<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="f2827ff98f5b828c89bf7e3dd4bdcaa222c90b3ef69249225d29892018841dd5eb0554fc6bed1bf531441c5a9d9d68d0cec4287f2399f267160281b0b650373c" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
<package pkgid="93147ca9e8f30daa7a117a7fa3237a78762f32a133776a0b55072a0d7828f6ad5bf4735e068967970bcbe37e7d054f716a00a86591f99bf181cb54e79ba2ee19" name="selinux-policy" arch="src">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
<package pkgid="bd21658cc29398906b077bbc91639d633728fd258ddf097e772115fbebd4135bb7d3bd19ab2fbe0c2084f282130b4e63490204add5ab333a11b993cb4edc599c" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
<package pkgid="35ea0488d4fa664e238bbe9aea1b915af4374ac4419fbf52cb686238373c967122dda4081ca0641bbee4b38c01a342c397638e54300a6857f4ed5f9581226093" name="selinux-policy-doc" arch="noarch">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
<package pkgid="b014a9979b16c0b9dd5a0ff60a06ae59ec5b8af162e9772960f96f937f0199edbb99be3ba63c48a08952e0462f1af1679af66400d38e86d9f6a6c7233ed87f81" name="selinux-policy-minimum" arch="noarch">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
<package pkgid="481d134df49a611d1fa1b01290f18c6ff7f24373448d19d8f4290056e0f90352163071e13b483410973a4e8822bc975cb2f0e58dbd820e79e5eeb250a895ed53" name="selinux-policy-sandbox" arch="noarch">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
<package pkgid="2aa82f2103fd3c07b2c974b06878d239404060d735c8866eef51a593031a3ab2a2c7d8e838b982f123861bc94537cb2b89e9f22d877e93d60b293d73ea075cca" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20260623" rel="lp160.6.3"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1771934400">- Split out post install relabel logic into postInstallRelabel marco
  to be reused for the minimum policy (bsc#1258722)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1772452800">- Update to version 20260302:
  * Allow systemd-coredump the kill capability in the user namespace
  * Allow NetworkManager list bpf directories
  * Allow virtnodedevd the dac_read_search capability
  * Allow pkcsslotd read files in /proc and /sys
  * Allow pkcsslotd map its private tmpfs files
  * Allow dovecoth-auth to connect to systemd-logind over a unix socket
  * Allow tlshd write generic certificate dirs
  * Allow mdadm to use CAP_BPF during RAID monitoring
  * Allow rhsmcertd read anaconda run files
  * Allow rpc.mountd setuid and setgid capabilities
  * Use kernel_dgram_send() for systemd_notify_t
  * Allow lttng-sessiond to use sd_notify
  * Label /etc/aliases.cdb with etc_aliases_t
  * Add aliases.lmdb to mta_filetrans_named_content()
  * Update gpg_role() interface with unix_stream_socket permissions
  * Allow systemd-hostnamed to create its Varlink socket
  * Allow thumbnailer mount on fonts cache directories
  * Support confined users usage of bubblewrap
  * Allow vdagent get attributes of the pidfs filesystem
  * Allow sshd-session inherit limits from its parent sshd process
  * Revert "Allow sshd-session inherit limits from its parent process"
  * Allow sshd-session read network sysctls
  * Add the fs_write_tmpfs_files() interface
  * Update gpg policy for interactions with rhc-playbook-verifier
  * Allow rhc_playbook_verifier_t stream connect to itself
  * Update policy for rhc-worker-playbook
  * Allow sudodomain connect to gkeyringd over a unix stream socket
  * Allow tlshd communication to unconfined_t over a tcp socket
  * Allow tlshd write generic certificates
  * Allow thumbnailer connect to abrt over a unix stream socket
- Syncing with upstream rawhide selinux-policy up to:
  * 1f374c68142f647ade9fd043592ce4766803ce46
- Update embedded container-selinux version to commit:
  * 521cf8c56e8df7cd6809571ed9e796b495ceaa71 (v2.246.0)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1772539200">- Have the selinux-policy package own %{_sharedstatedir}/selinux
  until the move to /etc</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1772539201">- Update to version 20260303:
  * Enable init_server_no_new_privs during build (bsc#1253047)
  * Add init_server_no_new_privs where no domtrans pattern was used (bsc#1253047)
  * Allow nnp_transition in domtrans pattern (bsc#1253047)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1773144000">- Update to version 20260310:
  * Allow wtmpdbd to read pidfs (bsc#1259444)
  * Allow systemd-mountfsd the perfmon capability
  * Allow lttng tracing in default configuration
  * Allow rtkit-daemon write systemd inhibit pipes
  * Apply the systemd system generator template to the kdump-dep generator
  * Apply the systemd system generator template to the anaconda generator
  * Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
  * TLP uses ps aux to check for different services (bsc#1257527)
  * Introduce separate types for generic systemd generators.
  * Confine system generator nm-initrd-generator.sh (bsc#1257754)
  * Allow rtkit-daemon dbus chat with systemd-logind
  * ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350)
  * Dontaudit tlshd write generic certificate dirs
- Syncing with upstream rawhide selinux-policy up to:
  * 8507a66c816a382439d4933cfff14c8ee8a83d1e</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1773230400">- Update to version 20260311:
  * Allow redis_t to create netlink_rdma_socket
  * Allow systemd create symlinks in /run/varlink/registry
  * Support hooks in /run/systemd/resolve.hook
  * Allow virtlogd_t dac_override for virtlock (bsc#1253389)
  * Allow mdadm use modprobe (bsc#1257793)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1775822400">- Update to version 20260410:
  * Add missing Nextcloud file contexts (bsc#1261535)
  * openSUSE uses /var/lib/php8 (bsc#1239177)
  * /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
  * Allow cloud init to domtrans into ssh keygen (bsc#1249964)
  * Allow accountsd dbus chat with systemd-homed
  * Allow accountsd read accountsd_share_t files
  * Fix file context specification for /usr/share/accountsservice
  * Allow xdm_exec_t be an entrypoint of login_userdomain
  * Allow sshd-session send a generic signal to sshd-auth
  * Allow virtnetworkd get attributes of filesystems with extended attributes
  * Allow Polkit to get attributes of user terminals
  * Allow nfsidmap connect to xdm over a unix stream socket
  * Label /usr/share/accountsservice with accountsd_share_t
  * Allow systemd-resolved write to systemd-networkd socket
  * Dontaudit setroubleshootd read root's home files like .rpmmacros
  * Support sandboxing features for sysadm_t
  * Allow unconfined_t mounton on itself (bsc#1261035)
  * update support for polkit agent helper (bsc#1251931)
  * Add auth_nnp_domtrans_chkpwd()
  * Allow staff_sudo_t read PID1's process state
  * Allow staff_sudo_t read logind sessions files
  * Allow nfs-server system generator the dac_read_search capability
  * Allow snmpd create and use netlink tcpdiag socket
  * Allow systemd-coredump signull containers
  * Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
  * Dontaudit logrotate perfmon and sys_admin capabilities
  * Allow samba-bgqd sendto over a unix dgram socket
  * Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
  * Move interfaces from other modules to optional block
  * Allow fedoratp_exec_t be an entrypoint of unconfined_t
  * Allow rasdaemon_t to list pstore (bsc#1259742)
  * Allow virtqemud_t send kill signal to svirt_tcg_t
  * Allow virtqemud_t get priority of a svirt_t process
  * Allow sysadm user connect to lvm over a unix stream socket
  * Allow staff user delete thump_tmp_t files
  * Allow staff user connect to systemd-logind over a unix stream socket
  * Allow staff user mount /proc
  * Allow virtqemud map vhost net device
  * Dontaudit ps to read proc (bsc#1257527)
  * Revert "Define file equivalency for /var/opt" (bsc#1259704)
  * Allow dovecot_deliver_t map its private tmp files
  * Allow rpcbind get attributes of the pidfs filesystem
  * Fix names in mysql.if
  * Allow create kerberos files in mysql db home
  * Allow systemd-resolved connect to systemd-networkd over a unix stream socket
  * Introduce local_login_allow_accountutils_fallback_mode boolean (bsc#1259119)
  * Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
- Syncing with upstream rawhide selinux-policy up to:
  * d3068ffe2a211a7e959bb1d0ad9dd434c2d7da5b
- Update embedded container-selinux version to commit:
  * f336064bb5a086cab121c02acf285a68fa4b8352 (v2.247.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1776254400">- Update to version 20260414:
  * Allow snapper_sdbootutil_plugin_t linux_immutable (bsc#1261945)
  * allow unconfined services to read VM state (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1776772800">- Change store root-path for selinux modules from /var/lib/selinux
  to /etc (fixes bsc#1221342 PED-12492)
  * Service file and script is installed to eventually delete
    /var/lib/selinux once no snapshot is using it
  * Fix copy custom modules to /etc and can be checked by the provided script
    `/usr/libexec/selinux/cleanoldsepoldir.sh --check-custom-selinux-modules`
  * Add filters for duplicate entries to rpmlintrc for now
  * Drop dir-or-file-outside-snapshot rpmlint filter</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1777291200">- start cleanoldsepoldir.service after successfull health-checker.service
  fixes occational fail on transactional systems when boot failed
  (boo#1261698)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1778241600">- Update to version 20260508:
  * Add boolean ntp_refclock_access (bsc#1262711)
  * Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
  * Allow thump_t setattr on thumb_tmp_t lnk_files
  * Allow accounts-daemon read accountsd_share_t symlinks (bsc#1262502)
  * Label /usr/bin/sudo-rs and /usr/bin/su-rs
  * Allow pwupdd to read cracklib (bsc#1259138)
  * Allow pwupdd to log to audit log (bsc#1259138)
  * Move accountutils_pwaccessd_varlink_socket_connect from auth_use_pam (bsc#1259138)
  * Allow gpsd the setcap process capability
  * Add note about the process to merge template
  * Add mgetty_allow_sendfax boolean (bsc#1258666)
  * Do not backslash-escape underscores in file context specifications
  * Label /var/log/mgetty.* getty_log_t (bsc#1258666)
  * Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359)
  * Allow sshd-auth/sshd-session get attributes of their sshd parent
  * Allow systemd-tmpfiles to adjust resource limits
  * Allow logwatch to getattr nsfs files
  * Allow xdm dbus chat with rhsmcertd
  * Allow dhcpc_hook_t unix_dgram_socket and module_request
  * Allow accountsd list accountsd_share_t dirs</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1779451200">- Update to version 20260522:
  * Fix build by switching to corecmd_exec_bin_noattr()
  * Split using dirsrv_ and dirsrvadmin_ interfaces into separate blocks
  * Allow virtqemud execute kmod in the kmod domain
  * Allow qatlib map kernel modules
  * Allow sys_resource on execution of generic executables conditionally
  * Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t
  * Label /run/coreos with coreos_installer_var_run_t
  * Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file()
  * Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273)
  * Update fstools swap interfaces with dir search
  * Allow go-fdo-server to read system information
  * Change README to openSUSE specific README
  * Add missing fc rule for org.gnome.DisplayManager (bsc#1264182)
  * config: make /etc/systemd/user same as /usr/lib/systemd/user
  * Do not audit iptables attempts to read other process state
  * Policy for go-fdo-server
  * Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot
  * Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
  * Allow NetworkManager_dispatcher_nvme_t check status of systemd services
  * Allow iptables_t read state of some processes
  * Label /dev/HID-SENSOR-.* with hid_sensor_device_t
- Syncing with upstream rawhide selinux-policy up to:
  * 190ed3591e0004c395409dd62acea41c8a684fc1
- Update embedded container-selinux version to commit:
  * e659fc8858d2e34781cc1640ac1658ba484cb3f5 (v2.248.0)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1779796800">- Update to version 20260526:
  * Dontaudit apcupsd dac_override (bsc#1261232)
  * Allow virtqemud_t to call and transition into udev</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1780660800">- Update to version 20260605:
  * Update dbus_role_template() with communication over unix dgram socket
  * Allow staff user read nsfs files
  * Allow staff user additional sandboxing permissions
  * Dontaudit sa-update perfmon and sys_admin capabilities
  * packit: Stop notifying martinpitt for Cockpit test failures
  * Allow the kernel to execute also special files
  * Bring back execmem permission for svirt_tcg_t
  * Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
  * Leave content of virtqemud_use_execmem empty
  * Dontaudit libvirt-daemons execmem
  * Allow virtstoraged to setattr fixed disk devices
  * Dontaudit ksmtuned dac_read_search and dac_override capabilities
  * Remove unused hypervkvp_unit_file_t
  * Allow mock create and use its private tmpfs files
  * Allow samba-bgqd send to nmbd over a unix datagram socket
  * Vibecode Gitlab CI smoke test for Leap 16.0+
- Syncing with upstream rawhide selinux-policy up to:
  * 443befa43872b63a5c1d7773fca159fda2abf772
- Update embedded container-selinux version to commit:
  * d3e0ce57e97c38e1403c0eb5a29b10d5d6dd82c6 (v2.249.0)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1780747200">- move %postMigration from %posttrans to %post to finish migration
  and copy user/custom modules to /etc when zypper dup is aborted
  due different package issue or semodu invocation (fixes boo#1264463)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1781784000">- Update to version 20260618:
  * Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
  * Add sysnet_mount_file() interface</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1781870400">- Fix syntax in scriptlets</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870401">- Mark all bash-using sections as requiring bash
- Delete old %defattr, it's the default now anyway
- Reduce %if BUILD_xxx to span just %files and triggers,
  that's all it needs</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1782216000">- fixed text output during package instalation (bnc#1268009)
- enhance migration marker cleanup in /etc/selinux to properly
  delete markers when removing selinux-policy-FLAVOUR package</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1782216001">- Update to version 20260623:
  * Allow snapper_sdbootutil_plugin_t create transient units (bsc#1267377)
  * Allow bootctl access unconfined_t pid (bsc#1267377)
  * Refactor sdbootutil into seperate module (bsc#1267377)
  * Allow pcrlock to send kernel dgram (bsc#1267377)
  * Add tiny sdbootutil module for sdbootutil snapper plugin changes (bsc#1267377)</changelog>
</package>
</otherdata>