# changelog

author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.3.20190408git43d9187c14
changelog:
  - infiniband: allow large MTU (rh #1534869) (rh #1653494)
  - sr-iov: tolerate lack of sriov_drivers_autoprobe sysfs property (rh #1695093)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.18.0-0.4.20190408git43d9187c14
changelog:
  - keyfile: ensure keyfiles don't get a .nmconnection file name extension (rh#1697858)
  - dhcp: preserve legacy dhcp-client-id default for internal dhcp (rh #1695723)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.0-1
changelog:
  - Update to 1.18.0 release
  - cli: fix crash handling gsm secrets (rh #1698495)
  - rules: fix duplicate policy routing rules (rh #1652653)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-2
changelog:
  - cli: hide certificate blobs unless --show-secrets is passed (rh #1702199)
  - device: fix reapply of MTU (rh #1702657)
  - settings: fix failed assertion when adding connections (rh #1707261)
  - core: ensure software devices are managed when networking gets enabled (rh #1701585)
  - device: restore IPv6 configuration on link up (rh #1548237)
  - dbus: fix return value for LoadConnection and avoid assertion for relative path (rh #1708660)
  - core: fix file permissions of /var/lib/NetworkManager/secret_key (rh #1709849)
  - tc: add suppor for mired action an fq_codel qdisc (rh #1546802)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-3
changelog:
  - team: don't kill teamd for external devices (rh #1711952)
  - ifcfg-rh: use PKCS#12 private key also as client certificate in reader (rh #1714610)
  - po: update translations (rh #1689962)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.0-4
changelog:
  - cli: don't wait forever in the editor on update connection failure (rh #1702203)
  - team: fix setting validate_active, validate_inactive and send_always flags (rh #1720153)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1056.el7]
changelog:
  - [infiniband] ib/mlx5: Allow modify AV in DCI QP to RTR (Alaa Hleihel) [1714002]
  - [scsi] core: Allow state transitions from OFFLINE to BLOCKED (Ewan Milne) [1631136]
  - [edac] amd64: Set maximum channel layer size depending on family (Gary Hook) [1705210]
  - [edac] amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1705210]
  - [edac] amd64: Recognize x16 symbol size (Gary Hook) [1705210]
  - [edac] amd64: Support more than two Unified Memory Controllers (Gary Hook) [1705210]
  - [edac] amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1705210]
  - [vhost] vsock: add weight support (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost_net: fix possible infinite loop (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost_net: use packet weight for rx handler, too (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Jason Wang) [1702943] {CVE-2019-3900}
  - [vhost] don't read and process iotlb message with bad lenth (Jason Wang)
  - [vhost] correctly check the return value of translate_desc() in log_used() (Jason Wang) [1657577]
  - [vhost] log dirty page correctly (Jason Wang) [1657577]
  - [vhost] fix OOB in get_rx_bufs() (Jason Wang) [1710182]
  - [vhost] reject zero size iova range (Jason Wang)
  - [vhost] Fix Spectre V1 vulnerability (Jason Wang) [1672554]
  - [vhost] vhost_net: flush batched heads before trying to busy polling (Jason Wang) [1710182]
  - [vhost] vhost_net: batch used ring update in rx (Jason Wang) [1710182]
  - [x86] mark AMD Rome processors supported (David Arcari) [1543509]
  - [x86] microcode: Only load the microcode once on AMD systems (Prarit Bhargava) [1710942]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1057.el7]
changelog:
  - [fs] ext4: zero out the unused memory region in the extent tree block (Lukas Czerner) [1715280] {CVE-2019-11833}
  - [fs] revert "lockd: Show pid of lockd for remote locks" (Benjamin Coddington) [1717377]
  - [scsi] qla2xxx: Allow IRQ balance to spread vectors across multiple CPU (Himanshu Madhani) [1713412]
  - [netdrv] i40e: Do not check VF state in i40e_ndo_get_vf_config (Stefan Assmann) [1701191]
  - [netdrv] qed: Backport missing hw ptp config hunks (Manish Chopra) [1712585]
  - [infiniband] rdma/qedr: Fix incorrect device rate (Manish Chopra) [1713577]
  - [watchdog] core: Add watchdog_thresh command line parameter (Prarit Bhargava) [1714612]
  - [x86] kvm: x86: Sync the pending Posted-Interrupts (Peter Xu) [1719525]
  - [x86] kvm: vmx: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt (Peter Xu) [1719525]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1058.el7]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719915] {CVE-2019-11479}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719595] {CVE-2019-11477}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719850] {CVE-2019-11478}
  - [fs] Revert "Fix default behaviour for empty domains and add domainauto option" (Leif Sahlberg) [1710421]
  - [fs] libceph: handle an empty authorize reply (Ilya Dryomov) [1718305]
  - [scsi] qla2xxx: Mark NVMe/FC initiator mode usage as technology preview (Ewan Milne) [1721655]
  - [nvme] Removing DMA_ATTR_NO_WARN for dma_alloc_attrs (Gopal Tiwari) [1715433]
  - [netdrv] qlcnic: fix Tx descriptor corruption on 82xx devices (Manish Chopra) [1715481]
  - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664199] {CVE-2019-5489}
  - [kernel] pm/hibernate: exclude all PageOffline() pages (David Hildenbrand) [1718771]
  - [hv] hv_balloon: mark inflated pages PG_offline (David Hildenbrand) [1718771]
  - [kernel] kexec: export PG_offline to VMCOREINFO (David Hildenbrand) [1718771]
  - [kernel] mm: convert PG_balloon to PG_offline (David Hildenbrand) [1718771]
  - [kernel] mm: split page_type out from _mapcount (David Hildenbrand) [1718771]
  - [kernel] mm: clean up non-standard page->_mapcount users (David Hildenbrand) [1718771]
  - [kernel] mm: consolidate all page-flags helpers in <linux/page-flags.h> (David Hildenbrand) [1718771]
  - [kernel] mm: page-flags: clean up the page flag test, set, clear macros (David Hildenbrand) [1718771]
  - [kernel] alarmtimer: Prevent overflow for relative nanosleep (Artem Savkov) [1653677] {CVE-2018-13053}
  - [kernel] module.c: Only return -EEXIST for modules that have finished loading part II (Prarit Bhargava) [1704844]
  - [x86] mm: Create an SME workarea in the kernel for early encryption (Lianbo Jiang) [1718348]
  - [x86] mm: Identify the end of the kernel area to be reserved (Lianbo Jiang) [1718348]
  - [x86] kdump: Export the SME mask to vmcoreinfo (Lianbo Jiang) [1718348]
  - [fs] proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() (Lianbo Jiang) [1718348]
  - [x86] kdump, proc/vmcore: Enable kdumping encrypted memory with SME enabled (Lianbo Jiang) [1718348]
  - [iommu] amd: Remap the IOMMU device table with the memory encryption mask for kdump (Lianbo Jiang) [1718348]
  - [kernel] kexec: Allocate decrypted control pages for kdump if SME is enabled (Lianbo Jiang) [1718348]
  - [x86] ioremap: Add an ioremap_encrypted() helper (Lianbo Jiang) [1718348]
  - [x86] pti: Do not create debugfs for the pti_enabled when SME is active (Lianbo Jiang) [1720997]
  - [x86] resctrl: Prevent NULL pointer dereference when local MBM is disabled (Prarit Bhargava) [1713547]
  - [s390] pkey: Indicate old mkvp only if old and current mkvp are different (Hendrik Brueckner) [1720388]
  - [s390] qdio: clear intparm during shutdown (Hendrik Brueckner) [1720390]
  - [s390] Remove VLAIS in ptff() and clear_table() (Yauheni Kaliuta) [1691710]
  - [s390] remove 31 bit support (Yauheni Kaliuta) [1691710]
  - [s390] timex: fix get_tod_clock_ext() inline assembly (Yauheni Kaliuta) [1691710]
  - [s390] Use for_each_set_bit_inv instead of for_each_set_bit_left (Yauheni Kaliuta) [1691710]
  - [s390] bitops: add for_each_set_bit_inv helper (Yauheni Kaliuta) [1691710]
  - [s390] bitops: rename find_first_bit_left() to find_first_bit_inv() (Yauheni Kaliuta) [1691710]
  - [s390] bitops: use flogr instruction to implement __ffs, ffs, __fls, fls and fls64 (Yauheni Kaliuta) [1691710]
  - [s390] bitops: use generic find bit functions / reimplement _left variant (Yauheni Kaliuta) [1691710]
  - [s390] bitops: remove CONFIG_SMP / simplify non-atomic bitops (Yauheni Kaliuta) [1691710]
  - [s390] bitops: make use of interlocked-access facility 1 instructions (Yauheni Kaliuta) [1691710]
  - [s390] bitops: fix inline assembly constraints (Yauheni Kaliuta) [1691710]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1059.el7]
changelog:
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712861] {CVE-2019-11810}
  - [fs] cifs: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM (Leif Sahlberg) [1714220]
  - [fs] cifs: add more spinlocks to pretect against races (Leif Sahlberg) [1580165]
  - [fs] xfs: serialize unaligned dio writes against all other dio writes (Brian Foster) [1699800]
  - [fs] xfs: disable copy_file_range() to avoid broken splice copy (Brian Foster) [1688067]
  - [fs] ext4: check superblock mapped prior to committing (Lukas Czerner) [1721737]
  - [sound] alsa: alsa: hda - do not use ALC255_FIXUP_MIC_MUTE_LED for Huawei laptops (Jaroslav Kysela) [1721867]
  - [sound] alsa: revert "[sound] alsa: hda - Support led audio trigger" (Jaroslav Kysela) [1721867]
  - [mm] memory_hotplug: fix scan_movable_pages() for gigantic hugepages (Rafael Aquini) [1721503]
  - [mm] page_alloc: fix has_unmovable_pages for HugePages (Rafael Aquini) [1721503]
  - [mm] memory_hotplug: check zone_movable in has_unmovable_pages (Rafael Aquini) [1721503]
  - [mm] memory_hotplug: make has_unmovable_pages more robust (Rafael Aquini) [1721503]
  - [kernel] workqueue: Fix NULL pointer dereference (Denys Vlasenko) [1655834]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1060.el7]
changelog:
  - [char] random: move FIPS continuous test to output functions (Herbert Xu) [1723910]
  - [netdrv] i40e: fix WoL support check (Stefan Assmann) [1720021]
  - [fs] revert "gfs2: Use d_materialise_unique instead of d_splice_alias" (Robert S Peterson) [1677686]
  - [mm] vmpressure: make sure there are no events queued after memcg is offlined (Vratislav Bendel) [1685447]
  - [mm] revert "mm: split page_type out from _mapcount" (David Hildenbrand) [1723689]
  - [mm] huge_memory: make pmd huge before dirty (Rafael Aquini) [1720278]
  - [mm] revert "don't split THP page when MADV_FREE syscall is called" (Rafael Aquini) [1720278]
  - [mm] revert "fix incorrect unlock error path in madvise_free_huge_pmd" (Rafael Aquini) [1720278]
  - [mm] revert "pmd dirty emulation in page fault handler" (Rafael Aquini) [1720278]
  - [mm] revert "thp: fix crash due race in MADV_FREE handling" (Rafael Aquini) [1720278]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1061.el7]
changelog:
  - [linux] efi: Disable local interrupts across efi run-time calls (Lenny Szubowicz) [1716252]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1723032]
  - [net] tcp: provide TCP_FRAG_IN_WRITE/RTX_QUEUE for tcp_fragment use (Florian Westphal) [1723032]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.1.1.el7]
changelog:
  - [fs] nfsv4.1: Avoid false retries when RPC calls are interrupted (Benjamin Coddington) [1739077 1732427]
  - [fs] NFS4.1 handle interrupted slot reuse from ERR_DELAY (Benjamin Coddington) [1739077 1732427]
  - [fs] nfsv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY (Benjamin Coddington) [1739077 1732427]
  - [fs] cifs: fix panic in smb2_reconnect (Leif Sahlberg) [1737382 1702264]
  - [scsi] sg: protect against races between mmap() and SG_SET_RESERVED_SIZE (Ewan Milne) [1737380 1710533]
  - [scsi] sg: recheck MMAP_IO request length with lock held (Ewan Milne) [1737380 1710533]
  - [scsi] sg: reset 'res_in_use' after unlinking reserved array (Ewan Milne) [1737380 1710533]
  - [scsi] sg: protect accesses to 'reserved' page array (Ewan Milne) [1737380 1710533]
  - [netdrv] mlx4/en_netdev: allow offloading VXLAN over VLAN (Paolo Abeni) [1734333 1733671]
  - [netdrv] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1704879 1704880] {CVE-2019-9500}
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1739130 1732106]
  - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/feature: Relocate X86_FEATURE_INVPCID_SINGLE (Waiman Long) [1729810 1724510] {CVE-2019-1125}


author: Christopher Snyder <csnyder@redhat.com> 1.24.6-1
changelog:
  - 1700445: Do not disabled repos in redhat.repo; ENT-1261 (jhnidek@redhat.com)
  - 1591704: Handle disabled status when golden ticket is in play
    (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.7-1
changelog:
  - 1704662: Do not create corrupted redhat.repo (wrong scheme); ENT-1306
    (jhnidek@redhat.com)
  - 1703768: Display 'Status Details' correctly in GUI; ENT-1305
    (jhnidek@redhat.com)
  - 1699345: Do not perform proxy check under some circumstances.
    (awood@redhat.com)
  - 1698645: Ensure we use local syspurpose when there are network issues
    (csnyder@redhat.com)
  - 1698443: Proper callbacks in cert sorter (wpoteat@redhat.com)
  - 1697563: Suppress output when collecting profile (khowell@redhat.com)
  - 1696428: use enabled_metadata = 0 for disabled repositories
    (jhnidek@redhat.com)
  - 1669994: Use on_date on syspurpose status if specified (nmoumoul@redhat.com)
  - 1668152: Remove the Select SLA screen from initial-setup
    (nmoumoul@redhat.com)
  - 1660883: Better feedback for repo commands when not registered
    (wpoteat@redhat.com)
  - 1657173: Install cron service properly on SLES; ENT-1250 (jhnidek@redhat.com)
  - 1657171: Bug fix of .spec file specific for SuSE; ENT-1056
    (jhnidek@redhat.com)
  - 1637090: Do not send Host header twice, when m2crypto is used; ENT-1100
    (jhnidek@redhat.com)
  - 1621275: Less communication with candlepin server from sub-man plugin;
    ENT-923 (jhnidek@redhat.com)
  - 1708722: Only show syspurpose usage when necessary (csnyder@redhat.com)
  - 1688221: Update translations (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.10-1
changelog:
  - 1688221: update translations (csnyder@redhat.com)
  - Revert "1700445: Do not disabled repos in redhat.repo; ENT-1261"
    (csnyder@redhat.com)
  - Revert "1621275: Less communication with candlepin server from sub-man
    plugin; ENT-923" (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.11-1
changelog:
  - 1709728: Dialog with proxy conf didn't pop-up; ENT-1333 (jhnidek@redhat.com)
  - 1704421: Install only one prod cert, when RPM is available in more repos.
    (jhnidek@redhat.com)
  - 1710564: Make entitlement certs and keys world-readable (csnyder@redhat.com)


author: Eric Garver <egarver@redhat.com> - 0.6.3-1
changelog:
  - rebase package to v0.6.3, include recent stable fixes
  - use QT4 patch for firewall-applet
  - remove cockpit service definition, cockpit package still ships their own
  - remove testsuite force of LC_ALL=C.UTF-8. RHEL-7 doesn't have C.UTF-8
  - remove nftables support


author: Eric Garver <egarver@redhat.com> - 0.6.3-2
changelog:
  - backport recent upstream stable fixes
  - backport fix to enable IP forwarding only if toaddr specified


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
  - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
  - Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621158)
    - CVE-2018-15910 (bug #1621160)
    - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-2.2
changelog:
  - Resolves: #1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744003 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744228 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Ray Strode <rstrode@redhat.com> - 3.26.2-7
changelog:
  - Fix logic error in password expiration notification bubble
    Resolves: #1530659
    Related: 1314443


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-9
changelog:
  + gnome-settings-daemon-3.26.2-9
  - Revert automatic suspend after inactivity, it was rejected
  - Related: #1449171


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Regenerate pr3393-rh1273760-support_rsaandmgf1_with_sha_in_pkcs11.patch against current sources
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.2
changelog:
  - Synchronise Requires with java-1.8.0-openjdk
  - Replace liblcms.so and libsctp.so in _privatelibs with libjavalcms.so and libjavasctp.so
  - Add libjavagtk.so and libmawt.so to _privatelibs
  - Remove duplicate fontconfig build requirement
  - Remove unneeded Requires for fontconfig, lcms2 and libjpeg (all dynamically linked against)
  - Add _isa to NSS requirements
  - Move policytool desktop file and man page to java-1.7.0-openjdk where the binary is
  - Resolves: rhbz#1608957


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.1
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Jan Grulich <jgrulich@redhat.com> - 19-23.9
changelog:
  - Check if we have write access to home directory before creating default folders
    Resolves: bz#1579764


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-9
changelog:
  - Do not fork konsole process when opening terminal from apps using dolphin-part
    Resolves: bz#1710362


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-32
changelog:
  - Include preauth name in trace output if possible
  - Update cert generation scripts to work on modern openssl
  - Fix per-request preauth scoping
  - Add test case for PKINIT DH renegotiation
  - Echo KDC cookies in preauth tryagain
  - Fall back to other preauth mechanisms after failures
  - Resolves: #1540130


author: Lukas Nykryn <lnykryn@redhat.com> - 219-59
changelog:
  - man: correct the meaning of TimeoutStopSec= (#1305509)
  - rules: mark hotplugged memory as movable (#1563532)
  - udev: add ID_INPUT_SWITCH for devices with switch capability (#5057) (#1597240)
  - rules: disable support for Dell IR cameras (#1591316)
  - rpm: fix 
  if [ $1 -eq 1 ] ; then 
                  systemctl preset \--global  >/dev/null 2>&1 || : 
  fi 
  () macro. (#1582383)
  - rpm: remove confusing --user before --global (#1582383)
  - automount: handle state changes of the corresponding mount unit correctly (#1596241)
  - man: document that SIGCONT always follows SIGTERM (#1601794)
  - rules: add udev rule that automatically offline HW attached to ACPI container (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-60
changelog:
  - Revert "rules: mark hotplugged memory as movable" (#1614686)
  - rules: implement new memory hotplug policy (#1614686)
  - Revert "rules: add udev rule that automatically offline HW attached to ACPI container" (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1619743)
  - cryptsetup-generator: don't return error if target directory already exists (#1619743)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
  - Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-63
changelog:
  - dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)
  - journald: free cmdline buffers owned by iovec (#1666646)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-64
changelog:
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631531)
  - core: disable the effect of Restart= if there's a stop job pending for a service (#6581) (#1626382)
  - networkd: respect DHCP UseRoutes option (#1663365)
  - networkd: fix dhcp4 link without routes not being considered ready (#8728) (#1663365)
  - networkd: dont crash when mtu changes (#6594) (#1663365)
  - tmpfiles: "e" takes globs (#1641764)
  - tmpfiles: 'e' is supposed to operate on directory only (#1641764)
  - tmpfiles: 'e' is supposed to accept shell-style globs (#1641764)
  - bus-message: do not crash on message with a string of zero length (#1643396)
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)
  - set automount state to waiting when the mount is stopped (#1651257)
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - shorten hostname before checking for trailing dot (#1631625)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1619543)
  - local-addresses: handle gracefully if routes lack an RTA_OIF attribute (#1627750)
  - rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1666612)
  - 6647 - use path_startswith("/dev") in cryptsetup (#6732) (#1664695)
  - core: mount-setup: handle non-existing mountpoints gracefully (#1585411)
  - units/rescue.service.in: fix announcement message (#1660422)
  - systemctl: Allow 'edit' and 'cat' on unloaded units (#1649518)
  - main: improve RLIMIT_NOFILE handling (#5795) (#1585913)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1609816)
  - journalctl: allow --file/--directory with --boot or --list-boots (#1463678)
  - journalct: allow --boot=0 to DTRT with --file/--directory (#1463678)
  - journal-remote: show error message if output file name does not end with .journal (bz#1267552)
  - artificially serialize building of .policy files (#1272485)
  - cryptsetup: add support for sector-size= option (#9936) (#1571801)
  - cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) (#1571801)
  - journal: fix syslog_parse_identifier() (#1657794)
  - journal: do not remove multiple spaces after identifier in syslog message (#1657794)
  - tmpfiles: change ownership of symlinks too (#1620110)
  - tmpfiles: fix check for figuring out whether to call chmod() (#1620110)
  - shared/install: allow "enable" on linked unit files (#1628575)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
  - backport fd_is_fs_type (#1663143)
  - backport chase_symlinks (#1663143)
  - fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
  - fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
  - sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
  - notify: add new --uid= command (#1663143)
  - core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
  - journald: respect KeepFree= as well as MaxUse= values (#1361893)
  - shutdown: in_container was used before its definition (#1693716)
  - core: Fix edge case when processing /proc/self/mountinfo (#1691511)
  - sd-bus: deal with cookie overruns (#1693559)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
  - Allocate temporary strings to hold dbus paths on the heap (#1667871)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
  - udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
  - udev: call poll() again after killing the spawned process (#1697909)
  - udev: check age against both timeouts to prevent integer wraparound (#1697909)
  - avoid possible hang if our child process hangs (#1697909)
  - missing: when adding syscall replacements, use different names (#1694605)
  - include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
  - sd-bus: unify three code-paths which free struct bus_container (#1643394)
  - hashmap: don't use mempool (#1609349)
  - man: be more explicit about thread safety of sd_journal (#1609349)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-67.1
changelog:
  - return error value on failure (#1729226)
  - revert local changes made during backport of the test (#1729226)
  - core/timer: Prevent timer looping when unit cannot start (#1729230)
  - core: add a "Requires=" dependency between units and the slices they are located in (#1729228)
  - core: rerun GC logic for a unit that loses a reference (#1729228)
  - pid1: rename unit_check_gc to unit_may_gc (#1729228)
  - pid1: include the source unit in UnitRef (#1729228)
  - pid1: fix collection of cycles of units which reference one another (#1729228)
  - pid1: free basic unit information at the very end, before freeing the unit (#1729228)
  - pid1: properly remove references to the unit from gc queue during final cleanup (#1729228)
  - service: relax PID file symlink chain checks a bit (#8133) (#1729414)
  - path-util: fix more path_is_mount e792e890f fallout (#1279231)


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
  - Rebase to libguestfs 1.36.10 in RHEL 7.5.
    resolves: rhbz#1472272
  - Build against OCaml 4.05
    resolves: rhbz#1447981
  - Enable the copyonread flag when running the appliance using libvirt.
    resolves: rhbz#1466563
  - Make sure kernel-rt is never used as Requires.
    resolves: rhbz#1471651
  - v2v: disable unconfiguration of manually installed VMware tools.
    resolves: rhbz#1477905
  - v2v: prefer pigz or pxz for uncompressing OVA files, if available
    resolves: rhbz#1448739
  - resize: handle empty UUIDs for swap partitions
    resolves: rhbz#1482737
  - v2v: remove mention of --dcpath in an error message
    resolves: rhbz#1486197
  - Disables the QEMU image file locking when opening disks as read-only
    resolves: rhbz#1417306
    resolves: rhbz#1503497
  - Briefly document the format used for URIs
    resolves: rhbz#1450325
  - v2v: deal with grub2 configurations without a default set
    resolves: rhbz#1472288
  - v2v: warn when a guest has passthrough devices
    resolves: rhbz#1472719
  - v2v: fix three regular expressions
    resolves: rhbz#1494555
  - v2v: enable conversion of full-disk LUKS-encrypted Linux guests
    resolves: rhbz#1451665
  - v2v: new 'vddk' import method
    resolves: rhbz#1477912
    resolves: rhbz#1513884
  - Enable libguestfs to work on z Systems
    resolves: rhbz#1479526
  - p2v: fx check for sudo requiring a password
    resolves: rhbz#1500673
  - v2v: handle disks with snapshots in vCenter
    resolves: rhbz#1172425
  - rescue: backport improved version
    resolves: rhbz#1438710
  - v2v: improve bootloader detection
    resolves: rhbz#1508299
  - v2v: parse MAC address of network interfaces in OVF files
    resolves: rhbz#1506572
  - Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
    pull the right qemu-kvm too, and thus remove the unversioned dependencies
    on it
    resolves: rhbz#1500870
  - v2v: fix RPM file owned test
    resolves: rhbz#1503958
  - Do not open read-only disks using <shareable/> in the libvirt backend
    resolves: rhbz#1518517
  - v2v: handle better when grubby does not report any default kernel
    resolves: rhbz#1519204
  - v2v: enhance vmx import method to access via SSH
    resolves: rhbz#1523767
  - builder: fix caching of templates when using --cache-all-templates
    resolves: rhbz#1523650


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.2-12
changelog:
  - Rebase to libguestfs 1.38.2 in RHEL 7.6.
    resolves: rhbz#1551055
  - v2v: warn about unknown VMware controller types
    resolves: rhbz#1510801
  - df: show correct sizes in human-readable mode for filesystems with
    block size = 512
    resolves: rhbz#1525262
  - v2v: fix example URL in man page
    resolves: rhbz#1540535
  - Fix SELinux relabelling when the SELinux config has no SELINUXTYPE key
    resolves: rhbz#1541525
  - Fix qemu-img-ma dependency in non-x86_64 architectures
    resolves: rhbz#1568676
  - v2v: update "resume=/dev/sdaX" entries in GRUB command lines
    resolves: rhbz#1532224
  - v2v: fix virtio-rng and memballoon OVF fragment for RHV
    resolves: rhbz#1550168
  - v2v: detect whether the root filesystem was not mounted in read-write mode
    resolves: rhbz#1567763
  - v2v: import OVAs with snapshots
    resolves: rhbz#1570407
  - v2v: ship a newer version of rhev-apt.exe
    resolves: rhbz#1571237
  - Move the osinfo-db dependency to libguestfs-tools-c, since it's the only
    place where it used now (by virt-builder-repository).
  - v2v: new 'rhv-upload' method to stream images directly to oVirt/RHV using
    oVirt REST API
    resolves: rhbz#1557273
  - Start lvmetad earlier when booting the appliance
    resolves: rhbz#1581810
  - v2v: fix kernel detection in Ubuntu guests since 18.04
    resolves: rhbz#1591248
  - v2v: convert the CPU topology correctly
    resolves: rhbz#1541908
  - Add a new inspect_get_osinfo API, and add its result to the output of
    virt-inspector
    resolves: rhbz#1544842
  - Pass absolute paths to NBD sockets when using the libvirt backend
    resolves: rhbz#1588451
  - v2v: do not write only <vendor> without <model> in libvirt XMLs
    resolves: rhbz#1591789
  - v2v: depend on nbdkit, nbdkit-plugin-python2, and nbdkit-plugin-vddk,
    used for -it vddk, and -o rhv-upload
    resolves: rhbz#1589776
    resolves: rhbz#1608718
  - v2v/p2v: disable on aarch64, since it is not supported (nor even working)
    there
    resolves: rhbz#1601488
  - v2v: handle srN devices in libvirt XML (for virt-p2v)
    resolves: rhbz#1612785
  - Do not use the -cpu parameter under any circumstances for ppc64le.
    resolves: rhbz#1605071


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.2-12.el7_6.1
changelog:
  - v2v: update documentation regarding SHA-2 certificates in Windows 7 and
    Windows Server 2008 R2
    resolves: rhbz#1632788
  - v2v: fix rhev-apt firstboot command for Windows
    resolves: rhbz#1625216


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-5
changelog:
  - Rebase to libguestfs 1.40.2 in RHEL 7.7.
    resolves: rhbz#1621895
  - v2v: uninstall the VMware Tools correctly
    resolves: rhbz#1465849
    resolves: rhbz#1481930
  - v2v: fix VMware vCenter roles needed for conversion
    resolves: rhbz#1530967
  - v2v: preserve the VM Generation ID
    resolves: rhbz#1598350
  - Query QEMU to known whether KVM is supported
    resolves: rhbz#1605071
  - v2v: add --mac option
    resolves: rhbz#1607274
  - v2v: install ovirt-guest-agent-common on Linux guests migrated to RHV
    resolves: rhbz#1619665
    resolves: rhbz#1691659
  - v2v: provide a way to query for the estimated size of the disks
    resolves: rhbz#1622785
  - Correctly inspect the newer versions of openSUSE (15, Factory, Thumbleweed)
    resolves: rhbz#1634248
  - p2v: add an option to Shutdown the machine after the conversion
    resolves: rhbz#1642044
  - v2v: fix epoch when querying installed RPM packages
    resolves: rhbz#1669395
  - Use a better icon for RHEL >= 7 guests
    resolves: rhbz#1679482
  - v2v: improve the architecture detection of Linux kernel modules
    resolves: rhbz#1690574
  - v2v: ship a newer version of rhev-apt.exe
    resolves: rhbz#1688155
  - v2v: update nbdkit information in documentation
    resolves: rhbz#1605242
  - v2v: warn when a guest has 'direct' network interfaces
    resolves: rhbz#1151902
  - v2v: use proper SELinux label for nbdkit sockets
    resolves: rhbz#1698437


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-5.el7_7.1
changelog:
  - v2v: fix a couple of Python 2 porting issues in the nbdkit Python script
    for 'rhv-upload'
    resolves: rhbz#1726168


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-16
changelog:
  - Handle copying bitmaps to larger data buffers (rhbz#1703159)
  - nwfilter: fix adding std MAC and IP values to filter binding (rhbz#1691358)
  - util: suppress unimportant ovs-vsctl errors when getting interface stats (rhbz#1683175)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-17
changelog:
  - cpu_map: Add support for cldemote CPU feature (rhbz#1537777)
  - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12126, CVE-2018-12127, CVE-2019-11091, CVE-2018-12130)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12127, CVE-2019-11091, CVE-2018-12130)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-18
changelog:
  - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
  - locking: restrict sockets to mode 0600 (CVE-2019-10132)
  - logging: restrict sockets to mode 0600 (CVE-2019-10132)
  - util: require command args to be non-NULL (rhbz#1672957)
  - qemu: use line breaks in command line args written to log (rhbz#1672957)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-19
changelog:
  - virfile: added GPFS as shared fs (rhbz#1710728)
  - util: file: introduce VIR_AUTOCLOSE macro to close fd of the file automatically (rhbz#1641702)
  - vircpuhost: Add support for reading MSRs (rhbz#1641702)
  - virhostcpu: Make virHostCPUGetMSR() work only on x86 (rhbz#1641702)
  - qemu: Make virQEMUCapsProbeHostCPUForEmulator more generic (rhbz#1641702)
  - qemuargv2xmltest: Use mocked virQEMUCapsProbeHostCPU (rhbz#1641702)
  - util: Add virHostCPUGetTscInfo (rhbz#1641702)
  - conf: Report TSC frequency in host CPU capabilities (rhbz#1641702)
  - cpu_x86: Fix placement of *CheckFeature functions (rhbz#1641702)
  - cpu_x86: Probe TSC frequency and scaling support (rhbz#1641702)
  - qemu: Check TSC frequency before starting QEMU (rhbz#1641702)
  - util: Propagate numad failures correctly (rhbz#1716387)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-20
changelog:
  - util: alloc: add macros for implementing automatic cleanup functionality (rhbz#1703661)
  - util: bitmap: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1703661)
  - util: Introduce virBitmapUnion() (rhbz#1703661)
  - util: Introduce virNumaNodesetToCPUset() (rhbz#1703661)
  - qemu: Fix qemuProcessInitCpuAffinity() (rhbz#1703661)
  - qemu: Fix leak in qemuProcessInitCpuAffinity() (rhbz#1703661)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-22
changelog:
  - qemu: Drop cleanup label from qemuProcessInitCpuAffinity() (rhbz#1718172)
  - qemu: Fix NULL pointer access in qemuProcessInitCpuAffinity() (rhbz#1718172)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-23
changelog:
  - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
  - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
  - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
  - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-23.el7_7.1
changelog:
  - qemu: Pass qemuCaps to qemuDomainDefCopy (rhbz#1742023)
  - qemu: Pass qemuCaps to qemuDomainDefFormatBufInternal (rhbz#1742023)
  - qemu: Pass qemuCaps to qemuDomainSaveImageOpen (rhbz#1742023)
  - qemu: Pass qemuCaps to qemuMigrationAnyPrepareDef (rhbz#1742023)
  - qemu: Pass correct qemuCaps to virDomainDefParseString (rhbz#1742023)
  - qemu: Pass qemuCaps to qemuMigrationCookieXMLParse (rhbz#1742023)
  - qemu: Pass correct qemuCaps to virDomainDefCopy (rhbz#1742023)
  - qemu: Pass correct qemuCaps to virDomainDefPostParse (rhbz#1742023)
  - qemu: Pass correct qemuCaps to virDomainDefParseNode (rhbz#1742023)
  - qemu: Pass correct qemuCaps to virDomainDeviceDefPostParse (rhbz#1742023)
  - qemu: Fix crash on incoming migration (rhbz#1742023)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231
  - Print a warning if grub2-mkimage is about to fail and suggest what to do.
    bz#1492177
  - Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-1
changelog:
  - Rebase to version 2.4, drop patches integrated upstream
    Resolves #1534646 #1484051 #1498828 #1571266 #1496518


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
  - Backport fixes for upstream bugs 1974 and 1975
  - Apply upstream PR1954 (record permanent MAC address for bond members)
  - Apply upstream PR2004 (support for custom network interface naming)
  - Backport fix for upstream bug 1926 (support for LACP bonding and teaming)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-20
changelog:
  - IPsrcaddr: add proto and table parameters
  - iSCSILogicalUnit: only create iqn when it doesnt exist

    Resolves: rhbz#1504055
    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-22
changelog:
  - IPsrcaddr: make proto optional to fix regression when used without
    NetworkManager

    Resolves: rhbz#1504055


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-23
changelog:
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1697558


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-30.1
changelog:
  - dhcpd: keep SELinux context in chroot
  - CTDB: add support for v4.9+

    Resolves: rhbz#1731426
    Resolves: rhbz#1731427


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-30
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with next bugfix
    resolves: rhbz#1531295
  - updated imjournal duplicates patch making slower code optional
    and added corresponding doc patch
    resolves: rhbz#1538372


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-31
changelog:
  RHEL 7.6 ERRATUM
  - added new patch fixing ompipe dropping messages when pipe full
    resolves: rhbz#1591819
  - updated mmkubernetes patch to accept non-kubernetes containers
    resolves: rhbz#1539193
    resolves: rhbz#1609023
  - removed json-parsing patches as the bug is now fixed in liblognorm


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-32
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with no log on EACCES
    resolves: rhbz#1531295
  - removed now needless build-deps


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-33
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with extended symlink watching
    resolves: rhbz#1531295
  - updated mmkubernetes patch to accept dots in pod name
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-35
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing memory corruption in omfwd module
    resolves: rhbz#1632659
  - added patch fixing imfile sopping monitor after rotation
    resolves: rhbz#1649250
  - added patch addressing imptcp CVE-2018-16881
    resolves: rhbz#1658288


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-36
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing mmkubernetes halt after pod deletition
    resolves: rhbz#1622767


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-37
changelog:
  RHEL 7.7 ERRATUM
  - edited patch fixing mmkubernetes halt after pod deletition
    (covscan found an issue in previous version)
    resolves: rhbz#1622767
  - added patch stopping flooding logs with journald errors
    resolves: rhbz#1632211
  - added patch stopping flooding logs with symlink false-positives
    resolves: rhbz#1685901
  - added patch stopping memory leak when processing internal msgs
    resolves: rhbz#1666365
  - added documentation patch with info about CRI-O to mmkubernetes
    resolves: rhbz#1625935


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-38
changelog:
  RHEL 7.7 ERRATUM
  - added patch increasing max path size preventing buffer overflow
    with too long paths
    resolves: rhbz#1656860


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-246
changelog:
  - Allow ngaios to use chown capability
  Resolves: rhbz#1653309
  - Dontaudit gpg_domain to create netlink_audit sockets
  Resolves: rhbz#1535109
  - Update fs_rw_cephfs_files() interface to allow also caller domain to read/write cephpfs_t lnk files
  Resolves: rhbz#1558836
  - Update domain_can_mmap_files() boolean to allow also mmap lnk files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247
changelog:
  - Fix typo in gpg SELinux module
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1535109
  - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on
  Resolves: rhbz#1653309
  - Allow nrpe_t domain to be dbus cliennt
  Resolves: rhbz#1653309
  - Add interface sssd_signull()
  Resolves: rhbz#1653309
  - Update userdomains to allow confined users to create gpg keys
  Resolves: rhbz#1535109


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Add interface systemd_logind_read_state()
  Resolves: rhbz#1653309


author: Gris Ge <fge@redhat.com> 1.37-17
changelog:
  - Fix help documents of sg_requests, sg_senddiag and sg_write_buffer.
    (RHBZ #1359282, #1359286, #1359292)


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-2
changelog:
  - [sos] bump release
    Resolves: bz1656812
  - [pcp] collect pmlogger without a sizelimit
    Resolves: bz1639166
  - [maas,mysql,npm,pacemaker,postgresql] fix plugopts data types
    Resolves: bz1697854
  - [foreman,satellite] increase plugin default timeouts
    Resolves: bz1697813
  - [sosreport] update sos.conf manpages
    Resolves: bz1311129
  - [openstack_instack] add ansible.log
    Resolves: bz1702802


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-3
changelog:
  - [katello] support both locations of qpid SSL certs
    Resolves: bz1711305
  - [plugins] add vdsm plugin
    Resolves: bz1706060


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-6
changelog:
  - [utilities] Fix high CPU usage and slow command collection
    Resolves: bz1736422
  - [sosreport,plugins] Stop plugin execution after timeout hit
    Resolves: bz1736424


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1643654
    - disable KSM only once, re-enable it only on full rollback
      resolves: rhbz#1622239
    - functions: reworked setup_kvm_mod_low_latency to count with kernel changes
      resolves: rhbz#1649408
    - updated virtual-host profile
      resolves: rhbz#1569375
    - added log message for unsupported parameters in plugin_net
      resolves: rhbz#1533852
    - added range feature for cpu exclusion
      resolves: rhbz#1533908
    - make a copy of devices when verifying tuning
      resolves: rhbz#1592743
    - fixed disk plugin/plugout problem
      resolves: rhbz#1595156
    - fixed unit configuration reading
      resolves: rhbz#1613379
    - reload profile configuration on SIGHUP
      resolves: rhbz#1631744
    - use built-in functionality to apply system sysctl
      resolves: rhbz#1663412


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1643654
    - used dmidecode only on x86 architectures
      resolves: rhbz#1688371
    - recommend: fixed to work without tuned daemon running
      resolves: rhbz#1687397


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-5.1
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739563


