# changelog

author: cunshunxia <cunshunxia@tencent.com> - 1.4.0-4
changelog:
  - add scriptlets for rpm-ostree and user-nsswitch.
  - change default profile to minimal with specified password-auth


author: Xiaojie Chen <jackxjchen@tencent.com> - 5.2-3
changelog:
  - fix crash with unset arrays in arithmetic contexts
  - fix crash in readline when started with an invalid locale specification


author: Kairui Song <kasong@tencent.com> - 6.6.6-2401.0.1
changelog:
  - kabi: freeze kabi for x86_64 and arm64
  - x86/mpparse, kexec: switch apic driver early when x2apic is pre-enabled
  - tracing: workaround UAF caused by memory ordering issue
  - mm/slub.c: sanitize freelist pointer assignment even more
  - mm/slub.c: fix a potential UAF
  - cgroup: use a standalone workqueue for killing css
  - mm/vmscan.c: add cond_resched function call into __shrink_page_cache
  - swap: expose required symbols for some 3rd part modules
  - swapfile: add a helper get_cached_swap_page_of_type
  - mm: memcg: introduce v2's interface to v1
  - psi: only show SOME PSI for non-IRQ in cgroup v1
  - psi: support cgroup v1 psi accounting
  - psi: expose cgroup v1 interface for psi
  - psi: link legacy root to psi_system
  - sched/psi: simplify cgroup psi retrieving
  - arm64: fake a reliable stacktrace for livepath
  - arm64: enable livepatch without stable stacktrace
  - arm64: basic infrastructure for livepatch
  - pagecachelimit: limit the pagecache ratio of totalram
  - blkcg: add buffer IO throttle for cgroup v1
  - cgroupfs: support stat based on cpuacct
  - cgroupfs: fix non inited i_ino when inode created
  - cgroupfs: add files inside sys
  - cgroupfs: support for proc and sys
  - cgroupfs: quota aware support
  - cgroupfs: refactor cgroup resource statistics for reuse
  - memcg: make meminfo optionally recursive and rework
  - memcg: add meminfo and vmstat show
  - cpuset: add switch support for cpuset.stat in container
  - cpuset: fix cpuset.stat process field value exception
  - cpuset: add switch for cpuinfo in container
  - cpuset: add loadavg calc for each container
  - cpuset: add cpuinfo and stat show
  - sysfs: add sysfs attribute to hide disk devices
  - blkcg/diskstats/dm: add support for blkcg diskstats
  - blkcg/diskstats/md: add support for blkcg diskstats
  - blkcg/diskstats: add per blkcg diskstats support
  - ext4: Add an error info during new_inode
  - ext4: fix soft lockup caused by sbi->s_es_lru
  - ceph: add mds request pid info into debugfs
  - ceph: Add new mount option req_resend
  - ceph: re-send osd requests if timeout
  - nvme: add the hotplug info output about drive letter and BDF
  - nbd: add the nbd_ignore_blksize_set support
  - xfs: add kmem_alloc_by_vmalloc and kmem_alloc_large_dump_stack sysctl
  - xfs: set xfs default error level to 5
  - ceph: add sysctl to ignore error epoch barrier
  - ext3: set nobarrier as default
  - block: check whether queue is NULL or not in stats functions
  - net: modify default value of host max_orphan
  - net: namespaceify sysctl_tcp_max_orphans
  - vm: isolate max_map_count by pid namespace
  - cpuacct: get the uptime of container
  - proc: add pid mapping between host and container
  - taskstats: expose taskstats to all netspace
  - tcp: make TCP_RTO_MIN/MAX be tunable
  - tcp: support self define parameter to tune rto of syn/synack packets
  - tcp: introduce sysctl tcp_inherit_buffsize
  - net: ipv6 neigh tunnel bypass
  - net: add sysctl to control page frag
  - net: add sriov debug info
  - net: increase tcp listen hash
  - tcp: add TCP_FULLNAT_REAL setsockopt options for fullnat real ip
  - net: reduce the confliction while multi threads connecting same host
  - bonding: add broadcast_arp param to send arp broadcast
  - netlink: don't modprobe proto audit & selinux
  - tcp: add proc parameter to change init cwnd
  - net: add tcp_no_delay_ack to enable absolute quick ack
  - tcp: add tcp_loss_init_cwnd sysctl to tunnel packet numbers in loss
  - network: default zero bond_devices to support
  - tcp: double the default value of thash_entries
  - tcp: backoff the commit allowing timestamps even if SYN packet has tsval=0
  - net: dev ipv4/v6 stat
  - net: add tcp drop stats
  - ipmi: set kipmid_max_busy_us default to 1
  - sched: adaptive default skew_tick value
  - ipc/msg: increase defaults for shmmall, shmmax, msgmax and msgmnb
  - mm: increase dirty-ratio from 20 to 40
  - tkernel: netfilter: conntrack: add netagent extention slot
  - tkernel: net: add toa support
  - tkernel: mounts: add shield mountpoint in container support
  - tkernel: netatop: add netatop module in kernel/tkernel/
  - tkernel: ttools: add ttools module to support ptrace protect
  - tkernel: initial support and nonpriv_bind
  - sysrq: add ALT+LEFTCTRL to trigger crash dump
  - kabi: add paddings and optimize (part 3)
  - kabi: add paddings (part 2)
  - kabi: add paddings (part 1)
  - kabi: add kabi.h
  - kabi: modules: better vermagic check on module load
  - config: update config for ocks-2401
  - dist: config: update config from ocks-2303
  - dist: config: add default config files
  - dist: fix script checker
  - dist: tools/vm -> tools/mm
  - dist: move libcpupower.so to kernel-libs
  - dist: initial support
  - Linux 6.6.6


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.50-5
changelog:
  - integrate Adam William's /etc/ssl/certs with Debian-compatibility
  - back out blocklist change since p11-kit .24 is not yet available on rawhide


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.52-2
changelog:
  - Update to CKBI 2.52 from NSS 3.72
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"


author: wynnfeng <wynnfeng@tencent.com> - 2023.2.60-1
changelog:
  - Update to CKBI 2.60 from NSS 3.86
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "Global Chambersign Root"


author: Pavel Raiskup <praiskup@redhat.com> - 3.14-4
changelog:
  - /proc and /sys made %ghost to allow filesystem package updates in rootless
    container environments (rhbz#1548403)


author: Shuo Wang <abushwang@tencent.com> - 2.38-5
changelog:
  - backport patch to fix CVE-2023-6246, CVE-2023-6779, CVE-2023-6780
  - Fix heap buffer overflow for syslog


author: Qian Liang <renaliang@tencent.com> - 12.3.1-1
changelog:
  - updated to tgcc-12.3.1
  - Security updates: fix CVE-2023-4039. merge from https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=75c37e031408262263442f5b4cdb83d3777b6422
  - fix ICE in ipa profile multiple target speculative.


author: Wang Guodong <gordonwwang@tencent.com> - 4.33-2
changelog:
  - Move event.h from libev-devel to a subpackage(libev-event-devel), so 
    libev-devel no longer conflicts with libevent-devel.


author: kianli <kianli@tencent.com> - 4.18.8-1
changelog:
  - Upgrade to 4.18.8
  - Security fix for CVE-2023-3961
  - Security fix for CVE-2023-4091
  - Security fix for CVE-2023-4154
  - Security fix for CVE-2023-42669
  - Security fix for CVE-2023-42670


author: Xin Cheng <denisecheng@tencent.com> - 0.10.5-3
changelog:
  - Fix CVE-2023-48795: fix prefix truncation attack on Binary Packet Protocol (BPP)
  - Fix CVE-2023-6918: fix missing checks for return values for digests
  - Fix CVE-2023-6004: fix ProxyCommand/ProxyJump features allow injection


author: Xin Cheng <denisecheng@tencent.com> - 9.3p2-4
changelog:
  - CVE-2023-51385: forbid shell metasymbols in username/hostname
  - CVE-2023-51384: apply destination constraints to all p11 keys
  - CVE-2023-48795: fix Terrapin attack


author: Feng Weiyao <wynnfeng@tencent.com> - 3.0.9-1
changelog:
  - update to version 3.0.9
    Resolves: CVE-2023-0464            
    Resolves: CVE-2023-0465            
    Resolves: CVE-2023-0466            
    Resolves: CVE-2023-1255            
    Resolves: CVE-2023-2650


author: Feng Weiyao <wynnfeng@tencent.com> - 3.0.12-3
changelog:
  - Revert "Improved detection of engine-provided private "classic" keys" to temporaryly fix openssl-pkcs11 test failures


author: Zhao Zhen <jeremiazhao@tencent.com> - 3.11.4-1
changelog:
  - upgraded for upstream 3.11.4
  - fixed CVE-2023-24329, CVE-2022-45061, CVE-2022-42919, CVE-2021-28861, CVE-2020-10735, CVE-2015-20107
  - removed python-unversioned-command, it is now merged into python3 package, so python3 package contains
  - /usr/bin/python by default


author: Wang Guodong <gordonwwang@tencent.com> - 38.6-1
changelog:
  - upgrade to version 38.6 and update source files;
  - relabel some dirs such as /usr/lib/sysimages/rpm;
  - set selinux-policy config to enforcing mode by default.


author: TencentOS Team <tencent_os@tencent.com> - 38.28-1.1.tl4.1
changelog:
  - modify selinux policy config from enforcing to permissive only in tl3.4, 
    still enforcing in tl4


author: Yi Lin <nilusyi@tencent.com> - 15.7-5
changelog:
  - fix CVE-2023-40546, CVE-2023-40551, CVE-2023-40550, 
    CVE-2023-40549, CVE-2023-40548, CVE-2023-40547


author: Miaojun Dong <zoedong@tencent.com> - 4.5.5-1
changelog:
  - Bump version to 4.5.5
  - Add build requirement python3-setuptools
  - Comment the line to generates i18n docs because it is broken


author: Zhao Zhen <jeremiazhao@tencent.com> - 9.0.2092-1
changelog:
  - updated to upstream version 9.0.2092
  - fixed CVE-2023-4735 CVE-2023-4736 CVE-2023-4734 CVE-2023-4738 CVE-2023-4752 
    CVE-2023-4781 CVE-2023-4733 CVE-2023-4750 CVE-2023-5344 CVE-2023-5441 CVE-2023-5535


author: Yi Lin <nilusyi@tencent.com> - 9.0.2092-2
changelog:
  - fixed CVE-2023-48231 CVE-2023-48232 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 
    CVE-2023-48236 CVE-2023-48237 CVE-2023-48706 CVE-2024-22667


