committing changes in /etc made by "-bash"

Package changes:

.etckeeper

@@ -112,7 +112,6 @@ mkdir -p './sysconfig/modules'
 mkdir -p './sysconfig/rhn/allowed-actions/configfiles'
 mkdir -p './sysconfig/rhn/allowed-actions/script'
 mkdir -p './sysconfig/rhn/clientCaps.d'
-mkdir -p './systemd/system/nginx.service.d'
 mkdir -p './systemd/system/php-fpm.service.d'
 mkdir -p './terminfo'
 mkdir -p './tuned/recommend.d'
@@ -299,14 +298,10 @@ maybe chmod 0644 'clamav-unofficial-sigs/user.conf'
 maybe chown 'amavis' 'clamd.conf'
 maybe chgrp 'amavis' 'clamd.conf'
 maybe chmod 0640 'clamd.conf'
-maybe chown 'amavis' 'clamd.d'
-maybe chgrp 'amavis' 'clamd.d'
 maybe chmod 0755 'clamd.d'
 maybe chown 'amavis' 'clamd.d/amavisd.conf'
 maybe chgrp 'amavis' 'clamd.d/amavisd.conf'
 maybe chmod 0644 'clamd.d/amavisd.conf'
-maybe chown 'amavis' 'clamd.d/scan.conf'
-maybe chgrp 'amavis' 'clamd.d/scan.conf'
 maybe chmod 0644 'clamd.d/scan.conf'
 maybe chmod 0755 'cloud'
 maybe chmod 0755 'cockpit'
@@ -1202,23 +1197,23 @@ maybe chmod 0755 'issue.d'
 maybe chmod 0640 'issue.net'
 maybe chmod 0755 'java'
 maybe chmod 0755 'java/java-1.8.0-openjdk'
-maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64'
+maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64'
-maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib'
+maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/calendars.properties'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/calendars.properties'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/logging.properties'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/logging.properties'
-maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security'
+maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/blacklisted.certs'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/blacklisted.certs'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/java.policy'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/java.policy'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/java.security'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/java.security'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/nss.cfg'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/nss.cfg'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/nss.fips.cfg'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/nss.fips.cfg'
-maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy'
+maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy'
-maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy/limited'
+maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy/limited'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy/limited/US_export_policy.jar'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy/limited/US_export_policy.jar'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy/limited/local_policy.jar'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy/limited/local_policy.jar'
-maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy/unlimited'
+maybe chmod 0755 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy/unlimited'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy/unlimited/US_export_policy.jar'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy/unlimited/US_export_policy.jar'
-maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/lib/security/policy/unlimited/local_policy.jar'
+maybe chmod 0644 'java/java-1.8.0-openjdk/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/lib/security/policy/unlimited/local_policy.jar'
 maybe chmod 0755 'java/security'
 maybe chmod 0755 'java/security/security.d'
 maybe chmod 0755 'jvm'
@@ -4067,6 +4062,16 @@ maybe chgrp 'mock' 'mock/fedora-38-s390x.cfg'
 maybe chmod 0644 'mock/fedora-38-s390x.cfg'
 maybe chgrp 'mock' 'mock/fedora-38-x86_64.cfg'
 maybe chmod 0644 'mock/fedora-38-x86_64.cfg'
+maybe chgrp 'mock' 'mock/fedora-39-aarch64.cfg'
+maybe chmod 0644 'mock/fedora-39-aarch64.cfg'
+maybe chgrp 'mock' 'mock/fedora-39-i386.cfg'
+maybe chmod 0644 'mock/fedora-39-i386.cfg'
+maybe chgrp 'mock' 'mock/fedora-39-ppc64le.cfg'
+maybe chmod 0644 'mock/fedora-39-ppc64le.cfg'
+maybe chgrp 'mock' 'mock/fedora-39-s390x.cfg'
+maybe chmod 0644 'mock/fedora-39-s390x.cfg'
+maybe chgrp 'mock' 'mock/fedora-39-x86_64.cfg'
+maybe chmod 0644 'mock/fedora-39-x86_64.cfg'
 maybe chgrp 'mock' 'mock/fedora-eln-aarch64.cfg'
 maybe chmod 0644 'mock/fedora-eln-aarch64.cfg'
 maybe chgrp 'mock' 'mock/fedora-eln-i386.cfg'
@@ -5680,6 +5685,7 @@ maybe chmod 0644 'rspamd/cgp.inc'
 maybe chmod 0644 'rspamd/common.conf'
 maybe chmod 0644 'rspamd/composites.conf'
 maybe chmod 0644 'rspamd/groups.conf'
+maybe chmod 0644 'rspamd/lang_detection.inc'
 maybe chmod 0755 'rspamd/local.d'
 maybe chmod 0644 'rspamd/local.d/redis.conf'
 maybe chmod 0644 'rspamd/local.d/worker-controller.inc'
@@ -5746,6 +5752,7 @@ maybe chmod 0644 'rspamd/modules.d/whitelist.conf'
 maybe chmod 0644 'rspamd/options.inc'
 maybe chmod 0755 'rspamd/override.d'
 maybe chmod 0644 'rspamd/rspamd.conf'
+maybe chmod 0644 'rspamd/rspamd.conf.rpmnew'
 maybe chmod 0755 'rspamd/scores.d'
 maybe chmod 0644 'rspamd/scores.d/content_group.conf'
 maybe chmod 0644 'rspamd/scores.d/fuzzy_group.conf'
@@ -6150,6 +6157,8 @@ maybe chmod 0644 'systemd/resolved.conf'
 maybe chmod 0755 'systemd/system'
 maybe chmod 0644 'systemd/system.conf'
 maybe chmod 0755 'systemd/system/getty.target.wants'
+maybe chmod 0755 'systemd/system/httpd.service.d'
+maybe chmod 0644 'systemd/system/httpd.service.d/php-fpm.conf'
 maybe chmod 0644 'systemd/system/immortaldir.service'
 maybe chmod 0755 'systemd/system/local-fs.target.wants'
 maybe chmod 0755 'systemd/system/mariadb.service.d'
@@ -6161,6 +6170,7 @@ maybe chmod 0755 'systemd/system/nfs-idmapd.service.requires'
 maybe chmod 0755 'systemd/system/nfs-mountd.service.requires'
 maybe chmod 0755 'systemd/system/nfs-server.service.requires'
 maybe chmod 0755 'systemd/system/nginx.service.d'
+maybe chmod 0644 'systemd/system/nginx.service.d/php-fpm.conf'
 maybe chmod 0755 'systemd/system/php-fpm.service.d'
 maybe chmod 0755 'systemd/system/printer.target.wants'
 maybe chmod 0755 'systemd/system/redis-sentinel.service.d'

ImageMagick-6/delegates.xml

@@ -116,6 +116,6 @@
   <delegate decode="xps:cmyk" stealth="True" command="&quot;gxps&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=bmpsep8&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/>
   <delegate decode="xps:color" stealth="True" command="&quot;gxps&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=ppmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/>
   <delegate decode="xps:mono" stealth="True" command="&quot;gxps&quot; -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 &quot;-sDEVICE=pbmraw&quot; -dTextAlphaBits=%u -dGraphicsAlphaBits=%u &quot;-r%s&quot; %s &quot;-sOutputFile=%s&quot; &quot;%s&quot;"/>
-  <delegate decode="video:decode" command="&quot;ffmpeg&quot; -nostdin -v -1 -i &quot;%i&quot; -vframes %S -vcodec pam -an -f rawvideo -y &quot;%u.pam&quot; 2&gt; &quot;%u&quot;"/>
+  <delegate decode="video:decode" command="&quot;ffmpeg&quot; -nostdin -loglevel error -i &quot;%s&quot; -an -f rawvideo -y %s &quot;%s&quot;"/>
-  <delegate encode="video:encode" stealth="True" command="&quot;ffmpeg&quot; -nostdin -v -1 -i &quot;%M%%d.pam&quot; -plays %I &quot;%u.%m&quot; 2&gt; &quot;%u&quot;"/>
+  <delegate encode="video:encode" stealth="True" command="&quot;ffmpeg&quot; -nostdin -loglevel error -i &quot;%s%%d.%s&quot; %s &quot;%s.%s&quot;"/>
 </delegatemap>

alternatives/alt-java

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/alt-java
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/alt-java

alternatives/alt-java.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/alt-java-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/alt-java-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/java

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/java
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/java

alternatives/java.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/java-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/java-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/jjs

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/jjs
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/jjs

alternatives/jjs.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/jjs-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/jjs-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/jre

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre

alternatives/jre_1.8.0

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre

alternatives/jre_1.8.0_openjdk

@@ -1 +1 @@
-/usr/lib/jvm/jre-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64
+/usr/lib/jvm/jre-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64

alternatives/jre_openjdk

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre

alternatives/keytool

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/keytool
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/keytool

alternatives/keytool.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/keytool-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/keytool-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/orbd

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/orbd
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/orbd

alternatives/orbd.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/orbd-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/orbd-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/pack200

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/pack200
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/pack200

alternatives/pack200.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/pack200-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/pack200-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/policytool

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/policytool
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/policytool

alternatives/policytool.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/policytool-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/policytool-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/rmid

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/rmid
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/rmid

alternatives/rmid.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/rmid-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/rmid-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/rmiregistry

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/rmiregistry
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/rmiregistry

alternatives/rmiregistry.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/rmiregistry-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/rmiregistry-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/servertool

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/servertool
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/servertool

alternatives/servertool.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/servertool-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/servertool-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/tnameserv

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/tnameserv
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/tnameserv

alternatives/tnameserv.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/tnameserv-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/tnameserv-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

alternatives/unpack200

@@ -1 +1 @@
-/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64/jre/bin/unpack200
+/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64/jre/bin/unpack200

alternatives/unpack200.1.gz

@@ -1 +1 @@
-/usr/share/man/man1/unpack200-java-1.8.0-openjdk-1.8.0.372.b07-4.el8.x86_64.1.gz
+/usr/share/man/man1/unpack200-java-1.8.0-openjdk-1.8.0.382.b05-2.el8.x86_64.1.gz

cups/cupsd.conf

@@ -63,7 +63,13 @@ IdleExitTimeout 0
     Order deny,allow
   </Limit>
 
-  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
+  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job>
+    Require user @OWNER @SYSTEM
+    Order deny,allow
+  </Limit>
+
+  <Limit CUPS-Get-Document>
+    AuthType Default
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

cups/cupsd.conf.default

@@ -63,7 +63,13 @@ IdleExitTimeout 0
     Order deny,allow
   </Limit>
 
-  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
+  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job>
+    Require user @OWNER @SYSTEM
+    Order deny,allow
+  </Limit>
+
+  <Limit CUPS-Get-Document>
+    AuthType Default
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

dbus-1/system.d/com.redhat.RHSM1.conf

@@ -7,23 +7,9 @@
     <policy user="root">
         <allow own="com.redhat.RHSM1"/>
 
-        <!-- Basic D-Bus API stuff -->
+        <!--
-        <allow send_destination="com.redhat.RHSM1"
+        Lock down the objects to root access only
-            send_interface="org.freedesktop.DBus.Introspectable"/>
+        -->
-        <allow send_destination="com.redhat.RHSM1"
-            send_interface="org.freedesktop.DBus.Properties"/>
-        <allow send_destination="com.redhat.RHSM1"
-            send_interface="org.freedesktop.DBus.ObjectManager"/>
-
-        <!-- allow Config.Set from root -->
-        <allow send_destination="com.redhat.RHSM1"
-            send_interface="com.redhat.RHSM1.Config"
-            send_member="Set"/>
-    </policy>
-
-
-    <policy context="default">
-        <!-- TODO: make these read-only by default -->
 
         <allow send_destination="com.redhat.RHSM1"
             send_interface="com.redhat.RHSM1"/>
@@ -37,11 +23,6 @@
         <allow send_destination="com.redhat.RHSM1"
             send_interface="com.redhat.RHSM1.Config"/>
 
-        <!-- deny Config.Set by default -->
-        <deny send_destination="com.redhat.RHSM1"
-            send_interface="com.redhat.RHSM1.Config"
-            send_member="Set"/>
-
         <allow send_destination="com.redhat.RHSM1"
             send_interface="com.redhat.RHSM1.RegisterServer"/>
 
@@ -65,5 +46,54 @@
         <allow send_destination="com.redhat.RHSM1"
             send_interface="org.freedesktop.DBus.ObjectManager"/>
     </policy>
-</busconfig>
 
+
+    <policy context="default">
+
+        <!--
+        Non-root users can execute only methods providing
+        information from files readable by non-root users.
+        -->
+
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Entitlement"
+            send_member="GetStatus"/>
+
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Products"
+            send_member="ListInstalledProducts"/>
+
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Syspurpose"
+            send_member="GetSyspurpose"/>
+
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Syspurpose"
+            send_member="GetSyspurposeStatus"/>
+
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Config"
+            send_member="GetAll"/>
+
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Config"
+            send_member="Get"/>
+
+        <!--
+        The UUID returned by following method is read
+        from consumer cert. Only this file is not
+        readable by non-root users.
+        -->
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="com.redhat.RHSM1.Consumer"
+            send_member="GetUuid"/>
+
+        <!-- Basic D-Bus API stuff -->
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="org.freedesktop.DBus.Introspectable"/>
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="org.freedesktop.DBus.Properties"/>
+        <allow send_destination="com.redhat.RHSM1"
+            send_interface="org.freedesktop.DBus.ObjectManager"/>
+    </policy>
+</busconfig>

mock/eol/templates/centos-6.tpl

@@ -1,6 +1,6 @@
 # This list is taken from 'epel-6-x86_64' @buildsys-build group, minus the
 # 'epel-*' specific stuff.
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux-ng which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed tar unzip util-linux-ng which xz'
 
 config_opts['dist'] = 'el6'  # only useful for --resultdir variable subst
 # beware RHEL uses 6Server or 6Client

mock/eol/templates/centos-8.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'

mock/eol/templates/rhel-6.tpl

@@ -1,6 +1,6 @@
 # This list is taken from 'epel-6-x86_64' @buildsys-build group, minus the
 # 'epel-*' specific stuff.
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux-ng which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed tar unzip util-linux-ng which xz'
 
 config_opts['dist'] = 'el6'  # only useful for --resultdir variable subst
 # beware RHEL uses 6Server or 6Client

mock/fedora-39-aarch64.cfg

@@ -1 +0,0 @@
-fedora-rawhide-aarch64.cfg

mock/fedora-39-aarch64.cfg

@@ -0,0 +1,5 @@
+config_opts['releasever'] = '39'
+config_opts['target_arch'] = 'aarch64'
+config_opts['legal_host_arches'] = ('aarch64',)
+
+include('templates/fedora-branched.tpl')

mock/fedora-39-i386.cfg

@@ -1 +0,0 @@
-fedora-rawhide-i386.cfg

mock/fedora-39-i386.cfg

@@ -0,0 +1,5 @@
+config_opts['releasever'] = '39'
+config_opts['target_arch'] = 'i686'
+config_opts['legal_host_arches'] = ('i386', 'i586', 'i686', 'x86_64')
+
+include('templates/fedora-branched.tpl')

mock/fedora-39-ppc64le.cfg

@@ -1 +0,0 @@
-fedora-rawhide-ppc64le.cfg

mock/fedora-39-ppc64le.cfg

@@ -0,0 +1,5 @@
+config_opts['releasever'] = '39'
+config_opts['target_arch'] = 'ppc64le'
+config_opts['legal_host_arches'] = ('ppc64le',)
+
+include('templates/fedora-branched.tpl')

mock/fedora-39-s390x.cfg

@@ -1 +0,0 @@
-fedora-rawhide-s390x.cfg

mock/fedora-39-s390x.cfg

@@ -0,0 +1,5 @@
+config_opts['releasever'] = '39'
+config_opts['target_arch'] = 's390x'
+config_opts['legal_host_arches'] = ('s390x',)
+
+include('templates/fedora-branched.tpl')

mock/fedora-39-x86_64.cfg

@@ -1 +0,0 @@
-fedora-rawhide-x86_64.cfg

mock/fedora-39-x86_64.cfg

@@ -0,0 +1,5 @@
+config_opts['releasever'] = '39'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+
+include('templates/fedora-branched.tpl')

mock/fedora-40-aarch64.cfg

@@ -0,0 +1 @@
+fedora-rawhide-aarch64.cfg

mock/fedora-40-i386.cfg

@@ -0,0 +1 @@
+fedora-rawhide-i386.cfg

mock/fedora-40-ppc64le.cfg

@@ -0,0 +1 @@
+fedora-rawhide-ppc64le.cfg

mock/fedora-40-s390x.cfg

@@ -0,0 +1 @@
+fedora-rawhide-s390x.cfg

mock/fedora-40-x86_64.cfg

@@ -0,0 +1 @@
+fedora-rawhide-x86_64.cfg

mock/templates/almalinux-8.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8.alma'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'

mock/templates/almalinux-9.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils redhat-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils redhat-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 config_opts['dist'] = 'el9.alma'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '9'
 config_opts['package_manager'] = 'dnf'

mock/templates/amazonlinux-2023.tpl

@@ -1,5 +1,5 @@
 config_opts['root'] = 'amazonlinux-2023-{{ target_arch }}'
-config_opts['chroot_setup_cmd'] = 'install system-release bash bzip2 coreutils cpio diffutils findutils gawk glibc-minimal-langpack grep gzip info patch rpm-build sed shadow-utils system-rpm-config tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install system-release bash bzip2 coreutils cpio diffutils findutils gawk glibc-minimal-langpack grep gzip info patch rpm-build sed system-rpm-config tar unzip util-linux which xz'
 config_opts['dist'] = 'amzn2023' # only useful for --resultdir variable subst
 config_opts['plugin_conf']['ccache_enable'] = False
 config_opts['package_manager'] = 'dnf'

mock/templates/anolis-7.tpl

@@ -1,10 +1,13 @@
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config anolis-release rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config anolis-release rpm-build sed tar unzip util-linux which xz'
 
 config_opts['dist'] = 'an7'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '7'
 config_opts['package_manager'] = 'yum'
 config_opts['description'] = 'Anolis 7'
 
+# No v7 image https://hub.docker.com/r/openanolis/anolisos ?
+config_opts['use_bootstrap_image'] = False
+
 config_opts['yum.conf'] = """
 [main]
 keepcache=1

mock/templates/anolis-8.tpl

@@ -1,10 +1,12 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config anolis-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config anolis-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'an8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'
 config_opts['description'] = 'Anolis 8'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 
+config_opts['bootstrap_image'] = 'docker.io/openanolis/anolisos:8'
+
 config_opts['dnf.conf'] = """
 [main]
 keepcache=1

mock/templates/centos-7.tpl

@@ -1,6 +1,6 @@
 # This list is taken from 'epel-7-x86_64' @buildsys-build group, minus the
 # 'epel-*' specific stuff.
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 
 config_opts['dist'] = 'el7'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '7'

mock/templates/centos-stream-8.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'

mock/templates/centos-stream-9.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar redhat-rpm-config redhat-release which xz sed make bzip2 gzip coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep glibc-minimal-langpack'
+config_opts['chroot_setup_cmd'] = 'install tar redhat-rpm-config redhat-release which xz sed make bzip2 gzip coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep glibc-minimal-langpack'
 config_opts['dist'] = 'el9'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '9'
 config_opts['package_manager'] = 'dnf'

mock/templates/circlelinux-8.tpl

@@ -1,9 +1,11 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['bootstrap_image'] = 'docker.io/circlelinuxos/circlelinux:8'
+# Relates: https://github.com/rpm-software-management/mock/issues/1170
+config_opts['use_bootstrap_image'] = False
 
 
 config_opts['dnf.conf'] = """

mock/templates/eurolinux-8.tpl

@@ -1,12 +1,13 @@
 # EuroLinux open buildroots
 # Note: perl modules are broken by design
 
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['description'] = 'EuroLinux 8'
+config_opts['bootstrap_image'] = 'docker.io/eurolinux/eurolinux-8'
 
 config_opts['dnf.conf'] = """
 [main]

mock/templates/eurolinux-9.tpl

@@ -1,11 +1,12 @@
 # EuroLinux open buildroots
 
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el9'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '9'
 config_opts['package_manager'] = 'dnf'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['description'] = 'EuroLinux 9'
+config_opts['bootstrap_image'] = 'docker.io/eurolinux/eurolinux-9'
 
 config_opts['dnf.conf'] = """
 [main]

mock/templates/fedora-eln.tpl

@@ -1,5 +1,5 @@
 config_opts['releasever'] = 'eln'
-config_opts['eln_rawhide_releasever'] = '39'
+config_opts['eln_rawhide_releasever'] = '40'
 
 config_opts['root'] = 'fedora-eln-{{ target_arch }}'
 
@@ -8,7 +8,7 @@ config_opts['root'] = 'fedora-eln-{{ target_arch }}'
 # Note that similar idiom used in fedora-branched.tpl and fedora-rawhide.tpl.
 config_opts['mirrored'] = config_opts['target_arch'] != 'i686'
 
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils fedora-release-eln findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils fedora-release-eln findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 
 config_opts['dist'] = 'eln'  # only useful for --resultdir variable subst
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]

mock/templates/fedora-rawhide.tpl

@@ -7,7 +7,7 @@ config_opts['chroot_setup_cmd'] = 'install @{% if mirrored %}buildsys-{% endif %
 
 config_opts['dist'] = 'rawhide'  # only useful for --resultdir variable subst
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
-config_opts['releasever'] = '39'
+config_opts['releasever'] = '40'
 config_opts['package_manager'] = 'dnf'
 config_opts['bootstrap_image'] = 'registry.fedoraproject.org/fedora:rawhide'
 config_opts['description'] = 'Fedora Rawhide'

mock/templates/mageia-7.tpl

@@ -5,6 +5,7 @@ config_opts['releasever'] = '7'
 config_opts['macros']['%distro_section'] = 'core'
 config_opts['package_manager'] = 'dnf'
 config_opts['bootstrap_image'] = 'docker.io/library/mageia:7'
+config_opts['use_bootstrap_image'] = False
 config_opts['description'] = 'Mageia 7'
 
 config_opts['dnf.conf'] = """

mock/templates/mageia-branched.tpl

@@ -5,6 +5,7 @@ config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['macros']['%distro_section'] = 'core'
 config_opts['package_manager'] = 'dnf'
 config_opts['bootstrap_image'] = 'docker.io/library/mageia:{{ releasever }}'
+config_opts['use_bootstrap_image'] = False
 config_opts['description'] = 'Mageia {{ releasever }}'
 
 config_opts['dnf.conf'] = """

mock/templates/mageia-cauldron.tpl

@@ -5,7 +5,8 @@ config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['releasever'] = '9'
 config_opts['macros']['%distro_section'] = 'core'
 config_opts['package_manager'] = 'dnf'
-config_opts['bootstrap_image'] = 'mageia:cauldron'
+config_opts['bootstrap_image'] = 'docker.io/library/mageia:cauldron'
+config_opts['use_bootstrap_image'] = False
 config_opts['description'] = 'Mageia Cauldron'
 
 config_opts['dnf.conf'] = """

mock/templates/navy-8.tpl

@@ -1,9 +1,12 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config system-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config system-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['description'] = 'Navy Linux {{ releasever }}'
+# FIXME: this might soon stop working because the image is 8.4, see
+#        https://github.com/rpm-software-management/mock/issues/1171
+config_opts['bootstrap_image'] = 'docker.io/navylinux/navylinux:latest'
 
 config_opts['dnf.conf'] = """
 [main]

mock/templates/openeuler-20.03.tpl

@@ -1,8 +1,8 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ openEuler-rpm-config openEuler-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ openEuler-rpm-config openEuler-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'oe2003'  # only useful for --resultdir variable subst
-config_opts['releasever'] = '20.03-LTS'
+config_opts['releasever'] = '20.03LTS_SP3'
 config_opts['package_manager'] = 'dnf'
-config_opts['description'] = 'openEuler 20.03 LTS'
+config_opts['description'] = 'openEuler 20.03 LTS SP3'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['bootstrap_image'] = 'docker.io/openeuler/openeuler:20.03-lts'
 
@@ -28,42 +28,42 @@ user_agent={{ user_agent }}
 
 [OS]
 name=OS
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-20.03-LTS-SP3/OS&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/OS&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler
 
 [everything]
 name=everything
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-20.03-LTS-SP3/everything&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/everything&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler
 
 [EPOL]
 name=EPOL
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-20.03-LTS-SP3/EPOL/main&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/EPOL/main&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler
 
 [debuginfo]
 name=debuginfo
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-20.03-LTS-SP3/debuginfo&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/debuginfo&arch=$basearch
 enabled=0
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler
 
 [source]
 name=source
-metalink=https://mirrors.openeuler.org/metalink?path=openeuler/openEuler-20.03-LTS-SP3/source/repodata/repomd.xml
+metalink=https://mirrors.openeuler.org/metalink?path=openeuler/$releasever/source/repodata/repomd.xml
 enabled=0
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler
 
 [update]
 name=update
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-20.03-LTS-SP3/update&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler

mock/templates/openeuler-22.03.tpl

@@ -1,8 +1,8 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ openEuler-rpm-config openEuler-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ openEuler-rpm-config openEuler-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'oe2203'  # only useful for --resultdir variable subst
-config_opts['releasever'] = '22.03'
+config_opts['releasever'] = '22.03LTS_SP1'
 config_opts['package_manager'] = 'dnf'
-config_opts['description'] = 'openEuler 22.03'
+config_opts['description'] = 'openEuler 22.03 LTS SP1'
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['bootstrap_image'] = 'docker.io/openeuler/openeuler:22.03-lts'
 
@@ -31,49 +31,49 @@ user_agent={{ user_agent }}
 # all LTS-SPx is compatible with its LTS release
 [OS]
 name=OS
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-22.03-LTS-SP1/OS&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/OS&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker
 
 [everything]
 name=everything
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-22.03-LTS-SP1/everything&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/everything&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker
 
 [EPOL]
 name=EPOL
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-22.03-LTS-SP1/EPOL/main&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/EPOL/main&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker
 
 [debuginfo]
 name=debuginfo
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-22.03-LTS-SP1/debuginfo&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/debuginfo&arch=$basearch
 enabled=0
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker
 
 [source]
 name=source
-metalink=https://mirrors.openeuler.org/metalink?path=openeuler/openEuler-22.03-LTS-SP1/source/repodata/repomd.xml
+metalink=https://mirrors.openeuler.org/metalink?path=openeuler/$releasever/source/repodata/repomd.xml
 enabled=0
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker
 
 [update]
 name=update
-metalink=https://mirrors.openeuler.org/metalink?repo=openEuler-22.03-LTS-SP1/update&arch=$basearch
+metalink=https://mirrors.openeuler.org/metalink?repo=$releasever/update&arch=$basearch
 enabled=1
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker
 
 [update-source]
 name=update-source
-metalink=https://mirrors.openeuler.org/metalink?path=openeuler/openEuler-22.03-LTS-SP1/update/source/repodata/repomd.xml
+metalink=https://mirrors.openeuler.org/metalink?path=openeuler/$releasever/update/source/repodata/repomd.xml
 enabled=0
 gpgcheck=1
 gpgkey=file:///usr/share/distribution-gpg-keys/openeuler/RPM-GPG-KEY-openEuler-EulerMaker

mock/templates/openmandriva-branched.tpl

@@ -5,6 +5,9 @@ config_opts['macros']['%cross_compiling'] = '0' # Mock should generally be consi
 config_opts['package_manager'] = 'dnf'
 config_opts['description'] = 'OpenMandriva {{ releasever }}'
 
+# There's v4.2, but not v4.1, so we can not use releasever here, #1171
+config_opts['use_bootstrap_image'] = False
+
 config_opts['dnf.conf'] = """
 [main]
 keepcache=1

mock/templates/openmandriva-cooker.tpl

@@ -5,6 +5,7 @@ config_opts['releasever'] = '5.0'
 config_opts['macros']['%cross_compiling'] = '0' # Mock should generally be considered native builds
 config_opts['package_manager'] = 'dnf'
 config_opts['description'] = 'OpenMandriva Cooker {{ releasever }}'
+config_opts['bootstrap_image'] = 'docker.io/openmandriva/cooker:latest'
 
 config_opts['dnf.conf'] = """
 [main]

mock/templates/openmandriva-rolling.tpl

@@ -6,6 +6,9 @@ config_opts['macros']['%cross_compiling'] = '0' # Mock should generally be consi
 config_opts['package_manager'] = 'dnf'
 config_opts['description'] = 'OpenMandriva Rolling'
 
+# Is there a corresponding rolling image? #1171
+config_opts['use_bootstrap_image'] = False
+
 config_opts['dnf.conf'] = """
 [main]
 keepcache=1

mock/templates/oraclelinux-7.tpl

@@ -1,6 +1,6 @@
 # This list is taken from 'epel-7-x86_64' @buildsys-build group, minus the
 # 'epel-*' specific stuff.
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make oraclelinux-release patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make oraclelinux-release patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 
 config_opts['dist'] = 'el7'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '7'

mock/templates/oraclelinux-8.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release oraclelinux-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release oraclelinux-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'

mock/templates/oraclelinux-9.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar redhat-rpm-config redhat-release oraclelinux-release which xz sed make bzip2 gzip coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep glibc-minimal-langpack'
+config_opts['chroot_setup_cmd'] = 'install tar redhat-rpm-config redhat-release oraclelinux-release which xz sed make bzip2 gzip coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep glibc-minimal-langpack'
 config_opts['dist'] = 'el9'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '9'
 config_opts['package_manager'] = 'dnf'

mock/templates/rhel-7.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils findutils gawk gcc gcc-c++ grep gzip info make patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 config_opts['dist'] = 'el7'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '7Server'
 config_opts['package_manager'] = 'yum'

mock/templates/rhel-8.tpl

@@ -1,9 +1,10 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'
 config_opts['bootstrap_image'] = 'registry.access.redhat.com/ubi8/ubi'
+config_opts['bootstrap_image_ready'] = True
 config_opts['description'] = 'RHEL 8'
 
 config_opts['dnf_install_command'] += ' subscription-manager'

mock/templates/rhel-9.tpl

@@ -1,9 +1,10 @@
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils redhat-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils redhat-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 config_opts['releasever'] = '9'
 config_opts['dist'] = 'el{{ releasever }}'  # only useful for --resultdir variable subst
 config_opts['extra_chroot_dirs'] = [ '/run/lock', ]
 config_opts['package_manager'] = 'dnf'
 config_opts['bootstrap_image'] = 'registry.access.redhat.com/ubi{{ releasever }}/ubi'
+config_opts['bootstrap_image_ready'] = True
 config_opts['description'] = 'RHEL {{ releasever }}'
 
 config_opts['dnf_install_command'] += ' subscription-manager'

mock/templates/rocky-8.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip shadow-utils diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
+config_opts['chroot_setup_cmd'] = 'install tar gcc-c++ redhat-rpm-config redhat-release which xz sed make bzip2 gzip gcc coreutils unzip diffutils cpio bash gawk rpm-build info patch util-linux findutils grep'
 config_opts['dist'] = 'el8'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '8'
 config_opts['package_manager'] = 'dnf'

mock/templates/rocky-9.tpl

@@ -1,4 +1,4 @@
-config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils redhat-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed shadow-utils tar unzip util-linux which xz'
+config_opts['chroot_setup_cmd'] = 'install bash bzip2 coreutils cpio diffutils redhat-release findutils gawk glibc-minimal-langpack grep gzip info patch redhat-rpm-config rpm-build sed tar unzip util-linux which xz'
 config_opts['dist'] = 'el9'  # only useful for --resultdir variable subst
 config_opts['releasever'] = '9'
 config_opts['package_manager'] = 'dnf'

rspamd/composites.conf

@@ -65,18 +65,16 @@ composites {
     expression = "-R_DKIM_ALLOW & (R_DKIM_TEMPFAIL | R_DKIM_PERMFAIL | R_DKIM_REJECT)"
     policy = "remove_weight";
   }
-  MAIL_RU_MAILER_BASE64 {
+  APPLE_MAILER_COMMON {
-    expression = "MAIL_RU_MAILER & (FROM_EXCESS_BASE64 | MIME_BASE64_TEXT | REPLYTO_EXCESS_BASE64 | SUBJ_EXCESS_BASE64 | TO_EXCESS_BASE64)";
+    description = "Message was sent by 'Apple Mail' and has common symbols in place";
+    expression = "APPLE_MAILER & MV_CASE";
   }
-  YANDEX_RU_MAILER_CTYPE_MIXED_BOGUS {
+  APPLE_IOS_MAILER_COMMON {
-    expression = "YANDEX_RU_MAILER & -HAS_ATTACHMENT & CTYPE_MIXED_BOGUS";
+    description = "Message was sent by 'Apple iOS Mail' and has common symbols in place";
-  }
+    expression = "APPLE_IOS_MAILER & (MV_CASE | MIME_MA_MISSING_TEXT)";
-  MAILER_1C_8_BASE64 {
-    expression = "MAILER_1C_8 & (FROM_EXCESS_BASE64 | MIME_BASE64_TEXT | SUBJ_EXCESS_BASE64 | TO_EXCESS_BASE64)";
-    description = "Message was sent by '1C:Enterprise 8' and uses base64 encoded data";
   }
   HACKED_WP_PHISHING {
-    expression = "(HAS_X_POS | HAS_PHPMAILER_SIG) & HAS_WP_URI & (PHISHING | DBL_PHISH | PHISHED_OPENPHISH | PHISHED_PHISHTANK)";
+    expression = "(HAS_X_POS | HAS_PHPMAILER_SIG) & HAS_WP_URI & (PHISHING | CRACKED_SURBL | PH_SURBL_MULTI | DBL_PHISH | DBL_ABUSE_PHISH | URIBL_BLACK | PHISHED_OPENPHISH | PHISHED_PHISHTANK)";
     description = "Phish message sent by hacked Wordpress instance";
     policy = "leave";
   }
@@ -93,8 +91,8 @@ composites {
     policy = "leave";
   }
   RCVD_UNAUTH_PBL {
-    expression = "RECEIVED_PBL & !RCVD_VIA_SMTP_AUTH";
+    expression = "RECEIVED_SPAMHAUS_PBL & !RCVD_VIA_SMTP_AUTH";
-    description = "Relayed through Spamhaus PBL IP without sufficient authentication (possible indicating an open relay)";
+    description = "Relayed through Spamhaus PBL IP without sufficient authentication (possibly indicating an open relay)";
     score = 2.0;
     policy = "leave";
   }
@@ -159,11 +157,24 @@ composites {
     group = "scams";
   }
   FREEMAIL_AFF {
-    expression = "(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO) & R_UNDISC_RCPT & (INTRODUCTION | FROM_NAME_HAS_TITLE | FREEMAIL_REPLYTO_NEQ_FROM_DOM)";
+    expression = "(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO) & (TO_DN_RECIPIENTS | R_UNDISC_RCPT) & (INTRODUCTION | FROM_NAME_HAS_TITLE | FREEMAIL_REPLYTO_NEQ_FROM_DOM)";
     score = 4.0;
     policy = "leave";
     description = "Message exhibits strong characteristics of advance fee fraud (AFF a/k/a '419' spam) involving freemail addresses";
   }
+  REDIRECTOR_URL_ONLY {
+    expression = "HFILTER_URL_ONLY & REDIRECTOR_URL";
+    score = 1.0;
+    policy = "leave";
+    description = "Message only contains a redirector URL";
+  }
+  THREAD_HIJACKING_FROM_INJECTOR {
+    expression = "FAKE_REPLY & RCVD_VIA_SMTP_AUTH & (!RECEIVED_SPAMHAUS_PBL | RECEIVED_SPAMHAUS_XBL | RECEIVED_SPAMHAUS_SBL)";
+    score = 2.0;
+    policy = "leave";
+    description = "Fake reply exhibiting characteristics of being injected into a compromised mail server, possibly e-mail thread hijacking";
+    group = "compromised_hosts";
+  }
 
   .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf"
   .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf"

rspamd/lang_detection.inc

@@ -0,0 +1,28 @@
+# Language detection configuration
+# Please don't modify this file as your changes might be overwritten with
+# the next update.
+#
+# You can modify 'local.d/lang_detection.inc' to add and merge
+# parameters defined inside this section
+#
+# You can modify 'override.d/lang_detection.inc' to strictly override all
+# parameters defined inside this section
+
+# Path to the languages shared data
+# languages = "${RSPAMD_SHAREDIR}/languages"
+
+# Limit in words to treat text as short for language detection
+# short_text_limit = 10
+
+# Enable only specific languages
+# languages_enable = ["en", "de"]
+
+# Disable specific languages
+# languages_disable = ["fr", "es"]
+
+# Use the following fasttext model for language detection (if Fasttext support is compiled in)
+# fasttext_model = "${RSPAMD_SHAREDIR}/languages/fasttext_model.ftz"
+
+# Prefer fasttext over all other methods
+# prefer_fasttext = true;
+

rspamd/modules.d/multimap.conf

@@ -20,6 +20,7 @@ multimap {
     symbol = "REDIRECTOR_URL";
     description = "The presence of a redirector in the mail";
     score = 0.0;
+    one_shot = true;
   }
 
   # Freemail Addresses
@@ -39,6 +40,7 @@ multimap {
     symbol = "FREEMAIL_ENVRCPT";
     description = "Envelope Recipient is a Freemail address";
     score = 0.0;
+    one_shot = true;
   }
 
   freemail_from {
@@ -59,6 +61,7 @@ multimap {
     symbol = "FREEMAIL_TO";
     description = "To is a Freemail address";
     score = 0.0;
+    one_shot = true;
   }
 
   freemail_cc {
@@ -69,6 +72,7 @@ multimap {
     symbol = "FREEMAIL_CC";
     description = "To is a Freemail address";
     score = 0.0;
+    one_shot = true;
   }
 
   freemail_replyto {
@@ -98,6 +102,7 @@ multimap {
     symbol = "DISPOSABLE_ENVRCPT";
     description = "Envelope Recipient is a Disposable e-mail address";
     score = 0.0;
+    one_shot = true;
   }
 
   disposable_from {
@@ -118,6 +123,7 @@ multimap {
     symbol = "DISPOSABLE_TO";
     description = "To a disposable e-mail address";
     score = 0.0;
+    one_shot = true;
   }
 
   disposable_cc {
@@ -128,6 +134,7 @@ multimap {
     symbol = "DISPOSABLE_CC";
     description = "To a disposable e-mail address";
     score = 0.0;
+    one_shot = true;
   }
 
   disposable_replyto {

rspamd/rspamd.conf.rpmnew

@@ -0,0 +1,73 @@
+# System V init adopted top level configuration
+
+# Please don't modify this file as your changes might be overwritten with
+# the next update.
+#
+# You can modify '$LOCAL_CONFDIR/rspamd.conf.local.override' to redefine
+# parameters defined on the top level
+#
+# You can modify '$LOCAL_CONFDIR/rspamd.conf.local' to add
+# parameters defined on the top level
+#
+# For specific modules or configuration you can also modify
+# '$LOCAL_CONFDIR/local.d/file.conf' - to add your options or rewrite defaults
+# '$LOCAL_CONFDIR/override.d/file.conf' - to override the defaults
+#
+# See https://rspamd.com/doc/tutorials/writing_rules.html for details
+
+.include "$CONFDIR/common.conf"
+
+options {
+    pidfile = "$RUNDIR/rspamd.pid";
+    .include "$CONFDIR/options.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/options.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/options.inc"
+}
+
+lang_detection {
+    .include "$CONFDIR/lang_detection.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/lang_detection.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/lang_detection.inc"
+}
+
+.include(try=true; duplicate=merge) "$CONFDIR/cgp.inc"
+.include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/cgp.inc"
+
+logging {
+    type = "file";
+    filename = "$LOGDIR/rspamd.log";
+    .include "$CONFDIR/logging.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/logging.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/logging.inc"
+}
+
+worker "normal" {
+    bind_socket = "localhost:11333";
+    .include "$CONFDIR/worker-normal.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/worker-normal.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/worker-normal.inc"
+}
+
+worker "controller" {
+    bind_socket = "localhost:11334";
+    .include "$CONFDIR/worker-controller.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/worker-controller.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/worker-controller.inc"
+}
+
+worker "rspamd_proxy" {
+    bind_socket = "localhost:11332";
+    .include "$CONFDIR/worker-proxy.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/worker-proxy.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/worker-proxy.inc"
+}
+
+# Local fuzzy storage is disabled by default
+
+worker "fuzzy" {
+    bind_socket = "localhost:11335";
+    count = -1; # Disable by default
+    .include "$CONFDIR/worker-fuzzy.inc"
+    .include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/worker-fuzzy.inc"
+    .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/worker-fuzzy.inc"
+}

rspamd/scores.d/phishing_group.conf

@@ -35,12 +35,17 @@ symbols = {
     }
     HACKED_WP_PHISHING {
         weight = 4.5;
-        description = "Phishing message from hacked wordpress";
+        description = "Phish message sent by hacked Wordpress instance";
     }
     REDIRECTOR_FALSE {
         weight = 0.0;
         description = "Phishing exclusion symbol for known redirectors";
     }
+    URL_REDIRECTOR_NESTED {
+        weight = 1.0;
+        description = "URL redirector nested limit has been reached";
+        one_shot = true;
+    }
     PHISHED_WHITELISTED {
         weight = 0.0;
         description = "Phishing exclusion symbol for known exceptions";

rspamd/scores.d/rbl_group.conf

@@ -135,7 +135,7 @@ symbols = {
     }
     "RECEIVED_SPAMHAUS_XBL" {
         weight = 1.0;
-        description = "Received address is listed in ZEN XBL";
+        description = "Received address is listed in Spamhaus XBL";
         groups = ["spamhaus"];
         one_shot = true;
     }

rspamd/scores.d/surbl_group.conf

@@ -46,7 +46,7 @@ symbols = {
     }
     "CRACKED_SURBL" {
         weight = 4.0;
-        description = "A domain in the message is listed in as SURBL cracked";
+        description = "A domain in the message is listed in SURBL as cracked";
         one_shot = true;
         groups = ["surblorg"];
     }