<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="3a52090baeb046731274bbea42f0a1cbb793f1ce498d5b4c611e1866549269e3" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
<package pkgid="d62b0ebe66957454e51fcaf49d9219f226cefb65be11e52b18f04013ef06f5c6" name="selinux-policy" arch="src">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
<package pkgid="27cf86a7377e02374925df2b4b5079f6a1aa3350394e1b299295a4a914ecab20" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
<package pkgid="8dd33fbd26c9167078b87729a1e4fec0a5daf350861c583f182035a94c9159f1" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
<package pkgid="3857262459c6d877a4f683a1287e7600a5da32d915bbe65958252dd7bbc42229" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
<package pkgid="d6b1a2aca30d70f08b66bca010e2dcfc84ec2532c9f2e848fd14c898eb6b0f13" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
<package pkgid="f7d3e0c4c799d0e4fdca25045a20363965eb60ebb880b71f96167d659763c43c" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20250304" rel="lp154.342.1"/>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1733918400">- Fix minimum policy by readding rpm module (bsc#1234314)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734091200">- Update to version 20241213:
  * Add policy for importctl (bsc#1232670)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1734350400">- Explain third possible value in selinux config file (disabled)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734350401">- Update to version 20241216:
  * Allow vhostmd_t list virtqemud pid dirs (bsc#1230961)</changelog>
  <changelog author="cathy.hu@suse.com" date="1734696000">- Update to version 20241220:
  * Revert "Remove the fail2ban module sources"
  * Revert "Remove the linuxptp module sources"
  * Revert "Remove the amtu module sources"
  * Allow auditctl signal auditd
  * Dontaudit systemd-coredump the sys_resource capability
  * Allow traceroute_t bind rawip sockets to unreserved ports
  * Fix the cups_read_pid_files() interface to use read_files_pattern
  * Allow virtqemud additional permissions for tmpfs_t blk devices
  * Allow virtqemud rw access to svirt_image_t chr files
  * Allow virtqemud rw and setattr access to fixed block devices
  * Label /etc/mdevctl.d/scripts.d with bin_t
  * Allow virtqemud open svirt_devpts_t char files
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow svirt_tcg_t read virtqemud_t fifo_files
  * Allow virtqemud rw and setattr access to sev devices
  * Allow virtqemud directly read and write to a fixed disk
  * Allow virtqemud_t relabel virt_var_lib_t files
  * Allow virtqemud_t relabel virtqemud_var_run_t sock_files
  * Add gnome_filetrans_gstreamer_admin_home_content() interface
  * Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t
  * Make bootupd_t permissive
  * Allow init_t nnp domain transition to locate_t
  * allow gdm and iiosensorproxy talk to each other via D-bus
  * Allow systemd-journald getattr nsfs files
  * Allow sendmail to map mail server configuration files
  * Allow procmail to read mail aliases
  * Allow cifs.idmap helper to set attributes on kernel keys
  * Allow irqbalance setpcap capability in the user namespace
  * Allow sssd_selinux_manager_t the setcap process permission
  * Allow systemd-sleep manage efivarfs files
  * Allow systemd-related domains getattr nsfs files
  * Allow svirt_t the sys_rawio capability
  * Allow alsa watch generic device directories
  * Move systemd-homed interfaces to seperate optional_policy block
  * Update samba-bgqd policy
  * Update virtlogd policy
  * Allow svirt_t the sys_rawio capability
  * Allow qemu-ga the dac_override and dac_read_search capabilities
  * Allow bacula execute container in the container domain
  * Allow httpd get attributes of dirsrv unit files
  * Allow samba-bgqd read cups config files
  * Add label rshim_var_run_t for /run/rshim.pid
  * [5/5][sync from 'mysql-selinux'] Add mariadb-backup
  * [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock'
  * [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2
  * [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705
  * [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname'
  * Allow systemd-networkd read mount pid files
  * Update policy for samba-bgqd
  * Allow chronyd read networkmanager's pid files
  * Allow staff user connect to generic tcp ports
  * Allow gnome-remote-desktop dbus chat with policykit
  * Allow tlp the setpgid process permission
  * Update the bootupd policy
  * Allow sysadm_t use the io_uring API
  * Allow sysadm user dbus chat with virt-dbus
  * Allow virtqemud_t read virsh_t files
  * Allow virt_dbus_t connect to virtd_t over a unix stream socket
  * Allow systemd-tpm2-generator read hardware state information
  * Allow coreos-installer-generator execute generic programs
  * Allow coreos-installer domain transition on udev execution
  * Revert "Allow unconfined_t execute kmod in the kmod domain"
  * Allow iio-sensor-proxy create and use unix dgram socket
  * Allow virtstoraged read vm sysctls
  * Support ssh connections via systemd-ssh-generator
  * Label all semanage store files in /etc as semanage_store_t
  * Add file transition for nvidia-modeset
  * Allow dirsrv-snmp map dirsv_tmpfs_t files
  * Label /usr/lib/node_modules_22/npm/bin with bin_t
  * Add policy for /usr/libexec/samba/samba-bgqd
  * Allow gnome-remote-desktop watch /etc directory
  * Allow rpcd read network sysctls
  * Allow journalctl connect to systemd-userdbd over a unix socket
  * Allow some confined users send to lldpad over a unix dgram socket
  * Allow lldpad send to unconfined_t over a unix dgram socket
  * Allow lldpd connect to systemd-machined over a unix socket
  * Confine the ktls service
  * Allow dirsrv read network sysctls
  * Label /run/sssd with sssd_var_run_t
  * Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  * Allow unconfined_t execute kmod in the kmod domain
  * Allow confined users r/w to screen unix stream socket
  * Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  * Allow virtqemud read virtd_t files
  * Allow ping_t read network sysctls
  * Allow systemd-homework connect to init over a unix socket
  * Fix systemd-homed blobs directory permissions
  * Allow virtqemud read sgx_vepc devices
  * Allow lldpad create and use netlink_generic_socket
  * Allow systemd-homework write to init pid socket
  * Allow init create /var/cache/systemd/home
  * Confine the pcm service
  * Allow login_userdomain read thumb tmp files
  * Update power-profiles-daemon policy
  * Fix the /etc/mdevctl\.d(/.*)? regexp
  * Grant rhsmcertd chown capability &amp; userdb access
  * Allow iio-sensor-proxy the bpf capability
  * Allow systemd-machined the kill user-namespace capability
  * Remove the fail2ban module sources
  * Remove the linuxptp module sources
  * Remove legacy rules for slrnpull
  * Remove the aiccu module sources
  * Remove the bcfg2 module sources
  * Remove the amtu module sources
  * Remove the rhev module sources
  * Remove all file context entries for /bin and /lib
  * Allow ptp4l the sys_admin capability
  * Confine power-profiles-daemon
  * Label /var/cache/systemd/home with systemd_homed_cache_t
  * Allow login_userdomain connect to systemd-homed over a unix socket
  * Allow boothd connect to systemd-homed over a unix socket
  * Allow systemd-homed get attributes of a tmpfs filesystem
  * Allow abrt-dump-journal-core connect to systemd-homed over a unix socket
  * Allow aide connect to systemd-homed over a unix socket
  * Label /dev/hfi1_[0-9]+ devices
  * Remove the openct module sources
  * Remove the timidity module sources
  * Enable the slrn module
  * Remove i18n_input module sources
  * Enable the distcc module
  * Remove the ddcprobe module sources
  * Remove the timedatex module sources
  * Remove the djbdns module sources
  * Confine iio-sensor-proxy
  * Allow staff user nlmsg_write
  * Update policy for xdm with confined users
  * Allow virtnodedev watch mdevctl config dirs
  * Allow ssh watch home config dirs
  * Allow ssh map home configs files
  * Allow ssh read network sysctls
  * Allow chronyc sendto to chronyd-restricted
  * Allow cups sys_ptrace capability in the user namespace
  * Add policy for systemd-homed
  * Remove fc entry for /usr/bin/pump
  * Label /usr/bin/noping and /usr/bin/oping with ping_exec_t
  * Allow accountsd read gnome-initial-setup tmp files
  * Allow xdm write to gnome-initial-setup fifo files
  * Allow rngd read and write generic usb devices
  * Allow qatlib search the content of the kernel debugging filesystem
  * Allow qatlib connect to systemd-machined over a unix socket
  * mls/modules.conf - fix typo
  * Use dist/targeted/modules.conf in build workflow
  * Fix default and dist config files
  * Allow unprivileged user watch /run/systemd
  * CI: update to actions/checkout@v4
  * Allow boothd connect to kernel over a unix socket
  * Clean up and sync securetty_types
  * Bring config files from dist-git into the source repo
  * Confine gnome-remote-desktop
  * Allow virtstoraged execute mount programs in the mount domain
  * Make mdevctl_conf_t member of the file_type attribute</changelog>
  <changelog author="rfrohl@suse.com" date="1736510400">- Update to version 20250109:
  * Update virtqemud policy regarding the svirt_tcg_t domain
  * Allow virtqemud domain transition on numad execution
  * Support virt live migration using ssh
  * Allow virtqemud permissions needed for live migration
  * Allow virtqemud the getpgid process permission
  * Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
  * Allow virtqemud relabelfrom virt_log_t files
  * Allow virtqemud relabel tun_socket
  * Add policy for systemd-import-generator
  * Confine vsftpd systemd system generator
  * Allow virtqemud read and write sgx_vepc devices
  * Allow systemd-networkd list cgroup directories
  * Allow xdm dbus chat with power-profiles-daemon
  * Allow ssh_t read systemd config files
  * Add Valkey rules to Redis module
  * Update ktlsh policy
  * Allow request-key to read /etc/passwd
  * Allow request-key to manage all domains' keys
  * Add support for the KVM guest memfd anon inodes
- Update embedded container-selinux version to commit:
  * 7fdbd0e8c428c335406969878f28e14f335f2e7e</changelog>
  <changelog author="cathy.hu@suse.com" date="1737374400">- Update to version 20250120:
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Introduce policy for wtmpdbd (bsc#1235660)
  * Label xrdp scripts in /etc as bin_t (bsc#1233738)
  * introduce unconfined_service_transition_to_unconfined_user boolean (bsc#1233738)
  * Allow init to manage DOS files (bsc#1232527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737460800">- Update to version 20250121:
  * wtmpdbd systemd service uses NoNewPrivileges (bsc#1235660)
  * Transition samba-dcerpcd pid file from smbd_var_run_t to winbind_var_run_t (bsc#1235801)
  * /run/samba/samba-dcerpcd.pid needs fc type winbind_rpcd_var_run_t (bsc#1235801)
  * Adjust rpcd_lsad, samba-bgqd, samba-dcerpcd to SUSE-specific part (bsc#1235801)
  * Transition nmbd pid file from smbd_var_run_t to nmbd_var_run_t (bsc#1235801)</changelog>
  <changelog author="cathy.hu@suse.com" date="1737720000">- Update to version 20250124:
  * Dontaudit xdm_t wanting to create /root/.cache dir (bsc#1235669)</changelog>
  <changelog author="cathy.hu@suse.com" date="1738670400">- Update to version 20250204:
  * Allow quota_t load its kernel module (bsc#1235805)
  * Allow apcupsd's apccontrol to send messages using wall (bsc#1235688)
  * Allow journalctl read messages from /var/lib/machines (bsc#1235829)</changelog>
  <changelog author="rfrohl@suse.com" date="1738843200">- Update to version 20250206:
  * kanidm_unixd.fc: follow default style for aliased paths
  * Dontaudit systemd-logind remove all files
  * Add the files_dontaudit_read_all_dirs() interface
  * Add the files_dontaudit_delete_all_files() interface
  * Allow rhsmcertd notify virt-who
  * Allow irqbalance to run unconfined scripts conditionally
  * Allow snapperd execute systemctl in the caller domain
  * Allow svirt_tcg_t to connect to nbdkit over a unix stream socket
  * Allow iio-sensor-proxy read iio devices
  * Label /dev/iio:device[0-9]+ devices
  * Allow systemd-coredump the sys_admin capability
  * Allow apcupsd's apccontrol to send messages using wall
  * contrib/thumb: also allow per-user thumbnailers
  * contrib/thumb: fix thunar thumbnailer (rhbz#2315893)
  * Allow virt_domain to use pulseaudio - conditional
  * Allow pcmsensor read nmi_watchdog state information
  * Allow init_t nnp domain transition to gssproxy_t
  * Allow systemd-generator connect to syslog over a unix stream socket
  * Allow virtqemud manage fixed disk device nodes
  * Allow iio-sensor-proxy connect to syslog over a unix stream socket
  * Allow virtstoraged write to sysfs files
  * Allow power-profiles-daemon write sysfs files
  * Update iiosensorproxy policy
  * Allow pcmsensor write nmi_watchdog state information
  * Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t
  * Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type
  * Add the gpg_read_user_secrets() interface
  * Allow gnome-remote-desktop read resolv.conf
  * Update switcheroo policy
  * Allow nfsidmap connect to systemd-homed over a unix socket
  * Add the auth_write_motd_var_run_files() interface
  * Add the bind_exec_named_checkconf() interface
  * Add the virt_exec_virsh() interface
  * Allow database rotation for wtmpdbd_t
  * Allow wtmpdbd to send messages notifications
  * Allow virtqemud domain transition to nbdkit
  * Add nbdkit interfaces defined conditionally
  * Allow samba-bgqd connect to cupsd over an unix domain stream socket
  * Confine the switcheroo-control service
  * Allow svirt_t read sysfs files
  * Add rhsmcertd interfaces
  * Add the ssh_exec_sshd() interface
  * Add the gpg_domtrans_agent() interface
  * Label /usr/bin/dnf5 with rpm_exec_t
  * Label /dev/pmem[0-9]+ with fixed_disk_device_t
  * allow kdm to create /root/.kde/ with correct label
  * Change /usr/sbin entries to use /usr/bin or remove them
  * Allow systemd-homed get filesystem quotas
  * Allow login_userdomain getattr nsfs files
  * Allow virtqemud send a generic signal to the ssh client domain
  * Dontaudit request-key read /etc/passwd</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738929600">- Improve semodule stderr logging during install/update: Verbose logging
  will just confuse users and the policy will be rebuild later in the update
  process correctly, if there was an earlier error. These transient errors
  are only related to the order in which packages are installed.</changelog>
  <changelog author="cathy.hu@suse.com" date="1739275200">- Update to version 20250211:
  * Enable postfix_local_write_mail_spool boolean by default</changelog>
  <changelog author="cathy.hu@suse.com" date="1739361600">- Update to version 20250212:
  * Allow rlimit inheritance for domains transitioning to local_login_t</changelog>
  <changelog author="cathy.hu@suse.com" date="1739880000">- Update to version 20250218:
  * Enable postfix_local_write_mail_spool boolean by default for targeted only
  * Revert "Enable postfix_local_write_mail_spool boolean by default"
  * Support openSUSE-specific krb5kdc paths (bsc#1237064)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740139200">- Update to version 20250221:
  * Allow named_filetrans_domain filetrans raid/mdadm named content (bsc#1236807)
  * Grant privoxy_t the sys_chroot capability (bsc#1237375)
  * Allow init_t nnp_transition to tor_t (bsc#1237375)</changelog>
  <changelog author="cathy.hu@suse.com" date="1740398400">- Update to version 20250224:
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d
  * Allow snapper access to keys
  * Add rules for pcrlock (bsc#1233358)
  * allow snapper to call pcrlock and manage its files
  * allow unconfined_t to execute pcrlock
  * label rules for default systemd_pcrlock_var_lib_t locations
  * new interfaces: systemd_domtrans_pcrlock and systemd_pcrlock_exec
  * introduce systemd_pcrlock_var_lib_t and systemd_manage_pcrlock_files
  * Introduce interfaces snapper_manage_tmp_files and snapper_manage_tmp_dirs</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1740657600">- Improve selinux-policy packaging
  * Remove bashisms to support UNIX SH syntax in scriptlets (bsc#1237517)
  * Fix non-existing $package variable in "%post minimum" scriptlet
  * Improve selinux-policy.rpmlintrc file
  * Remove duplicates with fdupes</changelog>
  <changelog author="cathy.hu@suse.com" date="1741003200">- Update to version 20250303:
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)</changelog>
  <changelog author="jsegitz@suse.com" date="1741089600">- Update to version 20250304:
  * allow ssh-keygen to connect to the ssh daemon via vsockets (bsc#1238191)
  * Add context for plymouth debug log files (bsc#1237440)
  * dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
  * label apache2 binaries correctly (bsc#1237596)
  * Label /run/systemd/pcrlock.json systemd_pcrlock_var_lib_t
  * systemd_pcrlock_t needs to filetrans when recreating /var/lib/pcrlock.d</changelog>
</package>
</otherdata>