Update Changelog and VERSION for release 2.20221101.

Signed-off-by: Chris PeBenito <pebenito@ieee.org>
Signed-off-by: Kenton Groombridge <concord@gentoo.org>

1 files changed, 204 insertions, 0 deletions

diff --git a/Changelog b/Changelog
index 7334e4989..76cd60fdc 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,207 @@
+* Tue Nov 01 2022 Chris PeBenito <pebenito@ieee.org> - 2.20221101
+Chris PeBenito (46):
+      systemd: Drop systemd_detect_virt_t.
+      fstools: Handle resizes of the root filesystem.
+      mount: Get the attributes of all filesystems.
+      rpm: Add dnf and tdnf labeling.
+      logging: Change to systemd interface for tmpfilesd.
+      systemd: Remove systemd-run domain.
+      unconfined: Add missing capability2 perms.
+      lvm: Updates for multipath LVM.
+      locallogin: Use init file descriptors.
+      systemd: Misc fixes.
+      isns: Updates from testing.
+      container, docker: Fixes for containerd and kubernetes testing.
+      devices: Add type for SAS management devices.
+      devices: Add file context for /dev/vhost-vsock.
+      iptables: Ioctl cgroup dirs.
+      devices: Add type for infiniband devices.
+      storage: Add fc for /dev/ng*n* devices.
+      files: Add prerequisite access for files_mounton_non_security().
+      files: Make etc_runtime_t a config file.
+      systemd: Fixes for coredumps in containers.
+      container: Allow container engines to connect to http cache ports.
+      container: Getattr generic device nodes.
+      application: Allow apps to use init fds.
+      systemd: Misc updates.
+      filesystem: Move ecryptfs interface definitions.
+      mcs: Add additional SysV IPC constraints.
+      mcs: Collapse constraints.
+      mcs: Add additional socket constraints.
+      mcs: Add missing process permission constraints.
+      mcs: Remove duplicate node_bind constraint.
+      mcs: Reorganize file.
+      mls: Add setsockcreate constraint.
+      systemd: Add interface for systemctl exec.
+      Add cloud-init.
+      hypervkvp: Port updated module from Fedora policy.
+      init: Add tunable for systemd to create all its mountpoints.
+      Run Ci tests in parallel.
+      Revise userspace and SELint versions in CI
+      fapolicyd: Fix selint issue.
+      tests.yml: Remove irrelevant comment.
+      Drop audit_access allows.
+      sympa: Move lines.
+      sympa: Drop module version.
+      sympa, mta, exim: Revise interfaces.
+      sympa, logging; Fix lint errors.
+      container: Add missing UDP node bind access on container engines.
+
+Christian Göttsche (3):
+      Replace deprecated egrep usage
+      ci: update dependencies
+      ci: build SELint from source
+
+Daniel Burgener (1):
+      Drop explicit calls to seutil and kernel module interfaces in broad files
+         interfaces
+
+Dave Sugar (20):
+      ssh: allow ssh_keygen to read /usr/share/crypto-policies/
+      chronyd: Allow to read fips_enabled sysctl
+      chronyd: allow chronyd to read /usr/share/crypto-policies
+      systemd: init_t creates systemd-logind 'linger' directory
+      systemd: systemd-update-done fix startup issue
+      usbguard: Allow to read fips_enabled sysctl
+      firewalld: read to read fips_enabled sysctl
+      firewalld: create netfilter socket
+      firewalld: allow to load kernel modules
+      firewalld: write tmpfs files
+      firewalld: firewalld-cmd uses dbus
+      tpm2-abrmd: allow to send syslog messages
+      domain: move kernel_read_crypto_sysctls to a common location
+      fapolicyd: Initial SELinux policy
+      networkmanager: allow watch etc_t and lib_t
+      firewalld: allow watch on firewalld files
+      Seeing long delay during shutdown saying: 'A stop job is running for
+         Restore /run/initramfs on shutdown'
+      fix: issue #550 - compile failed when DIRECT_INITRC=y
+      fapolicyd: fagenrules chgrp's the compiled.rules
+      Add 'DIRECT_INITRC' config to automated tests
+
+Kenton Groombridge (95):
+      systemd: add separate type for user transient units
+      systemd: rename user runtime unit interfaces
+      docker, podman: use renamed user runtime unit status interface
+      systemd: rename status user mananger units interface
+      systemd: systemd-resolved is linked to libselinux
+      systemd: dontaudit systemd-generator getattr on all dirs
+      raid: allow mdadm to use user ptys
+      bootloader, files: allow bootloader to getattr on boot_t filesystems
+      matrixd: various fixes
+      container: add unconfined role
+      unconfined: use unconfined container role
+      podman: add interface to rangetrans when executing conmon
+      podman: rework conmon rules
+      podman: add file context for podman in /usr/libexec
+      container: rework combined role interfaces
+      podman: typealias podman_user_conmon_t to podman_conmon_user_t
+      fail2ban: allow fail2ban to getsched on its processes
+      modutils: allow kmod to write to kmsg
+      postfix: allow postfix-map to read certbot certs
+      postfix: allow postfix master to get the state of init
+      postfix: allow postfix master fsetid capability
+      bind: fixes for named working on dnssec files
+      sudo: allow sudo domains to create netlink selinux sockets
+      sysnetwork, systemd: allow DNS resolution over io.systemd.Resolve
+      container: allow containers to manipulate own fds
+      container: allow container engines to manage tmp symlinks
+      ssh: add tunable to allow sshd to use remote port forwarding
+      systemd: minor fixes to systemd user domains
+      init, systemd: allow unpriv users to read the catalog
+      container: add separate type for container engine units
+      container, podman: allow podman to restart container units
+      spamassassin: add file context for rspamd log directory
+      term, init: allow systemd to watch and watch reads on unallocated ttys
+      certbot: various fixes
+      systemd: add file transition for systemd-networkd runtime
+      systemd: add missing file context for /run/systemd/network
+      systemd: add file contexts for systemd-network-generator
+      systemd, udev: allow udev to read systemd-networkd runtime
+      systemd: allow systemd-networkd to read init runtime files
+      podman: add alias for conmon executable
+      systemd: ensure connecting to resolved allows searching init runtime
+      ssh: allow sshd to run setfiles when polyinstantiation is enabled
+      sudo: allow sudo domains to access caller's /proc/pid/stat
+      container: add file contexts for docker home config
+      files, init: allow systemd to remount etc filesystems
+      systemd: allow systemd-logind to read localization
+      init: fix possible typo
+      corecmd: label dracut lib as bin_t
+      sudo: various fixes
+      udev: various fixes for udevadm
+      bootloader, init: various fixes for systemd-boot
+      systemd: allow systemd-generator to read etc runtime files
+      systemd: add interface to read userdb runtime files
+      logging: various fixes for auditctl
+      screen: add interface to dontaudit runtime sock file
+      systemd: dontaudit systemd-tmpfiles getattr on screen sock file
+      systemd: dontaudit systemd-tmpfiles getattr on all dirs
+      fstools: fixes for fsadm with nfs
+      various: fixes for nfs
+      init: dontaudit initrc creating /dev/console during initrd
+      storage: include chr_files in fixed_disk_dev interfaces
+      systemd: allow systemd-userdbd to search default contexts
+      logging, systemd: allow auditctl to list userdb runtime dirs
+      bootloader, userdom: minor fixes for systemd-boot
+      systemd: allow systemd-resolved to read generic certs
+      sysadm: allow sysadm to rw ipmi devices
+      zfs: initial policy module
+      fstools, mount: remove legacy zfs rules
+      files, mount: remove legacy ZFS file contexts
+      sysadm: allow admin access to zfs
+      kernel: allow kthreads to read and write the zpool cache
+      systemd, zfs: allow systemd-generator to read zfs config
+      udev: allow reading ZFS config
+      zfs: various fixes
+      mta: add support for nullmailer
+      devices: add interface to rw infiniband devices
+      xdg: add interface to dontaudit searching xdg data dirs
+      opensm: initial policy
+      sysadm: allow opensm access
+      corenet: add portcon for glusterfs
+      glusterfs: various fixes
+      glusterfs: add type for gluster bricks
+      mount: allow mounting glusterfs volumes
+      selinuxutil: allow semanage, setfiles to inherit gluster fds
+      glusterfs, selinuxutil: make modifying fcontexts a tunable
+      glusterfs: add type for glusterd hooks
+      usermanage: add file context for chpasswd in /usr/bin
+      node_exporter: add file context for node_exporter in /usr/bin
+      usbguard: add file context for usbguard in /usr/bin
+      init: add file context for systemd units in dracut modules
+      git: add file contexts for other git utilities
+      dbus, init, mount, rpc: minor fixes for mount.nfs
+      zfs: allow reading exports
+      systemd: allow systemd-generator to use dns resolution
+      rpc: allow rpc admins to rw nfsd fs
+
+Pat Riehecky (2):
+      container: Boolean for ecryptfs
+      Clone `xguest_connect_network` for guest role
+
+Russell Coker (1):
+      Sympa list server
+
+Yi Zhao (16):
+      systemd: allow systemd user to watch /etc directories
+      logwatch: fixes for logwatch
+      postfix: allow postfix_local_t to search logwatch_cache_t
+      sysnetwork: allow systemd_networkd_t to read link file
+      logging: allow systemd-journal to manage syslogd_runtime_t sock_file
+      radius: fixes for freeradius
+      udev: allow udev_read_runtime_files to read link files
+      watchdog: allow watchdog to create /var/log/watchdog directory
+      systemd: allow systemd-resolved to manage link files
+      sysnetwork: fix privilege separation functionality of dhcpcd
+      sysnetwork: allow dhcpcd to send and receive messages from systemd
+         resolved
+      rpm: add label for dnf-automatic and dnf-3
+      systemd: allow systemd-backlight to read kernel sysctl settings
+      systemd: allow systemd-rfkill to get attributes of all fs
+      systemd: allow systemd-hostnamed to read selinux configuration files
+      systemd: add capability sys_admin to systemd_generator_t
+
 * Fri May 20 2022 Chris PeBenito <pebenito@ieee.org> - 2.20220520
 Björn Esser (1):
       authlogin: add fcontext for tcb