<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="15">
<package pkgid="a503d8717a1cadcadc85eaa56fb1954f7916b43f193c3b6a006b1eda20b5802fe4cedd7f5553c9103137357e2aec44d9f7b2076aa9f11df8ed372bd40eb9fe77" name="libselinux" arch="src">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="mcepl@suse.com" date="1687521600">- Remove separate libselinux-bindings SPEC file (bsc#1212618).</changelog>
  <changelog author="jsegitz@suse.com" date="1688472000">- Fix python packaging by setting the name to a fixed value</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Do not BuildRequire swig and ruby-devel in the main build phase:
  those are only needed for the bindings.</changelog>
  <changelog author="georg.pfuetzenreuter@suse.com" date="1696161600">- Repair initrd libselinux check in selinux-ready</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1720699200">- Fix segfault caused by upstream changes in selabel_open():
  libselinux-set-free-d-data-to-NULL.patch
  Can be removed once it is upstream.</changelog>
  <changelog author="cathy.hu@suse.com" date="1730980800">- Drop check_runlevel from selinux-ready script and remove restorecond
  from check_packages as we don't require it to be selinux-ready.</changelog>
  <changelog author="jsegitz@suse.com" date="1737720000">- Update selinux-ready to clarify that kernel options aren't necessary
  on newer (open)SUSE versions</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop libselinux-set-free-d-data-to-NULL.patch: included upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1753272000">- Add man_selinux_disabled_mismatch_kernel_config.patch to explain
  in the selinux(8) man page to not disable SELinux via
  /etc/selinux/config and enable it at the same time via kernel
  cmd line (bsc#1246549)</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1780401600">- Add patch for restorecon to log error on readonly fs (bsc#1232226)
  - Patch: restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
  - Can be dropped with the next toolchain release:
    https://github.com/SELinuxProject/selinux/commit/fd411d50ba1cb3e8ad5f8ce4e3c9bc7fcbe4340c</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream</changelog>
  <changelog author="jsegitz@suse.com" date="1784808000">- Drop man_selinux_disabled_mismatch_kernel_config.patch, current libselinux
  doesn't behave like this anymore</changelog>
</package>
<package pkgid="44495059c3d502097f1d970b5f49db41012c78e7ebad98906dbbaef48a6a4cbcf119ac881a6515f2d8e135a5def29a43675424625137d41e715e91abef5960c2" name="libselinux-bindings" arch="src">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="jsegitz@suse.com" date="1652097600">- Update to version 3.4:
  * Use PCRE2 by default
  * Make selinux_log() and is_context_customizable() thread-safe
  * Prevent leakeing file descriptors
  * Correctly hash specfiles larger than 4G
- Refreshed skip_cycles.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1677240000">- Update to version 3.5:
  * check for truncations
  * avoid newline in avc message
  * bail out on path truncations
  * add getpidprevcon to gather the previous context before the last
    exec of a given process
  * Workaround for heap overhead of pcre
  * fix memory leaks on the audit2why module init
  * ignore invalid class name lookup
- Drop restorecon_pin_file.patch, is upstream
- Refreshed python3.8-compat.patch
- Added additional developer key (Jason Zaman)</changelog>
  <changelog author="mliska@suse.cz" date="1679572800">- Enable LTO as it works fine now.</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1683288000">- Add python-wheel build dependency to build correctly with latest
  python-pip version.</changelog>
  <changelog author="kastl@b1-systems.de" date="1685620800">- allow building this with different python versions, to make this
  usable for the new sle15 macro (using python3.11)</changelog>
  <changelog author="jsegitz@suse.com" date="1687262400">- Add explicit BuildRequires for python3-pip and python3-wheel on
  15.5, currently the macros don't do the right thing</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="cathy.hu@suse.com" date="1701345600">- Also build python3-selinux for toolchain compability on SLE</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="code@bnavigator.de" date="1704283200">- The PEP517 python build requires setuptools</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1728993600">- Add 1231587-build-libselinux-with-swig-4.3.0.patch to fix build
  failure with swig 4.3.0 (bsc#1231587)</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop 1231587-build-libselinux-with-swig-4.3.0.patch: fixed upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - libselinux and python use system Python3 build module
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Build shared libraries with -fPIC for LTO.
- Packaging changes:
  - Add python-build as BuildRequires
  - Drop python3.6 build in 15.7, as python-build is not available for python3.6
  - Add workaround in Makefile as python multi build does not work
    with the combined dist/ folder from upstream</changelog>
</package>
<package pkgid="e6a61ab1fb620a853f71f44bcd4d815467ac4fe067b7e30122c3087dde55495f695b55147b6a47e6681931471115e8aca47947625185a1e6edc2a19ad4e953c5" name="libselinux-devel" arch="x86_64">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="mcepl@suse.com" date="1687521600">- Remove separate libselinux-bindings SPEC file (bsc#1212618).</changelog>
  <changelog author="jsegitz@suse.com" date="1688472000">- Fix python packaging by setting the name to a fixed value</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Do not BuildRequire swig and ruby-devel in the main build phase:
  those are only needed for the bindings.</changelog>
  <changelog author="georg.pfuetzenreuter@suse.com" date="1696161600">- Repair initrd libselinux check in selinux-ready</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1720699200">- Fix segfault caused by upstream changes in selabel_open():
  libselinux-set-free-d-data-to-NULL.patch
  Can be removed once it is upstream.</changelog>
  <changelog author="cathy.hu@suse.com" date="1730980800">- Drop check_runlevel from selinux-ready script and remove restorecond
  from check_packages as we don't require it to be selinux-ready.</changelog>
  <changelog author="jsegitz@suse.com" date="1737720000">- Update selinux-ready to clarify that kernel options aren't necessary
  on newer (open)SUSE versions</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop libselinux-set-free-d-data-to-NULL.patch: included upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1753272000">- Add man_selinux_disabled_mismatch_kernel_config.patch to explain
  in the selinux(8) man page to not disable SELinux via
  /etc/selinux/config and enable it at the same time via kernel
  cmd line (bsc#1246549)</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1780401600">- Add patch for restorecon to log error on readonly fs (bsc#1232226)
  - Patch: restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
  - Can be dropped with the next toolchain release:
    https://github.com/SELinuxProject/selinux/commit/fd411d50ba1cb3e8ad5f8ce4e3c9bc7fcbe4340c</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream</changelog>
  <changelog author="jsegitz@suse.com" date="1784808000">- Drop man_selinux_disabled_mismatch_kernel_config.patch, current libselinux
  doesn't behave like this anymore</changelog>
</package>
<package pkgid="1528c40517aefed828a1259aa816d85f823161142de4f65e4f6787cec7fcc22145220b07701079ce0ffaa94879346b43530ca89eaf835da3fc703ff04cbc0afc" name="libselinux-devel-static" arch="x86_64">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="mcepl@suse.com" date="1687521600">- Remove separate libselinux-bindings SPEC file (bsc#1212618).</changelog>
  <changelog author="jsegitz@suse.com" date="1688472000">- Fix python packaging by setting the name to a fixed value</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Do not BuildRequire swig and ruby-devel in the main build phase:
  those are only needed for the bindings.</changelog>
  <changelog author="georg.pfuetzenreuter@suse.com" date="1696161600">- Repair initrd libselinux check in selinux-ready</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1720699200">- Fix segfault caused by upstream changes in selabel_open():
  libselinux-set-free-d-data-to-NULL.patch
  Can be removed once it is upstream.</changelog>
  <changelog author="cathy.hu@suse.com" date="1730980800">- Drop check_runlevel from selinux-ready script and remove restorecond
  from check_packages as we don't require it to be selinux-ready.</changelog>
  <changelog author="jsegitz@suse.com" date="1737720000">- Update selinux-ready to clarify that kernel options aren't necessary
  on newer (open)SUSE versions</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop libselinux-set-free-d-data-to-NULL.patch: included upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1753272000">- Add man_selinux_disabled_mismatch_kernel_config.patch to explain
  in the selinux(8) man page to not disable SELinux via
  /etc/selinux/config and enable it at the same time via kernel
  cmd line (bsc#1246549)</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1780401600">- Add patch for restorecon to log error on readonly fs (bsc#1232226)
  - Patch: restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
  - Can be dropped with the next toolchain release:
    https://github.com/SELinuxProject/selinux/commit/fd411d50ba1cb3e8ad5f8ce4e3c9bc7fcbe4340c</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream</changelog>
  <changelog author="jsegitz@suse.com" date="1784808000">- Drop man_selinux_disabled_mismatch_kernel_config.patch, current libselinux
  doesn't behave like this anymore</changelog>
</package>
<package pkgid="b85b25e3ffa09d720d3572a899beeec09aebe590c77071b2fbe6bc64894bcb2f412d12d9af2ead71f562908f86f8abc0d89ef060316f862860568daa08d0c5ac" name="libselinux1" arch="x86_64">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="mcepl@suse.com" date="1687521600">- Remove separate libselinux-bindings SPEC file (bsc#1212618).</changelog>
  <changelog author="jsegitz@suse.com" date="1688472000">- Fix python packaging by setting the name to a fixed value</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Do not BuildRequire swig and ruby-devel in the main build phase:
  those are only needed for the bindings.</changelog>
  <changelog author="georg.pfuetzenreuter@suse.com" date="1696161600">- Repair initrd libselinux check in selinux-ready</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1720699200">- Fix segfault caused by upstream changes in selabel_open():
  libselinux-set-free-d-data-to-NULL.patch
  Can be removed once it is upstream.</changelog>
  <changelog author="cathy.hu@suse.com" date="1730980800">- Drop check_runlevel from selinux-ready script and remove restorecond
  from check_packages as we don't require it to be selinux-ready.</changelog>
  <changelog author="jsegitz@suse.com" date="1737720000">- Update selinux-ready to clarify that kernel options aren't necessary
  on newer (open)SUSE versions</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop libselinux-set-free-d-data-to-NULL.patch: included upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1753272000">- Add man_selinux_disabled_mismatch_kernel_config.patch to explain
  in the selinux(8) man page to not disable SELinux via
  /etc/selinux/config and enable it at the same time via kernel
  cmd line (bsc#1246549)</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1780401600">- Add patch for restorecon to log error on readonly fs (bsc#1232226)
  - Patch: restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
  - Can be dropped with the next toolchain release:
    https://github.com/SELinuxProject/selinux/commit/fd411d50ba1cb3e8ad5f8ce4e3c9bc7fcbe4340c</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream</changelog>
  <changelog author="jsegitz@suse.com" date="1784808000">- Drop man_selinux_disabled_mismatch_kernel_config.patch, current libselinux
  doesn't behave like this anymore</changelog>
</package>
<package pkgid="ac354a2ff19ddc703d3486e494a590800f98be734d89274fb41cf32f9d09d3459110c1a122f0ed1fa39ff766a4dbff5c3fd1e374c97fcf102cef04542505cdd7" name="python313-selinux" arch="x86_64">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="jsegitz@suse.com" date="1652097600">- Update to version 3.4:
  * Use PCRE2 by default
  * Make selinux_log() and is_context_customizable() thread-safe
  * Prevent leakeing file descriptors
  * Correctly hash specfiles larger than 4G
- Refreshed skip_cycles.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1677240000">- Update to version 3.5:
  * check for truncations
  * avoid newline in avc message
  * bail out on path truncations
  * add getpidprevcon to gather the previous context before the last
    exec of a given process
  * Workaround for heap overhead of pcre
  * fix memory leaks on the audit2why module init
  * ignore invalid class name lookup
- Drop restorecon_pin_file.patch, is upstream
- Refreshed python3.8-compat.patch
- Added additional developer key (Jason Zaman)</changelog>
  <changelog author="mliska@suse.cz" date="1679572800">- Enable LTO as it works fine now.</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1683288000">- Add python-wheel build dependency to build correctly with latest
  python-pip version.</changelog>
  <changelog author="kastl@b1-systems.de" date="1685620800">- allow building this with different python versions, to make this
  usable for the new sle15 macro (using python3.11)</changelog>
  <changelog author="jsegitz@suse.com" date="1687262400">- Add explicit BuildRequires for python3-pip and python3-wheel on
  15.5, currently the macros don't do the right thing</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="cathy.hu@suse.com" date="1701345600">- Also build python3-selinux for toolchain compability on SLE</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="code@bnavigator.de" date="1704283200">- The PEP517 python build requires setuptools</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1728993600">- Add 1231587-build-libselinux-with-swig-4.3.0.patch to fix build
  failure with swig 4.3.0 (bsc#1231587)</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop 1231587-build-libselinux-with-swig-4.3.0.patch: fixed upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - libselinux and python use system Python3 build module
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Build shared libraries with -fPIC for LTO.
- Packaging changes:
  - Add python-build as BuildRequires
  - Drop python3.6 build in 15.7, as python-build is not available for python3.6
  - Add workaround in Makefile as python multi build does not work
    with the combined dist/ folder from upstream</changelog>
</package>
<package pkgid="9c639ecda0629f4a2483c63f30dfa30f28a1d1cf259d3cb56dec814c8124ebdebd57d3c8baaa539ad4dfd7290f9d814706e9776d4422054c5a09bf753a5158cb" name="ruby-selinux" arch="x86_64">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="jsegitz@suse.com" date="1652097600">- Update to version 3.4:
  * Use PCRE2 by default
  * Make selinux_log() and is_context_customizable() thread-safe
  * Prevent leakeing file descriptors
  * Correctly hash specfiles larger than 4G
- Refreshed skip_cycles.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1677240000">- Update to version 3.5:
  * check for truncations
  * avoid newline in avc message
  * bail out on path truncations
  * add getpidprevcon to gather the previous context before the last
    exec of a given process
  * Workaround for heap overhead of pcre
  * fix memory leaks on the audit2why module init
  * ignore invalid class name lookup
- Drop restorecon_pin_file.patch, is upstream
- Refreshed python3.8-compat.patch
- Added additional developer key (Jason Zaman)</changelog>
  <changelog author="mliska@suse.cz" date="1679572800">- Enable LTO as it works fine now.</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1683288000">- Add python-wheel build dependency to build correctly with latest
  python-pip version.</changelog>
  <changelog author="kastl@b1-systems.de" date="1685620800">- allow building this with different python versions, to make this
  usable for the new sle15 macro (using python3.11)</changelog>
  <changelog author="jsegitz@suse.com" date="1687262400">- Add explicit BuildRequires for python3-pip and python3-wheel on
  15.5, currently the macros don't do the right thing</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="cathy.hu@suse.com" date="1701345600">- Also build python3-selinux for toolchain compability on SLE</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="code@bnavigator.de" date="1704283200">- The PEP517 python build requires setuptools</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1728993600">- Add 1231587-build-libselinux-with-swig-4.3.0.patch to fix build
  failure with swig 4.3.0 (bsc#1231587)</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop 1231587-build-libselinux-with-swig-4.3.0.patch: fixed upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - libselinux and python use system Python3 build module
  - Updated pywrap build targets for modern python builds using the Python3 build
    module.
  - Build shared libraries with -fPIC for LTO.
- Packaging changes:
  - Add python-build as BuildRequires
  - Drop python3.6 build in 15.7, as python-build is not available for python3.6
  - Add workaround in Makefile as python multi build does not work
    with the combined dist/ folder from upstream</changelog>
</package>
<package pkgid="76c00f966e5bbe49e1b59aa1fe7ad1ac418567e01ae2735d4eea4f64499b547c37f4cab1ff2545844856f10c2154ae2efdd1142443ae64e4cea95fdb6759890c" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="ce63ebeafd3d3ee6d7314b31c690cc12950775cefc027f175a161f3fc56808d1e3ea27848665dd12af1c8f49cca013e04fcf68704e20f9086829631f503ade6a" name="selinux-policy" arch="src">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="4dc6579a99e0352ef251d1b0ebeaeb3385a98052a52c6a3841147e70f10afc0182273b87579206d27622be3cf7756d160ea8a919d31fbf43361b9c70aee905df" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="4ce0b68118e51354cd17fb0eb4998516203d306232a91e1916759c5d83e222f34397be6bbf0d6c5826983d9d174c31095fc30d1324e22ec73c19e103f28ec460" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="61fe7da86baee0a53067e9950136ea766cd554776af881c01455e032c2d09961e6a24d9a5088ffdd2109521793f47bff91dab1a7b892af0eba55415e1c0caa83" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="b43b887cbdf308c40be78ce2f37738e6b501c74c53beb3976f7c5874c7fff92003c30b6811e31279be9012ceb00e8d9ffeaad5a229591c59399e829583cafb45" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="9d81fba70ab106550cdada4adc330f54637474bb558ccedbd1f360b3962607bb39b921ebb4d88417f526ea675351400cf4f3dce9ada4ba89bc7a1f4f0f4bcd9f" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20260810" rel="160099.5.1"/>
  <changelog author="zkubala@suse.com" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="zkubala@suse.com" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
</package>
<package pkgid="ced43b481961b74a9ab02b7e8be1f2bf1a815f3475a8adcacf548403487fa57d6c6480b481fb4f3c643c97d044b9b45ead89909e6f95be75f55fbe57bf6b4be0" name="selinux-tools" arch="x86_64">
  <version epoch="0" ver="3.11" rel="160099.231.1"/>
  <changelog author="mcepl@suse.com" date="1687521600">- Remove separate libselinux-bindings SPEC file (bsc#1212618).</changelog>
  <changelog author="jsegitz@suse.com" date="1688472000">- Fix python packaging by setting the name to a fixed value</changelog>
  <changelog author="mcepl@suse.com" date="1691150400">- (bsc#1212618) Divide libselinux and libselinux-bindings again.
  libselinux itself is in Ring0 so it has to have absolutely
  minimal dependencies, so it is better to separate
  libselinux-bindings into a separate pacakge.</changelog>
  <changelog author="dimstar@opensuse.org" date="1691496000">- Do not BuildRequire swig and ruby-devel in the main build phase:
  those are only needed for the bindings.</changelog>
  <changelog author="georg.pfuetzenreuter@suse.com" date="1696161600">- Repair initrd libselinux check in selinux-ready</changelog>
  <changelog author="cathy.hu@suse.com" date="1702987200">- Update to version 3.6
  https://github.com/SELinuxProject/selinux/releases/tag/3.6
  * libselinux: performance optimization for duplicate detection
  * Introduce getpolicyload - a helper binary to print the number of policy reloads on the running system
  * Add notself support for neverallow rules
  * Improve man pages
  * man pages: Remove the Russian translations
  * Add notself and other support to CIL
  * Add support for deny rules
  * Translations updated from
    https://translate.fedoraproject.org/projects/selinux/
  * Bug fixes
- Remove keys from keyring since they expired:
  - E853C1848B0185CF42864DF363A8AD4B982C4373
    Petr Lautrbach &lt;plautrba@redhat.com&gt;
  - 63191CE94183098689CAB8DB7EF137EC935B0EAF
    Jason Zaman &lt;jasonzaman@gmail.com&gt;
- Add key to keyring:
  - B8682847764DF60DF52D992CBC3905F235179CF1
    Petr Lautrbach &lt;lautrbach@redhat.com&gt;</changelog>
  <changelog author="cathy.hu@suse.com" date="1719835200">- Update to version 3.7
  https://github.com/SELinuxProject/selinux/releases/tag/3.7
  * User-visible changes
  * libselinux/utils/selabel_digest: drop unsupported option -d
  * libselinux/utils: improve compute_av output
  * libselinux: fail selabel_open(3) on invalid option
  * Improved man pages
  * Improvements
  * libselinux, libsepol: Add CFLAGS and LDFLAGS to Makefile checks
  * libselinux: enable usage with pedantic UB sanitizers
  * libselinux: support huge passwd/group entries
  * Bugfixes:
  * libselinux/utils/selabel_digest: avoid buffer overflow
  * libselinux: avoid pointer dereference before check
  * libselinux/utils/selabel_digest: pass BASEONLY only for file backend
  * libselinux: free empty scandir(3) result
  * libselinux: free data on selabel open failure
  * libselinux: use reentrant strtok_r(3)</changelog>
  <changelog author="cathy.hu@suse.com" date="1720699200">- Fix segfault caused by upstream changes in selabel_open():
  libselinux-set-free-d-data-to-NULL.patch
  Can be removed once it is upstream.</changelog>
  <changelog author="cathy.hu@suse.com" date="1730980800">- Drop check_runlevel from selinux-ready script and remove restorecond
  from check_packages as we don't require it to be selinux-ready.</changelog>
  <changelog author="jsegitz@suse.com" date="1737720000">- Update selinux-ready to clarify that kernel options aren't necessary
  on newer (open)SUSE versions</changelog>
  <changelog author="rfrohl@suse.com" date="1738670400">- Update to version 3.8
  https://github.com/SELinuxProject/selinux/releases/tag/3.8
  * libselinux: deprecate security_disable(3)
  * libselinux/utils: introduce selabel_compare
  * improved selabel_lookup performance
  * libselinux: support parallel usage of selabel_lookup(3)
  * Improved man pages
  * Always build for LFS mode on 32-bit archs.
  * Binary fcontext files format changed, files using old format are ignored
  * Code improvements and bug fixes
- For a more in depth list of changes see
  https://github.com/SELinuxProject/selinux/releases/download/3.8/shortlog-3.8.txt
- Drop libselinux-set-free-d-data-to-NULL.patch: included upstream
- keyring: Update Petr Lautrbach &lt;lautrbach@redhat.com&gt;
  * removed 0xBC3905F235179CF1 (expired: 2024-10-25)
  * added 0xFB4C685B5DC1C13E (expires: 2026-11-04)</changelog>
  <changelog author="cathy.hu@suse.com" date="1741348800">- Update to version 3.8.1
  https://github.com/SELinuxProject/selinux/releases/tag/3.8.1
  * no source change</changelog>
  <changelog author="jsegitz@suse.com" date="1752753600">- Update to version 3.9
  * Fix local literal fcontext definitions priority
  * Fix order for path substitutions
  * Limit fcontext regex path length</changelog>
  <changelog author="jsegitz@suse.com" date="1753272000">- Add man_selinux_disabled_mismatch_kernel_config.patch to explain
  in the selinux(8) man page to not disable SELinux via
  /etc/selinux/config and enable it at the same time via kernel
  cmd line (bsc#1246549)</changelog>
  <changelog author="jsegitz@suse.com" date="1760616000">- Ship license file (bsc#1252160)</changelog>
  <changelog author="cathy.hu@suse.com" date="1770292800">- Update to version 3.10
  https://github.com/SELinuxProject/selinux/releases/tag/3.10
  * libselinux: fix parsing of the enforcing kernel cmdline parameter
  * libselinux: remove out2 labels
  * libselinux: refactor selinux_getenforcemode
  * libselinux: load_policy: log using selinux_log instead of fprintf
  * libselinux: refactor selinux_check_securetty_context
  * libselinux: Ignore files removed during relabeling
  * libselinux/src/Makefile: build python module without isolation
- keyring: Add key of Jason Zaman &lt;jasonzaman@gmail.com&gt;
  * added 63191CE94183098689CAB8DB7EF137EC935B0EAF [expires: 2026-02-08]</changelog>
  <changelog author="cathy.hu@suse.com" date="1778500800">- Change License from SUSE-Public-Domain to LicenseRef-SUSE-Public-Domain
  due to rpmlint invalid-license warning.</changelog>
  <changelog author="cathy.hu@suse.com" date="1780401600">- Add patch for restorecon to log error on readonly fs (bsc#1232226)
  - Patch: restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
  - Can be dropped with the next toolchain release:
    https://github.com/SELinuxProject/selinux/commit/fd411d50ba1cb3e8ad5f8ce4e3c9bc7fcbe4340c</changelog>
  <changelog author="cathy.hu@suse.com" date="1783339200">- Update to version 3.11
  https://github.com/SELinuxProject/selinux/releases/tag/3.11
  - User-visible changes:
  - Several security improvements in libselinux
  - Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in file
    relabeling if /proc is available
  - Fixed libselinux constructor to not clobber errno (#445).
  - Fixed libselinux selabel_partial_match(3) to correctly find partial matches.
  - Fixed libselinux selinux_init_policy_load() to still try to mount selinuxfs on
    /sys/fs/selinux even if the mount of sysfs on /sys fails - this can occur
    legitimately within a user namespace.
  - Improved restorecon related functionality in libselinux
  - Development-relevant changes:
  - Reformatted entire tree based on .clang-format and added new
    check-format/format make targets to check and/or reformat code to match.
    This is now a requirement for new patches.
  - Fixed libselinux build for non-pthread builds.
  - Multiple fixes for musl/llvm-based builds, including adding a new
    EXTRA_LD_FLAGS variable that can be set for libselinux builds to pass
  - -undefined-version through to lld (#511 thru #515).
  - Fixed uclibc build failure (#435).
  - Build shared libraries with -fPIC for LTO.
  - Notable bug fixes:
  - libselinux: avoid out-of-bounds access on zero-length lines
- Packaging changes:
  - Drop patch restorecon-Only-log-error-on-readonly-fs-bsc-1232226.patch
    as it was accepted upstream
  - Rewrite skip_cycles.patch since the code path has been rewritten entirely
    upstream</changelog>
  <changelog author="jsegitz@suse.com" date="1784808000">- Drop man_selinux_disabled_mismatch_kernel_config.patch, current libselinux
  doesn't behave like this anymore</changelog>
</package>
</otherdata>