# changelog

author: Bill Peck <bpeck@redhat.com> 0.1.25-1
changelog:
  - fix restraint to report PASS or FAIL based on return code. (bpeck@redhat.com)
  - Update libarchive to 3.2.1. (asavkov@redhat.com)
  - Fix test_dependency. (asavkov@redhat.com)
  - Add batch rpm dependency install. (asavkov@redhat.com)
  - Add in audit rotate as plugin (jburke@redhat.com)
  - check on correct file (bpeck@redhat.com)
  - Add keepchanges documentation. (asavkov@redhat.com)
  - Add libssh malformed pubkey memory corruption patch. (asavkov@redhat.com)
  - build libarchive without nettle support (jbastian@redhat.com)
  - Switch to own remote semaphore implementation. (asavkov@redhat.com)
  - add rhts-flush as a no-op (dcallagh@redhat.com)
  - use $RPM_OPT_FLAGS (dcallagh@redhat.com)
  - re-enable optimizations by default (dcallagh@redhat.com)
  - Update libssh to 0.7.3. (asavkov@redhat.com)
  - Fix for rhts-report-result to accept the correct args (bpeck@redhat.com)
  - add support for reporting tests as skipped (bpeck@redhat.com)
  - Fix client return codes on failures. (asavkov@redhat.com)
  - add missing underscore versions of sync/block commands (bpeck@redhat.com)
  - Add recursive dependency tests. (asavkov@redhat.com)
  - allow process_run to use pty or not. Default to not. Can be enabled via task
    metadata or in task param. (bpeck@redhat.com)
  - Recursively check repodeps. (asavkov@redhat.com)
  - Add common 'test' to test-data. (asavkov@redhat.com)
  - Prepare test_dependency for recursive repodeps. (asavkov@redhat.com)
  - Fix rt_sigaction valgrind suppression. (asavkov@redhat.com)
  - Get rid of global session in fetch_http. (asavkov@redhat.com)
  - Move metadata processing to metadata.c (asavkov@redhat.com)
  - third-party: fix Makefile deps for patching targets (dcallagh@redhat.com)
  - third-party: fix -Wformat-nonliteral failures with newer gcc
    (dcallagh@redhat.com)


author: Artem Savkov <asavkov@redhat.com> 0.1.25-2
changelog:
  - Fix double task_handler calls after reporting result. (asavkov@redhat.com)
  - Properly process no metadata case in repodeps. (asavkov@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.26-1
changelog:
  - Use --whatprovides to check package installs. (asavkov@redhat.com)
  - Avoid memory bug by NULL-terminating an array (pmuller@redhat.com)
  - Fix suicide by ssh. (asavkov@redhat.com)
  - Fix a memory leak in multipart's read_cb. (asavkov@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.27-1
changelog:
  - Print out extracted files for dependencies as well (bpeck@redhat.com)
  - Update restraint standalone to process owner attribute from job.xml  - this
    fixes a problem where $SUBMITTER is not populated when run    in stand alone
    mode. (bpeck@redhat.com)
  - rstrnt-sync: close standard descriptors after fork. (asavkov@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.28-1
changelog:
  - rstrnt-sync block doesn't actually block. You need to keep checking on it.
    (bpeck@redhat.com)
  - New linger plugin to enable session bus testing in Fedora24 and newer.
    (bpeck@redhat.com)
  - update TODO list (bpeck@redhat.com)
  - Docs: Add *_MEMBERS env var descriptions. (asavkov@redhat.com)
  - Fix doublefree of restraint_url->uri. (asavkov@redhat.com)
  - Unflat recipeSets. (asavkov@redhat.com)
  - Rework roles processing. (asavkov@redhat.com)
  - fix for keeping multi-host recipes in sync (bpeck@redhat.com)
  - Implement timer removal. (asavkov@redhat.com)
  - Capture output of make testinfo.desc (bpeck@redhat.com)
  - MetaDataFetchInfo archive_entry callback. (asavkov@redhat.com)
  - Switch to restraint_url instead of SoupURI. (asavkov@redhat.com)
  - curl: switch to multi mode. (asavkov@redhat.com)
  - Add ssl_verify parameter to fetch tag. (asavkov@redhat.com)
  - Switch fetch_http to use libcurl. (asavkov@redhat.com)
  - Fix rhel4 libcurl. (asavkov@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.29-1
changelog:
  - Remove sync plugin until a solution is found to mixed roles between recipes
    and guests. (bpeck@redhat.com)
  - Add reconnection retries option. (asavkov@redhat.com)
  - Limit number of reconnection retries. (asavkov@redhat.com)
  - Fix infinite loop on ssh failure. (artem.savkov@gmail.com)
  - Do not free ssh password. (asavkov@redhat.com)
  - Fix segfault on failed hostname resolution. (artem.savkov@gmail.com)
  - fix expected output (bpeck@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.30-1
changelog:
  - Merge recipe roles into task roles. (asavkov@redhat.com)
  - fix tasks metadata documentation to show correct example. (bpeck@redhat.com)
  - Fix problem with init.d start function BZ 1351663 (jbieren@redhat.com)
  - Fix http timeouts during long dependency installs. (asavkov@redhat.com)
  - sync: adjust set timeouts. (asavkov@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.31-1
changelog:
  - Check for stime and etime before trying to access them. (bpeck@redhat.com)
  - Fix connection retry counting (asavkov@redhat.com)
  - If fragment is defined then remove fragment from path. (bpeck@redhat.com)
  - Check url validity in parse_task (asavkov@redhat.com)
  - Fix a segfault in openssl on ppc64. (asavkov@redhat.com)
  - Bump zlib version to 1.2.11. (asavkov@redhat.com)
  - fix error found by -Werror=format-security (dcallagh@redhat.com)
  - third-party: remove -Wno-format in cmake (dcallagh@redhat.com)
  - need python at build time, for libsoup (dcallagh@redhat.com)
  - Add task start/stop times and duration to job.xml (asavkov@redhat.com)
  - add softDependencies metadata (jbastian@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.32-1
changelog:
  - fix without static (bpeck@redhat.com)
  - third-party: fix intltool build with Perl 5.26 (dcallagh@redhat.com)
  - third-party: update to latest intltool release (dcallagh@redhat.com)


author: Bill Peck <bpeck@redhat.com> 0.1.33-1
changelog:
  - fix file:/// handling.  when host is NULL the full task path is truncated
    early. (bpeck@redhat.com)
  - Support file:// path (bpeck@redhat.com)


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-13
changelog:
  - Remove old pkcsslotd.pp from minimum package
  - Allow rlogind to use also rlogin ports.
  - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
  - Allow bacula to connect also to postgresql.
  - Label /usr/libexec/tomcat/server as tomcat_exec_t
  - Add support for /usr/sbin/ctdbd_wrapper
  - Add support for /usr/libexec/ppc64-diag/rtas_errd
  - Allow rpm_script_roles to access system_mail_t
  - Allow brltty to create /var/run/brltty
  - Allow lsmd plugin to access netlink_route_socket
  - Allow smbcontrol to read passwd
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
  Resolves:#1140106
  - Allow osad to execute rhn_check
  - Allow load_policy to rw inherited sssd pipes because of selinux_child
  - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
  - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
  - Add additional booleans substitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-14
changelog:
  - Allow virt_qemu_ga_t to execute kmod.
  - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
  - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
  Resolves:#1113725
  - Enable OpenStack cinder policy
  - Add support for /usr/share/vdsm/daemonAdapter
  - Add support for /var/run/gluster


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-15
changelog:
  - Fix bugs in interfaces discovered by sepolicy.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Allow lsm plugins to connect to tcp/18700 by default.
  - Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
  - Fix pcp_domain_template() interface.
  - Fix conman.te.
  - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
  - Allow glance-scrubber to connect tcp/9191.
  - Add missing setuid capability for sblim-sfcbd.
  - Allow pegasus ioctl() on providers.
  - Add conman_can_network.
  - Allow chronyd to read chrony conf files located in /run/timemaster/.
  - Allow radius to bind on tcp/1813 port.
  - dontaudit block suspend access for openvpn_t 
  - Allow conman to create files/dirs in /tmp.
  - Update xserver_rw_xdm_keys() interface to have 'setattr'.
  Resolves:#1172291 
  - Allow sulogin to read /dev/urandom and /dev/random.
  - Update radius port definition to have also tcp/18121
  - Label prandom as random_device_t.
  - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-16
changelog:
  - Allow sssd to send dbus all user domains.
  Resolves:#1172291
  - Allow lsm plugin to read certificates.
  - Fix labeling for keystone CGI scripts.
  - Make snapperd back as unconfined domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-17
changelog:
  - Allow ipsec to execute _updown.netkey script to run unbound-control.
  - Allow neutron to read rpm DB.
  - Add additional fixes for hyperkvp
   * creates new ifcfg-{name} file
   * Runs hv_set_ifconfig.sh, which does the following
   * Copies ifcfg-{name} to /etc/sysconfig/network-scripts
  - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
  - Add labeling for pacemaker.log.
  - Allow radius to connect/bind radsec ports.
  - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
  - Allow  virt_qemu_ga to dbus chat with rpm.
  - Update virt_read_content() interface to allow read also char devices.
  - Allow glance-registry to connect to keystone port.
  Resolves:#1181818


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-18
changelog:
  - Add auditing support for ipsec.
  Resolves:#1182524
  - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
  - Allow netutils chown capability to make tcpdump working with -w


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-21
changelog:
  - pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
  - Allow fowner capability for sssd because of selinux_child handling.
  - ALlow bind to read/write inherited ipsec pipes
  - Allow hypervkvp to read /dev/urandom and read  addition states/config files.
  - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
  - Add glusterd_filetrans_named_pid() interface
  - Allow radiusd to connect to radsec ports.
  - Allow setuid/setgid for selinux_child
  - Allow lsmd plugin to connect to tcp/5988 by default.
  - Allow lsmd plugin to connect to tcp/5989 by default.
  - Update ipsec_manage_pid() interface.
  Resolves:#1184978


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23
changelog:
  - Update seutil_manage_config() interface.
  Resolves:#1185962
  - Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
  - Turn on docker_transition_unconfined by default


