<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="59bc926c4ccab819d3b8507b487d70302537d9c5f3d4e712510bac4f5e0fd998" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
<package pkgid="875e1feaf6b79e4a4aacbdc14bf53be6bf70cc5ac355bac6374de0a493d86a9a" name="selinux-policy" arch="src">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
<package pkgid="9ac98bccde7368c86ca9605766bb06f11b779bd964c4167a23f328f46e61d897" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
<package pkgid="e01c78be6b3ccdc91e2a21e5d86099e54fc79e7b67dfaa721d01ccced8bb1bdf" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
<package pkgid="0ffd599749268e3bda8adae6bd128aa84ff190f1af62a4d17a8752c8fc21c8c4" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
<package pkgid="02091676564449014cc6886ab1e6b59f858943359ed08f36477b8665188a7605" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
<package pkgid="9d91e847fb0a94ae09f51909ef4694dcaf2400ef89a9e7ec73ec55e445898506" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20260820" rel="150700.3.2"/>
  <changelog author="cathy.hu@suse.com" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="rfrohl@suse.com" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="cathy.hu@suse.com" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="zkubala@suse.com" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="rfrohl@suse.com" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="kilgore.trout@idesmi.eu" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="jengelh@inai.de" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="zkubala@suse.com" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="cathy.hu@suse.com" date="1782820800">- Update to version 20260630:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
  <changelog author="rfrohl@suse.com" date="1782993600">- Update to version 20260702:
  * Include key_socket in socket_class_set
  * Remove 14 permissive domains
  * ci: Run cockpit-machines tests in PRs
  * Remove the lockdown class from the policy
  * Allow systemd-logind the sys_ptrace capability in the user namespace
  * Allow systemd-sleep the perfmon capability
  * Allow sshd_session_t dyntransition to sftpd_t
  * Allow lttng kernel tracing
  * Allow loadkeys create and use its private tmpfs files
  * Allow journald create and use netlink_tcpdiag_socket
  * Fix typo in the comment of build.conf
  * Allow gpg_pinentry_t to write session dbus socket files
  * Allow systemd-hostnamed read hwdb files
  * Allow systemd-machined to manage nspawn runtime directory
  * Allow pcm-sensor-server the sys_admin capability
  * Allow nut/upsmon read nut_conf_t symlinks
  * Support new sanlock features - using libdm and SG_IO
  * Allow thumb_t mount proc filesystem
  * Allow aide connect to the GDM userdb provider socket
  * Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets
  * Allow nfsd_t to create netlink_generic_socket (bsc#1267826)
  * Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install()
  * Allow install_t domain transition to insights_client_t
  * Allow staff user mounton /var/lib dirs
  * Allow systemd-coredump signull container runtime
  * Allow blueman get the attributes of a tmpfs filesystem
  * portage_compile_domain: Require xdm_xserver_tmp_t type
  * Add missing interface requirements
  * Dontaudit virt_driver_domain execmem
  * fixed file after comment from zpytela.
  * added caddy related paths.
  * Remove extra parameters from interface headers
  * Update bootupd policy for running lsblk
  * Allow pcscd_t to search cgroup
- Syncing with upstream rawhide selinux-policy up to:
  * 3cf2aa66a844ba5e87fb2a8f04be08c62cf5538a
- Update embedded container-selinux version to commit:
  * 9715eb09108e9fabb0fbaeee9044636b349370eb (v2.250.0)</changelog>
  <changelog author="rfrohl@suse.com" date="1783512000">- Update selinux-policy-sandbox description (bsc#1270534)</changelog>
  <changelog author="cathy.hu@suse.com" date="1783944000">- Update to version 20260713:
  * Fix wrong gen_requires in snapper_read_data_files (bsc#1271282)</changelog>
  <changelog author="cathy.hu@suse.com" date="1784116800">- Update to version 20260715:
  * Allow snapper_sdbootutil_plugin_t status and stop unit files(bsc#1271391)
  * Allow sdbootutil_t read and write snapperd_t pipes (bsc#1271391)</changelog>
  <changelog author="zkubala@suse.com" date="1784548800">- fix cleanoldsepoldir.sh to properly handle migration markers
  when /var/lib/selinux doesn't exists (backported from SLFO_Main codebase)</changelog>
  <changelog author="cathy.hu@suse.com" date="1785153600">- Update to version 20260727:
  * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860)
  * adjust amavis spool path regex for openSUSE (bsc#1268627)
  * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366)
  * Support vfs_snapper to work with samba_share_t (bsc#1265400)
  * vfs_samba uses dbus to communicate with snapper (bsc#1265400)</changelog>
  <changelog author="rfrohl@suse.com" date="1785844800">- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a</changelog>
  <changelog author="cathy.hu@suse.com" date="1786363200">- Update to version 20260810:
  * (open)SUSE only sendmail fixes (bsc#1273901)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227200">- Update to version 20260820:
  * Label the postgresql executables correctly (bsc#1274861)</changelog>
  <changelog author="cathy.hu@suse.com" date="1787227201">- Update to version 20260820:
  * sshd_session_t needs to access kanidm sshkeys (bsc#1275492)
  * Fix broken kanidm_sshkeys_t security context (bsc#1275492)</changelog>
</package>
</otherdata>