path: root/Changelog.contrib

This is the Changelog for the old refpolicy-contrib submodule.  This
submodule was removed and its contents moved back to the main Reference
Policy repository on 2018-23-06.


* Sun Jan 14 2018 Chris PeBenito <pebenito@ieee.org> - 2.20180114
Chad Hanson (1):
      Allow rpm to relabel files at all levels

Chris PeBenito (46):
      Remove deprecated interfaces more than one year old.
      Remove complement and wildcard in allow rules.
      Merge branch 'master' of git://github.com/teg/refpolicy-contrib
      dbus: Module version bump for dbus-broker patch from Tom Gundersen.
      Module version bump for patches from Guido Trentalancia.
      Module version bumps for patches from David Sugar.
      dhcp, logrotate: Module version bump.
      Module version bumps for chkrootkit, dkim, dmidecode, portage, and
         rkhunter.
      Module version bumps.
      spamassassin: Move lines.
      mandb, spamassassin: Module version bumps.
      spamassassin: Fix build error.
      spamassassin: Add missing requirement in spamassassin_admin().
      dphysswapfile: Module version bump.
      gpg, pulseaudio, rpc: Module version bump.
      dnsmasq, gnome, mon, mta, openoffice, pulseaudio, wm: Version bumps.
      Revert "postfix: Some table drivers (notably cdb) need to mmap() their
         databases"
      java, mozilla, mta, postfix: Module version bump.
      portage: Fix usr_t map interface usage.
      apache, portage: Module version bump.
      dbus, policykit, wm: Module version bump.
      dbus: Add comment.
      Merge branch 'nm_audit' of git://github.com/bigon/refpolicy-contrib
      networkmanager: Module version bump.
      virt: Move a line.
      alsa, mon, virt: Module version bump.
      gpg, mozilla, rpc: Module version bump.
      Several module version bumps.
      blueman, evolution, gpg, mozilla, openoffice, thunderbird, wireshark, wm:
         Module version bump.
      wm: Module version bump.
      networkmanager: Move line.
      networkmanager: Module version bump.
      Merge branch 'pkcs' of https://github.com/dodys/refpolicy-contrib
      pkcs: Rename pkcs_slotd_unit_file_t.
      pkcs: Module version bump.
      accountsd, policykit: Module version bump.
      dbus, devicekit, modemmanager, networkmanager, virt: Module version bump.
      modemmanager: Move lines.
      rpm: Module version bump.
      cachefilesd, dbus, dirmngr, gnome, gpg, pulseaudio: Module version bump.
      Replace deprecated mmap perm sets and pattern usage.
      gssproxy: Module version bump.
      monit: Module version bump.
      apache, dkim, monit: Module version bump.
      spamassassin: Module version bump.
      Bump module versions for release.

Christian Göttsche (20):
      dkim: align filecontexts
      dkim: update
      milter: align filecontexts
      apache: align filecontexts
      dmidecode: use userdom_use_inherited_user_terminals
      spamassassin: align filecontexts
      chkrootkit: update
      rkhunter: add several missing permission
      fakehwclock: update
      milter: update
      mandb: fixes for systemd timer and /usr/local/man label
      spamassassin: update
      dphysswapfile: fix swapfile creation
      apache: update
      monit: update
      dkim: align file contexts
      dkim: update
      apache: update
      monit: read /usr/share/ca-certificates for cert verification
      spamassassin: fix missing perms

Daniel Jurgens (1):
      networkmanager: Grant access to unlabeled PKeys

David Sugar (5):
      mon: move rpc_* into optional
      wm: consolidate networkmanger interface calls into single optional
      cron: optional_policy for mta_* interfaces
      Label /usr/bin/mutter
      Allow to read /proc/sys/crypto/fips_enabled

Eduardo Barretto (2):
      Update pkcs policy to include pkccsslotd.service
      Update missing permissions for pkcs

Guido Trentalancia (13):
      libmtp: read symlinks in user home directories
      spamassassin: update rules for the Bayesian classifier trainer
      wm: let gnome-shell start properly
      gnome: keyring daemon dbus policy update
      gnome: keyring daemon read SELinux config
      openoffice: improve temporary directories' operations
      pulseaudio: general update
      wm: gnome-shell SELinux integration
      mozilla: run Java Web Start applications
      wm: run PolicyKit
      dbus: read user home content files
      mozilla: read generic SSL certificates
      contrib: use the new SSL private keys type (was: "let the mozilla and
         other domains read generic SSL certificates")

Jason Zaman (12):
      cgmanager: Apply auth_use_nsswitch interface
      alsa: needs to map its tmpfs files
      virt: add policy for virtlogd
      virt: updated perms for starting guests
      gssproxy: add policy
      rpc: Allow stream connect to gssproxy
      gpg: search dir when connecting to agent socket
      dirmngr: allow filetrans in gpg_runtime_t
      gpg: Add gpg_agent_use_card boolean for OpenPGP cards
      cachefilesd: make cachefilesd_cache_t a mountpoint
      Set user_runtime_content_type for all remaining types in /run/user/%{UID}/
      gssproxy: allow writing kerberos rcache

Jason Zaman via refpolicy (3):
      pulseaudio: Add neccessary map permissions
      gpg: add fcontexts for user runtime sockets
      rpc: add sm-notify pid fcontext

Laurent Bigonville (2):
      Allow NetworkManager to write to audit
      Call systemd_write_inherited_logind_inhibit_pipes() where needed

Luis Ressel (12):
      portage: Allow portage_t and portage_sandbox_t to access locale_t
      postfix: Some table drivers (notably cdb) need to mmap() their databases
      portage: Grant the map permissions neccessary for git and install
      alsa: alsactl needs to map its configuration
      mozilla: Add neccessary map permissions
      mandb: man-db needs to map its 'index.db' cache
      portage: Remove nonsensical dontaudit of an allowed permission
      portage: Transition to ldconfig_t when calling ldconfig
      postfix: Some table drivers (notably cdb) need to mmap() their databases
      postfix: Silence cap_dac_read_search denials
      portage: Grant portage the map permission on usr_t
      Allow gtk apps to map usr_t files

Nicolas Iooss (2):
      dbus: move comments out of the file context definitions
      logrotate: allow systemd to start logrotate

Russell Coker (3):
      udev and dhcpd
      minor nspawn, dnsmasq, and mon patches
      refpolicy and certs

Tom Gundersen (1):
      dbus: add policy for dbus-broker

* Sat Aug 05 2017 Chris PeBenito <pebenito@ieee.org> - 2.20170805
Chris PeBenito (82):
      Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
      Module version bump for usrmerge FC fixes from Jason Zaman.
      mon policy from Russell Coker.
      Module version bump for cups patches from Guido Trentalancia.
      Module version bump for tbird and mozilla printing from Guido
         Trentalancia.
      Revert "cups/lpd: read permission for cupsd_var_run_t socket files"
      Module version bump for cups revert.
      Sort capabilities permissions from Russell Coker.
      Little misc patch from Russell Coker.
      mon: Fix deprecated interface usage.
      dpkg: Updates from Russell Coker.
      Monit policy from Russell Coker and cgzones.
      monit: Fix build error.
      fetchmail, mysql, tor: Misc fixes from Russell Coker.
      Merge branch 'alsa_module' of git://github.com/cgzones/refpolicy-contrib
      Merge branch 'vnstat_module' of git://github.com/cgzones/refpolicy-contrib
      Module version bump for alsa and vnstatd fixes from cgzones.
      Merge branch 'ntp_module' of git://github.com/cgzones/refpolicy-contrib
      Module version bump for ntp fixes from cgzones.
      samba: A few line moves.
      Module version bump for samba patch from Russell Coker.
      Systemd fixes from Russell Coker.
      Xen fixes from Russell Coker.
      mailman: Fixes from Russell Coker.
      MTA fixes from Russell Coker.
      Network daemon patches from Russell Coker.
      apache: Fix CI error.
      Merge branch 'modutils_adapt_interfaces' of
         git://github.com/cgzones/refpolicy-contrib
      Merge branch 'corecmd_read_bin_symlinks' of
         git://github.com/cgzones/refpolicy-contrib
      Module version bumps for fixes from cgzones.
      Merge branch 'mandb' of git://github.com/cgzones/refpolicy-contrib
      Merge branch 'dphysswapfile' of git://github.com/cgzones/refpolicy-contrib
      Module version bump for dphysswapfile and mandb fixes from cgzones.
      Merge branch 'var_run_filecontext' of
         git://github.com/cgzones/refpolicy-contrib
      Merge branch 'vnstatd' of git://github.com/cgzones/refpolicy-contrib
      Module version bump for fixes from cgzones.
      dontaudit net_admin for SO_SNDBUFFORCE
      /var/run -> /run again
      Merge branch 'monit' of git://github.com/cgzones/refpolicy-contrib
      Module version bump for monit patch from cgzones.
      systemd-resolvd, sessions, and tmpfiles take2
      Misc fc changes from Russell Coker.
      Systemd-related changes from Russell Coker.
      networkmanager: adjust interface docs format.
      wm: interface docs adjustment.
      Module version bump for misc fixes from Guido Trentalancia.
      systemd init from Russell Coker
      misc daemons from Russell Coker.
      logging patches from Russell Coker
      kmod, lvm, brctl patches from Russell Coker
      devicekit, mount, xserver, and selinuxutil from Russell Coker
      some userdomain patches from Russell Coker
      Module version bump for gnome fix from Guido Trentalancia.
      apache: Move blocks.  No rule changes.
      Module version bump for changes from Sven Vermeulen and Guido
         Trentalancia.
      login take 4 from Russell Coker.
      Rename apm to acpi from Russell Coker.
      Module version bump for patches from Russell Coker.
      some little misc things from Russell Coker.
      apt/dpkg strict patches from Russell Coker.
      Module version bump for minor fixes from Guido Trentalancia.
      Merge branch 'usr_bin_fc' of
         git://github.com/fishilico/selinux-refpolicy-contrib
      Module version bump for /usr/bin fc fixes from Nicolas Iooss.
      Module version bump for chronyd changes from Luis Ressel.
      openoffice: Move ooffice_rw_tmp_files() implementation.
      Module version bump for openoffice fix from Guido Trentalancia.
      libmtp: move lines
      Module version bump for fixes from Guido Trentalancia.
      Module version bump for mmap fixes from Stephen Smalley.
      Module version bump for misc patches from Guido Trentalancia.
      gpg: Fix overspecified dependencies in gpg_agent_tmp_filetrans.
      dirmngr: Whitespace fixes.
      Module version bumps for patches from Jason Zaman.
      cgmanager: Move lines
      Module version bumps for patches from Jason Zaman.
      gpg: Module version bump for patch from Guido Trentalancia.
      mozilla: Module version bump for patch from Luis Ressel.
      rkhunter: Fix module version and move lines.
      Module version bump for patches from cgzones.
      chkrootkit: Fix module version.
      Module version bump for patches from cgzones.
      Bump module versions for release.

Guido Trentalancia (28):
      cups: read permission for cupsd_var_run_t socket files in
         cups_stream_connect()
      cups/lpd: read permission for cupsd_var_run_t socket files
      thunderbird: allow stream connections to cups so that it can print
      mozilla: allow stream connections to cups so that it can print
      java: enable interactive use
      evolution: add dbus acquire service permission
      evolution: do not audit kernel read state
      evolution: add some critical permissions
      mozilla: read hardware state information
      mozilla: add a permission
      wm: load the NetworkManager applet
      wm: interactive start
      Gnome and Evolution dbus chat permissions
      openoffice: support starting it from the window manager
      evolution: minor fixes and updates
      java: error messages terminal printout
      loadkeys: use init fds (system bootup)
      plymouth: pid interface usability
      shutdown: send msg to syslog
      openoffice: open files retrieved using mozilla
      contrib: new libmtp module
      openoffice: minor update
      gnome: improved integration with openoffice
      cups: let hplip read udev pid files
      dbus: let session bus daemon manage user runtime dirs
      zabbix: Grant zabbix_agent_t to call setrlimit on self
      ntp: fix the drift file context and transition
      gpg: manage user runtime socket files and directories

Jason Zaman (12):
      usrmerge: Add missed /usr fcontexts
      java: update fcontexts for new versions of icedtea
      dirmngr: add to roles and allow gpg to domtrans
      gpg dirmngr: create and connect to socket
      dirmngr: fcontext for ~/.gnupg/crls.d/
      dirmngr: Network rules to connect to keyserver
      cgmanager: add policy from gentoo
      consolekit: Add support for consolekit2
      consolekit: allow purging tmp
      consolekit: introduce consolekit_use_inhibit_lock interface
      dbus: use consolekit inhibit locks
      networkmanager: use consolekit inhibit locks

Luis Ressel (3):
      chronyd: Re-align fc file
      chronyd: Allow init scripts to create /run/chrony
      mozilla: Add fc for the files used by the firefox addon "vimperator"

Nicolas Iooss (1):
      Support systems with a single /usr/bin directory

Russell Coker (1):
      patch for samba

Stephen Smalley (1):
      contrib: allow map permission where needed

Sven Vermeulen (1):
      rpc_* interfaces should be wrapped by optional_policy()

cgzones (16):
      update ntp module
      update alsa module
      vnstatd: update module
      corecmd_read_bin_symlinks(): remove deprecated and redundant calls
      modutils: adopt calls to new interfaces
      vnstatd: update
      dphysswapfile: update
      monit: update
      mandb: update
      logrotate: reload monit after log rotation
      remove /var/run file context lefovers, add dbus exception
      monit: add syslog access and support for monit systemd service
      rkhunter: add policy module
      arpwatch: align file contexts
      chkrootkit: add policy module
      arpwatch: update

* Sat Feb 04 2017 Chris PeBenito <pebenito@ieee.org> - 2.20170204
Chris PeBenito (41):
      Module version bump for patches from Jason Zaman.
      authbind: Remove dead policy.
      Module version bump for cups patch from Guido Trentalancia.
      Merge pull request #29 from cgzones/deprecated_macros
      Module version bump for Debian fprintd fc entry from Laurent Bigonville.
      Module version bumps for openoffice patches from Guido Trentalancia.
      Module version bumps for patches from Guido Trentalancia.
      Merge pull request #30 from cgzones/trailing_whitespaces
      Module version bumps for mozilla and gpg patches from Luis Ressel.
      Module version bump for patches from Guido Trentalancia.
      Module version bump for patches from Guido Trentalancia.
      rtkit, wm: Remove calls to nonexistant interfaces.
      Module version bumps for patches from Guido Trentalancia.
      rtkit: enable dbus chat with xdm
      Module version bump for patches from Guido Trentalancia.
      Module version bump for xscreensaver patch from Guido Trentalancia.
      Merge branch 'run_transition' of
         git://github.com/cgzones/refpolicy-contrib
      Module version bumps for /run fc changes from cgzones.
      Module version bump for openoffice and wm patches from Guido Trentalancia.
      Module version bump for patches from Guido Trentalancia.
      Module version bump for wm patch from Guido Trentalancia.
      Merge branch 'usr-fc' of
         git://github.com/fishilico/selinux-refpolicy-contrib
      Module version bump for fc updates from Nicolas Iooss.
      Module version bump for patches from Guido Trentalancia.
      Module version bump for capability2 fixes from Guido Trentalancia.
      Module version bump for plymouth fix from Guido Trentalancia.
      boinc: Update from Russell Coker.
      Module version bump for mozilla update from Guido Trentalancia.
      Merge pull request #47 from cgzones/dphysswap_module
      Merge pull request #40 from cgzones/fakehwclock_module
      Merge branch 'gpg_module' of git://github.com/cgzones/refpolicy-contrib
      Merge branch 'irqbalance_module' of
         git://github.com/cgzones/refpolicy-contrib
      Merge branch 'loadkeys_module' of
         git://github.com/cgzones/refpolicy-contrib
      Module version bumps for patches from cgzones.
      Merge branch 'exim_module' of git://github.com/cgzones/refpolicy-contrib
      Merge branch 'screen_module' of git://github.com/cgzones/refpolicy-contrib
      Module version bump for screen and exim changes from cgzones.
      screen: Revert broken interface call.
      cups: Move hplip_domtrans interface.
      Module version bump for cups patch from Guido Trentalancia.
      Bump module versions for release.

Dominick Grift (1):
      Re-add raid fc spec that must have been removed earlier by mistake

Guido Trentalancia (29):
      cups: descend "rw" directories when reading configuration files
      Apache OpenOffice module (contrib policy part)
      openoffice: rename two interfaces in openoffice and evolution
      mozilla: extend dbus connection permissions
      openoffice: permission to read user temporary files
      xguest: restrict ability to execute files on noxattr filesystems
      pulseaudio: update server and client permissions
      mozilla: remove redundant pulseaudio interface calls
      networkmanager: read user certs not user content (was enable
         userdom_read_user_certs() throughout the policy)
      Make several calls to mta interfaces optional
      wm: update the window manager (wm) module and enable its role template
         (v7)
      rtkit: enable dbus chat with xdm
      networkmanager: enable dbus chat with xdm
      policykit: enable dbus chat with xdm
      games: general update and improved pulseaudio integration
      wm: improved integration with games
      xscreensaver: update the module so that it can be effectively used
      wm: properly set domain entrypoint in wm_application_domain()
      openoffice: add writer support for sending email directly to multiple
         recipients
      contrib: use new genhomedircon template for username
      contrib: extend wm ability to launch confined graphical applications
      contrib: support the new interface to manage X session logs
      networkmanager: dbus chat with cups
      cups: add cups-browsed executable fc
      devicekit: add new wake_alarm permission (capability2)
      networkmanager: add new wake_alarm permission (capability2)
      plymouth: use the correct running domain for the client
      mozilla: execute evolution to send emails
      cups: new interface to execute HPLIP applications in their own domain

Jason Zaman (4):
      pcscd: dbus and domain lookup
      devicekit: fcontext for udisks2
      gnome: add gkeyring rules and fcontext
      gpg: add new socket paths

Laurent Bigonville (1):
      Add debian path for fprintd daemon

Luis Ressel (3):
      gpg: Add filetrans for scdaemon socket and gpg-agent extra sockets
      gpg.fc: Adjust whitespace
      mozilla: Add miscfiles_dontaudit_setattr_fonts_cache_dirs()

Nicolas Iooss (1):
      Add file contexts for files in /usr/{lib,sbin}

cgzones (10):
      use domain_auto_transition_pattern instead of domain_auto_trans
      remove trailing whitespaces
      transition file contexts to /run
      update loadkeys module
      add fakehwclock module
      add dphysswapfile module
      update gpg module
      update screen module
      update irqbalance module
      update exim module

* Sun Oct 23 2016 Chris PeBenito <pebenito@ieee.org> - 2.20161023
Adam Tkac (2):
      varnishncsa (varnishlog_t) reads localization files
      Grant certmonger "chown" capability

Chris PeBenito (42):
      Merge branch 'bigon-geoclue'
      Add additional comments in geoclue.
      Merge branch 'bigon-virt-1'
      Merge branch 'nm-1' of git://github.com/bigon/refpolicy-contrib into
         bigon-nm-1
      Merge branch 'bigon-nm-1'
      Module version bump for virt and networkmanager patches from Laurent
         Bigonville.
      Merge branch 'master' of git://github.com/bigon/refpolicy-contrib
      Module version bump for firewalld updates from Laurent Bigonville.
      Module version bump for collectd update from Jason Zaman.
      Module version bumps for user runtime fixes from Jason Zaman.
      Boinc updates from Russell Coker.
      rpcbind: Read /sys/devices/system/cpu/online from Russell Coker.
      watchdog: Move line.
      Module version bump for watchdog pidfile option from Russell Coker.
      Systemd units from Russell Coker.
      Module version bump for pulseaudio fc fix from Jason Zaman.
      cpucontrol: revise cpucontrol_conf_t labeling, from Guido Trentalancia.
      Module version bumps for patches from Guido Trentalancia.
      Update the telepathy module:
      Update the alsa module so that the alsa_etc_t file context (previously
         alsa_etc_rw_t) is widened to the whole alsa share directory, instead of
         just a couple of files.
      alsa: Add compatibility alias for alsa_etc_rw_t.
      Update the sysnetwork module to add some permissions needed by the dhcp
         client (another separate patch makes changes to the ifconfig part).
      Module version bump for various patches from Guido Trentalancia.
      pulseaudio: Fix compile errors.
      Merge branch 'master' of
         https://github.com/SeanPlacchetti/refpolicy-contrib
      Module version bump for webalizer dead type removal from Sean Placchetti.
      Module version bump for Evolution SSL fix from Guido Trentalancia.
      evolution: Read user certs from Guido Trentalancia.
      cups: Move can_exec() line.
      cups: Module version bump for hplip patch from Guido Trentalancia
      pulseaudio: Move interface definitions.
      Module version bump for mozilla patch from Guido Trentalancia.
      Module version bump for gnome patch from Guido Trentalancia.
      Module version bump for evolution patch from Guido Trentalancia.
      gpg: Whitespace fix.
      Merge branch 'feature/fix-networkmanager-varrun-macro' of
         https://github.com/rfkrocktk/refpolicy-contrib
      Module version bump for networkmanager fix from Naftuli Tzvi Kay.
      Merge branch 'rfkrocktk-feature/syncthing'
      Rearrange lines in syncthing.
      webalizer: Rearrange a couple lines.
      Module version bump for webalizer patch from Russell Coker.
      Bump module versions for release.

Dominick Grift (18):
      Module version bump for changes to the geoclue module by Laurent
         Bigonville.
      Module version bump for changes to various modules from Laurent
         Bigonville.
      geoclue: move kernel interface call to the appropriate position
      Actually associate mailmain_domain attribute with mailman domains
      Module version bumps for changes to various modules by Nicolas Iooss
      Module version bump for changes to the cron module by Jason Zaman
      Module version bump for changes to the redis module by Grant Ridder
      Module version bump for changes to the raid module by Laurent Bigonville
      Module version bump for changes to the networkmanager module by Laurent
         Bigonville.
      Module version bump for changes to the redis module by Grant Ridder.
      Module version bump for changes to the mozilla module by Laurent
         Bigonville.
      Module version bump for changes to the geoclue module by Nicolas Iooss.
      Add hwloc-dump-hwdata SELinux policy
      Module version bump for changes to the varnishd module by Robert Moucha
      Module version bump for changes to the puppet module by Thomas Mueller
      Module version bump for changes to the varnishd module by Adam Tkac
      Module version bump for changes to the certmonger module by Adam Tkac
      Revert "dbus: allow system, and session bus clients to answer to dbus
         unconfined domains"

Grant Ridder (2):
      Add read/write perms for redis-sentinel
      Allow tcp_connect to redis_port_t for redis_t

Guido Trentalancia (7):
      Policykit module: add fs_getattr_xattr_fs()
      Update the policy for module apm
      Let gpg disable core dumps
      Update the rtkit module
      Update the pulseaudio module for usability and ORC support
      cups: update permissions for HP printers (load firmware)
      gpg: public key signature verification in evolution

Guido Trentalancia via refpolicy (3):
      evolution: read SSL certificates
      mozilla: let mozilla play audio
      gnome: add support for the OIL Runtime Compiler (ORC) optimized code
         execution

Jason Zaman (10):
      cron: Allow locks to be lnk_files
      collectd: update policy for 5.5
      consolekit: allow managing user runtime
      pulseaudio: fcontext and filetrans for runtime
      ftp: Add filetrans from user_runtime
      gnome: Add filetrans from user_runtime
      mplayer: Add filetrans from user_runtime
      userhelper: Add filetrans from user_runtime
      wm: Add filetrans from user_runtime
      pulseaudio: fix user runtime fcontext

Laurent Bigonville (13):
      Add initial geoclue 2 module
      Properly escape dot in the path to the geoclue daemon
      Use auth_use_nsswitch() as we need DNS resolving and access nsswitch.conf
      virt.fc: Add some debian contexts
      networkmanager.fc: nm-dispatcher.action has been renamed to nm-dispatcher
      Allow some domain to read sysctl_vm_overcommit_t
      Allow mdadm read efivarfs files
      Allow /var/run/firewalld/ directory to transition to firewalld_var_run_t
      Add an interface to allow a domain to read firewalld_var_run_t files
      Allow firewalld to create firewalld_var_run_t directory.
      dontaudit firewalld attempt to relabel its own config files
      Allow NM to execute arping
      Debian now ships firefox-esr, properly label the executable

Luis Ressel (1):
      New policy for tboot utilities

Naftuli Tzvi Kay (2):
      Fix NetworkManager Read Pid Files Macro
      Syncthing Policy

Nicolas Iooss (3):
      Describe _initrc_domtrans interfaces differently from the _domtrans ones
      Fix typos in several interfaces
      Add Arch Linux path for geoclue module

Robert Moucha (1):
      Fix trivial typo in varnishncsa name

Russell Coker (2):
      watchdog reads pid files
      named reads vm sysctls

Russell Coker via refpolicy (1):
      webalizer patch for inclusion

Sean Placchetti (1):
      -Remove unused declarations from webalizer type enforcement file

Thomas Mueller (1):
      Allow puppet_t transtition to shorewall_t

doverride (3):
      Merge pull request #8 from bigon/geoclue
      Merge pull request #11 from bigon/overcommit-1
      Merge pull request #12 from fishilico/typos

* Tue Dec 08 2015 Chris PeBenito <selinux@tresys.com> - 2.20151208
Alexander Wetzel (1):
      add vfio support for libvirt

Chas Williams - CONTRACTOR (1):
      afs: update labels, file contexts and allow access to urandom

Chris PeBenito (14):
      Module version bump for hadoop_admin() fix from Jazon Zaman.
      Module version bump for fc typo in radius from Sven Vermeulen.
      Module version bump for patches from Jason Zaman.
      Module version bump for init_startstop_service from Jason Zaman.
      Module version bump for cron_admin interface from Jason Zaman.
      Comment/whitespace fix in virt.te.
      Module version bump for vfio support for libvirt from Alexander Wetzel.
      Add systemd unit types.
      Add systemd socket activations.
      Merge branch 'pebenito-master'
      Module version bump for systemd additions.
      Merge branch 'bigon-systemd'
      Module version bump for dbus systemd patch from Laurent Bigonville.
      Bump module versions for release.

Dominick Grift (16):
      Module version bump for courier fixes from Sven Vermeulen.
      Module version bump for afs fixes from Chas Williams.
      Redundant rules and afs_files_t is not a filesystem type
      Various samhain fixes
      Cachefilesd module updates
      Module version bump for changes to the dnsmasq policy module by Jason
         Zaman
      Module version bump for changes to the snmp policy module by Jason Zaman
      Module version bump for changes to the pulseaudio policy module by Jason
         Zaman
      cachefiles: It is cachefilesd_cache_t
      Module version bump for update to the networkmanager policy module by
         Stephen Smalley.
      Module version bumps for "Remove run interface calls from admin
         interfaces" changes by Jason Zaman.
      Module version bump for changes to the pulseaudio module by Niklas Haas.
      Changes to the git, hadoop and rsync modules by Jason Zaman.
      Module version bump for changes to the virt module by Jason Zaman
      Module version bump for changes to the mozilla module from Laurent
         Bigonville.
      Module version bump for changes to the wine module by Nicolas Iooss

Jason Zaman (19):
      hadoop: remove _role from _admin interface
      rpcbind: typo fix
      git: make inetd interface optional
      rpc: introduce allow_gssd_write_tmp boolean
      rpc: allow setgid capability
      virt: add virt_tmpfs_t type and permissions
      introduce virt_leaseshelper_t
      dnsmasq: allow exec shell for scripts
      snmp: missing fcontext for snmpd
      pulseaudio: filetrans for autospawn.lock
      Use init_startstop_service in admin interfaces A-M
      Use init_startstop_service in admin interfaces N-Z
      Remove _run() interfaces from _admin()
      Introduce cron_admin interface
      rsync: remove rsync_run from admin interface
      git: allow git_system_t to listen on tcp_sockets
      hadoop: init_startstop_service() can not take attributes
      virt: Allow creating qemu guest agent socket
      virt: Add policy for virtlockd the Virtual machine lock manager

Laurent Bigonville (2):
      Transition D-Bus system service out of the init_t domain when PID1 is
         systemd
      Label iceweasel plugin-container executable as mozilla_plugin_exec_t

Nicolas Iooss (1):
      wine: remove use of nonexisting interface

Niklas Haas (1):
      pulse: don't give pulseaudio_client full access to user_home_t

Stephen Smalley (1):
      contrib: networkmanager: allow netlink_generic_socket access

Sven Vermeulen (6):
      Locate authdaemon socket and communicate with authdaemon
      Allow authdaemon to access selinux fs to check SELinux state
      Grant setuid/setgid to courier_pop_t
      Execute courier helper script after authentication
      Courier IMAP needs to manage the users' maildir
      Fix typo for radiusd /var/lib location

doverride (2):
      Merge pull request #3 from haasn/pulse-nohome
      Merge pull request #6 from bigon/mozilla-1

* Wed Dec 03 2014 Chris PeBenito <selinux@tresys.com> - 2.20141203
Chris PeBenito (26):
      Whitespace fix in ntp.fc.
      Module version bump for ntp fc entries from Laurent Bigonville.
      Whitespace fix in shibboleth.te.
      Module version bump for new shibboleth module from Martin Lang.
      Module version bump for apt fix from Nicolas Iooss.
      Module version bump for dnsmasq MTU fix from Sven Vermeulen.
      Module version bump for apache content interfaces from Sven Vermeulen.
      Module version bump for gitweb fc entry on Debian and ArchLinux from
         Nicolas Iooss.
      Module version bump for fc regex fixes from Nicolas Iooss.
      Module version bump for various fixes from Laurent Bigonville.
      Module version bump for ModemManager fc entry from Laurent Bigonville.
      Add missing cron_admin_role() dependency.
      Move sock_file filetrans to fcron_crond conditional.
      Module version bump for cron and snort updates from Sven Vermeulen.
      Module version bump for java icedtea fc entries from Sven Vermeulen.
      Module version bump for apache/mlogc patch from Elia Pinto.
      Remove name from ntp-kod ntp_drift_t filetrans.
      Module version bump for ntp-kod file support from Jason Zaman.
      Module version bump for init_daemon_pid_file use from Sven Vermeulen.
      Module version bump for alsa and hiawatha fixes from Sven Vermeulen.
      Module version bump for ftp and tftp fixes from Nicolas Iooss.
      Move irc exec lines.
      Module version bump for irc re-exec itself patch from Luis Ressel.
      Module version bump for NetworkManager fc fix for ArchLinux from Nicolas
         Iooss.
      Module version bump for _admin fixes from Jason Zaman.
      Bump module versions for release.

Dominick Grift (3):
      Module version bump for changes to the loadkeys module by Nicolas Iooss
      cron: that boolean identifier does not exist         also require it
      Module version bump for changes to the networkmanager modules by Lubomir
         Rintel

Elia Pinto (1):
      apache.te: Add labelling support for /var/log/mlogc

Jason Zaman (20):
      Add filetrans for ntp-kod file
      ccs: syntax errors in ccs_admin interface
      condor: syntax error in condor_admin
      distcc: syntax error in distcc_admin
      ftp: syntax error in ftp_admin
      kerberos: syntax error in kerberos_admin
      kismet: syntax error in kismet_admin
      nut: syntax error in nut_admin
      prelude: syntax error in prelude_admin
      psad: syntax error in psad_admin
      quota: syntax error in quota_admin
      rpcbind: syntax error in rpcbind_admin
      rpm: syntax error in rpm_admin
      systemtap: syntax error in stapserver_admin
      svnserve: syntax error in svnserve_admin
      uptime: syntax error in uptime_admin
      zabbix: syntax error in zabbix_admin
      remove pyzor_role() from pyzor_admin()
      remove spamassassin_role() from spamassassin_admin()
      rsync: syntax error in rsync_admin

Laurent Bigonville (7):
      Add several fcontext for debian specific paths for ntp
      Fix dbus_all_session_domain(), session_bus_type is an attribute
      Allow gconfd to be started by the session bus
      Fix the usage of dbus_spec_session_domain() interface
      Properly label exim4 initscript under Debian
      Add new gnome_spec_domtrans_all_gkeyringd() interface
      Label /usr/sbin/ModemManager as modemmanager_exec_t

Lubomir Rintel (1):
      Allow NetworkManager to create Bluetooth SDP sockets

Luis Ressel (1):
      irc.te: Allow irssi to re-execute itself

Martin Lang (1):
      Add a policy module for shibboleth authentication

Nicolas Iooss (7):
      apt: remove non-existing permission set write_dir_perms
      Label /usr/share/gitweb/static as httpd_git_content_t
      Fix strange file patterns
      ftp: fix labels in /var/lock/subsys/
      Label /usr/bin/tftpd as tftpd_exec_t
      Label /usr/lib/networkmanager/ like /usr/lib/NetworkManager/
      Allow loadkeys to read usr_t files

Sven Vermeulen (17):
      dnsmasq reads MTU sysctl
      Support read/append/manage functions for various httpd content
      Snort policy updates
      fcron socket support
      Fix typo in dnsmasq.if
      Mark icedtea binaries as java_exec_t
      Use init_daemon_pid_file for contrib modules
      Enable asound.state.lock support
      Add support for Hiawatha web server
      Use logging_search_logs, not logging_search_log
      Use logging_search_logs, not logging_search_log
      Use files_search_etc, not logging_search_etc
      Use files_search_etc, not logging_search_etc
      Use files_search_etc, not files_search_config
      Use corecmd_search_bin, not corecmd_searh_bin
      Use fs_search_tmpfs, not files_search_tmpfs
      Use domain_auto_trans, not auto_trans

* Tue Mar 11 2014 Chris PeBenito <selinux@tresys.com> - 2.20140311
Chris PeBenito (17):
      Minor rearrangement of minidlna lines.
      Module version bump for openvpn tmp files from Sven Vermeulen.
      Update modules for file_t merge into unlabeled_t.
      Module version bump for postfix showq fc from Laurent Bigonville.
      Rename gpg_agent_connect to gpg_stream_connect_agent.
      Module version bump for gpg agent interface from Luis Ressel.
      Whitespace fixes in git.fc.
      Module version bump for debian git fc entries from Laurent Bigonville.
      Move bin_t fc to corecommands.
      Move exec/transition lines in couchdb.
      Add comment about couchdb_js policy.
      Module version bump for couchdb updates from Luis Ressel.
      Module version bump for pcscd fix from Luis Ressel.
      Move screen dontaudit rule.
      Module version bump for screen fix from Luis Ressel.
      Module version bump for git fc fix from Nicolas Iooss.
      Bump module versions for release.

Dan Walsh (28):
      Allow irc_t to use tcp sockets
      Add labels for apache logs under miq package
      Allow smbcontrol to create content in /var/lib/samba
      Allow ktalkd to bind to the ktalkd_port
      Allow memcache to read sysfs data
      Allow mdadm to getattr any file system
      Allow cupsd_lpd_t to bind to the printer port
      Allow rlogind to bind to the rlogin_port
      Allow cvs to bind to the cvs_port
      svirt domains neeed to create kobject_uevint_sockets
      Lots of new access required for sosreport
      Allow tgtd_t to connect to isns ports
      openct needs to be able to create netlink_object_uevent_sockets
      Allow glusterd to create sock_file in /run
      Add support for tmp directories to openvswitch
      Allow virt_domain with USB devices to look at dos file systems
      Additional access for MLS
      Additional access for MLS window manager
      Additional access for MLS window manager
      Additional access for MLS window manager
      Allow rpcbind to use nsswitch
      Allow gpg_agent to use ssh-add
      Add apache labeling for glpi
      Allow pegasus to transition to dmidecode
      Allow mcelog to use the /dev/cpu device
      Allow apmd to request the kernel load modules
      Allow postfix programs to getattr on all executables
      label mate-keyring-daemon with gkeyringd_exec_t

Dominick Grift (126):
      Typo fix in ksmtuned_admin() by Shintaro Fujiwara
      Fix monolithic built
      Change file context spec for aide log files to catch suffixes
      Module version bumps for changes in various policy modules by Sven
         Vermeulen
      Squid: Use a single pattern for brevity
      Irc was already allowed to create tcp sockets, it only needed an
         additional accept, and listen to be able to act as a proxy
      Its probably a better idea to use the httpd_sys_ra_content_t type sid
         for logs in these locations
      Module version bump for changes to the tcsd policy module by Lukas
         Vrabec
      Module version bump for changes to various policy modules by Miroslav
         Grepl
      Module version bump for changes to the samba policy module by Dan Walsh
      Module version bump for changes to the telepathy policy module by
         Miroslav Grepl
      We do not have a boinc domain type attribute     Change boolean
         description a bit
      Additional rabbitmq couchdb support
      Module version bumps for changes to various policy modules by Miroslav
         Grepl
      Additional git tcp networking rules
      Additional ktalkd udp networking rules
      Module version bump for changes to various policy modules by Dan Walsh
      Addtional cups ldp tcp networking rules
      Should be server packets because it is binding, and not connecting
      Clean up telnet, and rlogin networking rules
      Additional cvs tcp networking rules
      Module version bump for changes to various policy modules by Dan     Walsh
      Addtional tgtd tcp networking rules
      Additional polipo tcp networking rules
      Fix asterisk files_spool_filetrans()
      Module version bump for changes to the networkmanager policy module by
         Lukas Vrabec
      Additional fs_tmpfs_filetrans() for munin service plugin content on
         tmpfs
      Module version bump for changes to various policy modules by Miroslav
         Grepl
      Support rlogind, and telnetd as init daemon domains ( i think fedora is
          campaigning to get rid of (x)?inetd )
      Support mariadb logging, file context specification for mariadb specific
           config location
      Change logwatch boolean identifier to something more self-documenting.
         Additional tcp networking rules
      Module version bump for changes to various policy modules by Miroslav
         Grepl
      Fix inconsistencies in the pkcs policy module
      Fix fetchmail inconsistencies
      Module version bump for changes in various policy modules by Dan Walsh
      Support for window managers to stream socket connect to pulseaudio
      Logwatch does not need to be able to bind tcp sockets to generic nodes
         since its only connecting
      Adds userhelper_exec_consolehelper for window managers
      Remove duplicate rules due to addition of auth_use_nsswitch()
      We dont use the arbt domain types template.     Use a more uniform boolean
         discription
      Clean up libstoragemngmt policy module     We do not yet support systemd
      Change type from etc_rw to conf for readability     admin access to
         condor_conf_t
      Hit by a nasty optional policy nesting issue
      We will find another way to run pa as a system server
      Module version bump for changes to various policy modules by Miroslav
         Grepl
      Clean up hypervkvp policy module (seems incomplete)
      Clean up initial redis policy module
      Additional openvpn tcp networking rules
      redis: allow redis to bind tcp sockets to redis_port_t type ports
      bluetooth: bluetooth_t acquires org.bluez service on dbus system bus
      wm: associate wm_exec_t to core command executable files so that initrc_t
         (/sbin/start-stop-daemon) can access it (metacity)
      logrotate restarts syslogd via init script in Debian
      This file is called just man-db in Debian.
      exim: exim owns directory /var/lib/exim4
      accountsd: accounts-daemon lists /var/log
      alsa: alsactl listing /dev/shm alsa: alsactl reading /dev/urandom alsa:
         alsactl getting attributes of devtmpfs / (/dev) alsa: alsactl maintains
         a pulseaudio tmpfs file
      Cron: /sbin/runlevel reads /run/utmp cron: anacron (system_cronjob_t)
         reading, writing inherited random crond tmp files (/tmp/tmpfk1VT2O)
      dbus: allow system, and session bus clients to answer to dbus unconfined
         domains
      apt: Run apt system cronjobs in the apt_t domain apt: apt system cronjob
         creates dpkg.status.* files in /var/backup
      devicekit: upowerd reads own unix stream socket devicekit:
         devicekit_power_t (runlevel) read /run/utmp
      mandb: Make the man-db cronjob work on Debian
      rtkit: traverse /proc to get to process state files
      networkmanager: NetworkManager reads /run/udev/data/n2 file
      avahi: create a avahi_initrc_domtrans for udev_t: udev runs a avahi dns
         check script which does, i guess, a dns check. If needed it starts, or
         stops avahi via its init script. I also created a
         avahi_manage_pid_files() for udev_t because the script manages a file
         called "checked_nameservers.*" in /run/avahi-daemon
      Cleanups of various modules with regard to regular expressions and white
           space
      apt: As it turns out the /var/backups directory is labeled in the backup
           module (which i incidentally did not have installed earlier). Instead
         of     creating this file with a file type transition to
         apt_var_cache_t, allow     apt_t to manage backup_store files
      mta: this needs to be verified again, it should just have been running
         in exim_t. I might have taken this from old logs
      mandb: /etc/cron.daily/man-db executes dpkg, reads dpkg db on Debian
      slocate: catch /usr/bin/updatedb.mlocate, and /etc/cron.daily/mlocate on
           Debian
      dpkg: catch /etc/cron.daily/dpkg on Debian     dpkg: allow
         /etc/cron.daily/dpkg to manage backup store files on Debian
      cron: consistent usage of regular expressions     cron: prelink no longer
         runs in the system cronjob domain
      alsa: alsactl wants to associate pulse-shm-.* to device_t type
         filesystems. This happens early on but i do not understand how that
         (/dev) relates to /dev/shm in this regard
      devicekit: reads udev pid files     modemmanager: reads udev pid files
      vdagent: spice-vdagentd uses /dev/vport1p1 virtio console
      tmpreaper: mountall-bootcl in the tmpreaper_t domain reads, writes
         /dev/pts/0 inherited from init script
      revert regular expressions
      wm: allow $1_wm_t to stream connect to $1_gkeyringd_t
      mta: allow system_mail_t (user_mail_domains) to read kernel sysctls and
          to read exim var lib files.
      mta: These are duplicates because system_mail_t is a user_mail_domain,
         as it is based off of the mta_base_mail_template() which assigns that
           type attribute
      locate: extra rules needed by debian /etc/cron.daily/locate script
      backup: in Debian /etc/cron.daily/passwd backs-up shadow, passwd etc to
          /var/backups
      avahi: create interfaces that will allow calles to create avahi pid dirs
           and create specifc avahi pid objects with a type transition (for
         udev,     which runs: /usr/lib/avahi/avahi-daemon-check-dns.sh in
         Debian
      Initial gdomap policy module
      Initial minissdpd policy module
      alsa: due to a bug in gnome 3.4, in debian, alsactl does all kinds of
         weird things related to pulseaudio
      various: revert regex fixes: fcsort does not want this now
      gdomap: gdomap_port_t is now available, gdomap binds tcp, and udp socket
         to it
      alsa: make alsa_t and pulseaudio_client so that pulseaudio_client rules
         apply to it. alsactl does not actually run pulseaudio it seems though.
      pulseaudio: allow all pulseaudio_client to send null signals to
         unconfined_t, since unconfined_t is not actually a pulseaudio_client (
         unconfined_t runs pulseaudio without a domain transition)
      avahi: create avahi_setattr_pid_dirs() for udev (avahi dns check script
         run by udev in Debian)
      These { read write } tty_device_t chr files on boot up in Debian
      colord: colord executable file locations in Debian
      colord: reads /proc/1, reads /run/udev files
      vdagent: read/write mtrr file
      mandb: dpkg running in the mandb_t domain in Debian (mandb cronjob)
         traverses /root
      exim: traverses sysfs, uses system cronjob file descriptors (/dev/null) in
         Debian (/etc/cron.daily/exim)
      minissdpd fixes
      devicekit: disk reads /proc/sys/vm/overcommit_memory
      devicekit: edit devicekit_append_inherited_log_files to include get
         attribute permission so that it can be also used for fsadm
      devicekit: 95hdparm-apm (devicekit_power_t) gets attributes of /dev/sda
         (fixed_disk_device_t)
      networkmanager: added interfaces that fedora calls for dhcpc. In Debian it
         was confirmed that at least dhclient manages
         /var/lib/NetworkManager/dhclient-eth0.conf
      firewalld: various fixes that i borrowed from Fedora but that also apply
         to Debian (confirmed)
      firewalld: interfaces created for iptables
      irqbalance: getsched from Debian
      colord: colord reads /proc/3412/cmdline (cupsd state files)
      virt: libvirtd reads /run/udev/data/+input:input3
      firewalld: traverses / on sysfs
      rngd: needs ipc_lock capability, maintains /run/rngd.pid
      tmpreaper: mountall-bootcl executes /bin/plymouth on Debian
      minissdpd: deal with assertion violation (sys_module)
      gdomap: missing networking rules, it traverses /tmp for some reason
      ntp: create ntp_read_drift_files() for dhclient
      dpkg: allow dpkg, and dpkg script to domain transition to initrc_t on any
         init script file type rather than only the generic initrc_exec_t init
         script file type
      exim: exim4 reads online
      apt: apt runs /usr/bin/apt-get apt: on_ac_power (apt_t) lists
         /sys/class/power_supply
      exim: exim_manage_var_lib_files created for init: init script runs helper
         apps that create/manage /var/lib/exim4/config.autogenerated.tmp
      gdomap/minissdpd: create read_config interfaces for initrc_t
      exim: make exim init script create /var/run/exim4 with a proper context
      pulseaudio: pulsaudio_t needs to be able to read user_tmpfs_files
         (/run/shm/pulse-shm-.*)
      dnsmasq: add support for /etc/dnsmasq.d/
      Module version bumps for various policy modules
      Module version bump for changes to the logrotate module by Luis Ressel
      Git: git daemons can list and read git personal repositories
      Module version bumps for changes to various policy modules by Fedora
      redis, lsm: typo fixes
      userhelper: append newline

James Carter (8):
      - Fixed typo in contrib/avahi.if
      - Fixed typo in contrib/glusterfs.te
      - Fixed typo in contrib/jabber.if
      - Fixed typo in contrib/keystone.if
      - Fixed typo in contrib/mailscanner.if
      - Fixed typo in contrib/qpid.if
      - Fixed typo in contrib/readahead.fc.
      - Fixed typo in contrib/rpm.if.

Laurent Bigonville (2):
      Label /usr/lib/postfix/showq as postfix_showq_exec_t
      Properly label git-daemon and gitweb.cgi on Debian

Luis Ressel (10):
      Allow initrc_t to create /var/run/opendkim
      Label /etc/cron.daily/logrotate correctly.
      gpg: Create gpg_agent_connect interface
      Minor updates to couchdb policy
      couchdb: Add separate domain for couchjs
      couchdb: Dontaudit denials caused by Erlang's disksup
      Reformat couchdb.fc
      pcscd.if: Permit access to pid files inside /var/run/pcscd/.
      Allow gpg-agent's scdaemon to connect to pcscd.
      Dontaudit screen asking for the sys_tty_config capability

Lukas Vrabec (8):
      Allow tcsd to read utmp file
      fix boinc policy
      Add support for couchdb in rabbitmq policy
      Fix transition rules in asterisk policy
      Add fowner capability to networkmanager policy
      Add policy for lsmd
      Add policy for hypervkvpd
      Add policy for redis-server

Mika Pflüger (1):
      Correct typo in passenger module name

Miroslav Grepl (40):
      Allow passenger to execute ifconfig
      Allow mpd setcap which is needed by pulseaudio
      Allow block_suspend cap for samba-net
      Allow t-mission-control to manage gabble cache files
      Allow nslcd to read /sys/devices/system/cpu
      Add labeling for ~/.cache/telepathy/avatars/gabble
      Allow firewalld to read NM state
      Allow systemd running as git_systemd to bind git port
      Fix labeling for fetchmail pid files/dirs
      Fix polipo.te
      Fix cupsd.te
      Allow munin service plugins to manage own tmpfs files/dirs
      Make ktalk as init domain
      Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
      Add logwatch_can_sendmail boolean
      Allow rhsmcertd to read init state
      Allow fsetid for pkcsslotd
      Allow fetchmail to create own pid with correct labeling
      Fix rhcs_domain_template()
      Add support for abrt-upload-watch
      Allow virtd to relabel unix stream socket
      Fix lsm.fc for pid files
      Also sock_file trans rule is needed in lsm
      Update condor_master rules to allow read system state info and allow
         logging
      Add labeling for /etc/condor and allow condor domain to write it (bug)
      Allow condor domains to manage own logs
      Allow glusterd to read domains state
      Add openvpn_can_network_connect() boolean
      Fix minissdpd_admin()
      Allow ctdb to getattr on al filesystems
      Watchdog opens the raw socket
      Allow watchdog to read network state info
      Add setroubleshoot_signull() interface
      Allow sosreport to send signull to setroubleshootd
      Allow sosreport all signal perms
      Allow sosreport to dbus chat with rpm
      Allow zabbix_agentd to read all domain state
      Allow smoltclient to execute ldconfig
      Allow sosreport to request the kernel to load a module
      Allow setpgid for sosreport

Nicolas Iooss (1):
      git: fix file pattern after whitespace fixes

Sven Vermeulen (6):
      Add minidlna policy
      Allow openvpn temporary files
      Add aide bin /usr/bin and mark /var/lib/aide
      Provide alsa_write_lib interface
      Run dmidecode after newrole or on terminals
      Grant write privileges to squid on its log files

* Wed Apr 24 2013 Chris PeBenito <selinux@tresys.com> - 2.20130424
Chris PeBenito (18):
      Rewrite of mcelog module from Guido Trentalancia
      Remove unnecessary lines in mcelog.te.
      Slight rearrangement in mcelog.te.
      Module version bump for mcelog update from Guido Trentalancia.
      Module version bump for ntp module fixes from Dominick Grift.
      Module version bump for fc substitutions optimizations from Sven
         Vermeulen.
      Module version bump for postfix/mta misc fixes from Sven Vermeulen.
      Module version bump for init_daemon_run_dirs usage from Sven Vermeulen.
      Turn off all tunables by default, from Guido Trentalancia.
      Module version bump for tunable default change.
      Module version bump for saslauthd tcp mysql connections from Mika Flueger.
      Move kernel request line in quota.
      Module version bump for quota kernel module request from Mika Pflueger.
      Module version bump for djbdns ports fixes from Russell Coker.
      Remove stray + in keystone.te.
      Whitespace fixes in cron.fc.
      Module version bump for pulseaudio type_transition conflict fix from Sven
         Vermeulen.
      Bump module versions for release.

Dominick Grift (889):
      Initial BIRD Internet Routing Daemon policy
      oident daemon fixes
      Introduce ntp_conf_t
      Allow ntp_admin() to manage ntp_drift_t content.
      List etc_t directories
      Use "Role allowed access." for consistency
      Use permissions sets for compatibility.
      Remove getattr permision from ntp_admin()
      Initial Sensord policy module
      Various block_suspend capability2 support from Fedora
      Gitolite3 support from Fedora
      /var/lib/sqlgrey is greylist milter data from Fedora
      Terminal related fixes for plymouthd from Fedora     Support block_suspend
         capability2 for plymouth
      Support minimal polkit in new location
      Support ldap for user authentication from Fedora
      Sanlock sends kill signals to non-root processes from Fedora     Various
         other capabilities for sanlock from Fedora
      Initial support for sqlgrey from Fedora
      Tor reads network sysctls from Fedora
      GPG agent reads /dev/random from Fedora
      Freshclam reads system and network state from Fedora
      Execute wpa_cli in the NetworkManager_t domain for wicd from Fedora
      lpstat.cups reads fips_enabled from Fedora
      Initial system tap compile server policy module
      Systemtap server admin manages stapserver_var_lib_t content
      Telepathy Idle reads gschemas.compiled from Fedora
      Initial slpd policy module
      Initial lightsquid policy module
      Initial wdmd policy module
      Initial mailscanner policy module and some depencies.
      Support slpd log rotation
      Initial numad policy module
      Open log files for append only
      CGClear reads CGConfig files from Fedora     Cosmetic changes to cgroup
         policy module     File contexts of cgroup app executables files in
         /sbin also apply to     /usr/sbin     Make cgroup_admin() a bit more
         compact
      Initial svnserve policy module
      Various small changes to ucspitcp
      Initial fcoe policy module
      Initial lldpad policy module
      fcoemon sends to lldpad with a dgram socket
      Initial quantum policy module
      Initial dspam policy module
      Module version bump for Telepathy file context spec fixes from Laurent
         Bigonville.
      Initial isns policy module
      Various changes to tcs policy module
      Initial ctdb policy module
      Various changes to the sblim policy module and its dependencies
      Initial polipo policy module
      Module version bump for networkmanager fixes
      Fixes to the polipo policy module
      Module version bump for smartmon fixes from Laurent Bigonville.
      Module version bump for accountsd file context spec fix from     Laurent
         Bigonville.
      Various changes to the raid module
      Module version bump for rtkit file context spec fix from     Laurent
         Bigonville
      Initial couchdb policy module
      Changes to the bind policy module
      Initial dnssectrigger policy module
      Initial man2html policy module
      Initial openhpi policy module
      Bind sends/receives http server instead of client packets conditionally
      Two file context regular expression fixes by Eric Paris
      Type mdadm_t is no longer a unconfined type
      Initial pkcs policy module
      Initial cfengine policy module
      Initial keystone policy module
      Initial l2tp policy module
      Initial mongodb policy module
      cfengine whitespace cleanup
      Changes to the accountsservice policy module
      Changes to the acct policy module
      Changes to the ada policy module
      changes to the afs policy module
      Changes to the accountsservice policy module
      Changes to the aiccu policy module
      Changes to the aide policy module
      Syntax error in afs_admin()
      Changes to the aisexec policy module
      Changes to the alsa policy module
      Changes to the amanda policy module
      Changes to the amavisd policy module and relevant dependencies
      Changes to the amtu policy module
      Changes to the anaconda policy module
      Changes to the abrt policy module and relevant dependencies
      numad sends/receives msgs from Fedora
      Amtu executable file in installed in /usr/sbin in Fedora
      The (usr/)? expression does not work consistently so better not use it
         at all
      Changes to the httpd policy module
      Merge branch 'master' of
         ssh://dgrift@oss.tresys.com/home/git/refpolicy-contrib
      Fixes to the apache policy module and dependencies
      Changes to the apcupsd policy module
      Role attributes for lightsquid application domain
      Changes to the mailscanner module
      Changes to the svnserve policy module
      Changes to the quantum policy module
      Changes to the dspam module
      Changes to the ctdb policy module
      Changes to the couchdb policy module
      Changes to the openhpid policy module
      Changes to the keystone policy module
      Changes to the l2tp policy module
      Changes to the apm module and relevant dependencies
      Changes to the arpwatch policy module
      Changes to the apcupsd policy module
      Changes to the abrt policy module
      Changes to the apache policy module
      Changes to the asterisk policy module and dependencies
      Changes to the authbind policy module
      Changes to the automount policy module
      Change acpid lock file context spec
      Changes to the avahi policy module and dependencies
      Changes to the awstats policy module
      Changes to the bacula policy module
      Changes to the bcfg2 policy module
      Changes to the apt policy module
      Changes to the apache policy module
      Changes to the backup module
      Changes to the bind policy module
      Bird module clean up
      Fix arpwatch connected_stream_socket_perms
      Changes to the bitlbee policy module
      Changes to the blueman policy module
      Changes to the bluetooth policy module
      Changes to the brctl policy module
      Changes to the apache policy module
      Changes to the bugzilla policy module
      Changes to the calamaris policy module
      Implement lightsquid_admin()
      Changes to the apache policy module and dependencies
      Initial boinc policy module
      Initial callweaver policy module
      Changes to the canna policy module
      Changes to the ccs policy module
      Changes to the cdrecord policy module
      Changes to the certmaster policy module and various role attribute fixes
      cdrecord needs to read and write callers unix domain stream socket not
         create it
      Changes to the certmonger policy module and its dependencies
      Initial cachefilesd policy module
      Changes to the certwatch policy module
      Changes to the chronyd policy module
      Changes to the cipe policy module
      Changes to the clamav policy module
      Various network clean up
      Add dev_rw_cachefiles() to cachefilesd policy module
      Changes to the clockspeed policy module
      Changes to the clogd policy module
      Changes to the cmirrord policy module
      Changes to the cobbler policy module
      Changes to the colord policy module
      Changes to the comsat policy module
      Initial collectd policy module
      Initial condor policy module and relevant dependencies
      Changes to the consolekit policy module and relevant dependencies
      Changes to the corosync policy module and relevant dependencies
      Clean up couchdb network rules
      Changes to the courier policy module
      Changes to the cpucontrol policy module
      Changes to the cpufreqselector policy module
      Changes to the cron policy module and relevant dependencies
      Changes to the cups policy module and relevant dependencies
      Changes to the cvs policy module
      Remove redundant connect avperms
      Changes to the cyphesis policy module
      Remove redundant rules from apache_admin()
      Changes to the cyrus policy module
      Changes to the daemontools policy module
      Changes to the dante policy module
      Modify dbadm boolean descriptions
      Changes to the dbus policy module and its dependencies
      Changes to the dcc policy module
      Changes to the ddclient policy module
      Changes to the ddcprobe policy module
      Changes to the denyhosts policy module
      Changes to the devicekit policy module and relevant dependencies
      Changes to the dhcpd policy module
      Changes tothe dictd policy module
      Changes to the discc policy module
      Changes to the djbdns policy module
      Changes to the dkim policy module
      Changes to the dmidecode policy module
      Module bump for Laurent Bigonville trousers init script file context
         specification fix
      Module bump for Laurent Bigonville libvirt init script file context
         specification fix
      Changes to the dnsmasq policy module and relevant dependencies
      Changes to the dovecot policy module
      Changes to the dpkg policy module
      Changes to the entropyd policy module
      Changes to the evolution policy module
      Changes to the exim policy module and relevant dependencies
      Changes to the cron policy module
      Changes to the fail2ban policy module
      fcoemon XML clean up
      Changes to the fetchmail policy module
      Changes to the fingerd policy module
      Initial firewalld policy module
      Changes to the firstboot policy module
      Changes to the fprint policy module and relevant dependencies
      Changes to the ftp module
      Changes to the games policy module
      Clean up evolution and cdrecord XML
      Changes to the gatekeeper policy module
      Changes to the gift policy module
      Changes to the git policy module
      Changes to the gitosis policy module
      Changes to the glance policy module
      Initial glusterfs policy module
      Add gatekeeper newline
      Deprecate glusterd_admin() use glusterfs_admin() instead
      Portage module version bump for autofs support by Matthew Thode and
         clean up
      cfengine: This location is now labeled with a cfengine private type
      Changes to the slpd policy module
      Changes to the gnomeclock policy module and relevant dependencies
      Changes to the gpg policy module
      Changes to the gpm policy module
      Changes to the gpsd policy module and relevant dependencies
      changes to the guest policy module
      Changes to the gnomeclock policy module
      Deprecate various DBUS interfaces and relevant dependencies
      Changes to the cachefilesd policy module
      Remove file context specification for kgpg which is a GUI frontend to
         GPG. Domain transition to gpg_t will happen when kgpg runs gpg.
         (rhbz#862229)
      Initial mandb policy module
      Changes to the hadoop policy module
      Changes to the hald policy module
      Changes to the hddtemp policy module
      Changes to the howl policy module
      changes to the mandb policy module
      Changes to the dbus policy module
      Changes to the rpm policy module
      Changes to the i18n_input policy module
      Changes to the icecast policy module
      Changes to the ifplugd policy module
      Changes to the imaze policy module
      Changes to the inetd policy module and relevant dependencies
      Changes to the innd policy module
      Changes to the irc policy module
      Changes to the ircd policy module
      Changes to the irc policy module
      Changes to the dbus policy module
      Changes to the avahi policy module
      Changes to the bluetooth policy module
      Changes to the aiccu policy module
      Changes to the bacula policy module
      Changes to the boinc policy module
      Changes to the bugzilla policy module
      Changes to the ccs policy module
      Changes to the clamav policy module
      Changes to the cobbler policy module
      Changes to the cyphesis policy module
      Changes to the dante policy module
      Changes to the dbskk policy module
      Changes to the ddclient policy module
      Changes to the denyhosts policy module
      Changes to the dnssectrigger policy module
      Changes to the dovecot policy module
      Changes to the drbd policy module
      Changes to the evolution policy module
      Changes to the fail2ban policy module
      Changes to the firewalld policy module
      Changes to the firstboot policy module
      Changes to the games policy module
      Changes to the gift policy module
      Changes to the glance policy module
      Changes to the hald policy module
      Changes to the dbus policy module
      Changes to the git policy module
      Changes to the polipo policy module
      Changes to the firewalld policy module
      Changes to the gpg policy module
      Tab clean up in ircbalance file context file
      Changes to the irqbalance policy module
      Tab clean up in iscsi file context file
      Changes to the iscsi policy module
      Tab clean up in jabber file context file
      Changes to the jabberd policy module
      Changes to the pyicqt policy module
      Tab clean up in java file context file
      Changes to the java policy module
      Changes to the dbus policy module
      Changes to the gnome policy module
      Changes to the apache policy module
      Changes to the accountsd policy module
      Changes to the alsa policy module
      Changes to the evolution policy module
      Changes to the bluetooth policy module
      Changes to the games policy module
      Changes to the gift policy module
      Changes to the gpg policy module
      Changes to the hadoop policy module
      Tab clean up in kdump file context file
      Changes to the kdump policy module
      Changes to the gpg policy module
      Changes to the dbus policy module
      Changes to the evolution policy module
      Changes to the gpm policy module
      Version bump for evolution file context fixes by Laurent Bigonville
      Version bump for nut file context fixes by Laurent Bigonville
      Changes to the kdumpgui policy module
      Tab clean up in kerberos file context file
      Changes to the kerberos policy module and relevant dependencies
      Changes to the kerneloops policy module
      Tab clean up in kerberos file context file
      Changes to the kismet policy module
      Clean up amavis XML header
      Initial keyboardd policy module
      Tab clean up in ksmtuned file context file
      Changes to the ksmtuned policy module
      Tab clean up in ktalk file context file
      Changes to the ktalk policy module
      Changes to the kudzu policy module
      Initial iodine policy module
      Initial dirmngr policy module
      Changes to the iodine policy module
      Changes to the kerberos policy module
      Changes to the kdumpgui policy module
      Update deprecated interface calls ( gnome_read_config ->
         gnome_read_generic_home_content )
      Changes to the mozilla policy module
      Changes to the thunderbird policy module
      Changes to the l2tp policy module
      Tab clean up in ldap file context file
      Changes to the ldap policy module
      Tab clean up in likewise file context file
      Changes to the likewise policy module
      Tab clean up in lircd file context file
      Changes to the lircd policy module
      Changes to the livecd policy module
      Tab clean up in loadkeys file context file
      Changes to the loadkeys policy module and relevant dependencies
      Tab clean up in lockdev file context file
      Changes to the lockdev policy module
      Tab clean up in logrotate file context file
      Changes to the logrotate policy module and relevant dependencies
      Tab clean up in logwatch file context file
      Changes to the logrotate policy module
      Changes to the logwatch policy module
      Tab clean up in lpd file context file
      Changes to the lpd policy module
      Tab clean up in cron policy module
      Changes to the lpd policy module
      Changes to the consolekit policy module
      Tab fix in cron policy module
      Tab clean up in mailman file context file
      Changes to the mailman policy module and relevant dependencies
      Tab clean up in mcelog file context file
      Changes to the mcelog policy module
      Tab clean up in mediawiki file context file
      Mediawiki XML clean up
      Tab clean up in memcached file context file
      Changes to the memcached policy module
      Changes to the apache policy module
      Tab clean up in milter file context file
      Changes to the milter policy module and relevant dependencies
      Changes to the modemmanager policy module
      Tab clean up in mojomojo file context file
      Changes to the mojomojo policy module and relevant dependencies
      Changes to the gpg policy module
      Changes to the mongodb policy module
      Changes to the mono policy module
      Changes to the monop policy module
      Tab clean up in mozilla file context file
      Changes to the mozilla policy module and relevant dependencies
      Changes to the mozilla policy module
      Changes to the apache policy module
      Tab clean up in mpd file context file
      Changes to the mpd policy module
      Tab clean up in mplayer file context file
      Changes to the evolution policy module
      Changes to the mplayer policy module
      Changes to the irc policy module
      Tab clean up in mrtg file context file
      Changes to the mrtg policy module
      Tab clean up in mta file context file
      Changes to the mta policy module and relevant dependencies
      Changes to the mta policy module and relevant dependencies
      Get rid of mozilla_conf_t as it is unused
      Changes to the logrotate policy module
      Changes to the logwatch policy module
      Changes to the java policy module
      Changes to the apache module and relevant dependencies
      Tab clean up in munin file context file
      Changes to the munin policy module and relevant dependencies
      Tab clean up in mysql file context file
      Changes to mysqld policy module
      Changes to various policy modules
      Changes to the munin policy module
      Changes to the dovecot policy module
      Changes to various policy modules
      Changes to the mta policy module
      Changes to the certmonger policy module and relavant dependencies
      Tab clean up in nagios file context file
      Changes to the nagios policy module and relevant dependencies
      Changes to the modutils policy module
      Tab cleanup in the nessus file context file
      Changes to the nessus policy module
      Tab clean up in the network manager file context file
      Changes to the networkmanager policy module and relevant dependencies
      Changes to the mozilla policy module
      Changes to the cobbler policy module
      Initial rngd policy module
      Tab clean up in the nis file context file
      Changes to the nis policy module
      Tab clean up in the nscd file context file
      Changes to the nscd policy module
      Tab clean up in the nsd file context file
      Changes to the nsd policy module
      Tab clean up in the nslcd file context file
      Changes to the nslcd policy module
      Tab clean up in the ntop file context file
      Changes to the ntop policy module
      Tab clean up in the ntp file context file
      Changes to the ntp policy module
      Changes to the numad policy module
      Tab clean up in the nut file context file
      Changes to the nut policy module
      Tab clean up in the nx file context file
      Changes to the nx policy module
      Changes to the oav policy module
      Initial obex policy module
      Tab clean up in the oddjob file context file
      Tab clean up in gpg policy module
      Changes to the oddjob policy module
      Changes to the mozilla policy module
      Initial pacemaker policy module
      Tab clean up in the oidentd file context file
      Changes to the oident policy module
      Tab clean up in the openca file context file
      Changes to the openca policy module
      Tab clean up in the openct file context file
      Changes to the openct policy module
      Tab clean up in the openvpn file context file
      Changes to the openvpn policy module
      Tab clean up in the pads file context file
      Changes to the pads policy module
      Tab clean up in the passenger file context file
      Changes to the passenger policy module and relevant dependencies
      Tab clean up in the pcmcia file context file
      Changes to the pcmcia policy module
      Tab clean up in the pcscd file context file
      Changes to the pcscd policy module and relevant dependencies
      Tab clean up in the pegasus file context file
      Changes to the pegasus policy module
      Tab clean up in the perdition file context file
      Changes to the perdition policy module
      Tab clean up in the pingd file context file
      Changes to the pingd policy module
      Changes to the plymouthd policy module
      Changes to the mozilla policy module
      Changes to the plymouth policy module
      Tab clean up in the podsleuth file context file
      Changes to the podsleuth policy module
      Tab clean up in the policykit file context file
      Changes to the policykit policy module and relevant dependencies
      Tab clean up in the portage file context file
      Changes to the portage policy module
      Tab clean up in the portmap file context file
      Changes to the portmap policy module
      Tab clean up in the portreserve file context file
      Changes to the portreserve policy module
      Tab clean up in the portslave file context file
      Changes to the portslave policy module and relevant dependencies
      Tab clean up in the postfix file context file
      Changes to the postfix policy module and relevant dependencies
      Fixes to various policy modules
      Tab clean up in the postfixpolicyd file context file
      Changes to the postfixpolicyd policy module
      Tab clean up in the postgrey file context file
      Changes to the postgrey policy module
      Tab clean up in the ppp file context file
      Changes to the ppp policy module and relevant dependencies
      Tab clean up in the prelink file context file
      Changes to the prelink policy module and relevant dependencies
      Tab clean up in the prelude file context file
      Changes to the prelude policy module
      Tab clean up in the privoxy file context file
      Changes to the privoxy policy module
      Tab clean up in the procmail file context file
      Changes to the procmail policy module
      Tab clean up in the psad file context file
      Changes to the psad policy module
      Changes to the ptchown policy module
      Tab clean up in the publicfile file context file
      Changes to the publicfile policy module
      Fix a fatal syntax error in mozilla_plugin_role()
      Changes to the plymouth policy module
      Changes to the policykit policy module
      Module version bump for fixes in shorewall, fail2ban and portage policy
          modules by Sven Vermeulen
      Tab clean up in the puppet file context file
      Changes to ther puppet policy module and relevant dependencies
      Initial pwauth policy module
      Tab clean up in the pxe file context file
      Changes to the pxe policy module
      Tab clean up in the pyzor file context file
      Changes to the pyzor policy module
      Tab clean up in the qemu file context file
      Changes to the qemu policy module
      Tab clean up in the virt file context file
      Changes to the virt policy module and relevant depedencies
      Changes to the virt policy module
      Changes to the cron policy module
      Changes to the qemu policy module
      Changes to the virt policy module
      Epylog wants sys_nice and setsched
      Tab clean up in the qmail file context file
      Changes to the qmail policy module
      Tab clean up in the qpid file context file
      Changes to the qpid policy module
      Tab clean up in the quota file context file
      Changes to the quota policy module and relevant dependencies
      Initial rabbitmq policy module
      Tab clean up in the radius file context file
      Changes to the radius policy module
      Tab clean up in the radvd file context file
      Changes to the radvd policy module
      Changes to the raid policy module
      Tab clean up in the razor file context file
      Changes to the razor policy module and relevant dependencies
      Smokeping cgi needs to run ping with a domain transition     Remove
         redundant socket create already provided by
         sysnet_dns_name_resolve()
      Changes to the virt policy module
      Changes to the apache policy module
      Changes to the gnome policy module
      Changes to the rdisc policy mpdule
      Changes to the readahead policy module
      Changes to the remotelogin policy module
      Tab clean up in the resmgr file context file
      Changes to the resmgr policy module
      Tab clean up in the rgmanager file context file
      Changes to the rgmanager policy module
      Initial Realmd policy module and relevant dependencies
      Fix resmgrd init script file context specification
      Changes to the cups policy module
      automount reads overcommit_memory
      Changes to the networkmanager policy module
      Freshclam manages amavis spool content
      Changes to the tftp policy module
      Changes to the cobbler policy module
      Tab clean up in the rhcs file context file
      Changes to the rhcs policy module and relevant dependencies
      Tab clean up in the rhgb file context file
      Changes to the rhgb policy module
      Tab clean up in the rhsmcertd file context file
      Changes to the rhsmcertd policy module
      Tab clean up in the ricci file context file
      Changes to the ricci policy module
      Tab clean up in the rlogin file context file
      Changes to the rlogin policy module
      Tab clean up in the roundup file context file
      Changes to the roundup policy module
      Changes to the remotelogin policy module
      Changes to the apache policy module
      Changes to the awstats policy module
      fix puppet_admin() need to require types that it uses
      Replace wrong type in puppet_admin()
      Fix a syntax error in ricci_domtrans()
      Catch all rpcbind content in /var/run
      Changes to the cups policy module
      Tab clean up in the rpc file context file
      Changes to the rpc policy module
      Tab clean up in the rpcbind file context file
      Changes to the rpcbind policy module
      Tab clean up in the rpm file context file
      Changes to the rpm policy module and depedencies
      Changes to the rshd policy module
      Changes to the virt policy module
      Changes to the rssh policy module
      Tab clean up in the rsync file context file
      Fix a typo in apache XML
      Changes to the rsync policy module
      Changes to the rtkit policy module
      Tab clean up in the rwho file context file
      Changes to the rwho policy module
      Reads /proc/sys/kernel/random/poolsize
      Tab clean up in the samba file context file
      Changes to the samba policy module and relevant dependencies
      Tab clean up in the sambagui file context file
      Changes to the sambagui policy module
      Initial firewallgui policy module
      Tab clean up in the samhain file context file
      Changes to the samhain policy module
      Tab clean up in the sanlock file context file
      Changes to the sanlock policy module and relevant dependencies
      Tab clean up in the sasl file context file
      Changes to the sasl policy module
      Chnages to the sblim policy module
      Tab clean up in the screen file context file
      Changes to the screen policy module
      Tab clean up in the sectoolm file context file
      Changes to firewallgui policy module
      Changes to the sectoolm policy module
      Tab clean up in the sendmail file context file
      Changes to the sendmail policy module and relevant dependencies
      Tab clean up in the setroubleshoot file context file
      Changes to the setroubleshoot policy module
      Tab clean up in the shorewall file context file
      Changes to the shorewall policy module
      Tab clean up in the shutdown file context file
      Changes to the shutdown policy module and relevant dependencies
      Tab clean up in the slocate file context file
      Changes to the slocate policy module and relevant dependencies
      These domains transition to shutdown domain now so they no longer need
         direct access
      Re-add missing network rule in screen policy module
      fail2ban server sets scheduler
      shutdown XML clean up
      libvirtd sets kernel scheduler
      mongod reads cpuinfo_max_freq
      Changes to the slrnpull policy module
      Tab clean up in the smartmon file context file
      Changes to the smartmon policy module
      Tab clean up in the smokeping file context file
      Changes to the smokeping policy module
      Tab clean up in the smoltclient file context file
      Changes to the smoltclient policy module
      Tab clean up in the snmp file context file
      Changes to the snmp policy module
      Tab clean up in the snort file context file
      Changes to the snort policy module
      Changes to the sosreport policy module and relevant dependencies
      Tab clean up in the soundserver file context file
      Changes to the soundserver policy module
      Tab clean up in the spamassassin file context file
      Changes to the spamassassin policy module and relevant dependendies
      spamassassin_role callers create ~/.spamd with the spamd_home_t user
         home type instead
      Re-add sys_admin capability that was lost with porting from Fedora
      Move mailscanner content to mailscanner module
      Changes to the speedtouch policy module
      Tab clean up in the squid file context file
      Changes to the squid policy module
      Changes to the sssd policy module
      Tab clean up in the stunnel file context file
      Changes to the stunnel policy module
      Tab clean up in the sxid file context file
      Changes to the sxid policy module
      Tab clean up in the sysstat file context file
      Changes to the sysstat policy module
      Tab clean up in the tcpd file context file
      Changes to the tcpd policy module
      Changes to the tcsd policy module
      Tab clean up in the telepathy file context file
      Changes to the telepathy policy module
      Tab clean up in the telnet file context file
      Changes to the telnet policy module
      Tab clean up in the tftp file context file
      Changes to the tftp policy module
      Tab clean up in the tgtd file context file
      Changes to the tgtd policy module
      Tab clean up in the thunderbird file context file
      Changes to the thunderbird policy module
      Catch /var/log/cron directory as well
      Dovecot module version bump for fixes by Sven Vermeulen
      Portage module version bump for fixes by Sven Vermeulen
      Cron module version bump for fixes by Sven Vermeulen
      Changes to the exim policy module
      Entropyd reads /proc/meminfo
      Blueman reads tmp_t directories
      Do not audit attempts by cups config to read tmp_t directories
      Do not audit attempts by fail2ban to read tmp_t directories
      Do not audit attempts by firewalld to read tmp_t directories
      Gnomeclock reads urandom and realtime clock
      Kdumpctl needs sys_chroot capability
      Various kdumpgui fixes from Fedora
      Do not audit attempts by logwatch to read tmp_t directories
      Catch all alias files
      Refine aliases file transition with names
      Realmd dbus chat policykit and networkmanager from Fedora
      Do not audit attempts by tuned to read tmp_t directories
      Changes to the timidity policy module
      Tab clean up in the tmpreaper file context file
      Changes to the tmpreaper policy module and relevant dependencies
      Tab clean up in the tor file context file
      Changes to the tor policy module
      Changes to the transproxy policy module
      Tab clean up in the tripwire file context file
      Changes to the tripwire policy module
      Tab clean up in the tuned file context file
      Changes to the tuned policy module
      Tab clean up in the tvtime file context file
      Changes to the tvtime policy module
      Changes to the tzdata policy module
      Changes to the ucspitcp policy module
      Tab clean up in the ulogd file context file
      Changes to the ulogd policy module
      Tab clean up in the uml file context file
      Changes to the uml policy module
      Make it so that irc clients can also get attributes of cifs, nfs, fuse
         and other file systems
      Changes to the updfstab policy module
      Changes to the uptime policy module
      Tab clean up in the usbmodules file context file
      Changes to the usbmodule policy module
      Changes to the usbmuxd policy module
      Tab clean up in the userhelper file context file
      Screen sends child terminated signals to all interactive fd domains
      Changes to the userhelper policy module and relevant dependencies
      Changes to the virt policy module
      Module version bump for fail2ban changes by Sven Vermeulen
      Changes to the rpm policy module
      fix smartmon init script file context specification
      Changes to the usernetctl policy module
      Tab clean up in the uucp file context file
      Changes to the uucp policy module
      Changes to the virt policy module
      Tab clean up in the uuid file context file
      Changes to the uuidd policy module
      Tab clean up in the uwimap file context file
      Changes to the uwimap policy module
      Tab clean up in the varnishd file context file
      Changes to the varnishd policy module
      Changes to the vbetool policy module
      Tab clean up in the vdagent file context file
      Changes to the vdagent policy module
      Tab clean up in the vhostmd file context file
      Changes to the vhostmd policy module
      Changes to the vlock policy module
      Tab clean up in the vmware file context file
      Changes to the vmware policy module
      Tab clean up in the vnstatd file context file
      Changes to the vnstatd policy module
      Tab clean up in the vpn file context file
      Changes to the vpnc policy module
      Tab clean up in the w3c file context file
      Changes to the w3c policy module
      Tab clean up in the watchdog file context file
      Changes to the watchdog policy module
      Changes to the wdmd policy module
      Changes to the webadm policy modules
      Changes to the webalizer policy module
      White space fix in apache policy module
      Changes to the wine policy module
      Tab clean up in the wireshark file context file
      Changes to the wireshark policy module
      Tab clean up in the wm file context file
      Changes to the wm policy module
      Changes to the inn policy module
      Move man cache file type to miscfiles
      Changes to the inn policy module
      More accurate dbadm boolean descriptions
      mysql_admin() has access to ~/.my.cnf files
      Tab clean up in the xen file context file
      Changes to the xen policy module and relevant dependencies
      Tab clean up in the xfs file context file
      Changes to the xfs policy module
      Changes to the xguest policy module and relevant dependencies
      Changes to the xprint policy module
      Changes to the xscreensaver policy module
      Tab clean up in the yam file context file
      Changes to the yam policy module
      Tab clean up in the zabbix file context file
      Changes to the zabbix policy module
      Tab clean up in the zarafa file context file
      Changes to the zarafa policy module
      Tab clean up in the zebra file context file
      Changes to the zebra policy module
      Changes to the zosremote policy module
      Changes to the mysql policy module
      Tab clean up in the pulseaudio file context file
      Changes to the pulseaudio policy module and relevant dependencies
      Changes to the pulseaudio policy module
      One chown too many
      Changes to the mplayer policy module
      The prelink cron script now runs in its own domain
      Initial smstools policy module
      Initial openvswitch policy module and relevant dependencies
      Reads pcsd pid files
      Reads random device
      winbind manages smbd pid sock files from Fedora
      Changes to the bind policy module
      CG rules daemon reads all sysctls
      Runs consoletype and searches nfs state data from Fedora
      Support munin unbound plugin from Fedora
      Zabbix sends signals from Fedora
      Blueman sets scheduler and sends signals from Fedora
      pcscd_read_pub_files is deprecated, use pcscd_read_pid_files instead
      Module version bumps for fixes in portage and virt modules by Sven
         Vermeulen
      Policy module version bumps for various changes by Sven Vermeulen
      Changes to the openvpn policy module
      Module version bumps for various fixes by Sven Vermeulen
      Changes to the mandb policy module
      Changes to the tmpreaper policy module
      Changes to the munin policy module
      Changes to the rngd policy module
      Changes to the awstats policy module and relevant dependencies
      Changes to the apache policy module
      Changes to various policy modules
      Changes to the abrt policy module
      Changes to the passenger policy module and relevant depedencies
      Changes to the pegagus policy module
      Changes to the mta policy module
      Changes to the fetchmail policy module
      Changes to the bitlbee policy module
      Changes to the blueman policy module and relevant dependencies
      Changes to the amavis policy module
      Changes to the userhelper policy module
      Changes to the blueman policy module
      Changes to the squid policy module
      Changes to the sblim policy module
      Changes to the kdumpgui policy module
      Changes to the mailman policy module
      Changes to the realmd policy module
      Changes to the raid policy module
      Changes to the samba policy module
      Changes to the various policy modules
      Changes to the snmp policy module
      Changes to the spamassassin policy module
      Changes to the sssd policy module
      Changes to the l2tpd policy module
      Changes to the shorewall policy module
      Changes to the xen policy module
      Changes to the tftp policy modules
      Changes to the accountsd policy module
      Changes to the tgtd policy module
      Changes to the corosync policy module
      Changes to the kdump policy module
      Changes to the openvswitch policy module
      Changes to the mpd policy module
      Changes to the mozilla policy module
      Changes to the zarafa policy module
      Changes to the boinc policy module
      Changes to the setroubleshoot policy module
      Changes to the dspam policy module
      Changes to the rgrmanager policy module and relevant dependencies
      Changes to the svnserve policy module
      Changes to the virt policy module
      Changes to the prelink policy module
      Changes to the apache policy module
      Changes to the gnomeclock policy module
      Changes to various policy modules
      Changes to the pegagus policy module
      Changes to the shorewall policy module
      Changes to the kerberos policy module
      Changes to the rhcs policy module
      Changes to the irc policy module
      Changes to the clamav policy module
      Changes to the mrtg policy module
      Changes to the munin policy module
      Changes to the amavis policy module
      Changes to the ppp policy module
      Initial jockey policy module
      Module version bumps for "several named transition for directories
         created in /var/run by initscripts" in various modules by Laurent
         Bigonville
      Module version bumps for fixes in various modules by Laurent Bigonville
      Module version bump for changes to the consolekit policy module by
         Laurent Bigonville
      Changes to the stunnel policy module
      Module version bumps for fixes in various modules by Sven Vermeulen
      Changes to the virt policy module
      Changes to the apache policy module
      Changes to the wm policy module
      Changes to the samba policy module
      Changes to the certmonger policy module
      Changes to the mozilla policy module
      Changes to the corosync policy module
      Changes to the pacemaker policy module
      Changes to the tuned policy module
      Changes to the cups module and relevant dependencies
      Changes to the rhsmcertd policy module
      Changes to the lpd policy module
      Changes to the munin policy module
      Changes to the ntp policy module
      Changes to the tor policy module
      Changes to the firewalld policy module
      Changes to the dspam policy module
      Changes to the setroubleshoot policy module
      Changes to the condor policy module
      Changes to the kerberos policy module
      Changes to the passenger policy module
      Changes to the ppp policy module
      Changes to the the dkim policy module
      Changes to the abrt policy module
      Changes to the lircd policy module
      Changes to the dkim policy module
      Changes to the virt policy module
      Changes to the munin policy module
      Changes to the dovecot policy module
      Changes to the cobbler policy module
      Changes to the userhelper policy module
      Changes to the logwatch policy module
      Changes to the wdmd policy module and relevant dependencies
      Changes to the nscd policy module and relevant dependencies
      Changes to the dbus policy module
      Module version bumps for fixes in various policy modules by Laurent
         Bigonville
      Changes to the cups policy module
      Changes to the dbus policy module
      Changes to the apcupsd policy module
      Remove redundant net_bind_service capabilities in various modules
      Changes to the virt policy module
      Changes to the puppet policy module
      Module version bumps for fixes in various policy module by Sven
         Vermeulen
      Module version bumps for file context fixes in various policy modules by
           Laurent Bigonville
      Make httpd_manage_all_user_content() do what it advertises
      Add more networking rules to mplayer policy module for compatibility
      Fix fcronsighup file context. Should be crontab_exec_t as per previous
         spec
      Module version bumps for changes in various modules by Sven Vermeulen
      Move asterisk_exec() and modify XML header
      Consolekit creates /var/run/console directories with a type transition
         unconditionally
      Module version bump in consolekit policy module for changes by Sven
         Vermeulen
      The imaplogin executable file should be courier_pop_exec_t according to
          existing file context specification
      Module version bump for changes to the fail2ban policy module by Sven
         Vermeulen
      Modules version bumps for changes in various policy modules by Sven
         Vermeulen

Laurent Bigonville (28):
      Add Debian locations for Telepathy connection managers
      Label telepathy-rakia as telepathy-sofiasip
      Allow smartd daemon to write in /var/lib/smartmontools directory
      Add Debian location for smartd daemon initscript
      Add Debian location for accounts-daemon daemon
      Add Debian location for rtkit-daemon daemon
      Add Debian location for tcsd init script
      Add Debian location for libvirtd init script
      Add Debian location for evolution executables
      Add Debian locationis for nut executables and configuration files
      Add several named transition for directories created in /var/run by
         initscripts
      Run packagekit under apt_t context on Debian distribution
      Add proper label for colord daemon in debian
      Allow the system dbus to search cgroup directories
      Allow virtd_t context to read sysctl_crypto_t
      Allow colord_t context to read sysctl_crypto_t
      Add proper label for gconfd-2 daemon in Debian
      Ensure that consolekit can create /var/run/console directory on Debian
      Properly label nm-dispatcher.action on Debian
      policykit.fc: Properly label polkit-agent-helper-1 on Debian
      cups.fc: Properly label cups-pk-helper-mechanism on Debian
      Allow pcscd the fsetid capability
      Allow networkmanager_t to read crypto_sysctl_t
      Allow virsh_t context to read sysctl_crypto_t
      Allow cupsd_t to read cupsd_log_t
      gnomeclock.fc: Properly label gsd-datetime-mechanism in Debian
      ptchown.fc: Properly label pt_chown executable in Debian
      Label /usr/bin/kvm as qemu_exec_t

Matthew Thode (2):
      added autofs support and nsswitch support
      removing refrences to named_var_lib_t as it doesn't exist anymore for
         bind.if

Mika Pflüger (3):
      Allow saslauthd_t to talk to mysqld via TCP
      Quota policy adjustments: * Allow quota_t to load kernel modules
      Debian locations for dovecot deliver and dovecot auth.

Russell Coker (1):
      Fix djbdns ports

Sven Vermeulen (75):
      Update with new substitutions
      Mark the pid directory as a pid directory
      Add in transitions for queue types when the queues are created
      Fix typo in interface postfix_exec_postqueue
      Allow maildelivery to use dotlock files in the mail spool
      Allow postfix local to change ownership of mailfiles
      Use libexec location for postfix binaries
      Allow initrc_t to create run dirs for contrib modules
      Update logwatch location in file context
      Sandbox is an inherent part of the portage inner workings
      Fix startup issue with fail2ban-client
      Be able to get output from fail2ban-client
      Ignore searches when ran from the user home directory
      Shorewall admins execute shorewall too
      Shorewall needs sys_admin capability for manipulating network stack
      Be able to display dovecot errors
      Remove transition to ldconfig
      Adding interfaces for handling cron log files
      Fail2ban client checks state of log files before telling the server
      Support mysql init script
      Support initial creation of mysql database files
      Portage fetch domain needs to access certificates
      Make samba domtrans optional in virt
      Fix typo in tunable declaration for fcron_crond
      Introducing cron_manage_log_files interface
      Introduce dontaudit interfaces for leaked fd and unix stream sockets
      Dontaudit attempts by system_mail_t to use leaked fd or stream sockets
      Support at service
      Additional postfix admin requirements
      Reintroduce postfix_var_run_t for pid directory and fowner capability
      Postfix deferred queue should not mark mails as postfix_spool_maildrop_t
      Running qemu with SDL support requires more xserver-related privileges
      Fix typo in clockspeed comment
      Support openvpn status file
      Asterisk voicemail messages are generated from tmp
      Make rtkit calls optional
      Gentoo installs dovecot certs in /etc/ssl/dovecot
      Moving sandbox code to sandbox section (v2)
      Allow sandbox to log violations
      Use rw_fifo_file_perms
      Apache should not depend on gpg
      Named init script creates rundir
      Add ~/.maildir as a valid maildir destination
      Support stunnel_read_config for startup
      Updates on stunnel policy
      More .maildir fixes
      Mark make.profile entry as portage_conf_t (v2)
      Move mta call (coding style)
      Changes to puppet domain
      Allow rpc admin to run exportfs
      Grant sys_admin capability to puppet
      Puppet module helper scripts are puppet_var_lib_t
      Support netlink_route_socket creation for puppet
      Puppet initscript creates /run/puppet
      Puppet runs statfs against selinuxfs
      mplayer streams HTTP resources
      fcron and fcronsighup binaries are moved
      Asterisk needs to search through logs
      Denial in mail log on node bind
      Fix typo in mcelog_admin (missing bracket)
      Add in contexts for fcron rm.systab and systab.tmp
      Remove pulseaudio filename_trans conflict
      Allow asterisk admins to execute asterisk binary directly
      Support tagfiles for consolekit
      ConsoleKit needs to read the dbus machine-id
      File context updates for courier-imap
      Update on file contexts for OpenLDAP
      Update on file contexts for wpa_supplicant
      Allow IRC clients to read certificates
      Allow reading /proc/self for fail2ban due to FAM support
      Update file contexts for puppet
      Support ~/.tmux.conf as tmux configuration file
      Add setuid/setgid capability to ulogd_t
      Support tmux control socket
      Postfix creates defer(red) queue locations