# changelog

author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.139-1
changelog:
  - installclasses/rhelah: Allow LVM thin and dm-crypt (walters)
    Resolves: rhbz#1546252
  - Ask for a default passphrase if required (vponcova)
    Resolves: rhbz#1436304
  - Add support for setting different types of passwords in TUI (vponcova)
    Related: rhbz#1436304


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.140-1
changelog:
  - Preserve the boot option zfcp.allow_lun_scan (vponcova)
    Resolves: rhbz#1561662
  - Don't display "Alternate Architectures" in product name (rvykydal)
    Resolves: rhbz#1488558


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.143-1
changelog:
  - Add data loss warning to nvdimm reconfigure dialog. (rvykydal)
    Resolves: rhbz#1280500
  - Add UI feedback for disk repopulating after nvdimm reconfiguration.
    (rvykydal)
    Resolves: rhbz#1280500
  - Use only devices specified by nvdimm command for installation. (rvykydal)
    Resolves: rhbz#1280500
  - Add option to reconfigure nvdimm devices into sector mode. (rvykydal)
    Resolves: rhbz#1280500
  - Allow only devices in sector mode to be selected. (rvykydal)
    Resolves: rhbz#1280500
  - Add nvdimm devices to Advanced Storage spoke. (rvykydal)
    Resolves: rhbz#1280500
  - Add kickstart support for nvdimm reconfiguration to sector mode. (rvykydal)
    Resolves: rhbz#1280500


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.144-1
changelog:
  - Don't allow unlocking and using of LUKS2 devices (vponcova)
    Resolves: rhbz#1608251
  - Fix glade accelerator conflicts (rvykydal)
    Related: rhbz#1602436
  - Add nvdimm files to POTFILES.in (rvykydal)
    Related: rhbz#1602436
  - Support nvdimm only on x86_64 (rvykydal)
    Resolves: rhbz#1602436


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.146-1
changelog:
  - Revert "If someone really wants to eject the cdrom, then do it. (jkonecny)"
    Resolves: rhbz#1618408


author: CentOS Sources <bugs@centos.org> - 21.48.22.147-1.el7.centos
changelog:
  - Add CentOS install class as default
  - use the right path for the EULA string (issue 7165,  bstinson)
  - use efi_dir = centos
  - disable the mirrorlist options
  - make boot part fs default to xfs


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-18
changelog:
  - Start the cloud-init init local service after the dbus socket is created
    so that the hostnamectl command works.
    Resolves: rhbz#1450521


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-23
changelog:
  - Fix a bug tha caused cloud-init to fail as a result of trying
    to rename bonds.
    Resolves: rhbz#1512247


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-24
changelog:
  - Set DHCP_HOSTNAME on Azure to allow for the hostname to be
    published correctly when bouncing the network.
    Resolves: rhbz#1434109


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.7.9-24.el7_5.1
changelog:
  - ci-Revert-azure-Fix-publishing-of-hostname.patch [bz#1568717]
  - ci-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch [bz#1568717]
  - ci-sysconfig-Don-t-disable-IPV6_AUTOCONF.patch [bz#1578702]
  - Resolves: bz#1568717
    (Add patch to bounce NICs in Azure/update DNS [rhel-7.5.z])
  - Resolves: bz#1578702
    (cloud-init-0.7.9-9.el7_4.6 breaks IPv4/IPv6 dual-stack EC2 instances in AWS [rhel-7.5.z])


author: Petr Menšík <pemensik@redhat.com> - 12:4.2.5-74
changelog:
  - Use bind-export-libs package instead of bind99
  - Use isc-config.sh to configure bind libs
  - Change requirement to bind-export-devel
  - Compile with recent bind includes, that does not include isc/util.h


author: Petr Menšík <pemensik@redhat.com> - 2.76-1
changelog:
  - Rebase to 2.76 (#1375527)
  - Include also dhcp_release6 (#1375569)
  - Fix compilation warnings
  - Correct manual about interface aliases, warn if used without --bind*


author: Petr Menšík <pemensik@redhat.com> - 2.76-2
changelog:
  - Fix a few coverity warnings
  - package is dual-licensed GPL v2 or v3
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead


author: Petr Menšík <pemensik@redhat.com> - 2.76-5
changelog:
  - Fix CVE-2017-14491
  - Fix CVE-2017-14492
  - Fix CVE-2017-14493
  - Fix CVE-2017-14494
  - Fix CVE-2017-14496
  - Fix CVE-2017-14495
  - extra fixes


author: Peter Jones <pjones@redhat.com> - 2.02-0.74
changelog:
  - Fix symlink issues with grubenv
    Resolves: rhbz#1602773
    Related: rhbz#1497918
  - Make the common subpackage only build on x86_64 to avoid timestamp
    mismatches.
    Related: rhbz#1602773
    Related: rhbz#1497918


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.78
changelog:
  - Prevent errors from diskfilter scan of removable drives
    Resolves: rhbz#1446418
  - Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file
    Resolves: rhbz#1497918
  - Remove glibc32 and glibc-static(x86-32) BuildRequires
    Resolves: rhbz#1614259


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.79
changelog:
  - Ignore the modification time when doing RPM verification of /boot/efi files
    Resolves: rhbz#1496952


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails


author: Peter Jones <pjones@redhat.com> - 2.02-0.86
changelog:
  - Fix several CVEs:
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 8.28-17
changelog:
  - Fix the ordering of creating the debug entries, so they don't get picked
    when we're choosing kernel command line defaults on upgrades.
    Related: rhbz#1212128


author: rmarshall@redhat.com - 8.28-18
changelog:
  - Patched new-kernel-pkg so that kernel installations when MAKEDEBUG is
    set would put the debugging entries after the non-debugging entries.
    Resolves: #1285601
  - Re-numbered the last set of patches to go with the flow. No actual
    changes to the patches; just a git mv to rename.
  - Re-organized and updated the grubby man page contents to include some
    features that were not documented as well as correct typos and
    re-write some entries for better clarity.
    Resolves: #1232168


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Resolve issues with the recent grubby logic patches that
    appeared on the ppc platform. Fix a problem that occurred
    on systems where no kernel update had ever been installed.
    Resolves: rhbz#1285601
  - Specify the actual prune_debug file in sources.
    Resolves: rhbz#1285601


author: rmarshall@redhat.com - 8.28-23
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1285601
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1285601
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1285601


author: Peter Jones <pjones@redhat.com> - 8.28-24
changelog:
  - Ensure "grubby --default-title" takes the bootloader selection into
    account
    Resolves: rhbz#1340893


author: Peter Jones <pjones@redhat.com> - 8.28-25
changelog:
  - Ensure /etc/sysconfig/kernel has a stable mode, now that rpm handles ghost
    files differently.
    Resolves: rhbz#1584313


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.42-1
changelog:
  - rhel-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - network-functions: use tr to upper case strings rather than awk
  - sysconfig/readonly-root: Clarify the usage of readonly-root
  - network-functions: add error messages for bonding installation
  - sysctl.conf.s390: drop SHMALL and SHMMAX
  - network.service: 'reload' removed
  - rhel-readonly.service: target name for random seed fixed
  - init.d/functions: fix sourcing for ksh


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-5.el8]
changelog:
  - man: tc-ct.8: Add manual page for ct tc action (Andrea Claudi) [1844637]
  - tc: flower: Add matching on conntrack info (Andrea Claudi) [1844637]
  - tc: Introduce tc ct action (Andrea Claudi) [1844637]
  - tc: add NLA_F_NESTED flag to all actions options nested block (Andrea Claudi) [1844637]
  - Import tc_act/tc_ct.h uapi file (Andrea Claudi) [1844637]
  - ss: allow dumping kTLS info (Andrea Claudi) [1812207]
  - devlink: Add health error recovery status monitoring (Andrea Claudi) [1821039]


author: Andrea Claudi <aclaudi@redhat.com> [5.9.0-2.el8]
changelog:
  - tc: flower: fix json output with mpls lse (Andrea Claudi) [1885770]
  - tc-mpls: fix manpage example and help message string (Andrea Claudi) [1885770]
  - tc-vlan: fix help and error message strings (Andrea Claudi) [1885770]
  - m_mpls: test the 'mac_push' action after 'modify' (Andrea Claudi) [1885770]
  - m_mpls: add mac_push action (Andrea Claudi) [1885770]
  - m_vlan: add pop_eth and push_eth actions (Andrea Claudi) [1885770]
  - Update kernel headers (Andrea Claudi) [1885770]


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-1.el8]
changelog:
  - tc: f_flower: Add missing ct_state flags to usage description (Andrea Claudi) [1957243]
  - tc: f_flower: Add option to match on related ct state (Andrea Claudi) [1957243]


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-3.el8]
changelog:
  - tc: htb: improve burst error messages (Andrea Claudi) [1910745]
  - tc: u32: Fix key folding in sample option (Andrea Claudi) [1979425]
  - police: Fix normal output back to what it was (Andrea Claudi) [1981393]
  - police: Add support for json output (Andrea Claudi) [1981393]
  - police: add support for packet-per-second rate limiting (Andrea Claudi) [1981393]
  - Update kernel headers (Andrea Claudi) [1981393]
  - mptcp: add support for port based endpoint (Andrea Claudi) [1984733]


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: Phil Sutter <psutter@redhat.com> - 1.8.4-18
changelog:
  - xtables-translate: Fix translation of odd netmasks
  - nft: Fix bitwise expression avoidance detection
  - xtables-monitor: 'LL=0x304' is not very convenient, print LOOPBACK instead.
  - xtables-monitor: print packet first
  - xtables-monitor: fix packet family protocol
  - xtables-monitor: fix rule printing
  - xtables-monitor: Fix ip6tables rule printing


author: Phil Sutter <psutter@redhat.com> - 1.8.4-20
changelog:
  - extensions: SECMARK: Use a better context in test case
  - extensions: sctp: Translate --chunk-types option
  - extensions: sctp: Fix nftables translation
  - extensions: SECMARK: Implement revision 1
  - nft: cache: Retry if kernel returns EINTR


author: Phil Sutter <psutter@redhat.com> - 1.8.4-21
changelog:
  - extensions: hashlimit: Fix tests with HZ=100
  - ebtables: Dump atomic waste
  - doc: ebtables-nft.8: Adjust for missing atomic-options


author: Ryan O'Hara <rohara@redhat.com> - 2.0.10-6
changelog:
  - Fix segfault when smtp alerts configured (#1693706)
  - Fix double free when smtp_helo_name copied from local_name (#1693706)


author: Steve Dickson <steved@redhat.com> 2.0.14-1
changelog:
  - Updated to latest stable upstream version: 2.0.14-stable (bz 727129)
  - Removed the installion of the outdate man pages and the latex raw docs.
  - Corrected where the other doc are installed.


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Phil Sutter <psutter@redhat.com> [1.1.1-2.el8]
changelog:
  - chain: Hash chain list by name (Phil Sutter) [1658533]
  - chain: Add lookup functions for chain list and rules in chain (Phil Sutter) [1658533]
  - chain: Support per chain rules list (Phil Sutter) [1658533]
  - src: remove nftnl_rule_cmp() and nftnl_expr_cmp() (Phil Sutter) [1658533]


author: Phil Sutter <psutter@redhat.com> [1.1.1-3.el8]
changelog:
  - src: chain: Fix nftnl_chain_rule_insert_at() (Phil Sutter) [1666495]
  - src: chain: Add missing nftnl_chain_rule_del() (Phil Sutter) [1666495]
  - flowtable: Fix for reading garbage (Phil Sutter) [1661327]
  - flowtable: Fix memleak in nftnl_flowtable_parse_devs() (Phil Sutter) [1661327]
  - flowtable: Fix use after free in two spots (Phil Sutter) [1661327]
  - flowtable: Add missing break (Phil Sutter) [1661327]
  - object: Avoid obj_ops array overrun (Phil Sutter) [1661327]


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-2.20140718gitbdb6a3
changelog:
  - add timemaster (#1085580)
  - send peer messages to correct address
  - make NTP SHM segment number configurable
  - update UDS handling to allow running multiple ptp4l/phc2sys instances
  - fix warnings from static analysis


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
  - fix resetting of linreg servo (#1165045)
  - fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-5
changelog:
  - add support for active-backup bonding (#1002657)
  - add support for IP over InfiniBand (#1472880)
  - fix handling of unknown/invalid management TLVs in pmc (#1459446 #1459449)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-6
changelog:
  - add support for bonding to timemaster (#1549015)
  - improve timemaster to restart terminated processes (#1527170)
  - start ptp4l, timemaster and phc2sys after network-online target (#1541991)
  - don't forward management requests to UDS port (#1520366)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-1
changelog:
  - update to 2.0 (#1623919)
  - add support for more accurate synchronization to phc2sys (#1643977)
  - add support for active-backup team interface (#1650672)
  - limit unicast message rate per address and grant duration


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-3
changelog:
  - add support for active-backup team interface (#1685467)
  - add support for more accurate synchronization to phc2sys (#1677217)
  - add hwts_filter option to ptp4l (#1708554)
  - limit unicast message rate per address and grant duration (#1707395)
  - fix comparing of unicast addresses (#1707395)
  - fix building with new kernel headers (#1707395)
  - update testsuite (#1707395)
  - don't leak memory when allocation fails (#1707395)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-5
changelog:
  - fix sample timestamps when synchronizing PHC to system clock (#1787376)
  - fix handling of zero-length messages (#1827275)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.1.1-1
changelog:
  - update to 3.1.1 (#1895005 CVE-2021-3571)
  - add read-only UDS port (#1929797)
  - add option to set clockClass threshold (#1980386)
  - don't repeat some log messages in multi-port configuration (#1980377)
  - increase default TX timestamp timeout to 10 ms (#1977136)


author: Jan Kaluza <jkaluza@redhat.com> - 3.8.6-8
changelog:
  - fix #1201252 - delete unused entries in state file, fix bad performance
    with big state file
  - fix #1272236 - move logrotate.status to /var/lib/logrotate and add it to rwtab.d


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-10
changelog:
  - fix #1192936 - provide diagnostic in case log does not need rotating
  - fix #1321980 - do not exit if status file is corrupted


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-13
changelog:
  - fix #1393247 - migration of state file from previous versions of logrotate
  - fix #1374331 - preserve SELinux context with 'compress' and 'sharedscripts'
  - fix #1377335 - make 'createolddir' preserve sticky bit
  - fix #1369438 - heap buffer overflow when using long date format
  - fix #1375638 - make olddir respect the missingok flag


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-14
changelog:
  - fix #1381719 - make /var/lib/logrotate/logrotate.status the default state file
  - fix #1387533 - make 'su' directive accept usernames starting with digits


author: Kamil Dudka <kdudka@redhat.com> - 3.8.6-15
changelog:
  - fix #1483800 - update references to project page
  - fix #1472984 - improve the error message for bad config file mode
  - fix #1465720 - trigger weekly rotations more predictably
  - fix #1461907 - make 'copy' and 'copytruncate' work together


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-26
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-10
changelog:
  - Drop update-ppolicy-schema.sh scriptlet's output (#1487857)
  - Fix issues in MozNSS compatibility layer (#1400578)
    + Force write file with fsync to avoid race conditions
    + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
    + Allow missing cert and key which is a valid usecase
    + Create extraction folder only in /tmp to simplify selinux rules
    + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.44-11
changelog:
  - MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key (#1525485)
    + Fix a possible invalid dereference (covscan)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-12
changelog:
  - MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage (#1516409)
    + Warn just before use of a PIN about key file extraction


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
  - MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
  - MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
  - MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
  - Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1543955)
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: Brian C. Lane <bcl@redhat.com> 3.1-21
changelog:
  - Backport fix for 1 sector logical partition separation from start of extended
    Resolves: rhbz#1212323


author: Brian C. Lane <bcl@redhat.com> 3.1-22
changelog:
  - Use 512b sector size when communicating with device-mapper
    Resolves: rhbz#1188431
  - Add a test to make sure partitions are the correct size on device-mapper
    Related: rhbz#1188431


author: Brian C. Lane <bcl@redhat.com> 3.1-23
changelog:
  - libparted: Use read only when probing devices on linux
    Resolves: rhbz#1245144
  - tests: Use wait_for_dev_to_ functions
    Related: rhbz#1245144


author: Brian C. Lane <bcl@redhat.com> 3.1-24
changelog:
  - tests: Add udevadm settle to wait_for_ loop
    Related: rhbz#1260664
  - tests: Add-wait-to-t9042
    Resolves: rhbz#1257415
  - tests: Fix t1700 failing on a host with a 4k xfs file
    Related: rhbz#1260664


author: Brian C. Lane <bcl@redhat.com> 3.1-25
changelog:
  - docs: Add list of filesystems for fs-type
    Resolves: rhbz#1311596
  - libparted: Remove fdasd geometry code from alloc_metadata
    Resolves: rhbz#1244833


author: Brian C. Lane <bcl@redhat.com> - 3.1-29
changelog:
  - Add support for NVMe devices
    Resolves: rhbz#1316239
  - Backport partition resize command
    Resolves: rhbz#1423357


author: Miro Hrončok <mhroncok@redhat.com> - 2.2.3-6
changelog:
  - Subpackage python2-daemon has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Carl George <carl@george.computer> - 2.7.0-1
changelog:
  - Latest upstream rhbz#1527712
  - Drop patch1, requirements.txt does not affect final installation
  - Drop unnecessary coverage and flake8 build requirements


author: Jason Montleon <jmontleo@redhat.com> 8.0.0-8
changelog:
  - add upstream patch to make python-adal optional
  - remove python-adal requires for EL7 since it's not available in RHEL base, optional, or extras


author: Devrim Gündüz <devrim@gunduz.org> 2.5-1
changelog:
  - Update to 2.5, per changes described at:
    http://www.psycopg.org/psycopg/articles/2013/04/07/psycopg-25-released/


author: Peter Lemenkov <lemenkov@gmail.com> - 3.6.3-2
changelog:
  - Avoid RPC roundtrips in list commands
  - Use proto_dist from config instead of always using default (inet_tcp)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-8
changelog:
  - lvmlockd: add cmirrord support
  - LVM-activate: warn about incorrect vg_access_mode

    Resolves: rhbz#1606316
    Resolves: rhbz#1619428


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-10
changelog:
  - aws-vpc-move-ip: avoid false positive monitor result on initial probe
  - timeout/interval add "s"-suffix

    Resolves: rhbz#1624741
    Resolves: rhbz#1523318


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.5
changelog:
  - rabbitmq-cluster: get cluster status from mnesia during monitor
  - rabbitmq-cluster: fail monitor when node is in minority partition

    Resolves: rhbz#1641944
    Resolves: rhbz#1641946


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-3
changelog:
  - add more securetty required for mainframes (#1067347)
  - set SHELL envvar to /bin/bash in bashrc (#1063552)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-5
changelog:
  - reserve uidgid pair 142:142 for activemq (#1086923)
  - add xfs to /etc/filesystems, fallback to /proc/filesystems
    (#1123832)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-6
changelog:
  - change reservation of 185:185 to jboss user (#1192413)
  - reserve uidgid pair 167:167 for ceph (#1221043)
  - reserve uidgid for systemd-network(192:192) (#1213820)
  - reserve uidgid for systemd-resolve(193:193) (#1213820)
  - mention systemd-jounal-gateway can be dynamic (#1213820)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-7
changelog:
  - add basic empty subuid/subgid files for docker (#1311278)
  - specify full path to utilities in /etc/profile and /etc/bashrc
    (#1331871)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-8
changelog:
  - fix group id for tape in /etc/group (should be 33) (#1433020)
  - provide a way how to override set envvars through sh.local file(#1344007)
  - provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-10
changelog:
  - fix crudp name in /etc/protocols (#1566469)
  - do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells
    (#1571104)


author: Peter Jones <pjones@redhat.com> - 0.7-10
changelog:
  - Fix a couple more minor bugs aavmf has found in fallback.
    Related: rhbz#1190191
  - Build lib/ with the right CFLAGS
    Related: rhbz#1190191


author: Peter Jones <pjones@redhat.com> - 0.9-1
changelog:
  - Update to 0.9-1
  - Fix early call to BS->Exit()
    Resolves: rhbz#1115843
  - Implement shim on aarch64
    Resolves: rhbz#1100048
    Resolves: rhbz#1190191


author: Peter Jones <pjones@redhat.com> - 10-1
changelog:
  - Update to 10-1
  - Support ia32
    Resolves: rhbz#1310766
  - Handle various different load option implementation differences
  - TPM 1 and TPM 2 support.
  - Update to OpenSSL 1.0.2k


author: Peter Jones <pjones@redhat.com> - 11-1
changelog:
  - Update to 11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Fabian Arrotin <arrfab@centos.org> - 15-1.el7.centos
changelog:
  - Added 0001-Add-vendor-esl.patch (Patrick Uiterwijk)
  - Rebuilt with combined centos.esl (so new and previous crt)


author: Peter Jones <pjones@redhat.com> - 11-0.1
changelog:
  - Update to 11-0.1 to match shim-11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Peter Jones <pjones@redhat.com> - 12-2
changelog:
  - Fix /boot/efi/... permissions to match the filesystem's requirements
    Related: rhbz#1512749
  - Minor .spec cleanups
    Related: rhbz#1512749


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
  - core: when restarting services, don't close fds (#1803802)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
  - tests: add basic journal test (#1803802)
  - tests: add regression test for `systemctl restart systemd-journald` (#1803802)
  - tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
  - sd-bus: bump message queue size again (#1770158)
  - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
  - add test for ExecStopPost (#1733998)
  - core: when restarting services, don't close fds (#1757704)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
  - tests: add basic journal test (#1757704)
  - tests: add regression test for `systemctl restart systemd-journald` (#1757704)
  - tests: add test that journald keeps fds over termination by signal (#1757704)
  - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
  - mount: don't propagate errors from mount_setup_unit() further up (#1804757)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
  - fix the fix for #1691511 (#1804757)
  - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
  - Consider smb3 as remote filesystem (#1811700)
  - mount: don't add Requires for tmp.mount (#1813270)
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
  - sd-journal: remove the dead code and actually fix #14695 (#1812889)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
  - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
  - run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
  - core: clarify that the CollectMode bus property is constant (#1817576)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
  - logind: check PolicyKit before allowing VT switch (#1797672)
  - timer: don't use persietent file timestamps from the future (#6823) (#1769923)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798503)
  - journal-remote: split-mode=host, remove port from journal filename (#1244691)
  - core: downgrade log message about inability to propagate cgroup release message (#1679934)
  - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
  - set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
  - device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.4-1
changelog:
  - Upgrade 1.9.4 release
  - Fixed bad day-of-week of first entry in changelog
  - Do not install on systems with efi partition
    See https://access.redhat.com/articles/2217041
    Resolves: rhbz#1275031
    Resolves: rhbz#1293526
    Resolves: rhbz#1307176
    Resolves: rhbz#1313876
    Resolves: rhbz#1332691


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.4-2
changelog:
  - Test for UEFI system with /sys/firmware/efi, rather than looking in
    the boot directory for an efi directory.
  - Allow install on UEFI platform, but with warning message, in order to
    permit completion of provisioning.
    Resolves: rhbz#1356571


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.6-3
changelog:
  Apply patches from upstream since realease of 1.9.6
    Resolves: rhbz#1515081
    Resolves: rhbz#1511798


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-3
changelog:
  - Change spec file permission to 644 to avoid rpmlint complain
  - Update Requires to fix dependency check error reported in Bodhi
  - Remove tpm2-tss-devel version in BuildRequires comment
  - Update release version and changelog


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-4
changelog:
  - Dependency check failed for Requires again, here to fix this
  - Update release version and changelog


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.1.0-5
changelog:
  - Remove epel dependencies
  - Change tpm2-tss dependency to not be tied to 1 version
  - Fix resource leak in InitSysContext
  - Clean up HashEKPublicKey
  - Add needed null checks to tpm2_getmanufec
  - clean up resource leak in tpm2_getmanufec
  - use strdup to get server address in tpm2_getmanufec
  - change preparePcrSelections_g to void
  - return on success in print_rc_tpm_error_code
  - Update release version
  resolves: rhbz#1275029 - Add tpm2.0-tools package


author: Richard W.M. Jones <rjones@redhat.com> - 5.13-2
changelog:
  - Enable /etc/watchdog.d directory for storing test binaries
    (RHBZ#657750, RHBZ#831190).
  - Missing BR systemd-units.
  - Update .gitignore.
  - Drop Group line, not required by modern RPM.


author: Ales Ledvinka <aledvink@redhat.com> - 5.13-9
changelog:
  - SELinux: Add /usr/libexec/watchdog/scripts/ for test-bin and repair-bin to inherit from.
  - systemd: service with network available dependency
  - systemd: correct cgroup for realtime settings
  - Document SELinux and systemd.


author: Josef Ridky <jridky@redhat.com> - 5.13-12
changelog:
  - Resolves: #1092523 - add PIE and RELRO check 
  - Resolves: #1133135 - add ipmi.service dependency to watchdog.service file
  - Resolves: #1259816 - remove deprecated stanza in unit files


