wpoteat@redhat.com)
  - 810236: Update facts after registering with --consumerid.
    (dgoodwin@redhat.com)
  - 818461: invalid date format error when using or_IN.UTF-8 (cduryee@redhat.com)
  - Store date of migration in migration facts for rhn-migrate-classic-to-rhsm.
    (awood@redhat.com)
  - Unify our el5 and el6 firstboot modules (jbowes@redhat.com)
  - add a gconf setting for users who do not want to use the icon
    (cduryee@redhat.com)
  - do not use the gui by default when migrating (cduryee@redhat.com)
  - Allow service level change for consumer via CLI independent of other calls.
    (wpoteat@redhat.com)
  - 815479: Incorrect owner should be relayed on service level list call.
    (wpoteat@redhat.com)
  - 817390: add completion support for servicelevel (alikins@redhat.com)
  - 817117: fix completion of environment command (alikins@redhat.com)
  - 816377: handle cert migration data being missing (alikins@redhat.com)
  - Store date of migration and installation number in migration facts.
    (awood@redhat.com)
  - Fixing registration error when loading SlaWizard (mstead@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.3-1
changelog:
  - 817938: Add sorting to the contract selection table. (awood@redhat.com)
  - 822706: gtk widget visibility toggle compat for el5 (jbowes@repl.ca)
  - 822706: Display Register button on Installed Product tab if not registered.
    (mstead@redhat.com)
  - 825286: Handle unset service levels in a manner similar to unset release
    versions. (awood@redhat.com)
  - 826735: Merge start/end date sub details into one row. (dgoodwin@redhat.com)
  - fix make stylish (jbowes@repl.ca)
  - 811593: Feedback when not providing command options is not consistent.
    (wpoteat@redhat.com)
  - 806986: Subscription-Manager should refer to subscription name and product
    name. (wpoteat@redhat.com)
  - 825737: Service-level --set should configure proper value for GUI
    (wpoteat@redhat.com)
  - 817901: Disable the match installed products filter. (dgoodwin@redhat.com)
  - Remove unecessary use of lambda. (dgoodwin@redhat.com)
  - 818282: Sort virtual subscriptions to the top of contract selector.
    (dgoodwin@redhat.com)
  - 818383: display better messages for yum plugin usage (cduryee@redhat.com)
  - Fix logging of deleted expired certs (jbowes@repl.ca)
  - Remove the constants module (jbowes@repl.ca)
  - Remove useless format specifier (jbowes@repl.ca)
  - 801187: condense list --consumed output (jbowes@repl.ca)
  - Don't use kwargs for cli subclasses; it makes things shorter (jbowes@repl.ca)
  - Remove desc cli argument, no module used it (jbowes@repl.ca)
  - Use super for cli module init (jbowes@repl.ca)
  - Clean up rpmlint messages (jbowes@repl.ca)
  - Autogenerate the cli usage message (jbowes@repl.ca)
  - Remove obsolete nose tests (jbowes@repl.ca)
  - 812410: Show product name on CLI subscribe to pool. (dgoodwin@redhat.com)
  - 824680: make init script status return proper exit code (alikins@redhat.com)
  - fix nosetests for progress gui (jbowes@repl.ca)
  - Rework urlparse calls to work with RHEL 5. (awood@redhat.com)
  - 818238: Set a better progress title for sub search (jbowes@repl.ca)
  - 771756: Drop "rhsm icon" from the rhsm-icon usage message (jbowes@repl.ca)
  - 820294: Let candlepin handle org/env/key validation (jbowes@repl.ca)
  - 818397: Rename subscription-manager-gnome to -gui (jbowes@repl.ca)
  - Reduce wordiness of version command. (awood@redhat.com)
  - 824333: use rhel5-friendly urlparse options (cduryee@redhat.com)
  - Log the program versions when starting the GUI or making a CLI call.
    (awood@redhat.com)
  - Fix the About dialog to work in RHEL 5.8 (awood@redhat.com)
  - 821544: Remove the stacking id attribute from my susbcriptions since it is
    not being used currently. (bkearney@redhat.com)
  - add checkcommits exception for 824100 (alikins@redhat.com)
  - 824100: update zanata.xml to grab latest pt_BR.po (alikins@redhat.com)
  - 822057: do not hard-code cdn to port 443 (cduryee@redhat.com)
  - Display sane error on CLI if missing CA certificate. (dgoodwin@redhat.com)
  - Display sane error in GUI if missing CA certificate. (dgoodwin@redhat.com)
  - 812373: Terminology change for list --installed and --consumed
    (wpoteat@redhat.com)
  - zanata client will push any po/*.pot files it finds. Stop.
    (alikins@redhat.com)
  - 789182: Fix UnicodeEncodeError when logging. (awood@redhat.com)
  - README for github and people who like to read (alikins@redhat.com)
  - checkcommits exception for xgettext patch fixed in master
    (alikins@redhat.com)
  - 820743: Fix these strings so xgettext finds extracts them
    (alikins@redhat.com)
  - refine the regex for "make gettext_lint" (alikins@redhat.com)
  - Upload el6 yum packages to another dir for compatability.
    (dgoodwin@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.4-1
changelog:
  - 818978: Use systemd instead of sysv when installing on F17+ and RHEL7+.
    (mstead@redhat.com)
  - 827035: update identity certificate (jmrodri@gmail.com)
  - registergui: make screens without guis more generic (jbowes@redhat.com)
  - Incorrect field value removed on previous change (wpoteat@redhat.com)
  - 829812: Add an unset command for the release command (bkearney@redhat.com)
  - 823659: Update SLA text in Settings to Service Level (wpoteat@redhat.com)
  - Use a temp file for finding used widgets (jbowes@redhat.com)
  - clean up some unused import warnings (jbowes@redhat.com)
  - default to running style checks on tests (jbowes@redhat.com)
  - Make test cases stylish as well... (alikins@redhat.com)
  - Fix "make stylish" (alikins@redhat.com)
  - 829803: Added an unset command to service level. (bkearney@redhat.com)
  - Remove reference to InstalledProductsTab.product_id_text (alikins@redhat.com)
  - Add a "find-missing-widgets" target to makefile (alikins@redhat.com)
  - 830949: add accessibility locators for registration widgets
    (alikins@redhat.com)
  - 824979: No message for subscription-manager release --list with no
    subscriptions. (wpoteat@redhat.com)
  - Added UnRegisterCommand and UnSubscribeCommand nosetests (wpoteat@redhat.com)
  - registergui: get firstboot working with new new code (jbowes@repl.ca)
  - registergui: Create a PreformRegisterScreen class (jbowes@repl.ca)
  - registergui: add a post method for setting data on the parent
    (jbowes@repl.ca)
  - registergui: create a 'pre' hook for screens (jbowes@repl.ca)
    (cduryee@redhat.com)
  - 819665: print msg if user is registered to RHN Classic on "identity" command
    (cduryee@redhat.com)
    (wpoteat@redhat.com)
  - Add F17 yum repo release target. (dgoodwin@redhat.com)
  - fix make stylish (jbowes@redhat.com)
  - 810352: Disable the expansion of the system name selection in the register
    dialog (bkearney@redhat.com)
  - 824530: add test case for setting proxy cli for release (alikins@redhat.com)
  - rhsm-icon codestyle cleanups (jbowes@repl.ca)
  - 829900: Use the term 'Subscription Management Service' to refer to SAM, CFSE,
    etc (root@bkearney.(none))
  - 829898: Make the no service level option a bit clearer as to its meaning
    (bkearney@redhat.com)
  - Improve the logging so that the user only sees the approved output by default
    (bkearney@redhat.com)
  - 830193: Modify the output of the yum plugin to be consistent with RHN
    (bkearney@redhat.com)
  - 824530: "release" command ignoring cli proxy options (alikins@redhat.com)
  - 828042,828068: Make ja_JP's Confirm Subscription unique for firstboot.
    (mstead@redhat.com)
  - Updating strings from zanata (mstead@redhat.com)
  - 825309: Remove the archiecture field from the table. (bkearney@redhat.com)
  - 823608: Rename the software pane to product (bkearney@redhat.com)
  - 810369: Prefer the term Subscription to Entitlement (bkearney@redhat.com)
  - Add a warning comment about firstboot module titles (alikins@redhat.com)
  - Clean up an option (bkearney@redhat.com)
  - 827208: Fix the xmltag bugs in the or po file (bkearney@redhat.com)
  - 827214: Clean up the XML tags in ta po file. (bkearney@redhat.com)
  - Slight change in the path for the ta po file (bkearney@redhat.com)
  - Slight change in the path for the ta po file (bkearney@redhat.com)
  - Slight change in the path for the ml po file (bkearney@redhat.com)
  - 828583: Add some spacing at the end of the file paths in the ko.po file
    (bkearney@redhat.com)
  - 828816: the %prog variable should not be translated (bkearney@redhat.com)
  - 828821: Fix the addition of a new variable in the hi po file
    (bkearney@redhat.com)
  - 828903: Fix translation of options in the bn po file. (bkearney@redhat.com)
  - Fix part of the mis translated options (bkearney@redhat.com)
  - 828965: Fix a translated option which should not have been translated
    (bkearney@redhat.com)
  - 828954: fix the --pool option in the translated string (bkearney@redhat.com)
  - 828958: --available should not be translated (bkearney@redhat.com)
  - Add --password as an option, not a string. This cause several strings to be
    retranslated (bkearney@redhat.com)
  - 828969: Fix the options in the translated string (bkearney@redhat.com)
  - 828985: Fix the url in the translated string (bkearney@redhat.com)
  - 828989: Fix the access url (bkearney@redhat.com)
  - 818205: Release --set command should only accept values from --list.
    (awood@redhat.com)
  - registergui: extract out a screen superclass (jbowes@repl.ca)
  - registergui: get button label from screen class (jbowes@repl.ca)
  - registergui: keep screens in a list (jbowes@repl.ca)
  - registergui: pull out environment screen into its own class (jbowes@repl.ca)
  - registergui: sensitivity refactor and method move (jbowes@repl.ca)
  - registergui: extract out credentials_entered method (jbowes@repl.ca)
  - registergui: move organization screen to its own class (jbowes@repl.ca)
  - registergui: move credentials screen to its own class (jbowes@repl.ca)
  - registergui: move choose server screen to its own class (jbowes@repl.ca)
  - registergui: switch from GladeWrapper to GladeWidget (jbowes@repl.ca)
  - registergui: Remove some unused globals (jbowes@repl.ca)


author: Alex Wood <awood@redhat.com> 1.0.5-1
changelog:
  - 804109: Give a specific message when providing invalid credentials.
    (awood@redhat.com)
  - 810360: update wording in gnome help file (cduryee@redhat.com)
  - use new bin location of files for $STYLEFILES (alikins@redhat.com)
  - add 'debuglint' for checking for leftover debugger imports
    (alikins@redhat.com)
  - Update make clean target (jbowes@redhat.com)
  - Move py executables to bin/ (jbowes@redhat.com)
  - Put no results text inside the scrolled window (jbowes@redhat.com)
  - 817901: Show text when there are no subscriptions to show.
    (dgoodwin@redhat.com)
  - Move initd file to etc-conf (jbowes@redhat.com)
  - Move plugins to their own src dir (jbowes@repl.ca)
  - More test cases for utils.parse_url (alikins@redhat.com)
  - 829482: Delete unstranslated strings in order force a retranslation
    (bkearney@redhat.com)
  - 811602: Fix the help output based on UXD feedback (bkearney@redhat.com)
  - 828867: Removed the extra %s string from the te translation
    (bkearney@redhat.com)
  - 829479: Remove unstranslated strings to force a re-translation
    (bkearney@redhat.com)
  - Delete the unused pt.po file (bkearney@redhat.com)
  - 829476: Remove untranslated strings. (bkearney@redhat.com)
  - 811553: Improve the text for auto subscribe during registration
    (bkearney@redhat.com)
  - 829471: Fix the translation for usage, and remove a translation for %org id
    to force a retranslation (bkearney@redhat.com)
  - Remove an outdated ta.po file (bkearney@redhat.com)
  - 828810: Remove extra %s in translation (bkearney@redhat.com)
  - Test to ensure that pool id is in the output for list --available
    (wpoteat@redhat.com)
  - Close registration window even if it failed. (dgoodwin@redhat.com)
  - 825923: Subscription-manager service-level set should say "Service level set
    to:" (wpoteat@redhat.com)
  - 811594: Default behavior for ReposCommand is --list (wpoteat@redhat.com)
  - 832400: service-level --unset should display proper message for unregistered
    client. (wpoteat@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.6-1
changelog:
  - rhsmcertd no longer exits when not registered. (mstead@redhat.com)
  - po file cleanups (alikins@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - Free config resources in one place (mstead@redhat.com)
  - rhsmcertd: free GKeyFile when done (jbowes@redhat.com)
  - rhsmcertd: remove studlyCaps (jbowes@redhat.com)
  - "make stylish" should failed on "swapped" in glade files (alikins@redhat.com)
  - Remove 'swapped=on' from glade signal markup. (alikins@redhat.com)
  - add 'fix-glade-swapped' target to de-'swapped' glade files
    (alikins@redhat.com)
  - make stylish fixups (alikins@redhat.com)
  - Fix at-spi label for "offline_radio" widget (alikins@redhat.com)
  - shorter messages for cases where registered to RHN Classic
    (alikins@redhat.com)
  - Tighten up the gettext_lint regex (alikins@redhat.com)
  - Fix string that was breaking xgettext (alikins@redhat.com)
  - 810998: Add a button to test a proxy connection. (awood@redhat.com)
  - new messages, and remove checking of rhn serverURL (alikins@redhat.com)
  - remove unused es.po file (bkearney@redhat.com)
  - 829486: Removed untranslated words to force a re-translation
    (bkearney@redhat.com)
  - Remove unused bn.po file (bkearney@redhat.com)
  - 826856: Add check for service-level command that --org can only be used with
    --list option (bkearney@redhat.com)
  - 829483: Remove english to english translation to force a re-translations
    (bkearney@redhat.com)
  - Remove unused de po file (bkearney@redhat.com)
  - 819665: on 'version' display if we are registered to RHN Classic
    (alikins@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.0.8-1
changelog:
  - Add rpmlint config for tmpfiles.d (jbowes@redhat.com)
  - Use the i18n_optparse.OptionParser instead of optparse (alikins@redhat.com)
  - Use our i18n_optparse for the migration scripts (alikins@redhat.com)
  - Look for rhn-migrate* in bin for generating string catalogs
    (alikins@redhat.com)
  - 826874: add gladelint support for 'orientation' prop (alikins@redhat.com)
  - 826874: Remove unneeded property 'orientation' from glade
    (alikins@redhat.com)
  - 796782: add systemd tmpfiles configuration (jbowes@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.9-1
changelog:
  - On invalid credentials in register, return to the login screen
    (jbowes@redhat.com)
  - 821065: Make SLA/subscription asyncronous (jbowes@redhat.com)
  - 838942: make gui and cli use the same releaseVer check (jbowes@redhat.com)
  - fixes for translations from zanata (alikins@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - Remove check for date parsing not failing when we expect it to
    (alikins@redhat.com)
  - Remove glade orientation properties. (awood@redhat.com)
  - Moving the filter counting mechanism into the Filters class.
    (awood@redhat.com)
  - Adjust expand and fill properties for the filter dialog. (awood@redhat.com)
  - add za_CN.utf to list of known busted locales (alikins@redhat.com)
  - 824424: Fixing AttributeError thrown when accessing online help in RHEL 5.
    (awood@redhat.com)
  - Add icon to update progress window. (awood@redhat.com)
  - 806986: Display SKU for available and consumed subscriptions
    (jbowes@redhat.com)
  - Increase the default size of the subscriptions viewport. (awood@redhat.com)
  - Add no overlapping to the default filters. (awood@redhat.com)
  - Tweaks to filter options dialog. (awood@redhat.com)
  - 801187: print Provides: for all subs, even with no provides
    (jbowes@redhat.com)
  - The filter dialog now updates results in real time. (awood@redhat.com)
  - 837106: Add a11y property for register button (jbowes@redhat.com)
  - 813336: Break filter options out into a separate dialog box.
    (awood@redhat.com)
  - 837036: Do not refer to options as commands (bkearney@redhat.com)
  - 829495: Delete a mis-translated string to force re-translation
    (bkearney@redhat.com)
  - 828966: Delete a mis-translated string to force trasnlations
    (bkearney@redhat.com)
  - 767133: Remove english to english translations from bn_IN to force a new
    translation (bkearney@redhat.com)
  - 829491: Remove english trnaslations for italian translations
    (bkearney@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.10-1
changelog:
  - 828903: Pull in the latest translation for error messages with no options
    translated (bkearney@redhat.com)
  - 841011: Fix double words in the korean translations (bkearney@redhat.com)
  - 828958: Untranslate the word password when it it used as an option in the
    pt_BR translations (bkearney@redhat.com)
  - Fixes for translations from zanata (alikins@redhat.com)
  - Latest translations from zanata (alikins@redhat.com)
  - 839887: Make error message text more clear when network is disconnected
    (bkearney@redhat.com)
  - 839760: Fix the screen text for preferences based on UXD feedback
    (bkearney@redhat.com)
  - 818355: Rename the use of 'Contract Number' to contract in the gui
    (bkearney@redhat.com)
  - 840169: The service level was incorrectly being set after auto-subscription.
    (awood@redhat.com)
  - 840637: Fixed missing reference to parent window. (mstead@redhat.com)
  - Import and translate error strings for 'envirovment' cmd (alikins@redhat.com)
  - Removed --wait arg, delay 2 min in rhsmcertd (mstead@redhat.com)
  - Interval CLI args for rhsmcertd now specified as minutes. (mstead@redhat.com)
  - Update rhsmcertd.init.d to use new CLI args (mstead@redhat.com)
  - Bad url format test and a refactor of parse_url (alikins@redhat.com)
  - Print message when rhsmcertd is shutting down (mstead@redhat.com)
  - Fixed spelling and newline issues in rhsmcertd (mstead@redhat.com)
  - Handle a few new bad url formats (http//foo or http:sdf) (alikins@redhat.com)
  - Add wait and now args to rhsmcertd (mstead@redhat.com)
  - 839683: Add some strings from older optparse to our i18n version
    (alikins@redhat.com)
  - 838146: Subscription-manager cli does not allow unsubscribe when consumer not
    registered. (wpoteat@redhat.com)
  - rhsmcertd: add format specifier checking to r_log (jbowes@redhat.com)
  - Improve rhsmcertd logging (jbowes@redhat.com)
  - Fix bug where filter options were not persisted when the dialog was reopened.
    (awood@redhat.com)
  - 838242: proxy password from the cli wasn't getting used (alikins@redhat.com)
  - Adding options parsing support (work-in-progress). (mstead@redhat.com)
  - Added initial check delay to rhsmcertd (mstead@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.11-1
changelog:
  - Remove deprecated use of hasDate. (dgoodwin@redhat.com)
  - Fix missed use of renamed method. (dgoodwin@redhat.com)
  - make stylish clean (alikins@redhat.com)
  - use isoformat() here instead of strftime format string (alikins@redhat.com)
  - create warn and expire colors once, fix test failure (alikins@redhat.com)
  - make stylish cleanups (alikins@redhat.com)
  - Additional tests for date logic. (awood@redhat.com)
  - Update for some minor changes in python-rhsm. (dgoodwin@redhat.com)
  - add rhsm_display module (alikins@redhat.com)
  - Add module to set DISPLAY if RHSM_DISPLAY is set (alikins@redhat.com)
  - 837132: fix typo (alikins@redhat.com)
  - Add "ctrl-X" as accelerator for proxy config (alikins@redhat.com)
  - Make "Usage" consistent across rhel5/6 (alikins@redhat.com)
  - Add __str__ for our fake exception. (alikins@redhat.com)
  - class ClassName(): is not legal syntax on python2.4 (alikins@redhat.com)
  - Exception by default doesn't pass 'args' (alikins@redhat.com)
  - Linkify() doesn't work on rhel5, so disble the tests there
    (alikins@redhat.com)
  - hashlib doesn't exist on 2.4, md5 is deprecated on 2.6 (alikins@redhat.com)
  - use simplejson since 'json' isnt part of python 2.4 (alikins@redhat.com)
  - Use ISO8601 date format in allsubs tab (alikins@redhat.com)
  - Fix syntax for RHEL5. (dgoodwin@redhat.com)
  - Fix awkward stretching in Subscription column. (awood@redhat.com)
  - 804144: Fix awkward stretching of Product column. (awood@redhat.com)
  - 814731: Change the name of the menu item to Preferences from Settings, and
    change the accelerator keys (bkearney@redhat.com)
  - 837132: Clean up the error message in the yum plugin (bkearney@redhat.com)
  - 837038: Fix a grammatical error in the yum plugin (bkearney@redhat.com)
  - Fix certificate parsing error reporting. (dgoodwin@redhat.com)
  - Removing unnecessary assignments. (awood@redhat.com)
  - F15 builds can't be submitted in Fedora anymore. (dgoodwin@redhat.com)
  - updating options for rhn-migrate-classic-to-rhsm per bz840152; rewriting
    rhsmcertd for different options and usage examples (dlackey@redhat.com.com)
  - Account/contract number field rename. (dgoodwin@redhat.com)
  - Stylish fixes. (dgoodwin@redhat.com)
  - Fix a certv2 error. (dgoodwin@redhat.com)
  - 829825: Alter highlighting used in My Subscriptions tab (awood@redhat.com)
  - 772040: Have no overlap filter properly handles subscription dates.
    (mstead@redhat.com)
  - Update order support level/type to service. (dgoodwin@redhat.com)
  - Remove explicit use of certificate2 module. (dgoodwin@redhat.com)
  - Fix issues introduced in certv2 refactor. (dgoodwin@redhat.com)
  - Change entitlement_version fact to certificate_version. (dgoodwin@redhat.com)
  - Update to use new certificate2 module and classes. (dgoodwin@redhat.com)
  - Send entitlement version fact. (dgoodwin@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.12-1
changelog:
  - remove test cases that use si_LK locale (alikins@redhat.com)
  - 842845: Show better error if serverurl port is non numeric
    (alikins@redhat.com)
  - 838113: 'unregister' was not cleaning up repos (alikins@redhat.com)
  - 842170: replace None service level/type with "" not None (alikins@redhat.com)
  - 844069: Allow register --force even if ID cert is totally invalid.
    (dgoodwin@redhat.com)
  - 826874: Remove use of deprecated Gtk.Notebook.set_page (alikins@redhat.com)
  - 818355: Terminology Change: Contract Number -> Contract (wpoteat@redhat.com)
  - 844368: productid plugin was failing on ProductCert.product
    (alikins@redhat.com)
  - Ignore warning about use of dbus.dbus_bindings (alikins@redhat.com)
  - 844178: Fix error message when importing a non-entitlement cert bundle.
    (dgoodwin@redhat.com)
  - remove deprecated use of DateRange.hasNow() (jbowes@redhat.com)
  - remove use of DateRange.hasDate() (alikins@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.13-1
changelog:
  - Fix "Project-Id-Version" for ta_IN.po (alikins@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - Remove the 'repos' unittests until they are more mockable
    (alikins@redhat.com)
  - Created CLI tool for viewing certificate data. (mstead@redhat.com)
  - add versionlint to "make stylish" (alikins@redhat.com)
  - add versionlint, requires pyqver (alikins@redhat.com)
  - Remove unused mock return values (alikins@redhat.com)
  - Remove enable_grid_lines from contract details glade file
    (alikins@redhat.com)
  - more test cases for ConfigCommand (alikins@redhat.com)
  - 837897: Terminology Change: Service Level Agreement -> Service Level
    (wpoteat@redhat.com)
  - add test cases for ConfigCommand (alikins@redhat.com)
  - Better error when rm'ing config item from missing section
    (alikins@redhat.com)
  - unittest coverage for managercli.CLI (alikins@redhat.com)
  - Adding unit tests for migration script regexes. (awood@redhat.com)
  - 812903: Autosubscribe not working for newly added product cert after Register
    (wpoteat@redhat.com)
  - 845827: Update command that do not require a candlepin connection
    (alikins@redhat.com)
  - 845827: Split server version checkout out to avoid errors
    (alikins@redhat.com)
  - Hack to address double mapping for 180.pem and 17{6|8}.pem (awood@redhat.com)
  - fix pep8 (jesusr@redhat.com)
  - don't show access.redhat.com url after registering to Katello
    (jesusr@redhat.com)
  - remove the explicit url search from error handling. (jesusr@redhat.com)
  - Make gettext_lint also check for _(foo) usage (alikins@redhat.com)
  - Remove unneeded _(somevar) (alikins@redhat.com)
  - Fix NameError in migration script. (awood@redhat.com)
  - bogus newline in glade file (alikins@redhat.com)
  - 826874: Reenable grid lines on newer gtk (alikins@redhat.com)
  - 826874: Remove enable_grid_lines from treeviews in glade (alikins@redhat.com)
  - 826874: Removing more properties that don't exist on gtk2.10
    (alikins@redhat.com)
  - 826874: Change gtk target version to gtk 2.10 for all glade files
    (alikins@redhat.com)
  - 826874: Clean of gtk properties not in gtk2.10 in our glade files
    (alikins@redhat.com)
  - Add support for migrating to Katello. (jesusr@redhat.com)
  - 843191: 'version' command showed wrong info with no network
    (alikins@redhat.com)
  - 843915: Multiple-specifications of --enable and --disable repos
    (wpoteat@redhat.com)
  - fix Package-Id-Version in ta_IN.po (alikins@redhat.com)
  - Fix es_ES.po (missing newline) (alikins@redhat.com)
  - 842898: fix missing --password in it.po (alikins@redhat.com)
  - 843113: latest strings from zanata (alikins@redhat.com)
  - 837280: Show users that we strip out any scheme given with a proxy.
    (awood@redhat.com)
  - new strings (alikins@redhat.com)
  - Refactor of SubDetailsWidget and GladeWidget (alikins@redhat.com)
  - 826729: Move Cert Status up to top of Product's Subscription Details
    (wpoteat@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.14-1
changelog:
  - 849171: Remove an extraneous print statement (bkearney@redhat.com)
  - 849105: Fixed a typo in the error message (bkearney@redhat.com)
  - 772161: Notifiy virt who, if running, when the identity changes
    (bkearney@redhat.com)
  - Reduce reads/parses of certificates (jbowes@redhat.com)
  - remove unused function 'getInstalledProductHashMap' (jbowes@redhat.com)
  - 843191: handle network errors better for 'version' command
    (alikins@redhat.com)
  - 826739, 827553: Combine Service Level and Service Type and move up in display
    order. (awood@redhat.com)
  - 847316: Remove the menu path for Subscription Manager from the manual
    registration screen. (bkearney@redhat.com)
  - 848409,848195,848190,848184: Do not print the exception when attempting to do
    the server version check (bkearney@redhat.com)
  - 847795: String and terminology clean up (bkearney@redhat.com)
  - 847380: Update the verbiage to prefer the term Subscription Management
    (bkearney@redhat.com)
  - 846834: Updated verbiage to focus on subsriptions and not on entitlements
    (bkearney@redhat.com)
  - 846105: Verbiage changes to empasize subscriptions over entitlements
    (bkearney@redhat.com)
  - 836933: Handle empty spaces for servce levels (bkearney@redhat.com)
  - 836932,835050: Fix the service level lifecycle (bkearney@redhat.com)
  - 836932: Reduce extra loggging when setting the service level
    (bkearney@redhat.com)
  - About dialog was not working due to key errors from python
    (bkearney@redhat.com)
  - 833319: Updated the help text for registration and service levels
    (bkearney@redhat.com)
  - 847060: Add missing requires on pygobject2 (bkearney@redhat.com)
  - 828954: Fix ta_IN.po file error with options (bkearney@redhat.com)
  - 842898: re-implement string fix for it.po (bkearney@redhat.com)
  - 828958: Fix the accidental translation of an option (bkearney@redhat.com)
  - fix up make stylish (jbowes@redhat.com)
  - No longer require root to run rct (mstead@redhat.com)
  - Remove manually_subscribe.py, it's class moved to rhsm_login.py
    (alikins@redhat.com)
  - Bumping the required python-rhsm version (mstead@redhat.com)
  - Renamed rt command to rct. (mstead@redhat.com)
  - Fix test case failure on 5.9 (Exception.message) (alikins@redhat.com)
  - Refactor ManuallySubscribeScreen to use new Screen api (alikins@redhat.com)
  - Check passed args as None to allow empty args (mstead@redhat.com)
  - Exception.message is deprecated, just let _str_ do it (alikins@redhat.com)
  - use MockStdout intead of nosetests sys.stdout.getvalue() (alikins@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.15-1
changelog:
  - Replace 16x16 icon with a new version that has no background
    (bkearney@redhat.com)
  - 852107: Update verbiage in migration script. (awood@redhat.com)
  - 847060: Push dependency higher up in the chain (bkearney@redhat.com)
  - 848534: Change the about dialog icon to be a PNG to ensure accurate
    representation. (bkearney@redhat.com)
  - 841396: Select first item in My Subscriptions table by default.
    (awood@redhat.com)
  - 849483: Prompt user for org name if necessary. (awood@redhat.com)
  - 849644: Calls made with --no-auto were not actually registering the system.
    (awood@redhat.com)
  - 849494: Fix variable name collision. (awood@redhat.com)
  - 846834: Use Subscription instead of entitlement certificate
    (bkearney@redhat.com)
  - 847859: Expiration highlighting was being set incorrectly. (awood@redhat.com)
  - 847750: Handle bad proxy values in migration script. (awood@redhat.com)
  - 841961: Ignore case when specifying the service level in migration
    (bkearney@redhat.com)
  - 842020: Remove an extraneous option group for rhsmcertd (bkearney@redhat.com)
  - Refactored some of the shared CLI code in 'rct' (mstead@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.16-1
changelog:
  - 853187: Verbiage change in install-num-migrate-to-rhsm. (awood@redhat.com)
  - 852894: Abort migration if multiple JBEAP channels are detected.
    (awood@redhat.com)
  - 850715: Fix malloc for Config (jbowes@redhat.com)
  - 852001: output the orgs key as part of the identity command.
    (bkearney@redhat.com)
  - fix "make gettext", wrong var name for the find root (alikins@redhat.com)
  - 850715: Fixes based on coverity scans (bkearney@redhat.com)
  - 846316: Use the full name of Subscrition Manager during first boot
    (bkearney@redhat.com)
  - 851346: Remove special case channel certs before subscribing.
    (awood@redhat.com)
  - 847354: When printing, translate None type into an empty string
    (bkearney@redhat.com)


author: Alex Wood <awood@redhat.com> 1.0.17-1
changelog:
  - Fix gettext_lint issue with concat string in rhn-migrate (alikins@redhat.com)
  - 851124: Fix GUI unsubscribe. (dgoodwin@redhat.com)
  - fix po version for ta_IN.po (alikins@redhat.com)
  - latest strings (alikins@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.1.1-1
changelog:
  - updates to stat-cert for cert v3 (jbowes@redhat.com)
  - rct: Check for and handle files that aren't x509 certs (jbowes@redhat.com)
  - rct: remove content set count from cat-cert. use stat-cert instead.
    (jbowes@redhat.com)
  - implement aliases for cli commands (jbowes@redhat.com)
  - rct: add a stat-cert command (jbowes@redhat.com)
  - Switch certv2 related code to certv3 (jbowes@redhat.com)
  - 852107: Make banner headings equal in length (bkearney@redhat.com)
  - 842768: Remove --serverurl option from redeem command. (awood@redhat.com)
  - Set correct parent for these error dialogs. (awood@redhat.com)
  - set_parent_window() on RegisterScreen has been removed. (awood@redhat.com)
  - make regex better (jesusr@redhat.com)
  - 855762: Set correct parent for error dialog boxes raised by Autobind wizard.
    (awood@redhat.com)
  - 856349: rct cat-cert now printing content for all content types
    (mstead@redhat.com)
  - 842768: Limit --serverurl and --baseurl to specific commands.
    (awood@redhat.com)
  - 854467: Use of activation keys requires an org. (awood@redhat.com)
    (dgoodwin@rm-rf.ca)
  - 854879: Fixes for Anaconda desktop/workstation product cert installation.
    (dgoodwin@redhat.com)
  - 840415: Handle copyfile errors gracefully. (awood@redhat.com)
  - Adding new line b/w products when printed by rct (mstead@redhat.com)
  - 850920: --servicelevel and --no-auto are mutually exclusive.
    (awood@redhat.com)
  - Explicitly set GMT when doing entitlement date math (cduryee@redhat.com)
  - adding --unset option to service-level and release cmds
    (dlackey@redhat.com.com)
  - updated images for bz840599; changed rhsmcertd intervals, bz853571
    (dlackey@redhat.com.com)
  - 853233: Do not allow 68.pem and 71.pem to coexist after migration.
    (awood@redhat.com)
  - 852706: Fix server side certs not being deleted client side
    (alikins@redhat.com)
  - editing manpages and gnome help per UXD feedback; updating manpages for new
    command arguments; bz852323, bz850881, bz854357 (dlackey@redhat.com.com)
    rf.ca)
  - 845349: Support setting unknown values in the yum repo file
    (jbowes@redhat.com)
  - Add a count of content sets to entitlement certificates (bkearney@redhat.com)
  - 830988: Stacking is showing an odd parent in the My Subscriptions Tab
    (wpoteat@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.2-1
changelog:
  - 829825: Adding tests. (awood@redhat.com)
  - 853876: No need to check for GoneException when getting status
    (mstead@redhat.com)
  - 829825: Disable unsubscribe button when nothing is selected.
    (awood@redhat.com)
  - Remove unused import. (awood@redhat.com)
  - 859197: Fix product cert cleanup. (dgoodwin@redhat.com)
  - 781280: Add I18N comments for some string length issues.
    (dgoodwin@redhat.com)
  - 830193: Ensure logging is not diabled by RHN Classic Registration
    (bkearney@redhat.com)
  - remove unused RepoFile import (alikins@redhat.com)
  - 855081: Translate Arch as Arq. (bkearney@redhat.com)
  - Check identity cert permissions when running CLI commands (mstead@redhat.com)
  - mock all of RepoFile for the cli tests (alikins@redhat.com)
  - 845349: Don't clutter the repo file with empty keys (jbowes@redhat.com)
  - 845349: remove 'return' left in for debugging (jbowes@redhat.com)
  - Stylish errors for mr.po (bkearney@redhat.com)
  - 855085: Fixed the translation for [OPTIONS] (bkearney@redhat.com)
  - 855087: Fix a mis translated [OPTIONS] in the mr.po file.
    (bkearney@redhat.com)
  - Strings with the same value are not always the same instance.
    (awood@redhat.com)
  - updates from sefler for bz850881 (dlackey@redhat.com.com)
  - mock out utils.is_valid_server_info for tests (alikins@redhat.com)
  - 846207: Print error message for each invalid repo. (awood@redhat.com)
  - change test async to check for a number of thread callbacks
    (alikins@redhat.com)
  - latest strings from zanata (alikins@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.3-1
changelog:
  - 863961: Expect id cert Version to be populated in tests (alikins@redhat.com)
  - 863565: Give focus to the login field during subscription registration.
    (awood@redhat.com)
  - 838123: remove python2.5ism (alikins@redhat.com)
  - 844072: remove use and dep of PyXML (alikins@redhat.com)
  - 838123: Omit mac addresses from facts for lot and sit ipaddress types
    (bkearney@redhat.com)
  - 856236: Do not allow environmenets to be specified during registration if an
    activation key is used (bkearney@redhat.com)
  - 858289: Rename the desktop file to subscription-manager-gui.deskstop
    (bkearney@redhat.com)
  - 808217: Add a text banner to the output of release --list
    (bkearney@redhat.com)
  - 863428: Add environment support to the migration script. (awood@redhat.com)
  - 862099: Fix several dialog closing issues. (dgoodwin@redhat.com)
  - 854374: Removed extra spacing around help, and improved he rct text output a
    bit. (bkearney@redhat.com)
  - 853572: Fix a typoin the help messages (bkearney@redhat.com)
  - 859090: Remove the word technology from the branding string
    (bkearney@redhat.com)
  - 862308: Subscription Manager version reports registered to value when system
    not registered (wpoteat@redhat.com)
  - 861443: Re-raise GoneException in rhsmcertd-worker (mstead@redhat.com)
  - 861151: make stylish cleanup (alikins@redhat.com)
  - 852911: Add padding around firstboot tooltips icon. (dgoodwin@redhat.com)
  - 854312: Do not install a certificate that has expired. (mstead@redhat.com)
  - Make rhsm-icon work on gnome 3 (jbowes@redhat.com)
  - 853885: Fix icon notification popup only displaying once.
    (dgoodwin@redhat.com)
  - 853006: Wrap label in the manually subscribe firstboot screen.
    (dgoodwin@redhat.com)
  - 861151: release should not list for incompatible variants
    (alikins@redhat.com)
  - 861170: re.escape() values provided to the apply_hightlight() function.
    (awood@redhat.com)
  - 852630: Suscription manager unsubscribe --all shows error on expired
    subscriptions (wpoteat@redhat.com)
  - Freeze obsoletes version for -gnome to -gui rename (jbowes@redhat.com)
  - 860084: remove unused _x from ja_JP translation (alikins@redhat.com)
  - 860088: remove trailing dot from url in de_DE.po (alikins@redhat.com)
  - Don't reparse entitlement certs on every search filter change
    (jbowes@redhat.com)
  - 855257: fix issues with default contract quantity being wrong
    (alikins@redhat.com)
  - 860088: some translations were splitting urls into two lines
    (alikins@redhat.com)
  - Add to nosetest to ensure that Cert V3 check for validity passes.
    (wpoteat@redhat.com)
  - 860344: Subscription-manager import --certificate fails to recognize a new
    version 3.0 certificate (wpoteat@redhat.com)
  - New icon set. (awood@redhat.com)
  - 853035: Fix firstboot "back" issues. (dgoodwin@redhat.com)
  - Check the full version info of the yum api in productid (alikins@redhat.com)
  - 847319: Left align manually subscribe firstboot message (jbowes@redhat.com)
  - 860030: make server_version_check use a non authenticated call
    (alikins@redhat.com)
  - 847387: Display tooltip for info icon in RHEL 5.9. (awood@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.4-1
changelog:
  - 864177: Add the count for the first word in calculating where to break the
    line (bkearney@redhat.com)
  - 785666: For bonded interfaces, find mac address of members
    (alikins@redhat.com)
  - 839779: Add more context around how to cover the machine with a given SLA
    (bkearney@redhat.com)
  - 864177: Attempt to detect the size of the terminal to influence how product
    names are split up. (bkearney@redhat.com)
  - 864569: Make the date picker widget 10 characters wide (bkearney@redhat.com)
  - 855050: Set the icon-name property on all dialogs and windows
    (bkearney@redhat.com)
  - 848095: Reduce the indentation on the help text to improve the layout on
    smaller terminals. (bkearney@redhat.com)
    (wpoteat@redhat.com)
  - 862848: Change the name of the button to Cancel instead of Close
    (bkearney@redhat.com)
  - 867766: Unsubscribe from multiple entitlement certificates using serial
    numbers (wpoteat@redhat.com)
  - Clear any cached environments when registering with activation keys.
    (awood@redhat.com)
    (bryan.kearney@gmail.com)
  - Clear any cached activation key values. (awood@redhat.com)
  - 869729: --autosubscribe and --activationkey should be mutually exclusive
    (wpoteat@redhat.com)
  - 857191: Stacking shows a useless parent in All Available Subscriptions tab
    (wpoteat@redhat.com)
  - 863133: Subscription-Manager version command should have server type listed
    first (wpoteat@redhat.com)
  - updates for failed-qa issues in bz857195 (dlackey@redhat.com.com)
  - Increment the hardcoded page number due to added activation key screen.
    (awood@redhat.com)
  - 864555: add "menu" window hint to filters.glade (alikins@redhat.com)
  - 850870: Update on-line documentation link. (awood@redhat.com)
  - 817671: Add support for Activation Keys in the GUI. (awood@redhat.com)
  - 840415: Print an error message if the destination directory does not exist.
    (awood@redhat.com)
  - Fail fast if the user enters a bad org. (awood@redhat.com)
  - Marking a string for translation. (awood@redhat.com)
  - 866579: Fail fast if the user enters a bad environment. (awood@redhat.com)
  - Enable logging in firstboot (alikins@redhat.com)
  - 865954: Return to creds screen if consumer name is invalid
    (alikins@redhat.com)
  - 852107: Make the banners the same width (bkearney@redhat.com)
  - 748912: Make the error message a bit more friendly when there is no cert file
    to import (bkearney@redhat.com)
  - 865590: Fix broken offline unsubscribe. (dgoodwin@redhat.com)
  - 852328: Report Classic and Subscription Management consistently in the
    version and identity commands (bkearney@redhat.com)
  - 864159: Add a new message in the gui when no subscriptions are available on a
    specific date. (bkearney@redhat.com)
  - 850531: Change the label 'Certificate Status' to 'Status'
    (bkearney@redhat.com)
  - 850533: Change the label from 'Next Update' to 'Next System Check-in'
    (bkearney@redhat.com)
  - 855365: Display a singular sentence if only one subscription is removed
    (bkearney@redhat.com)
  - 862885: Change the text for unlimited to Unlimited (bkearney@redhat.com)
  - 864184: Make the machine type uppercase to be consistent with other output
    (bkearney@redhat.com)
  - 865545: Added report log when cert has no products. (mstead@redhat.com)
  - update releases.conf (alikins@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.6-1
changelog:
  - 872847: Change unsubscribe feedback when consumer has been deleted
    (wpoteat@redhat.com)
  - 869934: make "release" related cdn usage use proper urlparse
    (alikins@redhat.com)
  - 852328: Improve the server version checking (bkearney@redhat.com)
  - 871146: Fix proxy errors on first yum operation after registration.
    (dgoodwin@redhat.com)
  - 850430: Pressing Enter in the password entry now activates registration.
    (awood@redhat.com)
  - Attach subscriptions after registration with an activation key.
    (awood@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.7-1
changelog:
  - 873631: Migrate correctly when there is only one org. (awood@redhat.com)
  - 874147: Handle changes in python-ethool api (alikins@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.8-1
changelog:
  - 862909: install rct man page (alikins@redhat.com)
  - Fix to LocalTz DST determination (cduryee@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.9-1
changelog:
  - latest strings from zanata (alikins@redhat.com)
  - 864207: mark these strings for translation (alikins@redhat.com)
  - 854388: use ngettext to specify contract/contracts (alikins@redhat.com)
  - 876753: change rhsmcertd --heal-interval to --auto-attach-interval
    (alikins@redhat.com)
  - We require python-rhsm-1.1.5 now (ram) (alikins@redhat.com)
  - 876340: Move the last of the commands and help string to --auto-attach
    (bkearney@redhat.com)
  - 876294: Use attach instead of subscirbe in the rhn migration tooling
    (bkearney@redhat.com)
  - 856735: Move the Next Update notification to the About dialog.
    (awood@redhat.com)
  - Removed stacking from RAM (mstead@redhat.com)
  - Improved comments/logging/tests for RAM (mstead@redhat.com)
  - Updated the entitlement_version of client (mstead@redhat.com)
  - Added RAM limit to rct cat-cert output (mstead@redhat.com)
  - Removing dead code (mstead@redhat.com)
  - Check RAM when determining status (mstead@redhat.com)


author: Adrian Likins <alikins@redhat.com> 1.1.10-1
changelog:
  - latest strings from zanata (alikins@redhat.com)
  - 874623: Tell users running the version command if they are not registered.
    (awood@redhat.com)
  - 873418: Add at-spi locators to the activation key window. (awood@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.8.1-1
changelog:
  - Add two manifest commands to rct. (bkearney@redhat.com)
  - latest translations from zanata (alikins@redhat.com)
  - 895447: The count of subscriptions removed is zero for certs that have been
    imported. (wpoteat@redhat.com)
  - 895462: Message for subscription-manager repos --list for disabled repo needs
    to be modified (wpoteat@redhat.com)
  - 885964: After registration, recreate the UEP connection using the identity
    cert. (awood@redhat.com)
  - 869306: Add org ID to facts dialog. (awood@redhat.com)
  - 888853: Put output into proper columns regardless of the output language.
    (awood@redhat.com)
  - Update python-rhsm requires version (wpoteat@redhat.com)
  - 888052: Add all binaries to the makefile path for gettext string extraction
    (bkearney@redhat.com)
  - 851303: additional term updates (dlackey@redhat.com.com)
  - 844411: Add an --insecure option to subscription-manager. (awood@redhat.com)
  - 891621: Users can incorrectly enter activation keys when registering to
    hosted. (awood@redhat.com)
  - 889573: Only persist serverurl and baseurl when registering.
    (awood@redhat.com)
  - 889204: Encode the unicode string to utf-8 to avoid syslog errors
    (bkearney@redhat.com)
  - 889621: String substitution inside gettext causes message translations to
    never be found (bkearney@redhat.com)
  - 890296: Unicode characters with a - are causing printing issues for rct
    printing (bkearney@redhat.com)
  - 878269 (dlackey@redhat.com.com)
  - 784056: Raise a running instance of the GUI to the forefront.
    (awood@redhat.com)
  - 888968: Improve the gui message formatting for SLA selection
    (bkearney@redhat.com)
  - 873601: Return a non zero code if subscription manager is run with an
    incorrect command name (bkearney@redhat.com)
  - 839779: Improve messaging when autosubscribe does not work because of SLA
    (bkearney@redhat.com)
  - 867603: Add quantity to confirm subscriptions dialog. (awood@redhat.com)
  - 888790: Rebuild UEP connection after registering with activation keys.
    (awood@redhat.com)
  - 886280; 878257; 878264; 878269 (dlackey@redhat.com.com)
  - 814378: disable linkify if we are running as firstboot (alikins@redhat.com)
  - 886887: Take the user back to the activation key page if he enters an invalid
    key. (awood@redhat.com)
  - 863572: Make forward/back insensitive when registering (alikins@redhat.com)
  - 825950: updating SAM registration procedure; other term edits and updated
    screenshot (dlackey@redhat.com.com)
  - 885964: Do not make a getOwner call when not necessary. (awood@redhat.com)
  - Ask for the org in environments and service-level modules. (awood@redhat.com)
  - 886992: Fix for bad fix for 886604, wrong path for yum repos
    (alikins@redhat.com)
  - matt reid's edits to rct; bz886280; bz878257; bz878269; bz878264
    (dlackey@redhat.com.com)
  - 841496: Do not use hyphens in bash completion files as these are invalid for
    identifiers in the sh shell. (bkearney@redhat.com)
  - Improve logging for rhsmcertd scenarios (wpoteat@redhat.com)
  - 878609: Do not use public url redirectors, instead use a redhat.com address
    (bkearney@redhat.com)
  - 886604: Fix incorrect path in repos.d check (alikins@redhat.com)
  - 727092: Read in the org key during registration if none is given.
    (awood@redhat.com)
  - 845622: If an identity certificate has expired, there should be a friendly
    error message (wpoteat@redhat.com)
  - 883123: Have the migration code use the name and the label for org and
    environment lookup. (bkearney@redhat.com)
  - 886110: help blurb for --auto-attach formatted poorly (alikins@redhat.com)
  - 880070: require latest python-rhsm to handle unicode issues
    (alikins@redhat.com)
  - 798788: Results from subscription-manager facts --update after a server-side
    consumer was deleted. (wpoteat@redhat.com)
  - 878634: Improve the consistency of capitalization of URL, ID, HTTP, and CPU
    (bkearney@redhat.com)
  - 878657: Make consistent use of the term unregister instead of un-register
    (bkearney@redhat.com)
  - 883735: load branding module slightly differently (jesusr@redhat.com)
  - Stylish fix. (dgoodwin@redhat.com)
  - 878664: Add bash completion script for rct (bkearney@redhat.com)
  - 880764: Command line options which can be specified more than once should use
    the same help text (bkearney@redhat.com)
  - 867070: Adjust default sizing of subscriptions pane in Installed Products
    tab. (awood@redhat.com)
  - 873791: Expected exit codes from unsubscribe with multiple serial numbers
    (wpoteat@redhat.com)
  - 800323: Set default output stream encoding to UTF-8. (awood@redhat.com)
  - 862852: Fix double separator in redeem dialog. (dgoodwin@redhat.com)
  - Display "None" if environments value is empty on consumer. (awood@redhat.com)
  - 872351: Display environment in GUI facts dialog and CLI identity command.
    (awood@redhat.com)
  - 881091: Remove punctuation in the help message (bkearney@redhat.com)
  - Revert "878986: refactor to use curses/textwrap for format"
    (alikins@redhat.com)
  - 877579: Fix -1 quantity to consume for unlimited pools. (dgoodwin@redhat.com)
  - 881117: Add at-spi locator to redemption dialog. (awood@redhat.com)
  - 881952: Warn and continue if encountering a failure during system deletion.
    (awood@redhat.com)
  - 878820: Fix console error when yum.repos.d does not exist.
    (dgoodwin@redhat.com)
  - 839772: Display "Not Set" instead of "" in SLA and release preferences.
    (awood@redhat.com)
  - rev zanata branch version to 1.8.X (alikins@redhat.com)
  - 878986: refactor to use curses/textwrap for format (alikins@redhat.com)
  - 878986: Default to no line breaking if no stty is available
    (bkearney@redhat.com)
  - 878588: Move the requires on usermode from subscription-manager-gui to
    subscription-manager (bkearney@redhat.com)
  - 878648: Make the help usage formatting consistent for the rct and
    subscription manager commands (bkearney@redhat.com)
  - 869046: Remove stray 'print' (jbowes@redhat.com)
  - 864207: Autosubscribe should not run when all products are already
    subscribed. (wpoteat@redhat.com)
  - 854702: Place the asterisk indicating editability into the quantity cell.
    (awood@redhat.com)


author: Bryan Kearney <bkearney@redhat.com> 1.8.2-1
changelog:
  - Update tito for RHEL 7.0 (bkearney@redhat.com)
  - Small cleanups for test_migrate (alikins@redhat.com)
  - Write repofile once instead of during every iteration. (awood@redhat.com)
  - Add unit test for migration script. (awood@redhat.com)
  - Adding more tests for the migration script. (awood@redhat.com)
  - Bump the required version of python-rhsm to pick up the new config file
    defaults (bkearney@redhat.com)
  - Modify migration script tests to run on Fedora. (awood@redhat.com)
  - Give users the ability to disable package reporting (bkearney@redhat.com)
  - 891377: Note in deprecated string that auto-attach-interval is a command
    option (bkearney@redhat.com)
  - 901612: Yum plugin warnings should go to stderr, not stdout
    (bkearney@redhat.com)
  - 903298: Replace use of 'Register to' with 'Register with'
    (bkearney@redhat.com)
  - Rewrite of the migration script featuring unit tests. (awood@redhat.com)
  - Remove F16 and old cvs releasers, add F18. (dgoodwin@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.8.3-1
changelog:
  - string and string catalog update from zanata (alikins@redhat.com)
  - 908954: Ensure that 'Not Set' is shown in the preferences dialog if it is not
    set (bkearney@redhat.com)
  - 906214: rct --help should return 0. (bkearney@redhat.com)
  - 909294: Add accessibility names to the preferences combo boxes
    (bkearney@redhat.com)
  - 878097: Clarify that the --org option is ORG_KEY and not ORG_NAME
    (bkearney@redhat.com)
  - Just use 0 as error for reading int keys (alikins@redhat.com)
  - Old version of config entries considered to make changes backwards compatible
    (wpoteat@redhat.com)
  - 882459: aftermath of bug 876753 - Change --heal-interval to --attach-interval
    in rhsmcertd (wpoteat@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.8.4-1
changelog:
  - Pull latest strings from zanata. (dgoodwin@redhat.com)
  - Use PyXML for iso8601 date on RHEL5 and dateutil after (alikins@redhat.com)
  - Major switchover to server for compliance checking logic. (dgoodwin@redhat.com)
  - Introduce dependency injection framework. (dgoodwin@redhat.com)
  - 916369: Do not persist config changes until the action completes
    (bkearney@redhat.com)
  - Fix a bug with changing installed products during healing.
    (dgoodwin@redhat.com)
  - 912776: fix migration test scripts to expect get_int usage
    (alikins@redhat.com)
  - 912776: cast port numbers from cli to int immediately (alikins@redhat.com)
  - 912776: use config.get_int for server port as well (alikins@redhat.com)
  - 905649: subscription-manager does not work with dbus-python-1.1.1-1
    (wpoteat@redhat.com)
  - use ngettext for plural messages in certlib/managercli (alikins@redhat.com)
  - 912776: use cfg.get_int for proxy port (alikins@redhat.com)
  - 878097: update service-level org key help text (alikins@redhat.com)
  - Handle manifests with no subscriptions in the archive (alikins@redhat.com)
  - 878664: Add filename support to the bash completion for the rct tool.
    (bkearney@redhat.com)
  - 877590: Changes to the branding messages when the user attempts to register
    twice (bkearney@redhat.com)
  - New plugin framework. (alikins@redhat.com / awood@redhat.com)
  - 886115: Remove line continuations within strings. (bkearney@redhat.com)
  - 913302: Support Level and Support Type should be shown as Service Level and
    Service Type (bkearney@redhat.com)
  - Add unknown product status state. (dgoodwin@redhat.com)
  - 913703: Prefer the use of SKU over Product ID (bkearney@redhat.com)
  - 913720: Use the term order number instead of subscription id
    (bkearney@redhat.com)
  - 878634: Use correct capitalization for ID in the rct tool
    (bkearney@redhat.com)
  - 878097: Help text for service-level command should be consistent with other
    help texts (bkearney@redhat.com)
  - 906554: Add ui_repoid_vars line to yum based on the variables which are in
    the baseurl (bkearney@redhat.com)
  - 912707: Remove a use of the deprecated hasNow() function.
    (bkearney@redhat.com)
  - 913187: Allow older manifests to print out correctly. (bkearney@redhat.com)
  - 912776: Cast proxy port to an integer. (awood@redhat.com)
  - 882459: Deprecated message in help for cert-interval (wpoteat@redhat.com)
  - 895447: Changed messages to distinguish between local and server-side
    removal. (wpoteat@redhat.com)
  - 908671: Display the pool ID when available. (awood@redhat.com)
  - 911386: Displaying combined Service Level and Type should handle empty values
    for both items (jmolet@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.8.5-1
changelog:
  - 927875: Fix GUI bug if there is an expired certificate. (dgoodwin@redhat.com)
  - 922806: Use dependency injection with firstboot module. (awood@redhat.com)
  - 919512: Remove proxy options from config command. (awood@redhat.com)
  - 921126: latest string updates from zanata (alikins@redhat.com)
  - 919255: Remove extraneous print statement. (awood@redhat.com)
  - 919584: Fix unicode error in RHEL 5. (awood@redhat.com)
  - Implement entitlement/product status caching. (dgoodwin@redhat.com)
  - 921245: Update installed products tab after registration. (awood@redhat.com)
  - 893993: some refactoring, show_autosubscribe_output returns 0 or 1
    (ckozak@redhat.com)
  - 859197: add special case for products that provide 'rhel-' tags
    (alikins@redhat.com)
  - productid db now supports multiple repos per product id (alikins@redhat.com)
  - let ProductData support multiple repos per product (alikins@redhat.com)
  - 893993: attach --auto now prints the proper text when no products are
    installed (ckozak@redhat.com)
  - 918746: Switched or ordering for disabling repos.  Will now print all
    repository validation errors (ckozak@redhat.com)
  - 914717: rct cat-manifest fails to report Contract from the embedded
    entitlement cert (wpoteat@redhat.com)
  - More convenient dep injection. (dgoodwin@redhat.com)
  - Try to handle the really old dbus-python on rhel5 (alikins@redhat.com)
  - add missing conf file for all_slots plugin (alikins@redhat.com)
  - 919700: Reload consumer identity after force subscribing.
    (dgoodwin@redhat.com)
  - utils.parseDate is now isodate.parse_date (alikins@redhat.com)
  - Remove  ent/prod dir arguments to CLI commands. (dgoodwin@redhat.com)
  - PluginsCommand does not need network cli options (alikins@redhat.com)
  - Fix pluginDir config value in default config file (alikins@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.8.6-1
changelog:
  - Latest translations. (dgoodwin@redhat.com)
  - 903298: Fix a few more examples of Register to (bkearney@redhat.com)
  - 878634: Fix the final three uses of id instead of ID (bkearney@redhat.com)
  - Fix string formatting done outside of gettext _() (alikins@redhat.com)
  - 950892: entity typo (dlackey@redhat.com.com)
  - when no parameters are given, dump manifest uses current directory
    (ckozak@redhat.com)
  - fixed zipfile creation in python 2.4 (ckozak@redhat.com)
  - 919561: moving cat manifest into memory (ckozak@redhat.com)
  - 914717: Fields taken from pool data. (wpoteat@redhat.com)
  - 924919: stop log to stderr in isodata module (alikins@redhat.com)
  - 919561: refactored some code into additional methods, fixed naming
    conventions, and added test cases (ckozak@redhat.com)
  - Dont log exception if a repo doesn't have productid (alikins@redhat.com)
  - 919561: checking manifest zip for files outside of scope (ckozak@redhat.com)
  - 919561: moved new extractall into a class that extends ZipFile
    (ckozak@redhat.com)
  - 919561: fixed variable naming in new extractall method (ckozak@redhat.com)
  - 919561: replaced reference to zipfile.extractall (aded in python2.6)
    (ckozak@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.8.7-1
changelog:
  - 959563, 956298: for rhel 5.10 (dlackey@redhat.com.com)
  - 905922: use get_int instead of get in order to consume the value as a
    booolean (bkearney@redhat.com)
  - enhancements to tests (alikins@redhat.com)
  - Update expected rct output for content arch info (alikins@redhat.com)
  - let 'rct cat-cert' show arches info on content sets (alikins@redhat.com)
  - Use the unknown icon when it is appropriate. (bkearney@redhat.com)
  - Do not allow manual entry of numbers that aren't multiples of spinner
    increment. (awood@redhat.com)
  - 959570: Subscription names were being mangled in the installed products page.
    (bkearney@redhat.com)
  - 959124: Consistant system status between CLI and GUI (ckozak@redhat.com)
  - re-added compatibility for old candlepin servers. (ckozak@redhat.com)
  - 885130: Switch from using xmlrpclib to rhnlib's rpclib. (awood@redhat.com)
  - 958827: fixed duplicate reasons from bundled subs, removed messages for valid
    products, refactoreed client-side reasons code (ckozak@redhat.com)
  - 958775: correct info for future subscriptions (ckozak@redhat.com)
  - Removing messages from compliant installed products caused by bad overconsumption (ckozak@redhat.com)
  - Use server provided value to determine quantity increment. (awood@redhat.com)
  - 957218: Bump system.certificate_version for cores support (mstead@redhat.com)
  - 956285, 913635, 913628. still need to finalize output for 913628.  (dlackey@redhat.com.com)
  - 955142: Display core limit in rct cat-cert tool (mstead@redhat.com)
  - Warn when we detect we need a newer version of 'mock' (alikins@redhat.com)
  - 924919: remove loging about isodate implementation (alikins@redhat.com)
  - 957195: Pull in the latest or fix from zanata. (bkearney@redhat.com)
  - Add the unkown icon (bkearney@redhat.com)
  - Add reasons to list --installed and list --consumed.  Added list --status
    (ckozak@redhat.com)
  - 908037: remove all ¶ characters from the ml.po file. Zanata was also updated
    (bkearney@redhat.com)
  - 906552: Fixed mis translation of subscription-manager in pa.po and zh_CN.po.
    Zanata was also updated (bkearney@redhat.com)
  - 908059: Fix a pt_BR translation which did not include the http portion of a
    url. Zanata is fixed as well (bkearney@redhat.com)
  - Add F19, 5.10, 6.4 releasers. (dgoodwin@redhat.com)
  - use "assert_string_equal" for multiline str asserts (alikins@redhat.com)
  - add "assert_string_equals" that diffs multiline strings (alikins@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.8.8-1
changelog:
  - Fix echo'ing of exit status or exception on exit (alikins@redhat.com)
  - 962905: Fixing errors with quantity spinner. (awood@redhat.com)
  - 961124: Allow rct dump-manifest to be called more than once (bkearney@redhat.com)
  - 921249: Fix Unknown virt status being reported to server.  (dgoodwin@redhat.com)
  - 905136: Make the accessability value unique (bkearney@redhat.com)
  - 913635: typo (dlackey@redhat.com.com)
  - 889582 (dlackey@redhat.com.com)
  - 962520: require python-rhsm 1.8.11 for arches (alikins@redhat.com)
  - 919706: Relax rhn-setup-gnome dependency. (dgoodwin@redhat.com)
  - Add new expiring icon (bkearney@redhat.com)
  - use os.linesep as imported (alikins@redhat.com)
  - cleanup camelCase usage in various files (alikins@redhat.com)
  - adding architecture data (ckozak@redhat.com)
  - Default option is status (ckozak@redhat.com)
  - changed list --status to status (ckozak@redhat.com)
  - adding data to installed prods (ckozak@redhat.com)
  - SORT ALL THE IMPORTS! (alikins@redhat.com)
  - stylish cleanup (alikins@redhat.com)
  - mock.patch ConsumerIdentity instead of monkey patch (alikins@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.8.9-1
changelog:
  - 905136: added accessibily name for owner_label (jmolet@redhat.com)
  - 928175: fixed status command after user deletion (ckozak@redhat.com)
  - 950672: Added data for yellow. Added list view. (ckozak@redhat.com)
  - 963796: Unified descriptions (cschevia@redhat.com)
  - 966745: Correct typo in name of configuration value. (awood@redhat.com)
  - 967863: Suggest package to install when mapping file is missing. (awood@redhat.com)
  - 968364: show the issuer for certs in rct. (bkearney@redhat.com)
  - 966262 for rct.8; 959563 for subscription-manager.8 (dlackey@redhat.com.com)
  - Extract latest strings from code. (dgoodwin@redhat.com)
  - close file objects deliberately (alikins@redhat.com)
  - Use fnmatch to add wildcard support (bkearney@redhat.com)
  - One more miss from my issuer/errata debacle (bkearney@redhat.com)
  - Extend use of compliance status from cp (ckozak@redhat.com)
  - Add s390 lpar specific socket counting (alikins@redhat.com)
  - be extra paranoid and strip nul from /sys reads (alikins@redhat.com)
  - use new cpu info method by default (alikins@redhat.com)
  - Add a new method for calculating cpu sockets (alikins@redhat.com)
  - Added reasons to Subscription Details (ckozak@redhat.com)
  - Support enable and disable of all repos. (bkearney@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.8.10-1
changelog:
  - 922825: pre_subscribe conduit now contains more data (mstead@redhat.com)
  - 921222: Fixed subman auto-complete scripts (cschevia@redhat.com)
  - 922806: Fix RHEL 5 firstboot issue with backButton. (dgoodwin@redhat.com)
  - 960465: Subman disconnected when consumer cert is invalid (ckozak@redhat.com)
  - 966747: handle a custom facts file being empty (alikins@redhat.com)
  - 969280: Fix traceback on disconnected sub detach (ckozak@redhat.com)
  - handle s390x's without vm info in sysinfo (alikins@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.8.11-1
changelog:
  - 844532: xen dom0 cpu topology lies, work around it (alikins@redhat.com)
  - 854380: fix overlap filter (ckozak@redhat.com)
  - 915847: Provide option to skip using proxy when connecting to RHSM.
  - 921222: Fixed tab completion (cschevia@redhat.com)
  - 922871: Call pre_product_id_install hook on product install (mstead@redhat.com)
  - 924766: Show machine type when attaching 'virt only' subscriptions (wpoteat@redhat.com)
  - 927340: added empty warning, block auth unless proxy enabled (ckozak@redhat.com)
  - 928401: Fixed translation issue in redeem dialog (cschevia@redhat.com)
  - 947485: System 'disconnected' if no cache and disconnected (ckozak@redhat.com)
  - 947788: facts plugin can handle no 'facter' (alikins@redhat.com)
  - 966137: stat-cert handles ent cert with no content (alikins@redhat.com)
  - 972883: Add entries to productid.js during migration. (awood@redhat.com)
  - 973938: Flush std out and catch errors to work around the broken pipe from the more command (bkearney@redhat.com)
  - 974123: default behavior is help, no longer status (ckozak@redhat.com)
  - 974587: Allow list --consumed to handle certificates with empty order sections (bkearney@redhat.com) (awood@redhat.com)
  - 975164: 975186: fix certlib exception handling (ckozak@redhat.com)
  - Pull PluginManager from dependency injection framework (mstead@redhat.com)
  - Performance enhancements (ckozak@redhat.com)
  - added cp_provider doc strings, modified test fixture (ckozak@redhat.com)
  - Fix expand options so there is no border txt view (alikins@redhat.com)
  - Make PluginManager lazy loading (mstead@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.8.12-1
changelog:
  - 877331: Add --org and --environment options to migration script.  (awood@redhat.com)
  - 915847: Clear old proxy settings if the --no-proxy option is used. (awood@redhat.com)
  - 928401: Fixed translation issue in redeem dialog (cschevia@redhat.com)
  - 974123: default behavior is help, no longer status (ckozak@redhat.com)
  - 976689: Handle no xorg server, allow help (ckozak@redhat.com)
  - 976848: 976851: thread cache write, limit disk reads, singleton
  - 976865: dbus iface singleton for gui (ckozak@redhat.com)
  - 976866: single instance of ProdDir and EntDir (ckozak@redhat.com)
  - 976868: improve rhsmd logging (alikins@redhat.com)
  - 976868: enable logging from /usr/libexec/rhsmd (alikins@redhat.com)
  - 976924: empty service level and type (ckozak@redhat.com)
  - 977481: added proxy options to status (ckozak@redhat.com)
  - 977535: cli uses utf8 too (ckozak@redhat.com)
  - 977851: 977321: Centralize CertSorter, drive updates, refresh properly
  - 978322: fixed client deleting certs (ckozak@redhat.com)
  - 979492: register auto-attach force recreates cert dirs (ckozak@redhat.com)
  - 980209: removed injection calls from migration script (ckozak@redhat.com)
  - 980640: include stacked ents in provided (ckozak@redhat.com)
  - 981689: fix attach command (ckozak@redhat.com)
  - 982286: Fixed empty dialog message (cschevia@redhat.com)
  - latests strings from zanata and new keys.pot (alikins@redhat.com)
  - Fixed Preferences dialog to be non-threaded (cschevia@redhat.com)
  - updated spec to require python-rhsm v1.8.13-1 or greater (cschevia@redhat.com)
  - Added auto-attach property in the preferences dialog (cschevia@redhat.com)
  - Added autoheal command to subman CLI (cschevia@redhat.com)
  - Add support for SUBMAN_DEBUG to log to stdout (alikins@redhat.com)
  - remove logging of plugin args (alikins@redhat.com)
  - Fixed auto-complete script for auto-attach command (cschevia@redhat.com)


author: Alex Wood <awood@redhat.com> 1.9.1-1
changelog:
  - latest translations from zanata (alikins@redhat.com)
  - Preserve traceback when an exception is thrown from background thread.
    (awood@redhat.com)
  - Remove logging of injection setup (alikins@redhat.com)
  - 988411: more at-spi changes for QA (ckozak@redhat.com)
  - 908521: Pull in the latest mr strings (bkearney@redhat.com)
  - 928469: Pull in latest ml strings from zanata (bkearney@redhat.com)
  - 927990: Pull in latest ta_IN strings from zanata (bkearney@redhat.com)
  - 987579: Make clicking autoheal label work (cschevia@redhat.com)
  - 988430, 988861: remove logging from write_cache to avoid segfault
    (ckozak@redhat.com)
  - 966422: Do not hang firstboot if there is an exception during registration.
    (awood@redhat.com)
  - 978329: catch IdentityCertException gracefully (ckozak@redhat.com)
  - 988482: fix gtk warnings on gtk-2.10 (alikins@redhat.com)
  - 988411: fixed at-spi locator name (ckozak@redhat.com)
  - fixed dbus on rhel5 (ckozak@redhat.com)
  - 987071: specify arch of librsvg dep (alikins@redhat.com)
  - 987626: Remove PUTS while opening preferences dialog, fix related test
    (cschevia@redhat.com)
  - 987551: correctly reconnect to rhsmd daemon (ckozak@redhat.com)
  - 981611, 981565: fixed icon and text truncation (ckozak@redhat.com)
  - rev zanata branch to 1.9.X (alikins@redhat.com)
  - Rev master to 1.9.x (alikins@redhat.com)
  - 968820: raise timeout exceptions for cli calls (alikins@redhat.com)
  - 950892: add ents-nag-warning.png to docs install (alikins@redhat.com)
  - add new file to spec (ckozak@redhat.com)
  - 978466: fix missing socket info s390x/ppc64 (alikins@redhat.com)
  - 985515: moved DbusIface to fix anaconda productId (ckozak@redhat.com)
  - 983193: remove unused 'Virt Limit' cat-cert field (alikins@redhat.com)
  - Correcting whitespace error. (awood@redhat.com)
  - 986971: String Update: Quantity > Available (cschevia@redhat.com)
  - 980724: allsubstab cleared on identity change, check redeem on register
    (ckozak@redhat.com)
  - 921222: add 'status' to bash completion (alikins@redhat.com)
  - 977580: Preferences dialog hide and show (cschevia@redhat.com)
  - 977481: make proxy cli check require_connection (alikins@redhat.com)
  - 977896: Fixes for Workstation/Desktop certs (alikins@redhat.com)
  - Added comma to satisfy grammar rules (cschevia@redhat.com)
  - added at-spi locator for autoheal checkbox (jmolet@redhat.com)
  - 984203: Fix german translations (bkearney@redhat.com)
  - 974587: Add more checks for no order portion being present
    (bkearney@redhat.com)
  - 984206: Removed Spaces from String (cschevia@redhat.com)
  - Remove releasers due to branching. (dgoodwin@redhat.com)
  - 983670: Improved auto-attach description (cschevia@redhat.com)
  - 982286: Adjusted markup removal (cschevia@redhat.com)
  - 983250: 983281: certs check warning period (ckozak@redhat.com)
  - Adding Fedora 19 Yum releasers. (awood@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.9.2-1
changelog:
  - 851321: Refresh/redraw tables after removing subscriptions (cschevia@redhat.com)
  - 974587: allow certs with no content (ckozak@redhat.com)
  - 977920, 983660: manpage updates (dlackey@redhat.com.com)
  - 987579: Re-arranged preferences dialog (cschevia@redhat.com)
  - 990195: remove subscribe options (ckozak@redhat.com)
  - 991214: refresh ent dir, catch exception gracefully (ckozak@redhat.com)
  - 991548: Display correct error message for registration failures.  (awood@redhat.com)
  - 991580: add rhsmd debug to stdout (ckozak@redhat.com)
  - 993202: fix default config, take advantage of rhsmconfig options (ckozak@redhat.com)
  - 994266: list consumed shows expired bugs (ckozak@redhat.com)
  - 994997: Fix Unknown is_guest during firstboot. (dgoodwin@redhat.com)
  - Changed 'It is' to possessive 'Its' (cschevia@redhat.com)
  - Remove unused WARNING_DAYS variable (ckozak@redhat.com)
  - Bump python-rhsm requires to 1.9.1 for config changes. (dgoodwin@redhat.com)
  - add ondate to status (ckozak@redhat.com)
  - Fedora 17 is at end of life. (awood@redhat.com)


author: Alex Wood <awood@redhat.com> 1.10.1-1
changelog:
  - Adding Fedora 20 branch to releaser. (awood@redhat.com)
  - Subscribe/unsubscribe mirror attach/remove tests (alikins@redhat.com)
  - Revert "990195: remove subscribe options" (alikins@redhat.com)
  - 994620: reword tooltip message (ckozak@redhat.com)
  - 997935: stop making requests after unregister (ckozak@redhat.com)
  - 997740: allow autoheal call more often (ckozak@redhat.com)
  - Prevent name collision over the parent variable in RHEL 5 Firstboot.
    (awood@redhat.com)
  - 997189: error is now a sys.exc_info() tuple. (awood@redhat.com)
  - self._parent is not defined here. (awood@redhat.com)
  - bump version and remove rhel-6.5 releaser (jesusr@redhat.com)
  - Convert contract selection window to use a MappedListStore.
    (awood@redhat.com)
  - Stripe rows whenever the My Subs or All Available tabs are shown.
    (awood@redhat.com)
  - 991165: Refresh row striping after the TreeView is resorted.
    (awood@redhat.com)
  - Remove unused background attribute in Installed Products tab.
    (awood@redhat.com)
  - Set background color on progress bar renderer. (awood@redhat.com)
  - No need to set a hint to true in glade then false in code. (awood@redhat.com)
  - Remove duplicate import. (awood@redhat.com)
  - Add a very simple "smoke" test script (alikins@redhat.com)
  - 842402: Re-aligning Subscription Manager Gui (cschevia@redhat.com)


author: Alex Wood <awood@redhat.com> 1.10.2-1
changelog:
  - update translations from zanata (alikins@redhat.com)
  - 1004893: update prods before compliance (ckozak@redhat.com)
  - 1004908: Remove the rhn-setup-gnome dep even more. (alikins@redhat.com)
  - 1004908: move rhn-setup-gnome requires to -gui subpackage
    (pbabinca@redhat.com)
  - 1004385: rhsm icon completion fix (ckozak@redhat.com)
  - 1004341: add gui completion (ckozak@redhat.com)
  - 1001820: fix autocompletion (ckozak@redhat.com)
  - rev min python version for "make stylish" to 2.6 (alikins@redhat.com)
  - 994344: messaging for bad filetypes (ckozak@redhat.com)
  - 995597: continue attaching if a pool cannot be found (ckozak@redhat.com)
  - 1001169: fix pythonic empty string identity problems (ckozak@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.3-1
changelog:
  - Latest strings from zanata. (alikins@redhat.com)
  - Latest string catalog. (alikins@redhat.com)
  - point at the zanata 1.10.x version/branch (alikins@redhat.com)
  - Run 'make update-po' on translations. (awood@redhat.com)
  - Latest translations from Zanata. (awood@redhat.com)
  - Merge pull request #782 from candlepin/ckozak/environment_completion
    (alikins@redhat.com)
  - Merge pull request #776 from candlepin/alikins/1008462_log_virt_what
    (c4kofony@gmail.com)
  - 1011712: add missing environments completion (ckozak@redhat.com)
  - Merge pull request #773 from candlepin/ckozak/match_gui_filters
    (alikins@redhat.com)
  - Merge pull request #787 from candlepin/awood/1006985-abort-migration
    (alikins@redhat.com)
  - Use all keywords args for call to get_avail_ents (alikins@redhat.com)
  - Add 'providedProducts' to test pool (alikins@redhat.com)
  - stylish cleanups (alikins@redhat.com)
  - removed subscribed filter, added testing (ckozak@redhat.com)
  - Add some tests cases for managerlib.get_avail_ents (alikins@redhat.com)
  - fix wrong index in get_filtered_pools_list (ckozak@redhat.com)
  - remove unused args, remove unnecessary idcert read (ckozak@redhat.com)
  - add completion for new CLI filters (ckozak@redhat.com)
  - 654501: add some filtering to list available (ckozak@redhat.com)
  - Merge pull request #765 from candlepin/alikins/redhataccount
    (awood@redhat.com)
  - Move capture() context manager to fixtures.py (awood@redhat.com)
  - Merge pull request #786 from candlepin/ckozak/cli_list_provided
    (alikins@redhat.com)
  - 1006985: Abort migration when we detect different certs with the same ID.
    (awood@redhat.com)
  - Merge pull request #781 from candlepin/ckozak/cat_cert_unlimited
    (alikins@redhat.com)
  - 996993: add provided to list available (ckozak@redhat.com)
  - Merge pull request #784 from candlepin/ckozak/gui_unentitled_string
    (alikins@redhat.com)
  - 1012501: Correct number of entitled products with expired ents
    (ckozak@redhat.com)
  - 1012566: rhsmd cron job 700 (ckozak@redhat.com)
  - 1011703: Do not allow selection on listview (mstead@redhat.com)
  - Merge pull request #779 from candlepin/alikins/flex_branding3
    (c4kofony@gmail.com)
  - 1011961: -1 quantity is printed as unlimited (ckozak@redhat.com)
  - Merge pull request #774 from candlepin/ckozak/fix_gui_completion
    (alikins@redhat.com)
  - Make certlib repo and brand updating similar. (alikins@redhat.com)
  - 1004385: remove some gtk help options (ckozak@redhat.com)
  - Make BrandingInstaller run every cert install/rm (alikins@redhat.com)
  - Merge pull request #778 from candlepin/ckozak/update_repolib_attach
    (alikins@redhat.com)
  - keep repolib in certmgr (ckozak@redhat.com)
  - 1011234: no service level displays empty string (ckozak@redhat.com)
  - 1008016: update repos on certlib change (ckozak@redhat.com)
  - fix traceback when poolstash is empty (ckozak@redhat.com)
  - 1008462: log more virt-what output (alikins@redhat.com)
  - 1008462: Log detected virt info as we detect it. (alikins@redhat.com)
  - 1004341: gui completion no longer resets (ckozak@redhat.com)
  - Merge pull request #761 from candlepin/ckozak/overlap_filter_ondate
    (alikins@redhat.com)
  - Refactor credentials gathering. (awood@redhat.com)
  - Merge pull request #771 from candlepin/alikins/cmd_name_logging
    (jmrodri@nc.rr.com)
  - Merge pull request #769 from
    candlepin/ckozak/catch_exception_updating_installed (jmrodri@nc.rr.com)
  - Merge remote branch 'origin/master' into alikins/redhataccount
    (awood@redhat.com)
  - Merge pull request #768 from candlepin/ckozak/status_ondate_completion
    (jmrodri@nc.rr.com)
  - Merge pull request #766 from candlepin/alikins/make_zanata
    (jmrodri@nc.rr.com)
  - 973838: refresh redhat.repo after register (alikins@redhat.com)
  - make default logger include sys.argv[0] (alikins@redhat.com)
  - Merge pull request #770 from candlepin/mstead/add-virt-type-info
    (c4kofony@gmail.com)
  - Add System Type to output of list --consumed (mstead@redhat.com)
  - Add Type column to Confirm Subscription screen (mstead@redhat.com)
  - 1008603: Catch and log connection error while updating installed products
    (ckozak@redhat.com)
  - Merge pull request #767 from candlepin/ckozak/attach_suggested_quantity
    (wpoteat@redhat.com)
  - 1004385: Add missing rhsm-icon debug options (ckozak@redhat.com)
  - suggested quantity in list available (ckozak@redhat.com)
  - Merge pull request #754 from candlepin/alikins/flex_branding2
    (c4kofony@gmail.com)
  - 1001820: added ondate to completion (ckozak@redhat.com)
  - cleanup comments (alikins@redhat.com)
  - remove call on filter change, use None instead of now (ckozak@redhat.com)
  - Adding autocomplete stuff for new migration script options.
    (awood@redhat.com)
  - 767754: overlap filter ondate (ckozak@redhat.com)
  - Add a 'make zanata' target that syncs zanata (alikins@redhat.com)
  - Adding unit tests for new migration script options. (awood@redhat.com)
  - Correct failing unit tests and add convenience method. (awood@redhat.com)
  - Change brand attribute from 'os' to 'brand_type' (alikins@redhat.com)
  - Make rct show branding info (alikins@redhat.com)
  - Move to RHELBrandsInstaller by default. (alikins@redhat.com)
  - Split RHEL specific brand install bits (alikins@redhat.com)
  - Add a BrandsInstaller that handles multiple brands (alikins@redhat.com)
  - Invert dependencies, and add RHEL specific impls. (alikins@redhat.com)
  - Stylish cleanups. (alikins@redhat.com)
  - Added new parameters to the script (tazimkolhar@gmail.com)
  - clean up comments (alikins@redhat.com)
  - More entbranding logging and testing. (alikins@redhat.com)
  - Allow multi ents that provide identical branding (alikins@redhat.com)
  - More entbranding test cases. (alikins@redhat.com)
  - Add BrandPicker and Brand base class. (alikins@redhat.com)
  - Add branding support to ent cert importer. (alikins@redhat.com)
  - Update branding on cert sorter dir moniter event (alikins@redhat.com)
  - Move all branded product logic to entbranding (alikins@redhat.com)
  - make it more clear this is for RHEL branded ents (alikins@redhat.com)
  - Add support for populating product branding info. (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.4-1
changelog:
  - 1017351: ignore dbus failures on show_window (alikins@redhat.com)
  - 1016643: Fix firstboot issues with new firstboot. (alikins@redhat.com)
  - 1005420: adding --ondate to manpage (dlackey@redhat.com.com)
  - 1007580: Add contract number to the output of list --available
    (bkearney@redhat.com)
  - 1017299: handle dmidecode module not installed (alikins@redhat.com)
  - 846331: Add tooltips to the filters page (bkearney@redhat.com)
  - 1015553: fix help message for no-overlap. display usage requirement
    (ckozak@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.5-1
changelog:
  - 1021581: account/contract display nothing when no data exists
    (ckozak@redhat.com)
  - Swap heading of selectsla/confirmsubs widgets. (alikins@redhat.com)
  - 1006748: replace simplejson with 'ourjson' (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.6-1
changelog:
  - 985502: Use yum.i18n utf8_width function for string length in CLI
    (ckozak@redhat.com)
  - 916666: Displayed 'Next System Check-In' is inaccuarate (wpoteat@redhat.com)
  - Change wording for identity in CLI command. (dgoodwin@redhat.com)
  - 1019753: Stop including a fake consumer UUID fact. (dgoodwin@redhat.com)
  - 1022198: Display highest suggested quantity in contract selection
    (ckozak@redhat.com)
  - Hook up the 'why register' dialog from old rhn-client-tools.
    (dgoodwin@redhat.com)
  - Add screen to describe and skip registration in Fedora/EL7 firstboot.
    (dgoodwin@redhat.com)
  - Fix firstboot on Fedora 19. (dgoodwin@redhat.com)
  - Report distribution.version.modifier fact. ex 'beta' (ckozak@redhat.com)
  - Center filter dialog on parent window when opened (mstead@redhat.com)
  - Sort owner list in org selection screen (mstead@redhat.com)
  - 1004318: Bash completion for rct was not handing options and file lists
    correctly. (bkearney@redhat.com)
  - 1023166: Strip leading and trailing whitespaces from all usernames and
    passwords provided on the cli (bkearney@redhat.com)
  - 963579: Stop hiding the Library environment. (dgoodwin@redhat.com)
  - Fix layout issues with select sla screen in firstboot. (alikins@redhat.com)
  - Fix the layout for "Confirm Subscriptions" screen. (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.7-1
changelog:
  - 998033: Handle Unauthorized/Forbidden exceptions in CLI/GUI
    (mstead@redhat.com)
  - Remove unnecessary network calls after clean command (ckozak@redhat.com)
  - Bumping the python-rhsm required version (mstead@redhat.com)
  - Latest translations. (awood@redhat.com)
  - Introduced an Override model object to OverrideLib (mstead@redhat.com)
  - Use injected Identity instead of ConsumerIdentity in repolib
    (mstead@redhat.com)
  - Catch ValueError when determining boolean value (mstead@redhat.com)
  - Use a simplier method to compare two lists of dictionaries.
    (awood@redhat.com)
  - Hide item when server does not support overrides. (mstead@redhat.com)
  - Show message instead of repo table when no repos exist. (mstead@redhat.com)
  - Made Repository Details resemble Subscription Details (mstead@redhat.com)
  - Created an overrides module (mstead@redhat.com)
  - Created Repository Management Dialog (mstead@redhat.com)
  - Add 'repo-override' command to alter content repositories server-side.
    (awood@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.8-1
changelog:
  - 1030604: Handle 400 code for add override (mstead@redhat.com)
  - Use backed to ensure a refreshed Overrides object (mstead@redhat.com)
  - 1034574: Alternate message based on why no repos exist in GUI
    (mstead@redhat.com)
  - 1034396: No longer require entitlements to run repo-override command
    (mstead@redhat.com)
  - 1033741: Refresh Overrides CP connection when dialog is shown
    (mstead@redhat.com)
  - 1033690: Updated repo-overrides not supported message (mstead@redhat.com)
  - 1034649: Only allow repolib to update override cache if supported by the
    server (mstead@redhat.com)
  - 1032673: Warn on add override if repo doesn't exist (mstead@redhat.com)
  - 1030996: Fixed usage text for repo-override add/remove options
    (mstead@redhat.com)
  - 1032243: Updated the redhat.repo warning (mstead@redhat.com)
  - Use local ent certs to list attached pools (ckozak@redhat.com)
  - 1021013: Change wording on firstboot address screen (alikins@redhat.com)
  - 1020539: Show proxy info if no RHN in firstboot (alikins@redhat.com)
  - Make zip file of consumer information for debugging (wpoteat@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.9-1
changelog:
  - Check for RHSM_DISPLAY before loading any modules. (alikins@redhat.com)
  - 1034429: Fix stacktrace in logs on unregister. (dgoodwin@redhat.com)
  - add ServerUrlParseException strings to mapper (jesusr@redhat.com)
  - 1040167: Update installed products properly (ckozak@redhat.com)
  - Added atspi locator for overall status (ckozak@redhat.com)
  - ExceptionMapper will now traverse object graph looking for message
    (mstead@redhat.com)
  - Convert tests on stderr to use Capture context manager. (awood@redhat.com)
  - Have Capture grab both stdout and stderr. (awood@redhat.com)
  - Updated for readability (ckozak@redhat.com)
  - replace file monitors with a single monitor (ckozak@redhat.com)
  - Rename capture context manager and use new-style classes. (awood@redhat.com)
  - Correct Makefile for RHEL 5. (awood@redhat.com)
  - 1030604: print to stdout instead of stderr for consistency
    (mstead@redhat.com)
  - display pool type in cli and gui (ckozak@redhat.com)
  - 1031008: Properly handle exceptions when checking compliance
    (mstead@redhat.com)
  - Change the capture() context manager to tee output. (awood@redhat.com)
  - Remove mock stdout. Nosetest captures stdout by default. (awood@redhat.com)
  - respect http(s)_proxy env variable for proxy information (jesusr@redhat.com)
  - Created ExceptionMapper to allow sharing exception messages
    (mstead@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.10-1
changelog:
  - 1039736: Modify the remote server string to reference Satellite instead of
    CloudForms (bkearney@redhat.com)
  - 916666: Change method of service detection (wpoteat@redhat.com)
  - Correct at-spi name for subscription type text (ckozak@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.11-1
changelog:
  - 1018807: Ensure virt facts are a single line (bkearney@redhat.com)
  - 1007580: Print blank spaces if there is no contract number on the list
    command (bkearney@redhat.com)
  - Fedora 18 is at end of life. (awood@redhat.com)
  - Updated translations. (dgoodwin@redhat.com)
  - 104338: add default dest dir to rhsm-debug help (alikins@redhat.com)
  - 1042897: add proxy info to rhsm-debug completion (alikins@redhat.com)
  - 914833: rct cat-cert output reports an Order: Subscription: field.
    (wpoteat@redhat.com)
  - 1052297: delay import of site module (ckozak@redhat.com)
  - set default encoding to utf-8 in rhsm-debug and migrate scripts
    (ckozak@redhat.com)
  - 1048325: Set default encoding to utf-8 when running the rct script
    (ckozak@redhat.com)
  - 1050850: re-evaluate system facts when checking for updates
    (ckozak@redhat.com)
  - Some refactoring of rhsm-debug (alikins@redhat.com)
  - Additional improvements to rhsm-debug (wpoteat@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.12-1
changelog:
  - added testing for the pooltype cache (ckozak@redhat.com)
  - 961003: Stricter matches for rhel product tags (alikins@redhat.com)
  - 1059809: Cache pool types to avoid unnecessary api calls (ckozak@redhat.com)
  - 1059809 Improve attach and remove performance add progress bar
    (ckozak@redhat.com)
  - 908869: Fix the mis-transated options in pt-BR (bkearney@redhat.com)
  - 1044596: handle http,socket,ssl fetching release (alikins@redhat.com)
  - dont always print exception message (ckozak@redhat.com)
  - 1044596: Make release listing handle empty data (alikins@redhat.com)
  - 1020423: update help messages (jesusr@redhat.com)
  - Fix incorrect patching. (awood@redhat.com)
  - Mock ProductDatabase so tests can run without a productid.js file
    (awood@redhat.com)
  - 825388: Properly wrap text when reaching dialog limit (mstead@redhat.com)
  - 1021443: display Consumer deleted message (jesusr@redhat.com)
  - Altering titles per mreid conversation. (wpoteat@redhat.com)
  - 1039736: Fix missed reference to CloudForms in tooltip. (dgoodwin@redhat.com)
  - Fix ta_IN translation problem. (dgoodwin@redhat.com)
  - Lock timezone to EST5EDT in timezone tests. (awood@redhat.com)
  - 1005329: add at-spi locator to the SLA selection table (ckozak@redhat.com)
  - 1039914: Update the rhsm-debug man page (bkearney@redhat.com)
  - 874169: Fix label alignment in progress UI (mstead@redhat.com)
  - 1020361: Replace the use of the term Valid with Current in the status command
    (bkearney@redhat.com)
  - 1028596: Add the repo-override command to the subscription-manager man page
    (bkearney@redhat.com)
  - 1020522: Update the man page for subscription-manager with new list options
    (bkearney@redhat.com)
  - Pull in the latest strings from zanata. (bkearney@redhat.com)
  - 1057719: adding a small section on deprecated commands (dlackey@redhat.com)
  - 1017354: remove msg printed to stderr via yum (alikins@redhat.com)
  - 857147: Auto-subscribe window has a confusing name (wpoteat@redhat.com)
  - Use dateutil.tz instead of pytz. (awood@redhat.com)
  - 883486: The local time's start/end dates rendered in the list
    --available/--consumed incorrect (wpoteat@redhat.com)
  - 1049037: Add conditional requires on migration data package.
    (awood@redhat.com)
  - 973938: correctly handle SIGPIPE in rct (ckozak@redhat.com)
  - 878089: Add line wrapping when listing subscription-manager modules
    (ckozak@redhat.com)
  - 1017354: Ensure all message go to stdout, not stderr (bkearney@redhat.com)
  - 851325: Anchor choose server "default" button beside the text box.
    (dgoodwin@redhat.com)
  - 1039739: Add 96x96 and 256x256 icons (bkearney@redhat.com)
  - 873967: Move choose server tooltips closer to the elements they assist with.
    (dgoodwin@redhat.com)
  - 1044686: Make serverurl parse error detailed again (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.13-1
changelog:
  - 1060917: catch exception thrown in firstboot (ckozak@redhat.com)
  - Extract the latest strings (bkearney@redhat.com)
  - 995121: require gnome-icon-theme for calendar icon (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.14-1
changelog:
  - Use glob for finding entitlement certs to remove. (dgoodwin@redhat.com)
  - Make sure entitlement cert directory exists before we clean it out.
    (dgoodwin@redhat.com)
  - safer default args in AsyncWidgetUpdater (ckozak@redhat.com)
  - use enumerate instead of confusing myself (ckozak@redhat.com)
  - Pull in latest strings from zanata (bkearney@redhat.com)
  - make sure entitlement has a pool before reading it (ckozak@redhat.com)
  - quickly load preferences (ckozak@redhat.com)
  - 1061937: preference changes occur in the background (ckozak@redhat.com)
  - use existing signals (ckozak@redhat.com)
  - simplify preferences window (ckozak@redhat.com)
  - Fix test failure if run on system that is registered. (dgoodwin@redhat.com)
  - 1061393: Don't allow subscription-manager string to be translated
    (ckozak@redhat.com)
  - 1016427: On string was missed from the extraction (bkearney@redhat.com)
  - 1058495: productid yum errors on yum remove (alikins@redhat.com)
  - 1026501: Preserve PKI directories and have rpm own them.
    (dgoodwin@redhat.com)
  - 1058374: Fix crash on exception in managergui._show_buttons
    (ckozak@redhat.com)


author: Alex Wood <awood@redhat.com> 1.11.1-1
changelog:
  - 1021069: Add reference to network usage info. (alikins@redhat.com)
  - latest strings from zanata 1.11.X branch (alikins@redhat.com)
  - 1061923: Remove trailing period from privacy URL (wpoteat@redhat.com)
  - 1039913: rhsm-debug updates and fixes (alikins@redhat.com)
  - 1061407: don't allow some translations (ckozak@redhat.com)
  - 1055664: rhsm-debug now follows more config paths (alikins@redhat.com)
  - 1038242: add anaconda.pid check before chroot (alikins@redhat.com)
  - 1035115: Update product id certs (alikins@redhat.com)
  - 864195: New output line for subscribe --auto if it can't cover all products
    (wpoteat@redhat.com)
  - 1060727: Changes to rhsm-debug for sos report (wpoteat@redhat.com)
  - 1044596: Don't match beta product tags for release (alikins@redhat.com)
  - 851325: Tweak activation key checkbox to left (alikins@redhat.com)
  - Use systemd RPM macros to make life easier. (awood@redhat.com)
  - 958016: use rpm %{optflags} and _hardended_build (alikins@redhat.com)


author: Alex Wood <awood@redhat.com> 1.11.2-1
changelog:
  - Use the new Product.brand_name for brand_name (alikins@redhat.com)
  - 865702: Dont render exc messages with bogus markup (alikins@redhat.com)
  - 1070908: Don't count cpus without topo for lpar (alikins@redhat.com)
  - 1075167: Avoid using injected values in migrate-classic-to-rhsm
    (ckozak@redhat.com)
  - 1074568: Use our translations in optparser (ckozak@redhat.com)
  - Man page spelling corrections (wpoteat@redhat.com)
  - 1070737: correct config section for ca_cert_dir (ckozak@redhat.com)


author: Alex Wood <awood@redhat.com> 1.11.3-1
changelog:
  - Cleanup entbranding tests names. (alikins@redhat.com)
  - Test cases for empty,none,not set brand type/name (alikins@redhat.com)
  - Use a real certificate2.Product in tests cases. (alikins@redhat.com)
  - Latest strings from zanata (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.11.4-1
changelog:
  - Move atspi locator to correct element (ckozak@redhat.com)
  - 1090560: readd locator to the all subs view (ckozak@redhat.com)
  - test_cert_sorter could fail based on test order (alikins@redhat.com)
  - 1058383: widgets are added and removed dynamically (ckozak@redhat.com)


author: Alex Wood <awood@redhat.com> 1.11.5-1
changelog:
  - Removing CVS properties since CVS is dead. (awood@redhat.com)
  - CertSorter syncs installed prods before super init. (alikins@redhat.com)
  - Add more entcertlib class and method docs. (alikins@redhat.com)
  - Reorder methods in roughly exec order (alikins@redhat.com)
  - entcertlib docstring cleanup (alikins@redhat.com)
  - TestDataLib -> TestBaseActionInvoker (alikins@redhat.com)
  - repolib.RepoUpdateAction ->RepoUpdateActionCommand (alikins@redhat.com)
  - repolib.RepoLib -> RepoActionInvoker (alikins@redhat.com)
  - InstalledProductsLib -> InstalledProductsActionInvoker (alikins@redhat.com)
  - IdentityCertLib -> IdentityCertActionInvoker (alikins@redhat.com)
  - healiblib.HealingLib -> HealingActionInvoker (alikins@redhat.com)
  - FactAction -> FactsActionCommand (alikins@redhat.com)
  - FactActionReport -> FactsActionReport (alikins@redhat.com)
  - FactLib -> FactsActionInvoker (alikins@redhat.com)
  - entcertlib.EntCertLib -> EntCertActionInvoker (alikins@redhat.com)
  - certlib.DataLib -> certlib.BaseActionInvoker (alikins@redhat.com)
  - rename certmgr.py to action_client (alikins@redhat.com)
  - Rename CertManager to ActionClient (alikins@redhat.com)
  - Rename CertManager to CertActionClient (alikins@redhat.com)
  - Update docstrings. (alikins@redhat.com)
  - Remove no longer used old_install. (alikins@redhat.com)
  - Add entcertlib docs (alikins@redhat.com)
  - update copyright info (alikins@redhat.com)
  - s/entdir/ent_dir since we use that slightly more (alikins@redhat.com)
  - factsgui identity now injected at the last minute (alikins@redhat.com)
  - SubManFixture's mock identity now NonCallable (alikins@redhat.com)
  - test_async does not need to mock Facts (alikins@redhat.com)
  - Store default inject stub Facts on SubManFixture (alikins@redhat.com)
  - Remove unneeded Facts() init. (alikins@redhat.com)
  - Replace Facts() with injected facts in managercli (alikins@redhat.com)
  - Start replacing use of Facts() with inj'ed facts (alikins@redhat.com)
  - Stop passing facts to ReleaseBackend. (alikins@redhat.com)
  - Make repolib use inject ent_dir/prod_dir (alikins@redhat.com)
  - Make cp_provider manage ContentConnection (alikins@redhat.com)
  - Make ReleaseBackend use inj'ed ent/prod dirs (alikins@redhat.com)
  - split migrates basic/consumer connection methods (alikins@redhat.com)
  - migrate.py now uses inj'ed CP_PROVIDER (alikins@redhat.com)
  - ReleaseBackend doesn't need a uep, remove it. (alikins@redhat.com)
  - Stop passing a uep into CertManager and friends. (alikins@redhat.com)
  - Don't pass cp to RepoLib from cli, use inj (alikins@redhat.com)
  - update Overrides to use inject uep (alikins@redhat.com)
  - Split IdentityCertLib into Lib+Action (alikins@redhat.com)
  - Use the mock cp_provider inject with the fixture (alikins@redhat.com)
  - certlib.DataLib doesn't need a uep now (alikins@redhat.com)
  - Fix testcase to use injected uep (alikins@redhat.com)
  - Use inj'ed UEP in healinglib (alikins@redhat.com)
  - Use inj'ed UEP in repolib (alikins@redhat.com)
  - Use inj'ed UEP in packageprofilelib (alikins@redhat.com)
  - Use inject uep in installedproductslib (alikins@redhat.com)
  - Remove unneeded mock Facts in test_certmgr (alikins@redhat.com)
  - Make certmgr let FactLib use inj uep (alikins@redhat.com)
  - Make FactActionReport use inj'ed UEP (alikins@redhat.com)
  - Start letting EntCertLib use injected UEP (alikins@redhat.com)
  - Move entcertlib to use inj'ed cp_proivder (alikins@redhat.com)
  - Remove now wrong comment (alikins@redhat.com)
  - Remove late import of repolib (alikins@redhat.com)
  - Remove incorrect docstrings (alikins@redhat.com)
  - Remove initial entcertlib invocation (alikins@redhat.com)
  - Don't pass in a facts object, inject it (alikins@redhat.com)
  - We don't use the passed in entdir, don't pass it (alikins@redhat.com)
  - Handle ActionReport lists having None (alikins@redhat.com)
  - Remove commented out code (alikins@redhat.com)
  - Fix up for now, but need to remove these tests (alikins@redhat.com)
  - certdata merge cleanups (alikins@redhat.com)
  - merge cleanups (alikins@redhat.com)
  - Add new files to spec (alikins@redhat.com)
  - stylish cleanups (alikins@redhat.com)
  - Use injected identity instead of consumer object (alikins@redhat.com)
  - Update to use Caputure() instead of MockStdout (alikins@redhat.com)
  - Fix v1 cert exp cert output for catcert tests (alikins@redhat.com)
  - self.installed is a property now, fix references (alikins@redhat.com)
  - merge cleanups (alikins@redhat.com)
  - make stylish cleanups (alikins@redhat.com)
  - Update repolib tests for certlib refactor (alikins@redhat.com)
  - Repo/override cli tests use injected identity (alikins@redhat.com)
  - Update Repos and overrides for injected identity (alikins@redhat.com)
  - Update RepoLib to use new DataLib init (alikins@redhat.com)
  - Fix mismerge and merge cleanups (alikins@redhat.com)
  - Stylish cleanups, mostly no longer used imports (alikins@redhat.com)
  - Remove unused ProductCertRepo bits (alikins@redhat.com)
  - Keep certmgr update_reports as a instance variable (alikins@redhat.com)
  - Remove certlib.ConsumerIdentity. (alikins@redhat.com)
  - Move firstboot to use injected identity. (alikins@redhat.com)
  - Move 'subscription-manager' yum plugin to inj (alikins@redhat.com)
  - Remove unused ConsumerIdentity from test_unreg (alikins@redhat.com)
  - Using injection in migration for prod_dir/identity (alikins@redhat.com)
  - Remove _get_consumer_id from EntUpdateAction (alikins@redhat.com)
  - Move old test_certlib to test_entcertlib (alikins@redhat.com)
  - Fix fetch_certificates for entcert Report (alikins@redhat.com)
  - Add some comments about id error logging (alikins@redhat.com)
  - Add a certmgr.UnregisterCertMgr class (alikins@redhat.com)
  - Add a RepoActionReport formatter (alikins@redhat.com)
  - Add a RepoActionReport (alikins@redhat.com)
  - More injected id, clean check_registration use (alikins@redhat.com)
  - Test fixes and merge/rebase cleanup (alikins@redhat.com)
  - Make string equals show expected/actual (alikins@redhat.com)
  - identitycertlib now uses injected identity (alikins@redhat.com)
  - certmgr tests were hitting real rpmdb (alikins@redhat.com)
  - PackageProfileManager/InstalledProductsManager inj (alikins@redhat.com)
  - Move PackageProfileLib and InstalledProductsLib (alikins@redhat.com)
  - Make rhsm_d use injection consumer identity (alikins@redhat.com)
  - Convert test_async to use SubManFixture (alikins@redhat.com)
  - test_certmgr calls uep.getRelease, so mock it (alikins@redhat.com)
  - Use injected consumer identity in firstboot (alikins@redhat.com)
  - Use injected consume identity in factlib (alikins@redhat.com)
  - Use ConsumerIdentity from identity not certlib (alikins@redhat.com)
  - Fix self.exceptions reference (alikins@redhat.com)
  - _valid_consumer to _inject_mock_valid_consumer (alikins@redhat.com)
  - Move _[in]valid_consumer to test/fixture.py (alikins@redhat.com)
  - Use injected Identity in repolib (alikins@redhat.com)
  - Remove  certlib.ConsumerIdentity from managerlib (alikins@redhat.com)
  - Inject identity in utils for version check (alikins@redhat.com)
  - Give a name to Mock()s created in test/fixture (alikins@redhat.com)
  - Re add the new slimmer fitter certlib.py (alikins@redhat.com)
  - Make entcertlib uses injected identity (alikins@redhat.com)
  - Split certlib into entcertlib and certlib (alikins@redhat.com)
  - Make IdentityCertLib use inj IDENTITY (alikins@redhat.com)
  - Move IdentityCertLib to identitycertlib.py (alikins@redhat.com)
  - Split Healing* into healinglib.py (alikins@redhat.com)
  - repolib.UpdateAction is now RepoUpdateAction (alikins@redhat.com)
  - Checkout idcertlib._status from it's report (alikins@redhat.com)
  - Inject an ActionLock, and a Facts class. (alikins@redhat.com)
  - Add ActionReports, certlib cleanup, lock cleanup (alikins@redhat.com)
  - The Action subclass is unneeded now. (alikins@redhat.com)
  - CertManager split CertManager/HealingCertManager (alikins@redhat.com)
  - HealingAction just uses an EntCertUpdateReport atm (alikins@redhat.com)
  - reAction()'ify repolib, add RepoReport (alikins@redhat.com)
  - reAction()'ify Factlib, add FactUpdateReport (alikins@redhat.com)
  - certmgr expects a ActionReport from Action.perform (alikins@redhat.com)
  - Rename CertLib->EntCertLib (alikins@redhat.com)
  - Split UpdateReport into base class and sub classes (alikins@redhat.com)
  - Create UpdateReport in Certlib.CertLib and pass it (alikins@redhat.com)
  - Start refactoring certlib (alikins@redhat.com)
  - Add product certs with os_name in certdata (alikins@redhat.com)
  - Add ProductIdRepoMap as core of ProductDatabase (alikins@redhat.com)
  - Add a DefaultDict (defaultdict with pretty print) (alikins@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.11.7-1
changelog:
  - update existing repos with non-default overrides (ckozak@redhat.com)
  - correct repos --list behavior (ckozak@redhat.com)
  - Cache overrides when RepoFile is written (ckozak@redhat.com)
  - 1098891: Apply overrides to mutable properties (ckozak@redhat.com)
  - 1076359; Removes the extra l from --remove all (csnyder@redhat.com)
  - 1098891: Update repos, persisting local settings when possible
    (ckozak@redhat.com)
  - 1094617: Status line reporting for installed products uses incorrect date
    (wpoteat@redhat.com)
  - 1097208: 1097703: Fix rhsmcertd-worker daemon (ckozak@redhat.com)
  - 1086301: Fix product id product version compare (alikins@redhat.com)
  - 1096777: Bad URI for remove by serial (wpoteat@redhat.com)
  - 1095938: re-add at-spi locator in repos window (ckozak@redhat.com)
  - 1094492: Consumer name length issues in certificate (wpoteat@redhat.com)
  - Fix yum subman plugin RepoActionInvoker error. (alikins@redhat.com)
  - Overrides had no "cp", the connection was named uep (ckozak@redhat.com)


author: jesus m. rodriguez <jesusr@redhat.com> 1.12.1-1
changelog:
  - bump version to 1.12 (jesusr@redhat.com)
  - Support getting release versions via API call (mstead@redhat.com)
  - 855050: set default fallback window icon (ckozak@redhat.com)
  - refresh ent_dir after adding/deleting certs (ckozak@redhat.com)
  - 1035440: Don't rewrite redhat.repo unless it has changed (ckozak@redhat.com)
  - 1097536: match-installed filter was incorrectly removed. (wpoteat@redhat.com)
  - 1092754: 1094879: Remove install-num-migrate-to-rhsm tool (ckozak@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 1.12.2-1
changelog:
  - 1070585: GUI no longer locks on connection test. Adds cancel button.
    (csnyder@redhat.com)
  - Disable CLI if we are running inside a container. (dgoodwin@redhat.com)
  - Don't encourage registration in yum plugin if we have ents but no identity.
    (dgoodwin@redhat.com)
  - Allow yum plugin to generate redhat.repo when unregistered.
    (dgoodwin@redhat.com)
  - Rev zanata branch to 1.12.X (alikins@redhat.com)
  - 1030638: Changes default resolution values in mainwindow.glade to 800x600.
    (csnyder@redhat.com)
  - 1086377: Next system check-in not displaying in RHEL 5.11
    (wpoteat@redhat.com)
  - Fix plugin config so conduit conf methods work. (alikins@redhat.com)
  - 1058380: Subscripton Manager plugin reporting Subscription Management when
    RHN is in use (wpoteat@redhat.com)
  - Add support for sphinx doc generation. (alikins@redhat.com)


author: Alex Wood <awood@redhat.com> 1.12.3-1
changelog:
  - Bumping required python-rhsm version (mstead@redhat.com)
  - Fixing checkstyle. (mstead@redhat.com)
  - TODO/FIXME cleanup. (alikins@redhat.com)
  - Cleanup BaseOstreeKeyFileTest.cfgfile_data (alikins@redhat.com)
  - Remove unused model.OstreeRepo (alikins@redhat.com)
  - Use python-rhsm's new EntCert.key_path() (alikins@redhat.com)
  - Add specific exception for refspec parse error (alikins@redhat.com)
  - stylish cleanups (alikins@redhat.com)
  - Add test cases for OstreeContents (alikins@redhat.com)
  - Remove fixed FIXME. (alikins@redhat.com)
  - Add section name to exception reading remote name. (alikins@redhat.com)
  - Remove unused origin/refspec from report. (alikins@redhat.com)
  - repr and report format cleanups. (alikins@redhat.com)
  - Save needed ostree remote info to config file. (alikins@redhat.com)
  - Mock an ent cert associated with a content. (alikins@redhat.com)
  - Start passing along ent cert ssl info to ostree (alikins@redhat.com)
  - Fix mismerge for OstreeContents usage (alikins@redhat.com)
  - call get_path() to get path string on deploy (alikins@redhat.com)
  - Remove done TODO (map gpgkey->gpg-verify) (alikins@redhat.com)
  - _get_deployed_origin returns None if not a ostree install
    (alikins@redhat.com)
  - Fix missed return in gi_wrapper. (dgoodwin@redhat.com)
  - Rename poor choice of gi.py script. (dgoodwin@redhat.com)
  - Only replace origin remote if it matches first portion of ref.
    (dgoodwin@redhat.com)
  - Test subprocess error calling pygobject3 script, log output.
    (dgoodwin@redhat.com)
  - Start making OstreeContent resp for finding contents. (alikins@redhat.com)
  - Add models.py to spec (alikins@redhat.com)
  - Make models internal data attrs '_' (alikins@redhat.com)
  - Add a static map_gpg to OstreeRemote (alikins@redhat.com)
  - stylish cleanups (alikins@redhat.com)
  - Remove 'api' module. (alikins@redhat.com)
  - Add models module, for objects we pass to plugins (alikins@redhat.com)
  - OSTree package depends on pygobject3-base. (dgoodwin@redhat.com)
  - Move gi introspection code to separate script. (dgoodwin@redhat.com)
  - Add some missing copyright notices. (dgoodwin@redhat.com)
  - Remove inj from 'api' module. (alikins@redhat.com)
  - Add more tests. (alikins@redhat.com)
  - Remove per class repo_file_store_class (alikins@redhat.com)
  - Package ostree plugin as a sub-package. (dgoodwin@redhat.com)
  - Test cases for OstreeConfig and ..RepoFileWriter (alikins@redhat.com)
  - When persisting a OstreeCore copy all items. (alikins@redhat.com)
  - Default empty OstreeRemotes or OstreeCore (alikins@redhat.com)
  - Fix test cases to look for ostree.config (alikins@redhat.com)
  - Make OstreeConfig use OstreeConfigFileStore (alikins@redhat.com)
  - Remove OstreeConfigUpdater (alikins@redhat.com)
  - Complete happy path test for origin remote updating. (dgoodwin@redhat.com)
  - Attempt to disambiguate use of repo_config_file variables.
    (dgoodwin@redhat.com)
  - Beginning tests for ostree origin updating, refactor tempfiles in tests.
    (dgoodwin@redhat.com)
  - Name changes (alikins@redhat.com)
  - Add method to replace ostree remote in a refspec. (dgoodwin@redhat.com)
  - Get some better reporting, albeit klugey. (alikins@redhat.com)
  - Add some temp kluge, OstreeRemote's not immutable (alikins@redhat.com)
  - Make OstreeRemote a dict (alikins@redhat.com)
  - Simplify the config model a little. (alikins@redhat.com)
  - s/PluginManagerRunner/PluginHookRunner (alikins@redhat.com)
  - Stylish cleanups. (alikins@redhat.com)
  - Add a runiter to the fixtures mock PluginManager (alikins@redhat.com)
  - We still need the entdir refresh for 'attach'. (alikins@redhat.com)
  - Use PluginManager.runiter for content actions. (alikins@redhat.com)
  - Add a PluginManager.runiter() method. (alikins@redhat.com)
  - Update plugin docs. (alikins@redhat.com)
  - Add notes, comments, docstrings. (alikins@redhat.com)
  - Get ostree repo config saving working-ish (alikins@redhat.com)
  - Update some missed tests. (dgoodwin@redhat.com)
  - Refactor to an update content plugin. (dgoodwin@redhat.com)
  - Update makefile and spec for ostree plugin. (dgoodwin@redhat.com)
  - Move ostree plugin support code to subscription-manager namespace.
    (dgoodwin@redhat.com)
  - Add ostree/model.py for ostree related models. (alikins@redhat.com)
  - More tests for ostree/repo_file (alikins@redhat.com)
  - Add src/content_plugins to coverage (alikins@redhat.com)
  - Use RhsmConfigParser to read repo config (alikins@redhat.com)
  - More ostree impl tests. (alikins@redhat.com)
  - Use the 'api' module when importing from plugins. (alikins@redhat.com)
  - Start of test for 'api' module. (alikins@redhat.com)
  - Add an api module with our "exported" symbols (alikins@redhat.com)
  - Use regular config parser instead of pyxdg (alikins@redhat.com)
  - Add start of tests for ostree repo action (alikins@redhat.com)
  - Start ostree repo action class stubs (alikins@redhat.com)
  - Start ostree implementation tests (alikins@redhat.com)
  - Start adding ostree implementation (alikins@redhat.com)
  - Add TODO about content_plugin installs (alikins@redhat.com)
  - Move OstreeContentActionInvoker to it's own module (alikins@redhat.com)
  - Remove unneeded #!/usr/bin/python (alikins@redhat.com)
  - Make ostree content action loaded from plugins. (alikins@redhat.com)
  - Log exceptions from trying to load plugins. (alikins@redhat.com)
  - Add ostree_content plugin entry point (alikins@redhat.com)
  - HACK: install ostree content plugin in site-packages (alikins@redhat.com)
  - Add content_plugins dir,and ostree content plugins (alikins@redhat.com)
  - Remove sample yum_content plugin (alikins@redhat.com)
  - Hit ContentActionClient for some test coverage. (alikins@redhat.com)
  - Add test for ContentActionPluginConduit (alikins@redhat.com)
  - entcertlib.repo_hook can be content type agnostic (alikins@redhat.com)
  - Replace odd usage of 'repolib' name. (alikins@redhat.com)
  - Load content actions from plugin class search (alikins@redhat.com)
  - Add a dummy yum_content plugin for testing (alikins@redhat.com)
  - Add ContentActionPluginConduit plugin. (alikins@redhat.com)
  - Add ostree_action_invoker (ostree repo action) (alikins@redhat.com)
  - Add ContentActionClient (alikins@redhat.com)
  - 1104158: Version command needs better explanation for content
    (wpoteat@redhat.com)


