<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="e8bf1b0242f80b477a012ddf8d3084901f4d52c2e936d4ad9976c1b7743a7303eb2cdbbae450b6035b54290e116d5281c2433f2af0dde744039390dbcc9fc098" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
<package pkgid="81bc36fd769b83d42649510e452ecd092e19d7f333f5b29c4ba03a3edd07a89ba5b3c73c28baf022831f31805a7193db231c778338b5435f78eea0d83c00ef7f" name="selinux-policy" arch="src">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
<package pkgid="163556e6e5559b124862f022ee057606765dbd2283a4a7709dd44dc91e22773d59966e4d92a0c42715c58a2255c19160198256241abe7425e8cb1065ff281b2e" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
<package pkgid="0e5c9f68ffd8d1e782f6289b0010acf87a00bf9e154e1923fd8fd839e6c08fc5e2a84c67100b87f41d361cd61a2314ae2dc663f72b9d72712b82aa9c89caaf13" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
<package pkgid="e303c5a727522282b86f906416a5b556901aadaa162938f04668796f30f8e52f38960ee5130b7e2ff6519fdb1bd2b99071334c169a0bea1a827d6fd0bc5734a4" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
<package pkgid="3885856c6fdb6c36e49f4aa41f8096663f11e47c7b4b429a8751c9235855fc31c6d0e153bc244872c981098e566b28a05d9a775d202cdb505dd7f683b15f5eb9" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
<package pkgid="027e2a7429faa963b0b49008163be97fbe75d2d347d34000e49b9655cf2e8afd8e0aec7f76da60ef43a6af239a81b8b61becbac22b2e22563139d2b1f7ad15ae" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20260213" rel="160099.7.2"/>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update embedded container-selinux version to commit:
  - 9017e1f8074db9b7ae026670b0e0216cf53f18d9 (version 2.244.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195201">- Update to version 20251208:
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow virtqemud_t to read/write device_t (bsc#1251789)
  * Introduce sap_service_transition_to_unconfined_user boolean
  * allow init to read sap symlinks
  * Allow SAP domain to relocation text in all files</changelog>
  <changelog author="jsegitz@suse.com" date="1765368000">- Fix macros.selinux-policy to allow changing booleans when policy
  is not loaded. Previous logic was broken (bsc#1254395)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Create seperate type for /run/account (bsc#1253469)
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)
  * Allow virtlogd_t dac_override (bsc#1253389)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765972800">- Update to version 20251217:
  * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
  * Label amavis spool directory correctly (bsc#1254438)</changelog>
  <changelog author="cathy.hu@suse.com" date="1766059200">- Update to version 20251218:
  * Allow systemd_udev_trigger_generator_t use CAP_SYS_RESOURCE (bsc#1255079)</changelog>
  <changelog author="jsegitz@suse.com" date="1766059201">- Save previous file contexts in /run and ensure deletion (bsc#1245303)</changelog>
  <changelog author="danish.prakash@suse.com" date="1766145600">- macros.selinux-policy: Introduce %selinux_requires_min macro
  that requires all relevant dependencies except for *-python</changelog>
  <changelog author="rfrohl@suse.com" date="1766145601">- Update to version 20251219:
  * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)</changelog>
  <changelog author="rfrohl@suse.com" date="1767700800">- Update to version 20260106:
  * linuxptp: add support for dropping root privileges
  * fail2ban: Tweak selinux regex for /run/fail2ban.
  * Allow virtqemud setattr dri devices
  * Allow irqbalance create and use netlink generic socket
  * Allow thumb_t connect to XDM over a unix domain stream socket
  * Allow systemd-homework to remove ~/.identity-blob
  * Revert "Allow kl2tpd create and use netlink_generic_socket"
  * Support cockpit privileged access for the staff user
  * Update su_domain_type policy for kerberized su
  * Allow sshd-session inherit limits from its parent process
  * Allow systemd-machined read virtd process state
  * Allow kl2tpd create and use netlink_generic_socket
  * Update policy for redfish-finder
  * Label the greetd login manager framework as a display manager
  * Allow sshd-auth get attributes of sshd vsock socket
  * Confine redfish_finder - host api discovery service
  * Allow iptables read firewalld process state
  * Allow tuned_t use its private tmpfs files
  * The commit addresses the following AVC denials:
  * Allow passwd read and write a sshd-session unnamed pipes
  * Allow sshd-auth capabilities
  * Allow sshd-auth read network sysctls
  * Label /run/insights-client.ppid with insights_client_run_t
  * fix: unbreak thumbnailing for Thunar/tumblerd
  * Add files_mounton_generic_tmp_dirs() interface
  * Add the rpm_signal() interface
  * Allow session_bus_type get the attributes of the pidfs filesystem
  * Allow pcscd get the attributes of the pidfs filesystem
  * Allow sssd get the attributes of the pidfs filesystem
  * Allow KDE Plasma Login Manager to function as a display manager
  * Allow mdadm search filesystem_type directories
  * Update policy for dhcpc_hook_t
  * Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  * Allow staff role read/write cockpit-session unix stream sockets
  * Allow stap server read virtual memory sysctls
- Syncing with upstream rawhide selinux-policy up to:
  * 415e98f61041ebd8158063d62e750cd391841e00
- Update embedded container-selinux version to commit:
  * 3f7c37e93e172f531de233f40a58a1b8ec6ff17d (v2.245.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1767960000">- Update to version 20260108:
  * Set /var/lib/logwatch to logwatch_var_lib_t (bsc#1255862)</changelog>
  <changelog author="rfrohl@suse.com" date="1768910400">- Update to version 20260120:
  * Allow bluetoothd to access alsa config (bsc#1255866)
  * Allow snapper_sdbootutil_plugin to set targets file context during 'mv' (bsc#1256419)</changelog>
  <changelog author="rfrohl@suse.com" date="1769428800">- Update to version 20260126:
  * Allow thumb_t stream connect to systemd-machined
  * Allow thumb_t stream connect to systemd-homed
  * Allow aide get attributes of tmpfs and devtmpfs filesystems
  * Allow sshd noatsecure on sshd-session execution
  * Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  * Allow kernel_t to read/write all domains' pipes
  * Allow domain read sysfs files
  * allow abrt_dump_oops to write to init sockets
  * Add insights_client service interfaces
  * Allow plasma login manager stop login services
  * Allow NM nvme dispatcher script start systemd services
  * Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  * Allow sshd-session read, write, and map ica tmpfs files
  * Allow aide get attributes of a filesystem with extended attributes
  * Set correct label for glycin fontconfig (bsc#1253682)
  * Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682)
  * Logwatch zz-runtime uses uptime (bsc#1255862)
  * Add auth_login_pgm_signull interface (bsc#1255862)
  * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
  * Allow l2tpd_t access to netlink and sysfs
  * Label miscellaneous /dev/papr-* devices
  * Allow qemu-ga to skip authentication
  * Revert "Allow systemd-coredump signull containers"
  * Allow systemd-coredump signull containers
- Syncing with upstream rawhide selinux-policy up to:
  * b8928889681b041f10e511fd17accbcb2f82d5e0</changelog>
  <changelog author="rfrohl@suse.com" date="1770120000">- Update to version 20260203:
  * Add support for 'mariadb@.service' (bsc#1255024).</changelog>
  <changelog author="cathy.hu@suse.com" date="1770379200">- Update to version 20260206:
  * TLP uses ps aux to check for different services (bsc#1257527)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770984000">- Update to version 20260213:
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)</changelog>
</package>
</otherdata>