<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="73bdf013a822a5192a6c58311e2b9002e298ad6a7fac5c0e785d7c896c0a0ca3" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
<package pkgid="904b9c9f948a6507e5ab6d72ac880321b0da07278259f354ab6e0552fb141554" name="selinux-policy" arch="src">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
<package pkgid="630df128a0378789a39c5fde7f5582338b0c46b8d9368ab5419a82e870257907" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
<package pkgid="9b620c0b9d7f12ae578f5798a1662b9ed02a6a2bbd1882a6094914277cba660f" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
<package pkgid="0250abf96b8ad5406e3774dbe0df90bf603e0f44aed2a09b219ade9782394f12" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
<package pkgid="d0971052da5e81ab47f3708ba28bb152ab358999af3c0e814b0d5b67c7f4d638" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
<package pkgid="15e921c578adcb17bbada08d215545d7c0db80e86bc62dd9a7fc585c1bd9225f" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20251211" rel="150600.3.6"/>
  <changelog author="cathy.hu@suse.com" date="1756814400">- Update to version 20250902:
  * Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
  * Allow stalld map sysfs files
  * Allow NetworkManager-dispatcher-winbind get pidfs attributes
  * Allow openvpn create and use generic netlink socket
  * policy_capabilities: remove estimated from released versions
  * policy_capabilities: add stub for userspace_initial_context
  * add netlink_xperm policy capability and nlmsg permission definitions
  * policy_capabilities: add ioctl_skip_cloexec
  * selinux-policy: add allow rule for tuned_ppd_t
  * selinux-policy: add allow rule for switcheroo_control_t
  * Label /run/audit with auditd_var_run_t
  * Allow virtqemud start a vm which uses nbdkit
  * Add nbdkit_signal() and nbdkit_signull() interfaces
  * Fix insights_client interfaces names
  * Add insights_core and insights_client interfaces
  * dist/targeted/modules.conf: enable slrnpull module
  * Allow bootupd delete symlinks in the /boot directory
  * Allow systemd-coredumpd capabilities in the user namespace
  * Allow openvswitch read virtqemud process state
- Syncing with upstream rawhide selinux-policy up to:
  * 17956d28c011c35560e75a7293ac5924df57a1ee
- Update embedded container-selinux version to commit:
  * 5997aa524734886d35e187f52de2546f25c9f500 (version 2.241.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1756987200">- Update to version 20250904:
  * Allow systemd homed getattr all tmpfs files (bsc#1240883)
  * Allow systemd (PID 1) create lastlog entries
  * Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
  * Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
  * Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
  * Allow systemd-oomd watch tmpfs dirs
  * Allow chronyc the setgid and setuid capabilities</changelog>
  <changelog author="cathy.hu@suse.com" date="1757332800">- selinux-policy-devel needs to own /usr/share/selinux/devel/include/distributed
  otherwise packages that follow this guideline can not build without owning
  the directory themselves:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces</changelog>
  <changelog author="cathy.hu@suse.com" date="1757419200">- Update to version 20250909 (bsc#1249209):
  * Allow gdm create /etc/.pwd.lock with a file transition
  * Allow gdm bind a socket in the /run/systemd/userdbd directory
  * Allow nsswitch_domain connect to xdm over a unix domain socket</changelog>
  <changelog author="cathy.hu@suse.com" date="1758888000">- Update to version 20250926:
  * Add /opt/.snapshots to the snapper file context (bsc#1232226)
  * Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759752000">- Update to version 20251006:
  * Allow sshd_session_t write to wtmpdb
  * Support /usr/libexec/ssh as well as openssh folder
  * Set xenstored_use_store_type_domain boolean true(bsc#1247875)
  * Adjust guest and xguest users policy for sshd-session
  * Allow valkey-server create and use netlink_rdma_socket
  * Allow blueman get attributes of filesystems with extended attributes
  * Update files_search_base_file_types()
  * Allow geoclue get attributes of the /dev/shm filesystem
  * Allow apcupsd get attributes of the /dev/shm filesystem
  * Allow sshd-session read cockpit pid files
  * Allow nfs generator create and use netlink sockets
  * Conditionally allow virt guests to read certificates in user home directories
  * xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
  * Allow nfs-generator create and use udp sockets
  * Allow kdump search kdumpctl_tmp_t directories
  * Allow init open and read user tmp files
  * Fix the systemd_logind_stream_connect() interface
  * Allow staff and sysadm execute iotop using sudo
  * Allow sudodomains connect to systemd-logind over a unix socket
  * /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
  * Add default contexts for sshd-seesion
  * Define types for new openssh executables
  * Fix systemd_manage_unit_symlinks() interface definition
  * Support coreos installation methods
  * Add a new type for systemd-ssh-issue PID files
  * Allow gnome-remote-desktop connect to unreserved ports
  * Allow mdadm the CAP_SYS_PTRACE capability
  * Allow iptables manage its private fifo_files in /tmp
  * Allow auditd manage its private run dirs
  * Revert "Allow virt_domain write to virt_image_t files"
- Syncing with upstream rawhide selinux-policy up to:
  * 415b33792f9ea17d816a9e2602cddf21c16e7255
- Update embedded container-selinux version to commit:
  * edfbda465d37deb2a831330a2c3c65b557e6dff5 (version 2.242.0)</changelog>
  <changelog author="jsegitz@suse.com" date="1759838400">- Fixed typo in /etc/selinux/config</changelog>
  <changelog author="cathy.hu@suse.com" date="1759838401">- Update to version 20251007:
  * Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)</changelog>
  <changelog author="cathy.hu@suse.com" date="1759924800">- Update to version 20251008:
  * Assign alts_exec_t exec_file attribute (bsc#1250974)
  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760011200">- Update to version 20251009:
  * grub snapper plugin is now named 00-grub (bsc#1251793)</changelog>
  <changelog author="cathy.hu@suse.com" date="1760443200">- Update to version 20251014:
  * Make wicked script backwards compatible (bsc#1251923)
  * Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
  * Allow salt_t transition to rpm_script_t (bsc#1250696)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1760702400">- Update to version 20251016:
  * fail2ban: bump module version
  * fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
  * fail2ban: fix typos in interface descriptions
  * fail2ban: tweak file context regex for /run/fail2ban
  * fail2ban: drop file context for old rc.d file
  * Allow wicket to manage its proc directories (bsc#1235731)
  * Allow NM to manage wicked pid files (bsc#1235731)
  * Allow NM to reach systemd unit files (bsc#1235731)</changelog>
  <changelog author="cathy.hu@suse.com" date="1761048000">- Update to version 20251021:
  * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
  * Allow pcrlock to delete pid entries
  * Allow systemd_pcrlock_t to manage its pid files
  * Mark snapper_sdbootutil_plugin_t as permissive
  * Drop unnamed filetrans, should be done upstream (bsc#1241964)
  * Label pcrlock pid file correctly (bsc#1241964)
  * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
  * snapper takes output from stdout/err, allow pcrlock to write
  * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
  * Allow snapper sdbootutil plugin to read snapper data and conf
  * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
  * Replace snapper tmp file access for pcrlock (bsc#1241964)
  * Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
  * Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
  * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
  * Allow snapper sdbootutil sys_admin (bsc#1241964)
  * Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
  * Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
  * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
  * Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
  * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
  * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
  * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)</changelog>
  <changelog author="rfrohl@suse.com" date="1762257600">- Update to version 20251104:
  * Fix syntax error in userdomain.if
  * Allow nnp_transition for OpenSMTPD (bsc#1252431)
  * Allow ras-mc-ctl get attributes of the kmod executable
  * Define file equivalency for /var/opt
  * Allow virtnodedev_t the perfmon capability
  * Allow nut_upsdrvctl_t the sys_ptrace capability
  * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
  * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
  * Allow cupsd to manage cupsd_rw_etc_t lnk_files
  * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
  * Allow spamc read aliases file
  * Mark configfs_t as mountpoint (bsc#1246080)
  * Allow systemd-machined watch cgroup files
  * Allow sshd-auth read generic proc files
  * Allow sshd-auth read and write user domain ptys
  * Allow logwatch read and write sendmail unix stream sockets
  * Allow logwatch domain transition on rpm execution
  * Allow thumb_t mounton its private tmpfs files
  * Allow thumb_t create permission in the user namespace
  * Allow corenet_unconfined_type name_bind to icmp_socket
  * Allow systemd-networkd to manage systemd_networkd_var_lib_t files
  * Allow sshd-session get attributes of sshd vsock socket
- Syncing with upstream rawhide selinux-policy up to:
  * 95151e3c777301fd291f4db363a6bb24cad8c414</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762430400">- Update to version 20251106:
  * Allow pcscd_t to search cgroup (bsc#1253098)</changelog>
  <changelog author="filippo.bonazzi@suse.com" date="1762516800">- Suppress dir-or-file-outside-snapshot until policy is properly transactional (bsc#1253046)</changelog>
  <changelog author="cathy.hu@suse.com" date="1762862400">- Update to version 20251111:
  * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)</changelog>
  <changelog author="rfrohl@suse.com" date="1764331200">- Update to version 20251128:
  * update support for polkit agent helper (bsc#1251931)
  * Allow system_mail_t read apache system content conditionally
  * Allow login_userdomain read lastlog
  * Allow sshd-net read and write to sshd vsock socket
  * Update ktls policy
  * Add comprehensive SELinux policy module for bwrap thumbnail generation
  * Revert "Allow thumb_t create permission in the user namespace"
  * Allow systemd-machined read svirt process state
  * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
  * Allow sysadm access to TPM
  * Allow tlp get the attributes of the pidfs filesystem
  * Allow kmscon to read netlink_kobject_uevent_socket
  * Allow systemd-ssh-issue read kernel sysctls
  * fix: bz2279215 Allow speech-dispatcher access to user home/cache files
  * Allow create kerberos files in postgresql db home
  * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  * Allow shell comamnds in locate systemd service (bsc#1246559)
  * Introduce initrc_nnp_daemon_domain interface
  * Label /var/lib/cosmic-greeter with xdm_var_lib_t
  * Allow setroubleshoot-fixit get attributes of xattr fs
  * Allow insights-client manage /etc symlinks
  * Allow insights-client get attributes of the rpm executable
  * Allow nfsidmapd search virt lib directories
  * Allow iotop stream connect to systemd-userdbd
  * Allow gnome-remote-desktop read sssd public files
  * Allow thumb_t stream connect to systemd-userdbd
  * Add auth_nnp_domtrans_chkpwd()
  * Allow bluez dbus API passing unix domain sockets
  * Allow bluez dbus api pass sockets over dbus
  * Dontaudit systemd-generator connect to sssd over a unix stream socket
  * Allow init watch/watch_reads systemd-machined user ptys
- Syncing with upstream rawhide selinux-policy up to:
  * 874e36c884fc9e31ae12428338a38b14db65f554
- Update embedded container-selinux version to commit:
  * efdee4df4e98b5f5fe826b83db5ff4a9239e54bb (version 2.243.0)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765195200">- Update to version 20251208:
  * Make newidmapd_t, pwaccessd_t, pwupdd_t permissive until testing is complete (bsc#1253469)
  * Allow polkit access pwaccessd varlink socket (bsc#1253469)
  * Allow account-utils use userdbd varlink socket (bsc#1253469)
  * Initial policy for account-utils (bsc#1253469)</changelog>
  <changelog author="cathy.hu@suse.com" date="1765454400">- Update to version 20251211:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)
  * Create seperate type for /run/account (bsc#1253469)</changelog>
</package>
</otherdata>