From 2b83a4bd1d07ac648f4ee3ea4b3ab4d65e943334 Mon Sep 17 00:00:00 2001
From: Lukas Vrabec <lvrabec@redhat.com>
Date: Oct 10 2017 10:31:41 +0000
Subject: * Tue Oct 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-295

- Allow boinc_t to mmap files with label boinc_project_var_lib_t BZ(1500088)
- Allow fail2ban_t domain to mmap journals. BZ(1500089)
- Add dac_override to abrt_t domain BZ(1499860)
- Allow pppd domain to mmap own pid files BZ(1498587)
- Allow webserver services to mmap files with label httpd_sys_content_t BZ(1498451)
- Allow tlp domain to read sssd public files Allow tlp domain to mmap kernel modules
- Allow systemd to read sysfs sym links. BZ(1499327)
- Allow systemd to mmap systemd_networkd_exec_t files BZ(1499863)
- Make systemd_networkd_var_run as mountpoint BZ(1499862)
- Allow noatsecure for java-based unconfined services. BZ(1358476)
- Allow systemd_modules_load_t domain to mmap kernel modules. BZ(1490015)

---

diff --git a/container-selinux.tgz b/container-selinux.tgz
index cbce65e..a0acbbe 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 49a586b..aaf77a1 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -37908,7 +37908,7 @@ index 79a45f62e..6ed0c399a 100644
 +    allow $1 init_var_lib_t:dir search_dir_perms;
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda2480..fa8d5f276 100644
+index 17eda2480..cc1720cf2 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -38089,7 +38089,7 @@ index 17eda2480..fa8d5f276 100644
  
  allow init_t initctl_t:fifo_file manage_fifo_file_perms;
  dev_filetrans(init_t, initctl_t, fifo_file)
-@@ -125,13 +213,28 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr };
+@@ -125,13 +213,29 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr };
  
  kernel_read_system_state(init_t)
  kernel_share_state(init_t)
@@ -38107,6 +38107,7 @@ index 17eda2480..fa8d5f276 100644
 +corenet_udp_bind_all_ports(init_t)
 +
 +dev_create_all_chr_files(init_t)
++dev_list_sysfs(init_t)
 +dev_manage_sysfs(init_t)
 +dev_read_urand(init_t)
 +dev_read_raw_memory(init_t)
@@ -38119,7 +38120,7 @@ index 17eda2480..fa8d5f276 100644
  
  domain_getpgid_all_domains(init_t)
  domain_kill_all_domains(init_t)
-@@ -139,45 +242,103 @@ domain_signal_all_domains(init_t)
+@@ -139,45 +243,103 @@ domain_signal_all_domains(init_t)
  domain_signull_all_domains(init_t)
  domain_sigstop_all_domains(init_t)
  domain_sigchld_all_domains(init_t)
@@ -38230,7 +38231,7 @@ index 17eda2480..fa8d5f276 100644
  
  ifdef(`distro_gentoo',`
  	allow init_t self:process { getcap setcap };
-@@ -186,29 +347,293 @@ ifdef(`distro_gentoo',`
+@@ -186,29 +348,294 @@ ifdef(`distro_gentoo',`
  ')
  
  ifdef(`distro_redhat',`
@@ -38451,6 +38452,7 @@ index 17eda2480..fa8d5f276 100644
 +systemd_config_all_services(initrc_t)
 +systemd_read_unit_files(initrc_t)
 +systemd_login_status(init_t)
++systemd_map_networkd_exec_files(init_t)
 +
 +create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
 +
@@ -38533,7 +38535,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -216,7 +641,34 @@ optional_policy(`
+@@ -216,7 +643,35 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38566,10 +38568,11 @@ index 17eda2480..fa8d5f276 100644
 +optional_policy(`
 +	domain_named_filetrans(init_t)
 +	unconfined_server_domtrans(init_t)
++    unconfined_server_noatsecure(init_t)
  ')
  
  ########################################
-@@ -225,9 +677,9 @@ optional_policy(`
+@@ -225,9 +680,9 @@ optional_policy(`
  #
  
  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -38581,7 +38584,7 @@ index 17eda2480..fa8d5f276 100644
  allow initrc_t self:passwd rootok;
  allow initrc_t self:key manage_key_perms;
  
-@@ -258,12 +710,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
+@@ -258,12 +713,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
  
  allow initrc_t initrc_var_run_t:file manage_file_perms;
  files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -38598,7 +38601,7 @@ index 17eda2480..fa8d5f276 100644
  
  manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
  manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
-@@ -279,23 +735,36 @@ kernel_change_ring_buffer_level(initrc_t)
+@@ -279,23 +738,36 @@ kernel_change_ring_buffer_level(initrc_t)
  kernel_clear_ring_buffer(initrc_t)
  kernel_get_sysvipc_info(initrc_t)
  kernel_read_all_sysctls(initrc_t)
@@ -38641,7 +38644,7 @@ index 17eda2480..fa8d5f276 100644
  corenet_tcp_sendrecv_all_ports(initrc_t)
  corenet_udp_sendrecv_all_ports(initrc_t)
  corenet_tcp_connect_all_ports(initrc_t)
-@@ -303,9 +772,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
+@@ -303,9 +775,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
  
  dev_read_rand(initrc_t)
  dev_read_urand(initrc_t)
@@ -38653,7 +38656,7 @@ index 17eda2480..fa8d5f276 100644
  dev_rw_sysfs(initrc_t)
  dev_list_usbfs(initrc_t)
  dev_read_framebuffer(initrc_t)
-@@ -313,8 +784,10 @@ dev_write_framebuffer(initrc_t)
+@@ -313,8 +787,10 @@ dev_write_framebuffer(initrc_t)
  dev_read_realtime_clock(initrc_t)
  dev_read_sound_mixer(initrc_t)
  dev_write_sound_mixer(initrc_t)
@@ -38664,7 +38667,7 @@ index 17eda2480..fa8d5f276 100644
  dev_delete_lvm_control_dev(initrc_t)
  dev_manage_generic_symlinks(initrc_t)
  dev_manage_generic_files(initrc_t)
-@@ -322,8 +795,7 @@ dev_manage_generic_files(initrc_t)
+@@ -322,8 +798,7 @@ dev_manage_generic_files(initrc_t)
  dev_delete_generic_symlinks(initrc_t)
  dev_getattr_all_blk_files(initrc_t)
  dev_getattr_all_chr_files(initrc_t)
@@ -38674,7 +38677,7 @@ index 17eda2480..fa8d5f276 100644
  
  domain_kill_all_domains(initrc_t)
  domain_signal_all_domains(initrc_t)
-@@ -332,7 +804,6 @@ domain_sigstop_all_domains(initrc_t)
+@@ -332,7 +807,6 @@ domain_sigstop_all_domains(initrc_t)
  domain_sigchld_all_domains(initrc_t)
  domain_read_all_domains_state(initrc_t)
  domain_getattr_all_domains(initrc_t)
@@ -38682,7 +38685,7 @@ index 17eda2480..fa8d5f276 100644
  domain_getsession_all_domains(initrc_t)
  domain_use_interactive_fds(initrc_t)
  # for lsof which is used by alsa shutdown:
-@@ -340,6 +811,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
+@@ -340,6 +814,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
  domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
  domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
  domain_dontaudit_getattr_all_pipes(initrc_t)
@@ -38690,7 +38693,7 @@ index 17eda2480..fa8d5f276 100644
  
  files_getattr_all_dirs(initrc_t)
  files_getattr_all_files(initrc_t)
-@@ -347,14 +819,15 @@ files_getattr_all_symlinks(initrc_t)
+@@ -347,14 +822,15 @@ files_getattr_all_symlinks(initrc_t)
  files_getattr_all_pipes(initrc_t)
  files_getattr_all_sockets(initrc_t)
  files_purge_tmp(initrc_t)
@@ -38708,7 +38711,7 @@ index 17eda2480..fa8d5f276 100644
  files_read_usr_files(initrc_t)
  files_manage_urandom_seed(initrc_t)
  files_manage_generic_spool(initrc_t)
-@@ -364,8 +837,12 @@ files_list_isid_type_dirs(initrc_t)
+@@ -364,8 +840,12 @@ files_list_isid_type_dirs(initrc_t)
  files_mounton_isid_type_dirs(initrc_t)
  files_list_default(initrc_t)
  files_mounton_default(initrc_t)
@@ -38722,7 +38725,7 @@ index 17eda2480..fa8d5f276 100644
  fs_list_inotifyfs(initrc_t)
  fs_register_binary_executable_type(initrc_t)
  # rhgb-console writes to ramfs
-@@ -375,10 +852,11 @@ fs_mount_all_fs(initrc_t)
+@@ -375,10 +855,11 @@ fs_mount_all_fs(initrc_t)
  fs_unmount_all_fs(initrc_t)
  fs_remount_all_fs(initrc_t)
  fs_getattr_all_fs(initrc_t)
@@ -38736,7 +38739,7 @@ index 17eda2480..fa8d5f276 100644
  mcs_process_set_categories(initrc_t)
  
  mls_file_read_all_levels(initrc_t)
-@@ -387,8 +865,10 @@ mls_process_read_up(initrc_t)
+@@ -387,8 +868,10 @@ mls_process_read_up(initrc_t)
  mls_process_write_down(initrc_t)
  mls_rangetrans_source(initrc_t)
  mls_fd_share_all_levels(initrc_t)
@@ -38747,7 +38750,7 @@ index 17eda2480..fa8d5f276 100644
  
  storage_getattr_fixed_disk_dev(initrc_t)
  storage_setattr_fixed_disk_dev(initrc_t)
-@@ -398,6 +878,7 @@ term_use_all_terms(initrc_t)
+@@ -398,6 +881,7 @@ term_use_all_terms(initrc_t)
  term_reset_tty_labels(initrc_t)
  
  auth_rw_login_records(initrc_t)
@@ -38755,7 +38758,7 @@ index 17eda2480..fa8d5f276 100644
  auth_setattr_login_records(initrc_t)
  auth_rw_lastlog(initrc_t)
  auth_read_pam_pid(initrc_t)
-@@ -416,20 +897,18 @@ logging_read_all_logs(initrc_t)
+@@ -416,20 +900,18 @@ logging_read_all_logs(initrc_t)
  logging_append_all_logs(initrc_t)
  logging_read_audit_config(initrc_t)
  
@@ -38779,7 +38782,7 @@ index 17eda2480..fa8d5f276 100644
  
  ifdef(`distro_debian',`
  	dev_setattr_generic_dirs(initrc_t)
-@@ -451,7 +930,6 @@ ifdef(`distro_gentoo',`
+@@ -451,7 +933,6 @@ ifdef(`distro_gentoo',`
  	allow initrc_t self:process setfscreate;
  	dev_create_null_dev(initrc_t)
  	dev_create_zero_dev(initrc_t)
@@ -38787,7 +38790,7 @@ index 17eda2480..fa8d5f276 100644
  	term_create_console_dev(initrc_t)
  
  	# unfortunately /sbin/rc does stupid tricks
-@@ -486,6 +964,10 @@ ifdef(`distro_gentoo',`
+@@ -486,6 +967,10 @@ ifdef(`distro_gentoo',`
  	sysnet_setattr_config(initrc_t)
  
  	optional_policy(`
@@ -38798,7 +38801,7 @@ index 17eda2480..fa8d5f276 100644
  		alsa_read_lib(initrc_t)
  	')
  
-@@ -506,7 +988,7 @@ ifdef(`distro_redhat',`
+@@ -506,7 +991,7 @@ ifdef(`distro_redhat',`
  
  	# Red Hat systems seem to have a stray
  	# fd open from the initrd
@@ -38807,7 +38810,7 @@ index 17eda2480..fa8d5f276 100644
  	files_dontaudit_read_root_files(initrc_t)
  
  	# These seem to be from the initrd
-@@ -521,6 +1003,7 @@ ifdef(`distro_redhat',`
+@@ -521,6 +1006,7 @@ ifdef(`distro_redhat',`
  	files_create_boot_dirs(initrc_t)
  	files_create_boot_flag(initrc_t)
  	files_rw_boot_symlinks(initrc_t)
@@ -38815,7 +38818,7 @@ index 17eda2480..fa8d5f276 100644
  	# wants to read /.fonts directory
  	files_read_default_files(initrc_t)
  	files_mountpoint(initrc_tmp_t)
-@@ -541,6 +1024,7 @@ ifdef(`distro_redhat',`
+@@ -541,6 +1027,7 @@ ifdef(`distro_redhat',`
  	miscfiles_rw_localization(initrc_t)
  	miscfiles_setattr_localization(initrc_t)
  	miscfiles_relabel_localization(initrc_t)
@@ -38823,7 +38826,7 @@ index 17eda2480..fa8d5f276 100644
  
  	miscfiles_read_fonts(initrc_t)
  	miscfiles_read_hwdata(initrc_t)
-@@ -550,8 +1034,44 @@ ifdef(`distro_redhat',`
+@@ -550,8 +1037,44 @@ ifdef(`distro_redhat',`
  	')
  
  	optional_policy(`
@@ -38868,7 +38871,7 @@ index 17eda2480..fa8d5f276 100644
  	')
  
  	optional_policy(`
-@@ -559,14 +1079,31 @@ ifdef(`distro_redhat',`
+@@ -559,14 +1082,31 @@ ifdef(`distro_redhat',`
  		rpc_write_exports(initrc_t)
  		rpc_manage_nfs_state_data(initrc_t)
  	')
@@ -38900,7 +38903,7 @@ index 17eda2480..fa8d5f276 100644
  	')
  ')
  
-@@ -577,6 +1114,39 @@ ifdef(`distro_suse',`
+@@ -577,6 +1117,39 @@ ifdef(`distro_suse',`
  	')
  ')
  
@@ -38940,7 +38943,7 @@ index 17eda2480..fa8d5f276 100644
  optional_policy(`
  	amavis_search_lib(initrc_t)
  	amavis_setattr_pid_files(initrc_t)
-@@ -589,6 +1159,8 @@ optional_policy(`
+@@ -589,6 +1162,8 @@ optional_policy(`
  optional_policy(`
  	apache_read_config(initrc_t)
  	apache_list_modules(initrc_t)
@@ -38949,7 +38952,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -610,6 +1182,7 @@ optional_policy(`
+@@ -610,6 +1185,7 @@ optional_policy(`
  
  optional_policy(`
  	cgroup_stream_connect_cgred(initrc_t)
@@ -38957,7 +38960,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -626,6 +1199,17 @@ optional_policy(`
+@@ -626,6 +1202,17 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38975,7 +38978,7 @@ index 17eda2480..fa8d5f276 100644
  	dev_getattr_printer_dev(initrc_t)
  
  	cups_read_log(initrc_t)
-@@ -642,9 +1226,13 @@ optional_policy(`
+@@ -642,9 +1229,13 @@ optional_policy(`
  	dbus_connect_system_bus(initrc_t)
  	dbus_system_bus_client(initrc_t)
  	dbus_read_config(initrc_t)
@@ -38989,7 +38992,7 @@ index 17eda2480..fa8d5f276 100644
  	')
  
  	optional_policy(`
-@@ -657,15 +1245,11 @@ optional_policy(`
+@@ -657,15 +1248,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39007,7 +39010,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -686,6 +1270,15 @@ optional_policy(`
+@@ -686,6 +1273,15 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39023,7 +39026,7 @@ index 17eda2480..fa8d5f276 100644
  	inn_exec_config(initrc_t)
  ')
  
-@@ -726,6 +1319,7 @@ optional_policy(`
+@@ -726,6 +1322,7 @@ optional_policy(`
  	lpd_list_spool(initrc_t)
  
  	lpd_read_config(initrc_t)
@@ -39031,7 +39034,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -743,7 +1337,13 @@ optional_policy(`
+@@ -743,7 +1340,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39046,7 +39049,7 @@ index 17eda2480..fa8d5f276 100644
  	mta_dontaudit_read_spool_symlinks(initrc_t)
  ')
  
-@@ -766,6 +1366,10 @@ optional_policy(`
+@@ -766,6 +1369,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39057,7 +39060,7 @@ index 17eda2480..fa8d5f276 100644
  	postgresql_manage_db(initrc_t)
  	postgresql_read_config(initrc_t)
  ')
-@@ -775,10 +1379,20 @@ optional_policy(`
+@@ -775,10 +1382,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39078,7 +39081,7 @@ index 17eda2480..fa8d5f276 100644
  	quota_manage_flags(initrc_t)
  ')
  
-@@ -787,6 +1401,10 @@ optional_policy(`
+@@ -787,6 +1404,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39089,7 +39092,7 @@ index 17eda2480..fa8d5f276 100644
  	fs_write_ramfs_sockets(initrc_t)
  	fs_search_ramfs(initrc_t)
  
-@@ -808,8 +1426,6 @@ optional_policy(`
+@@ -808,8 +1429,6 @@ optional_policy(`
  	# bash tries ioctl for some reason
  	files_dontaudit_ioctl_all_pids(initrc_t)
  
@@ -39098,7 +39101,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -818,6 +1434,10 @@ optional_policy(`
+@@ -818,6 +1437,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39109,7 +39112,7 @@ index 17eda2480..fa8d5f276 100644
  	# shorewall-init script run /var/lib/shorewall/firewall
  	shorewall_lib_domtrans(initrc_t)
  ')
-@@ -827,10 +1447,12 @@ optional_policy(`
+@@ -827,10 +1450,12 @@ optional_policy(`
  	squid_manage_logs(initrc_t)
  ')
  
@@ -39122,7 +39125,7 @@ index 17eda2480..fa8d5f276 100644
  
  optional_policy(`
  	ssh_dontaudit_read_server_keys(initrc_t)
-@@ -857,21 +1479,62 @@ optional_policy(`
+@@ -857,21 +1482,62 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39186,7 +39189,7 @@ index 17eda2480..fa8d5f276 100644
  ')
  
  optional_policy(`
-@@ -887,6 +1550,10 @@ optional_policy(`
+@@ -887,6 +1553,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39197,7 +39200,7 @@ index 17eda2480..fa8d5f276 100644
  	# Set device ownerships/modes.
  	xserver_setattr_console_pipes(initrc_t)
  
-@@ -897,3 +1564,218 @@ optional_policy(`
+@@ -897,3 +1567,218 @@ optional_policy(`
  optional_policy(`
  	zebra_read_config(initrc_t)
  ')
@@ -47755,7 +47758,7 @@ index 2cea692c0..853ddefe4 100644
 +	files_pid_filetrans($1, net_conf_t, dir, "cloud-init")
 +')
 diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index a392fc4bc..d29b7f6fb 100644
+index a392fc4bc..a61ba7d4e 100644
 --- a/policy/modules/system/sysnetwork.te
 +++ b/policy/modules/system/sysnetwork.te
 @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4)
@@ -47821,7 +47824,7 @@ index a392fc4bc..d29b7f6fb 100644
 +
  manage_files_pattern(dhcpc_t, dhcpc_state_t, dhcpc_state_t)
  filetrans_pattern(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
-+allow dhcpc_t dhcpc_state_t:file relabel_file_perms;
++allow dhcpc_t dhcpc_state_t:file { map relabel_file_perms };
  
  # create pid file
  manage_files_pattern(dhcpc_t, dhcpc_var_run_t, dhcpc_var_run_t)
@@ -48270,10 +48273,10 @@ index 000000000..121b42208
 +/var/run/initramfs(/.*)?	<<none>>
 diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
 new file mode 100644
-index 000000000..634d9596a
+index 000000000..5871e072d
 --- /dev/null
 +++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1862 @@
+@@ -0,0 +1,1880 @@
 +## <summary>SELinux policy for systemd components</summary>
 +
 +######################################
@@ -50136,12 +50139,30 @@ index 000000000..634d9596a
 +    files_type($1)
 +    typeattribute $1 systemd_mount_directory;
 +')
++
++########################################
++## <summary>
++##	Mmap systemd_networkd_exec_t files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`systemd_map_networkd_exec_files',`
++	gen_require(`
++		type systemd_networkd_exec_t;
++	')
++
++	allow $1 systemd_networkd_exec_t:file map;
++')
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
 new file mode 100644
-index 000000000..e83a61cca
+index 000000000..e944cee17
 --- /dev/null
 +++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,1027 @@
+@@ -0,0 +1,1029 @@
 +policy_module(systemd, 1.0.0)
 +
 +#######################################
@@ -50195,6 +50216,7 @@ index 000000000..e83a61cca
 +
 +type systemd_networkd_var_run_t;
 +files_pid_file(systemd_networkd_var_run_t)
++files_mountpoint(systemd_networkd_var_run_t)
 +
 +systemd_domain_template(systemd_initctl)
 +
@@ -51138,6 +51160,7 @@ index 000000000..e83a61cca
 +
 +dev_read_sysfs(systemd_modules_load_t)
 +
++files_map_kernel_modules(systemd_modules_load_t)
 +files_read_kernel_modules(systemd_modules_load_t)
 +modutils_read_module_config(systemd_modules_load_t)
 +
@@ -51768,7 +51791,7 @@ index 0abaf8432..8b34dbc09 100644
 -/usr/lib/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
 -')
 diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
-index 5ca20a97d..5454d1668 100644
+index 5ca20a97d..43bb011b3 100644
 --- a/policy/modules/system/unconfined.if
 +++ b/policy/modules/system/unconfined.if
 @@ -12,53 +12,57 @@
@@ -51880,7 +51903,7 @@ index 5ca20a97d..5454d1668 100644
  ')
  
  ########################################
-@@ -175,343 +185,12 @@ interface(`unconfined_alias_domain',`
+@@ -175,258 +185,12 @@ interface(`unconfined_alias_domain',`
  ## </param>
  #
  interface(`unconfined_execmem_alias_program',`
@@ -52131,18 +52154,20 @@ index 5ca20a97d..5454d1668 100644
 -	')
 -
 -	dontaudit $1 unconfined_t:fifo_file read;
--')
--
--########################################
--## <summary>
++	refpolicywarn(`$0() has been deprecated.')
+ ')
+ 
+ ########################################
+ ## <summary>
 -##	Read and write unconfined domain unnamed pipes.
--## </summary>
--## <param name="domain">
--##	<summary>
--##	Domain allowed access.
--##	</summary>
--## </param>
--#
++##	Connect to unconfined_server with a unix socket.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -434,84 +198,19 @@ interface(`unconfined_dontaudit_read_pipes',`
+ ##	</summary>
+ ## </param>
+ #
 -interface(`unconfined_rw_pipes',`
 -	gen_require(`
 -		type unconfined_t;
@@ -52211,12 +52236,16 @@ index 5ca20a97d..5454d1668 100644
 -## </param>
 -#
 -interface(`unconfined_dontaudit_rw_tcp_sockets',`
--	gen_require(`
++interface(`unconfined_server_stream_connect',`
+ 	gen_require(`
 -		type unconfined_t;
--	')
--
++		type unconfined_service_t;
+ 	')
+ 
 -	dontaudit $1 unconfined_t:tcp_socket { read write };
-+	refpolicywarn(`$0() has been deprecated.')
++	files_search_pids($1)
++	files_write_generic_pid_pipes($1)
++	allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
  ')
  
  ########################################
@@ -52226,87 +52255,85 @@ index 5ca20a97d..5454d1668 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -519,17 +198,19 @@ interface(`unconfined_dontaudit_rw_tcp_sockets',`
+@@ -519,17 +218,17 @@ interface(`unconfined_dontaudit_rw_tcp_sockets',`
  ##	</summary>
  ## </param>
  #
 -interface(`unconfined_create_keys',`
-+interface(`unconfined_server_stream_connect',`
++interface(`unconfined_server_domtrans',`
  	gen_require(`
 -		type unconfined_t;
 +		type unconfined_service_t;
  	')
  
 -	allow $1 unconfined_t:key create;
-+	files_search_pids($1)
-+	files_write_generic_pid_pipes($1)
-+	allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
++	corecmd_bin_domtrans($1, unconfined_service_t)
  ')
  
  ########################################
  ## <summary>
 -##	Send messages to the unconfined domain over dbus.
-+##	Connect to unconfined_server with a unix socket.
++##	Allow caller domain to dbus chat unconfined_server.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -537,19 +218,17 @@ interface(`unconfined_create_keys',`
+@@ -537,19 +236,19 @@ interface(`unconfined_create_keys',`
  ##	</summary>
  ## </param>
  #
 -interface(`unconfined_dbus_send',`
-+interface(`unconfined_server_domtrans',`
++interface(`unconfined_server_dbus_chat',`
  	gen_require(`
 -		type unconfined_t;
 -		class dbus send_msg;
 +		type unconfined_service_t;
++        class dbus send_msg;
  	')
  
 -	allow $1 unconfined_t:dbus send_msg;
-+	corecmd_bin_domtrans($1, unconfined_service_t)
++        allow $1 unconfined_service_t:dbus send_msg;
++        allow unconfined_service_t $1:dbus send_msg;
  ')
  
  ########################################
  ## <summary>
 -##	Send and receive messages from
 -##	unconfined_t over dbus.
-+##	Allow caller domain to dbus chat unconfined_server.
++##	Send signull to unconfined_service_t.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -557,20 +236,19 @@ interface(`unconfined_dbus_send',`
+@@ -557,20 +256,17 @@ interface(`unconfined_dbus_send',`
  ##	</summary>
  ## </param>
  #
 -interface(`unconfined_dbus_chat',`
-+interface(`unconfined_server_dbus_chat',`
++interface(`unconfined_server_signull',`
  	gen_require(`
 -		type unconfined_t;
 -		class dbus send_msg;
 +		type unconfined_service_t;
-+        class dbus send_msg;
  	')
  
 -	allow $1 unconfined_t:dbus send_msg;
 -	allow unconfined_t $1:dbus send_msg;
-+        allow $1 unconfined_service_t:dbus send_msg;
-+        allow unconfined_service_t $1:dbus send_msg;
++	allow $1 unconfined_service_t:process signull;
  ')
  
  ########################################
  ## <summary>
 -##	Connect to the the unconfined DBUS
 -##	for service (acquire_svc).
-+##	Send signull to unconfined_service_t.
++##	Allow noatsecure.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -578,11 +256,10 @@ interface(`unconfined_dbus_chat',`
+@@ -578,11 +274,10 @@ interface(`unconfined_dbus_chat',`
  ##	</summary>
  ## </param>
  #
 -interface(`unconfined_dbus_connect',`
-+interface(`unconfined_server_signull',`
++interface(`unconfined_server_noatsecure',`
  	gen_require(`
 -		type unconfined_t;
 -		class dbus acquire_svc;
@@ -52314,7 +52341,7 @@ index 5ca20a97d..5454d1668 100644
  	')
  
 -	allow $1 unconfined_t:dbus acquire_svc;
-+	allow $1 unconfined_service_t:process signull;
++    allow $1 unconfined_service_t:process { noatsecure };
  ')
 diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
 index 5fe902db3..0a7c3bb00 100644
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 8c89eb9..99fe805 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -589,7 +589,7 @@ index 058d908e4..ee0c55969 100644
 +')
 +
 diff --git a/abrt.te b/abrt.te
-index eb50f070f..aa5b1112e 100644
+index eb50f070f..64589c601 100644
 --- a/abrt.te
 +++ b/abrt.te
 @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -718,7 +718,7 @@ index eb50f070f..aa5b1112e 100644
  
 -allow abrt_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_nice };
 -dontaudit abrt_t self:capability sys_rawio;
-+allow abrt_t self:capability { chown dac_read_search   fowner fsetid ipc_lock kill setgid setuid sys_nice sys_ptrace };
++allow abrt_t self:capability { chown dac_read_search dac_override fowner fsetid ipc_lock kill setgid setuid sys_nice sys_ptrace };
 +dontaudit abrt_t self:capability { net_admin sys_rawio sys_ptrace };
  allow abrt_t self:process { setpgid sigkill signal signull setsched getsched };
 +
@@ -5615,7 +5615,7 @@ index f6eb4851f..3628a384f 100644
 +    allow $1 httpd_t:process { noatsecure };
  ')
 diff --git a/apache.te b/apache.te
-index 6649962b6..721dab24b 100644
+index 6649962b6..513f68674 100644
 --- a/apache.te
 +++ b/apache.te
 @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
@@ -6303,7 +6303,7 @@ index 6649962b6..721dab24b 100644
  logging_log_filetrans(httpd_t, httpd_log_t, file)
  
  allow httpd_t httpd_modules_t:dir list_dir_perms;
-@@ -412,13 +524,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
+@@ -412,13 +524,21 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
  read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
  read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
  
@@ -6322,10 +6322,11 @@ index 6649962b6..721dab24b 100644
 +allow httpd_t httpd_sys_content_t:dir list_dir_perms;
 +read_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
 +read_lnk_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
++allow httpd_t httpd_sys_content_t:file map;
  
  allow httpd_t httpd_sys_script_t:unix_stream_socket connectto;
  
-@@ -438,6 +557,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi
+@@ -438,6 +558,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi
  
  manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
  manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
@@ -6333,7 +6334,7 @@ index 6649962b6..721dab24b 100644
  files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file })
  
  setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
-@@ -450,140 +570,178 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
+@@ -450,140 +571,178 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
  manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
  manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
  
@@ -6576,7 +6577,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  tunable_policy(`httpd_enable_cgi && httpd_use_nfs',`
-@@ -594,28 +752,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
+@@ -594,28 +753,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
  	fs_cifs_domtrans(httpd_t, httpd_sys_script_t)
  ')
  
@@ -6636,7 +6637,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -624,68 +804,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+@@ -624,68 +805,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
  	fs_read_nfs_symlinks(httpd_t)
  ')
  
@@ -6739,7 +6740,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  tunable_policy(`httpd_setrlimit',`
-@@ -695,49 +863,48 @@ tunable_policy(`httpd_setrlimit',`
+@@ -695,49 +864,48 @@ tunable_policy(`httpd_setrlimit',`
  
  tunable_policy(`httpd_ssi_exec',`
  	corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
@@ -6820,7 +6821,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  optional_policy(`
-@@ -749,24 +916,32 @@ optional_policy(`
+@@ -749,24 +917,32 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6859,7 +6860,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  optional_policy(`
-@@ -775,6 +950,10 @@ optional_policy(`
+@@ -775,6 +951,10 @@ optional_policy(`
  	tunable_policy(`httpd_dbus_avahi',`
  		avahi_dbus_chat(httpd_t)
  	')
@@ -6870,7 +6871,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  optional_policy(`
-@@ -786,35 +965,62 @@ optional_policy(`
+@@ -786,35 +966,62 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6946,7 +6947,7 @@ index 6649962b6..721dab24b 100644
  
  	tunable_policy(`httpd_manage_ipa',`
  		memcached_manage_pid_files(httpd_t)
-@@ -822,8 +1028,31 @@ optional_policy(`
+@@ -822,8 +1029,31 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6978,7 +6979,7 @@ index 6649962b6..721dab24b 100644
  
  	tunable_policy(`httpd_can_network_connect_db',`
  		mysql_tcp_connect(httpd_t)
-@@ -832,6 +1061,8 @@ optional_policy(`
+@@ -832,6 +1062,8 @@ optional_policy(`
  
  optional_policy(`
  	nagios_read_config(httpd_t)
@@ -6987,7 +6988,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  optional_policy(`
-@@ -842,20 +1073,48 @@ optional_policy(`
+@@ -842,20 +1074,48 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -7042,7 +7043,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  optional_policy(`
-@@ -863,16 +1122,31 @@ optional_policy(`
+@@ -863,16 +1123,31 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -7076,7 +7077,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  optional_policy(`
-@@ -883,65 +1157,189 @@ optional_policy(`
+@@ -883,65 +1158,189 @@ optional_policy(`
  	yam_read_content(httpd_t)
  ')
  
@@ -7288,7 +7289,7 @@ index 6649962b6..721dab24b 100644
  files_dontaudit_search_pids(httpd_suexec_t)
  files_search_home(httpd_suexec_t)
  
-@@ -950,123 +1348,75 @@ auth_use_nsswitch(httpd_suexec_t)
+@@ -950,123 +1349,75 @@ auth_use_nsswitch(httpd_suexec_t)
  logging_search_logs(httpd_suexec_t)
  logging_send_syslog_msg(httpd_suexec_t)
  
@@ -7442,7 +7443,7 @@ index 6649962b6..721dab24b 100644
  	mysql_read_config(httpd_suexec_t)
  
  	tunable_policy(`httpd_can_network_connect_db',`
-@@ -1083,172 +1433,107 @@ optional_policy(`
+@@ -1083,172 +1434,107 @@ optional_policy(`
  	')
  ')
  
@@ -7680,7 +7681,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  tunable_policy(`httpd_read_user_content',`
-@@ -1256,64 +1541,74 @@ tunable_policy(`httpd_read_user_content',`
+@@ -1256,64 +1542,74 @@ tunable_policy(`httpd_read_user_content',`
  ')
  
  tunable_policy(`httpd_use_cifs',`
@@ -7778,7 +7779,7 @@ index 6649962b6..721dab24b 100644
  
  ########################################
  #
-@@ -1321,8 +1616,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
+@@ -1321,8 +1617,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
  #
  
  optional_policy(`
@@ -7795,7 +7796,7 @@ index 6649962b6..721dab24b 100644
  ')
  
  ########################################
-@@ -1330,49 +1632,41 @@ optional_policy(`
+@@ -1330,49 +1633,41 @@ optional_policy(`
  # User content local policy
  #
  
@@ -7862,7 +7863,7 @@ index 6649962b6..721dab24b 100644
  kernel_read_system_state(httpd_passwd_t)
  
  corecmd_exec_bin(httpd_passwd_t)
-@@ -1382,38 +1676,109 @@ dev_read_urand(httpd_passwd_t)
+@@ -1382,38 +1677,109 @@ dev_read_urand(httpd_passwd_t)
  
  domain_use_interactive_fds(httpd_passwd_t)
  
@@ -11061,7 +11062,7 @@ index 02fefaaf7..308616e8d 100644
 +	')
  ')
 diff --git a/boinc.te b/boinc.te
-index 687d4c48d..ff5713723 100644
+index 687d4c48d..7ee6d41fd 100644
 --- a/boinc.te
 +++ b/boinc.te
 @@ -1,4 +1,4 @@
@@ -11162,7 +11163,7 @@ index 687d4c48d..ff5713723 100644
  
  manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
  manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
-@@ -61,84 +103,62 @@ files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file })
+@@ -61,84 +103,63 @@ files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file })
  manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t)
  fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file)
  
@@ -11186,6 +11187,7 @@ index 687d4c48d..ff5713723 100644
 -logging_log_filetrans(boinc_t, boinc_log_t, file)
 +manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 +manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
++allow boinc_t boinc_project_var_lib_t:file map;
  
 -can_exec(boinc_t, boinc_var_lib_t)
 -
@@ -11275,7 +11277,7 @@ index 687d4c48d..ff5713723 100644
  
  tunable_policy(`boinc_execmem',`
  	allow boinc_t self:process { execstack execmem };
-@@ -148,48 +168,69 @@ optional_policy(`
+@@ -148,48 +169,69 @@ optional_policy(`
  	mta_send_mail(boinc_t)
  ')
  
@@ -29249,7 +29251,7 @@ index 50d0084d4..94e193606 100644
  
  	fail2ban_run_client($1, $2)
 diff --git a/fail2ban.te b/fail2ban.te
-index cf0e56772..839025a07 100644
+index cf0e56772..040e11be6 100644
 --- a/fail2ban.te
 +++ b/fail2ban.te
 @@ -36,8 +36,8 @@ role fail2ban_client_roles types fail2ban_client_t;
@@ -29279,7 +29281,7 @@ index cf0e56772..839025a07 100644
  files_list_var(fail2ban_t)
  files_dontaudit_list_tmp(fail2ban_t)
  
-@@ -92,24 +90,37 @@ fs_getattr_all_fs(fail2ban_t)
+@@ -92,24 +90,38 @@ fs_getattr_all_fs(fail2ban_t)
  auth_use_nsswitch(fail2ban_t)
  
  logging_read_all_logs(fail2ban_t)
@@ -29287,6 +29289,7 @@ index cf0e56772..839025a07 100644
  logging_send_syslog_msg(fail2ban_t)
 +logging_read_syslog_pid(fail2ban_t)
 +logging_dontaudit_search_audit_logs(fail2ban_t)
++logging_mmap_generic_logs(fail2ban_t)
  
 -miscfiles_read_localization(fail2ban_t)
 +mta_send_mail(fail2ban_t)
@@ -29321,7 +29324,7 @@ index cf0e56772..839025a07 100644
  	iptables_domtrans(fail2ban_t)
  ')
  
-@@ -118,6 +129,10 @@ optional_policy(`
+@@ -118,6 +130,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -29332,7 +29335,7 @@ index cf0e56772..839025a07 100644
  	shorewall_domtrans(fail2ban_t)
  ')
  
-@@ -126,27 +141,37 @@ optional_policy(`
+@@ -126,27 +142,37 @@ optional_policy(`
  # Client Local policy
  #
  
@@ -78567,7 +78570,7 @@ index cd8b8b9cb..2cfa88a2d 100644
 +	allow $1 pppd_unit_file_t:service all_service_perms;
  ')
 diff --git a/ppp.te b/ppp.te
-index d616ca3e3..0ad15efea 100644
+index d616ca3e3..25b69407a 100644
 --- a/ppp.te
 +++ b/ppp.te
 @@ -6,41 +6,47 @@ policy_module(ppp, 1.14.0)
@@ -78637,7 +78640,7 @@ index d616ca3e3..0ad15efea 100644
  
  type pptp_log_t;
  logging_log_file(pptp_log_t)
-@@ -67,54 +74,59 @@ logging_log_file(pptp_log_t)
+@@ -67,54 +74,60 @@ logging_log_file(pptp_log_t)
  type pptp_var_run_t;
  files_pid_file(pptp_var_run_t)
  
@@ -78703,6 +78706,7 @@ index d616ca3e3..0ad15efea 100644
 -domtrans_pattern(pppd_t, pptp_exec_t, pptp_t)
 +manage_sock_files_pattern(pppd_t, pppd_var_run_t, pppd_var_run_t)
 +files_pid_filetrans(pppd_t, pppd_var_run_t, { dir file sock_file })
++allow pppd_t pppd_var_run_t:file map;
  
  allow pppd_t pptp_t:process signal;
  
@@ -78715,7 +78719,7 @@ index d616ca3e3..0ad15efea 100644
  kernel_read_kernel_sysctls(pppd_t)
  kernel_read_system_state(pppd_t)
  kernel_rw_net_sysctls(pppd_t)
-@@ -122,10 +134,10 @@ kernel_read_network_state(pppd_t)
+@@ -122,10 +135,10 @@ kernel_read_network_state(pppd_t)
  kernel_request_load_module(pppd_t)
  
  dev_read_urand(pppd_t)
@@ -78727,7 +78731,7 @@ index d616ca3e3..0ad15efea 100644
  corenet_all_recvfrom_netlabel(pppd_t)
  corenet_tcp_sendrecv_generic_if(pppd_t)
  corenet_raw_sendrecv_generic_if(pppd_t)
-@@ -135,9 +147,22 @@ corenet_raw_sendrecv_generic_node(pppd_t)
+@@ -135,9 +148,22 @@ corenet_raw_sendrecv_generic_node(pppd_t)
  corenet_udp_sendrecv_generic_node(pppd_t)
  corenet_tcp_sendrecv_all_ports(pppd_t)
  corenet_udp_sendrecv_all_ports(pppd_t)
@@ -78751,7 +78755,7 @@ index d616ca3e3..0ad15efea 100644
  corecmd_exec_bin(pppd_t)
  corecmd_exec_shell(pppd_t)
  
-@@ -147,36 +172,31 @@ files_exec_etc_files(pppd_t)
+@@ -147,36 +173,31 @@ files_exec_etc_files(pppd_t)
  files_manage_etc_runtime_files(pppd_t)
  files_dontaudit_write_etc_files(pppd_t)
  
@@ -78797,7 +78801,7 @@ index d616ca3e3..0ad15efea 100644
  
  optional_policy(`
  	ddclient_run(pppd_t, pppd_roles)
-@@ -186,11 +206,13 @@ optional_policy(`
+@@ -186,11 +207,13 @@ optional_policy(`
  	l2tpd_dgram_send(pppd_t)
  	l2tpd_rw_socket(pppd_t)
  	l2tpd_stream_connect(pppd_t)
@@ -78812,7 +78816,7 @@ index d616ca3e3..0ad15efea 100644
  	')
  ')
  
-@@ -216,18 +238,26 @@ optional_policy(`
+@@ -216,18 +239,26 @@ optional_policy(`
  	udev_read_db(pppd_t)
  ')
  
@@ -78843,7 +78847,7 @@ index d616ca3e3..0ad15efea 100644
  
  allow pptp_t pppd_etc_t:dir list_dir_perms;
  allow pptp_t pppd_etc_t:file read_file_perms;
-@@ -236,45 +266,46 @@ allow pptp_t pppd_etc_t:lnk_file read_lnk_file_perms;
+@@ -236,45 +267,46 @@ allow pptp_t pppd_etc_t:lnk_file read_lnk_file_perms;
  allow pptp_t pppd_etc_rw_t:dir list_dir_perms;
  allow pptp_t pppd_etc_rw_t:file read_file_perms;
  allow pptp_t pppd_etc_rw_t:lnk_file read_lnk_file_perms;
@@ -78903,7 +78907,7 @@ index d616ca3e3..0ad15efea 100644
  fs_getattr_all_fs(pptp_t)
  fs_search_auto_mountpoints(pptp_t)
  
-@@ -282,12 +313,12 @@ term_ioctl_generic_ptys(pptp_t)
+@@ -282,12 +314,12 @@ term_ioctl_generic_ptys(pptp_t)
  term_search_ptys(pptp_t)
  term_use_ptmx(pptp_t)
  
@@ -78918,7 +78922,7 @@ index d616ca3e3..0ad15efea 100644
  sysnet_exec_ifconfig(pptp_t)
  
  userdom_dontaudit_use_unpriv_user_fds(pptp_t)
-@@ -299,6 +330,10 @@ optional_policy(`
+@@ -299,6 +331,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -103395,7 +103399,7 @@ index e0644b5cf..ea347ccd5 100644
  	domain_system_change_exemption($1)
  	role_transition $2 fsdaemon_initrc_exec_t system_r;
 diff --git a/smartmon.te b/smartmon.te
-index 9cf6582d2..730889136 100644
+index 9cf6582d2..d0be162c8 100644
 --- a/smartmon.te
 +++ b/smartmon.te
 @@ -38,7 +38,7 @@ ifdef(`enable_mls',`
@@ -103407,8 +103411,12 @@ index 9cf6582d2..730889136 100644
  dontaudit fsdaemon_t self:capability sys_tty_config;
  allow fsdaemon_t self:process { getcap setcap signal_perms };
  allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
-@@ -60,21 +60,27 @@ kernel_read_system_state(fsdaemon_t)
+@@ -58,23 +58,31 @@ kernel_read_network_state(fsdaemon_t)
+ kernel_read_software_raid_state(fsdaemon_t)
+ kernel_read_system_state(fsdaemon_t)
  
++auth_use_nsswitch(fsdaemon_t)
++
  corecmd_exec_all_executables(fsdaemon_t)
  
 +corenet_all_recvfrom_netlabel(fsdaemon_t)
@@ -103437,7 +103445,7 @@ index 9cf6582d2..730889136 100644
  storage_raw_read_fixed_disk(fsdaemon_t)
  storage_raw_write_fixed_disk(fsdaemon_t)
  storage_raw_read_removable_device(fsdaemon_t)
-@@ -83,7 +89,9 @@ storage_write_scsi_generic(fsdaemon_t)
+@@ -83,7 +91,9 @@ storage_write_scsi_generic(fsdaemon_t)
  
  term_dontaudit_search_ptys(fsdaemon_t)
  
@@ -103448,7 +103456,7 @@ index 9cf6582d2..730889136 100644
  
  init_read_utmp(fsdaemon_t)
  
-@@ -92,12 +100,13 @@ libs_exec_lib_files(fsdaemon_t)
+@@ -92,12 +102,13 @@ libs_exec_lib_files(fsdaemon_t)
  
  logging_send_syslog_msg(fsdaemon_t)
  
@@ -103463,7 +103471,7 @@ index 9cf6582d2..730889136 100644
  
  tunable_policy(`smartmon_3ware',`
  	allow fsdaemon_t self:process setfscreate;
-@@ -116,9 +125,9 @@ optional_policy(`
+@@ -116,9 +127,9 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -111773,10 +111781,10 @@ index 000000000..368e18842
 +')
 diff --git a/tlp.te b/tlp.te
 new file mode 100644
-index 000000000..1ef713150
+index 000000000..5185a9e8e
 --- /dev/null
 +++ b/tlp.te
-@@ -0,0 +1,84 @@
+@@ -0,0 +1,86 @@
 +policy_module(tlp, 1.0.0)
 +
 +########################################
@@ -111833,6 +111841,7 @@ index 000000000..1ef713150
 +dev_rw_wireless(tlp_t)
 +
 +files_read_kernel_modules(tlp_t)
++files_map_kernel_modules(tlp_t)
 +files_load_kernel_modules(tlp_t)
 +
 +modutils_exec_insmod(tlp_t)
@@ -111859,6 +111868,7 @@ index 000000000..1ef713150
 +')
 +
 +optional_policy(`
++    sssd_read_public_files(tlp_t)
 +    sssd_stream_connect(tlp_t)
 +')
 diff --git a/tmpreaper.te b/tmpreaper.te
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 0090d85..045fb26 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 294%{?dist}
+Release: 295%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -678,6 +678,19 @@ exit 0
 %endif
 
 %changelog
+* Tue Oct 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-295
+- Allow boinc_t to mmap files with label boinc_project_var_lib_t BZ(1500088)
+- Allow fail2ban_t domain to mmap journals. BZ(1500089)
+- Add dac_override to abrt_t domain BZ(1499860)
+- Allow pppd domain to mmap own pid files BZ(1498587)
+- Allow webserver services to mmap files with label httpd_sys_content_t BZ(1498451)
+- Allow tlp domain to read sssd public files Allow tlp domain to mmap kernel modules
+- Allow systemd to read sysfs sym links. BZ(1499327)
+- Allow systemd to mmap systemd_networkd_exec_t files BZ(1499863)
+- Make systemd_networkd_var_run as mountpoint BZ(1499862)
+- Allow noatsecure for java-based unconfined services. BZ(1358476)
+- Allow systemd_modules_load_t domain to mmap kernel modules. BZ(1490015)
+
 * Mon Oct 09 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-294
 - Allow cloud-init to create content in /var/run/cloud-init
 - Dontaudit VM to read gnome-boxes process data BZ(1415975)