diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index fcb5143..59592da 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -6065,7 +6065,7 @@ index b31c054..872ff1b 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..d36451a 100644
+index 76f285e..0e6161d 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -6566,7 +6566,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2043,7 +2285,101 @@ interface(`dev_getattr_framebuffer_dev',`
+@@ -2043,7 +2285,99 @@ interface(`dev_getattr_framebuffer_dev',`
## </summary>
## </param>
#
@@ -6635,8 +6635,6 @@ index 76f285e..d36451a 100644
+ rw_blk_files_pattern($1, device_t, infiniband_device_t)
+')
+
-+
-+
+########################################
+## <summary>
+## Get the attributes of the framebuffer device node.
@@ -6669,7 +6667,7 @@ index 76f285e..d36451a 100644
gen_require(`
type device_t, framebuf_device_t;
')
-@@ -2402,7 +2738,97 @@ interface(`dev_filetrans_lirc',`
+@@ -2402,7 +2736,97 @@ interface(`dev_filetrans_lirc',`
########################################
## <summary>
@@ -6768,7 +6766,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2725,7 +3151,7 @@ interface(`dev_write_misc',`
+@@ -2725,7 +3149,7 @@ interface(`dev_write_misc',`
## </summary>
## <param name="domain">
## <summary>
@@ -6777,7 +6775,7 @@ index 76f285e..d36451a 100644
## </summary>
## </param>
#
-@@ -2811,6 +3237,78 @@ interface(`dev_rw_modem',`
+@@ -2811,6 +3235,78 @@ interface(`dev_rw_modem',`
########################################
## <summary>
@@ -6856,7 +6854,7 @@ index 76f285e..d36451a 100644
## Get the attributes of the mouse devices.
## </summary>
## <param name="domain">
-@@ -2903,20 +3401,20 @@ interface(`dev_getattr_mtrr_dev',`
+@@ -2903,20 +3399,20 @@ interface(`dev_getattr_mtrr_dev',`
########################################
## <summary>
@@ -6881,7 +6879,7 @@ index 76f285e..d36451a 100644
## </p>
## </desc>
## <param name="domain">
-@@ -2925,43 +3423,34 @@ interface(`dev_getattr_mtrr_dev',`
+@@ -2925,43 +3421,34 @@ interface(`dev_getattr_mtrr_dev',`
## </summary>
## </param>
#
@@ -6937,7 +6935,7 @@ index 76f285e..d36451a 100644
## range registers (MTRR).
## </summary>
## <param name="domain">
-@@ -2970,13 +3459,13 @@ interface(`dev_write_mtrr',`
+@@ -2970,13 +3457,13 @@ interface(`dev_write_mtrr',`
## </summary>
## </param>
#
@@ -6954,7 +6952,7 @@ index 76f285e..d36451a 100644
')
########################################
-@@ -3144,48 +3633,102 @@ interface(`dev_create_null_dev',`
+@@ -3144,52 +3631,106 @@ interface(`dev_create_null_dev',`
########################################
## <summary>
@@ -7013,9 +7011,10 @@ index 76f285e..d36451a 100644
## <summary>
-## Domain allowed access.
+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_getattr_printer_dev',`
+interface(`dev_dontaudit_getattr_nvram_dev',`
+ gen_require(`
+ type nvram_device_t;
@@ -7067,54 +7066,58 @@ index 76f285e..d36451a 100644
+## <param name="domain">
+## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
-@@ -3254,7 +3797,25 @@ interface(`dev_rw_printer',`
++## </summary>
++## </param>
++#
++interface(`dev_getattr_printer_dev',`
+ gen_require(`
+ type device_t, printer_device_t;
+ ')
+@@ -3254,7 +3795,7 @@ interface(`dev_rw_printer',`
########################################
## <summary>
-## Read printk devices (e.g., /dev/kmsg /dev/mcelog)
+## Relabel the printer device node.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_relabel_printer',`
-+ gen_require(`
-+ type printer_device_t;
-+ ')
-+
-+ allow $1 printer_device_t:chr_file relabel_chr_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Read and write the printer device.
## </summary>
## <param name="domain">
## <summary>
-@@ -3262,12 +3823,13 @@ interface(`dev_rw_printer',`
+@@ -3262,12 +3803,31 @@ interface(`dev_rw_printer',`
## </summary>
## </param>
#
-interface(`dev_read_printk',`
-+interface(`dev_manage_printer',`
++interface(`dev_relabel_printer',`
gen_require(`
- type device_t, printk_device_t;
-+ type device_t, printer_device_t;
++ type printer_device_t;
')
- read_chr_files_pattern($1, device_t, printk_device_t)
++ allow $1 printer_device_t:chr_file relabel_chr_file_perms;
++')
++
++########################################
++## <summary>
++## Read and write the printer device.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_manage_printer',`
++ gen_require(`
++ type device_t, printer_device_t;
++ ')
++
+ manage_chr_files_pattern($1, device_t, printer_device_t)
+ dev_filetrans_printer_named_dev($1)
')
########################################
-@@ -3399,7 +3961,7 @@ interface(`dev_dontaudit_read_rand',`
+@@ -3399,7 +3959,7 @@ interface(`dev_dontaudit_read_rand',`
########################################
## <summary>
@@ -7123,7 +7126,7 @@ index 76f285e..d36451a 100644
## number generator devices (e.g., /dev/random)
## </summary>
## <param name="domain">
-@@ -3413,7 +3975,7 @@ interface(`dev_dontaudit_append_rand',`
+@@ -3413,7 +3973,7 @@ interface(`dev_dontaudit_append_rand',`
type random_device_t;
')
@@ -7132,7 +7135,7 @@ index 76f285e..d36451a 100644
')
########################################
-@@ -3855,6 +4417,96 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3855,6 +4415,96 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
@@ -7229,7 +7232,7 @@ index 76f285e..d36451a 100644
## Search the sysfs directories.
## </summary>
## <param name="domain">
-@@ -3904,6 +4556,7 @@ interface(`dev_list_sysfs',`
+@@ -3904,6 +4554,7 @@ interface(`dev_list_sysfs',`
type sysfs_t;
')
@@ -7237,7 +7240,7 @@ index 76f285e..d36451a 100644
list_dirs_pattern($1, sysfs_t, sysfs_t)
')
-@@ -3946,23 +4599,49 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
+@@ -3946,23 +4597,49 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
########################################
## <summary>
@@ -7291,7 +7294,7 @@ index 76f285e..d36451a 100644
########################################
## <summary>
## Read hardware state information.
-@@ -4016,6 +4695,62 @@ interface(`dev_rw_sysfs',`
+@@ -4016,6 +4693,62 @@ interface(`dev_rw_sysfs',`
########################################
## <summary>
@@ -7354,7 +7357,7 @@ index 76f285e..d36451a 100644
## Read and write the TPM device.
## </summary>
## <param name="domain">
-@@ -4113,6 +4848,25 @@ interface(`dev_write_urand',`
+@@ -4113,6 +4846,25 @@ interface(`dev_write_urand',`
########################################
## <summary>
@@ -7380,7 +7383,7 @@ index 76f285e..d36451a 100644
## Getattr generic the USB devices.
## </summary>
## <param name="domain">
-@@ -4123,7 +4877,7 @@ interface(`dev_write_urand',`
+@@ -4123,7 +4875,7 @@ interface(`dev_write_urand',`
#
interface(`dev_getattr_generic_usb_dev',`
gen_require(`
@@ -7389,7 +7392,7 @@ index 76f285e..d36451a 100644
')
getattr_chr_files_pattern($1, device_t, usb_device_t)
-@@ -4409,9 +5163,9 @@ interface(`dev_rw_usbfs',`
+@@ -4409,9 +5161,9 @@ interface(`dev_rw_usbfs',`
read_lnk_files_pattern($1, usbfs_t, usbfs_t)
')
@@ -7401,7 +7404,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4419,17 +5173,17 @@ interface(`dev_rw_usbfs',`
+@@ -4419,17 +5171,17 @@ interface(`dev_rw_usbfs',`
## </summary>
## </param>
#
@@ -7424,7 +7427,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4437,12 +5191,12 @@ interface(`dev_getattr_video_dev',`
+@@ -4437,12 +5189,12 @@ interface(`dev_getattr_video_dev',`
## </summary>
## </param>
#
@@ -7440,7 +7443,7 @@ index 76f285e..d36451a 100644
')
########################################
-@@ -4539,6 +5293,134 @@ interface(`dev_write_video_dev',`
+@@ -4539,6 +5291,134 @@ interface(`dev_write_video_dev',`
########################################
## <summary>
@@ -7575,7 +7578,7 @@ index 76f285e..d36451a 100644
## Allow read/write the vhost net device
## </summary>
## <param name="domain">
-@@ -4557,6 +5439,24 @@ interface(`dev_rw_vhost',`
+@@ -4557,6 +5437,24 @@ interface(`dev_rw_vhost',`
########################################
## <summary>
@@ -7600,7 +7603,7 @@ index 76f285e..d36451a 100644
## Read and write VMWare devices.
## </summary>
## <param name="domain">
-@@ -4762,6 +5662,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4762,6 +5660,44 @@ interface(`dev_rw_xserver_misc',`
########################################
## <summary>
@@ -7645,7 +7648,7 @@ index 76f285e..d36451a 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
-@@ -4851,3 +5789,948 @@ interface(`dev_unconfined',`
+@@ -4851,3 +5787,966 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -7725,6 +7728,24 @@ index 76f285e..d36451a 100644
+
+########################################
+## <summary>
++## Read and write uhid devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_uhid_dev',`
++ gen_require(`
++ type device_t, uhid_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, uhid_device_t)
++')
++
++########################################
++## <summary>
+## Create all named devices with the correct label
+## </summary>
+## <param name="domain">
@@ -27234,7 +27255,7 @@ index 2479587..890e1e2 100644
/var/(db|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/lib/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
-index 3efd5b6..12dca57 100644
+index 3efd5b6..9e85ea0 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -23,11 +23,17 @@ interface(`auth_role',`
@@ -27296,7 +27317,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -95,48 +117,20 @@ interface(`auth_use_pam',`
+@@ -95,69 +117,67 @@ interface(`auth_use_pam',`
interface(`auth_login_pgm_domain',`
gen_require(`
type var_auth_t, auth_cache_t;
@@ -27350,7 +27371,10 @@ index 3efd5b6..12dca57 100644
mls_file_read_all_levels($1)
mls_file_write_all_levels($1)
-@@ -146,18 +140,43 @@ interface(`auth_login_pgm_domain',`
+ mls_file_upgrade($1)
+ mls_file_downgrade($1)
+ mls_process_set_level($1)
++ mls_process_write_to_clearance($1)
mls_fd_share_all_levels($1)
auth_use_pam($1)
@@ -27402,7 +27426,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -231,6 +250,25 @@ interface(`auth_domtrans_login_program',`
+@@ -231,6 +251,25 @@ interface(`auth_domtrans_login_program',`
########################################
## <summary>
@@ -27428,7 +27452,7 @@ index 3efd5b6..12dca57 100644
## Execute a login_program in the target domain,
## with a range transition.
## </summary>
-@@ -322,6 +360,24 @@ interface(`auth_rw_cache',`
+@@ -322,6 +361,24 @@ interface(`auth_rw_cache',`
########################################
## <summary>
@@ -27453,7 +27477,7 @@ index 3efd5b6..12dca57 100644
## Manage authentication cache
## </summary>
## <param name="domain">
-@@ -402,6 +458,8 @@ interface(`auth_domtrans_chk_passwd',`
+@@ -402,6 +459,8 @@ interface(`auth_domtrans_chk_passwd',`
optional_policy(`
samba_stream_connect_winbind($1)
')
@@ -27462,7 +27486,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -428,6 +486,24 @@ interface(`auth_domtrans_chkpwd',`
+@@ -428,6 +487,24 @@ interface(`auth_domtrans_chkpwd',`
########################################
## <summary>
@@ -27487,7 +27511,7 @@ index 3efd5b6..12dca57 100644
## Execute chkpwd programs in the chkpwd domain.
## </summary>
## <param name="domain">
-@@ -448,6 +524,25 @@ interface(`auth_run_chk_passwd',`
+@@ -448,6 +525,25 @@ interface(`auth_run_chk_passwd',`
auth_domtrans_chk_passwd($1)
role $2 types chkpwd_t;
@@ -27513,7 +27537,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -467,7 +562,6 @@ interface(`auth_domtrans_upd_passwd',`
+@@ -467,7 +563,6 @@ interface(`auth_domtrans_upd_passwd',`
domtrans_pattern($1, updpwd_exec_t, updpwd_t)
auth_dontaudit_read_shadow($1)
@@ -27521,7 +27545,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -664,6 +758,10 @@ interface(`auth_manage_shadow',`
+@@ -664,6 +759,10 @@ interface(`auth_manage_shadow',`
allow $1 shadow_t:file manage_file_perms;
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
@@ -27532,7 +27556,7 @@ index 3efd5b6..12dca57 100644
')
#######################################
-@@ -763,7 +861,50 @@ interface(`auth_rw_faillog',`
+@@ -763,7 +862,50 @@ interface(`auth_rw_faillog',`
')
logging_search_logs($1)
@@ -27584,7 +27608,7 @@ index 3efd5b6..12dca57 100644
')
#######################################
-@@ -824,9 +965,29 @@ interface(`auth_rw_lastlog',`
+@@ -824,9 +966,29 @@ interface(`auth_rw_lastlog',`
allow $1 lastlog_t:file { rw_file_perms lock setattr };
')
@@ -27615,7 +27639,7 @@ index 3efd5b6..12dca57 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -834,12 +995,27 @@ interface(`auth_rw_lastlog',`
+@@ -834,12 +996,27 @@ interface(`auth_rw_lastlog',`
## </summary>
## </param>
#
@@ -27646,7 +27670,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -854,15 +1030,15 @@ interface(`auth_domtrans_pam',`
+@@ -854,15 +1031,15 @@ interface(`auth_domtrans_pam',`
#
interface(`auth_signal_pam',`
gen_require(`
@@ -27665,7 +27689,7 @@ index 3efd5b6..12dca57 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -875,13 +1051,33 @@ interface(`auth_signal_pam',`
+@@ -875,13 +1052,33 @@ interface(`auth_signal_pam',`
## </summary>
## </param>
#
@@ -27703,7 +27727,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -959,9 +1155,30 @@ interface(`auth_manage_var_auth',`
+@@ -959,9 +1156,30 @@ interface(`auth_manage_var_auth',`
')
files_search_var($1)
@@ -27737,7 +27761,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1040,6 +1257,10 @@ interface(`auth_manage_pam_pid',`
+@@ -1040,6 +1258,10 @@ interface(`auth_manage_pam_pid',`
files_search_pids($1)
allow $1 pam_var_run_t:dir manage_dir_perms;
allow $1 pam_var_run_t:file manage_file_perms;
@@ -27748,7 +27772,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1176,6 +1397,7 @@ interface(`auth_manage_pam_console_data',`
+@@ -1176,6 +1398,7 @@ interface(`auth_manage_pam_console_data',`
files_search_pids($1)
manage_files_pattern($1, pam_var_console_t, pam_var_console_t)
manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t)
@@ -27756,7 +27780,7 @@ index 3efd5b6..12dca57 100644
')
#######################################
-@@ -1576,6 +1798,25 @@ interface(`auth_setattr_login_records',`
+@@ -1576,6 +1799,25 @@ interface(`auth_setattr_login_records',`
########################################
## <summary>
@@ -27782,7 +27806,7 @@ index 3efd5b6..12dca57 100644
## Read login records files (/var/log/wtmp).
## </summary>
## <param name="domain">
-@@ -1726,24 +1967,7 @@ interface(`auth_manage_login_records',`
+@@ -1726,24 +1968,7 @@ interface(`auth_manage_login_records',`
logging_rw_generic_log_dirs($1)
allow $1 wtmp_t:file manage_file_perms;
@@ -27808,7 +27832,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1767,11 +1991,13 @@ interface(`auth_relabel_login_records',`
+@@ -1767,11 +1992,13 @@ interface(`auth_relabel_login_records',`
## <infoflow type="both" weight="10"/>
#
interface(`auth_use_nsswitch',`
@@ -27825,7 +27849,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1805,3 +2031,280 @@ interface(`auth_unconfined',`
+@@ -1805,3 +2032,280 @@ interface(`auth_unconfined',`
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -42476,7 +42500,7 @@ index 0abaf84..8b34dbc 100644
-/usr/lib/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
-')
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
-index 5ca20a9..e749152 100644
+index 5ca20a9..cf27c0a 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -12,53 +12,57 @@
@@ -42529,10 +42553,10 @@ index 5ca20a9..e749152 100644
+ systemd_config_all_services($1)
+
+ domain_mmap_low($1)
-+
-+ ubac_process_exempt($1)
- tunable_policy(`allow_execheap',`
++ ubac_process_exempt($1)
++
+ tunable_policy(`selinuxuser_execheap',`
# Allow making the stack executable via mprotect.
allow $1 self:process execheap;
@@ -42587,7 +42611,7 @@ index 5ca20a9..e749152 100644
')
########################################
-@@ -175,381 +185,12 @@ interface(`unconfined_alias_domain',`
+@@ -175,361 +185,12 @@ interface(`unconfined_alias_domain',`
## </param>
#
interface(`unconfined_execmem_alias_program',`
@@ -42941,26 +42965,32 @@ index 5ca20a9..e749152 100644
- ')
-
- allow $1 unconfined_t:key create;
--')
--
--########################################
--## <summary>
++ refpolicywarn(`$0() has been deprecated.')
+ ')
+
+ ########################################
+ ## <summary>
-## Send messages to the unconfined domain over dbus.
--## </summary>
--## <param name="domain">
--## <summary>
--## Domain allowed access.
--## </summary>
--## </param>
--#
++## Connect to unconfined_server with a unix socket.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -537,19 +198,19 @@ interface(`unconfined_create_keys',`
+ ## </summary>
+ ## </param>
+ #
-interface(`unconfined_dbus_send',`
-- gen_require(`
++interface(`unconfined_server_stream_connect',`
+ gen_require(`
- type unconfined_t;
- class dbus send_msg;
-- ')
--
++ type unconfined_service_t;
+ ')
+
- allow $1 unconfined_t:dbus send_msg;
-+ refpolicywarn(`$0() has been deprecated.')
++ files_search_pids($1)
++ files_write_generic_pid_pipes($1)
++ allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
')
########################################
@@ -42971,12 +43001,12 @@ index 5ca20a9..e749152 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -557,20 +198,19 @@ interface(`unconfined_dbus_send',`
+@@ -557,20 +218,17 @@ interface(`unconfined_dbus_send',`
## </summary>
## </param>
#
-interface(`unconfined_dbus_chat',`
-+interface(`unconfined_server_stream_connect',`
++interface(`unconfined_server_domtrans',`
gen_require(`
- type unconfined_t;
- class dbus send_msg;
@@ -42985,25 +43015,23 @@ index 5ca20a9..e749152 100644
- allow $1 unconfined_t:dbus send_msg;
- allow unconfined_t $1:dbus send_msg;
-+ files_search_pids($1)
-+ files_write_generic_pid_pipes($1)
-+ allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
++ corecmd_bin_domtrans($1, unconfined_service_t)
')
########################################
## <summary>
-## Connect to the the unconfined DBUS
-## for service (acquire_svc).
-+## Connect to unconfined_server with a unix socket.
++## Allow caller domain to dbus chat unconfined_server.
## </summary>
## <param name="domain">
## <summary>
-@@ -578,11 +218,10 @@ interface(`unconfined_dbus_chat',`
+@@ -578,11 +236,11 @@ interface(`unconfined_dbus_chat',`
## </summary>
## </param>
#
-interface(`unconfined_dbus_connect',`
-+interface(`unconfined_server_domtrans',`
++interface(`unconfined_server_dbus_chat',`
gen_require(`
- type unconfined_t;
- class dbus acquire_svc;
@@ -43011,7 +43039,8 @@ index 5ca20a9..e749152 100644
')
- allow $1 unconfined_t:dbus acquire_svc;
-+ corecmd_bin_domtrans($1, unconfined_service_t)
++ allow $1 unconfined_service_t:dbus send_msg;
++ allow unconfined_service_t $1:dbus send_msg;
')
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 5fe902d..a349d18 100644
@@ -43280,7 +43309,7 @@ index db75976..1ee08ec 100644
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
+
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 9dc60c6..0bed312 100644
+index 9dc60c6..2861886 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@@ -45054,7 +45083,32 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -1629,6 +2135,42 @@ interface(`userdom_relabelto_user_home_dirs',`
+@@ -1613,6 +2119,24 @@ interface(`userdom_manage_user_home_dirs',`
+
+ ########################################
+ ## <summary>
++## Create user home directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`userdom_dontaudit_manage_user_home_dirs',`
++ gen_require(`
++ type user_home_dir_t;
++ ')
++
++ dontaudit $1 user_home_dir_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
+ ## Relabel to user home directories.
+ ## </summary>
+ ## <param name="domain">
+@@ -1629,6 +2153,42 @@ interface(`userdom_relabelto_user_home_dirs',`
allow $1 user_home_dir_t:dir relabelto;
')
@@ -45097,7 +45151,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1708,6 +2250,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
+@@ -1708,6 +2268,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -45106,7 +45160,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -1741,10 +2285,12 @@ interface(`userdom_list_all_user_home_content',`
+@@ -1741,10 +2303,12 @@ interface(`userdom_list_all_user_home_content',`
#
interface(`userdom_list_user_home_content',`
gen_require(`
@@ -45121,7 +45175,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -1769,7 +2315,7 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1769,7 +2333,7 @@ interface(`userdom_manage_user_home_content_dirs',`
########################################
## <summary>
@@ -45130,7 +45184,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1777,19 +2323,17 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1777,19 +2341,17 @@ interface(`userdom_manage_user_home_content_dirs',`
## </summary>
## </param>
#
@@ -45154,7 +45208,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1797,55 +2341,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
+@@ -1797,55 +2359,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
## </summary>
## </param>
#
@@ -45225,7 +45279,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1853,18 +2397,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
+@@ -1853,18 +2415,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
## </summary>
## </param>
#
@@ -45253,7 +45307,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1872,55 +2417,55 @@ interface(`userdom_mmap_user_home_content_files',`
+@@ -1872,45 +2435,182 @@ interface(`userdom_mmap_user_home_content_files',`
## </summary>
## </param>
#
@@ -45311,59 +45365,48 @@ index 9dc60c6..0bed312 100644
#
-interface(`userdom_dontaudit_append_user_home_content_files',`
+interface(`userdom_relabel_user_tmp_dirs',`
- gen_require(`
-- type user_home_t;
++ gen_require(`
+ type user_tmp_t;
- ')
-
-- dontaudit $1 user_home_t:file append_file_perms;
++ ')
++
+ allow $1 user_tmp_t:dir relabel_dir_perms;
- ')
-
- ########################################
- ## <summary>
--## Do not audit attempts to write user home files.
++')
++
++########################################
++## <summary>
+## Do not audit attempts to set the
+## attributes of user home files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -1928,32 +2473,149 @@ interface(`userdom_dontaudit_append_user_home_content_files',`
- ## </summary>
- ## </param>
- #
--interface(`userdom_dontaudit_write_user_home_content_files',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
+interface(`userdom_dontaudit_setattr_user_home_content_files',`
- gen_require(`
- type user_home_t;
- ')
-
-- dontaudit $1 user_home_t:file write_file_perms;
++ gen_require(`
++ type user_home_t;
++ ')
++
+ dontaudit $1 user_home_t:file setattr_file_perms;
- ')
-
- ########################################
- ## <summary>
--## Delete all user home content files.
++')
++
++########################################
++## <summary>
+## Set the attributes of all user home directories.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
+## <rolecap/>
- #
--interface(`userdom_delete_all_user_home_content_files',`
++#
+interface(`userdom_setattr_all_user_home_content_dirs',`
- gen_require(`
-- attribute user_home_content_type;
-- type user_home_dir_t;
++ gen_require(`
+ attribute user_home_type;
- ')
-
-- userdom_search_user_home_content($1)
-- delete_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
++ ')
++
+ allow $1 user_home_type:dir setattr_dir_perms;
+')
+
@@ -45460,51 +45503,45 @@ index 9dc60c6..0bed312 100644
+## </param>
+#
+interface(`userdom_dontaudit_append_user_home_content_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
-+ dontaudit $1 user_home_t:file append_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to write user home files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`userdom_dontaudit_write_user_home_content_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
-+ dontaudit $1 user_home_t:file write_file_perms;
- ')
+ gen_require(`
+ type user_home_t;
+ ')
+@@ -1938,7 +2638,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
########################################
-@@ -1971,7 +2633,80 @@ interface(`userdom_delete_user_home_content_files',`
- type user_home_t;
+ ## <summary>
+-## Delete all user home content files.
++## Delete files in a user home subdirectory.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1946,10 +2646,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`userdom_delete_all_user_home_content_files',`
++interface(`userdom_delete_user_home_content_files',`
+ gen_require(`
+- attribute user_home_content_type;
+- type user_home_dir_t;
++ type user_home_t;
')
-- allow $1 user_home_t:file delete_file_perms;
-+ userdom_search_user_home_content($1)
-+ delete_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
-+')
-+
-+########################################
-+## <summary>
+ userdom_search_user_home_content($1)
+@@ -1958,7 +2657,7 @@ interface(`userdom_delete_all_user_home_content_files',`
+
+ ########################################
+ ## <summary>
+-## Delete files in a user home subdirectory.
+## Delete all files in a user home subdirectory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1966,12 +2665,66 @@ interface(`userdom_delete_all_user_home_content_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`userdom_delete_user_home_content_files',`
+interface(`userdom_delete_all_user_home_content_files',`
+ gen_require(`
+ attribute user_home_type;
@@ -45524,10 +45561,11 @@ index 9dc60c6..0bed312 100644
+## </param>
+#
+interface(`userdom_delete_user_home_content_sock_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
+ gen_require(`
+ type user_home_t;
+ ')
+
+- allow $1 user_home_t:file delete_file_perms;
+ allow $1 user_home_t:sock_file delete_file_perms;
+')
+
@@ -45568,7 +45606,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2007,8 +2742,7 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2007,8 +2760,7 @@ interface(`userdom_read_user_home_content_symlinks',`
type user_home_dir_t, user_home_t;
')
@@ -45578,7 +45616,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2024,20 +2758,14 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2024,20 +2776,14 @@ interface(`userdom_read_user_home_content_symlinks',`
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -45603,7 +45641,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
-@@ -2120,7 +2848,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2120,7 +2866,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
########################################
## <summary>
@@ -45612,7 +45650,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2128,19 +2856,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2128,19 +2874,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
## </summary>
## </param>
#
@@ -45636,7 +45674,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2148,12 +2874,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
+@@ -2148,12 +2892,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
## </summary>
## </param>
#
@@ -45652,7 +45690,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2388,18 +3114,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
+@@ -2388,18 +3132,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
## </summary>
## </param>
#
@@ -45710,7 +45748,7 @@ index 9dc60c6..0bed312 100644
## Do not audit attempts to read users
## temporary files.
## </summary>
-@@ -2414,7 +3176,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
+@@ -2414,7 +3194,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
type user_tmp_t;
')
@@ -45719,7 +45757,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2455,6 +3217,25 @@ interface(`userdom_rw_user_tmp_files',`
+@@ -2455,6 +3235,25 @@ interface(`userdom_rw_user_tmp_files',`
rw_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
')
@@ -45745,7 +45783,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
-@@ -2538,7 +3319,7 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2538,7 +3337,7 @@ interface(`userdom_manage_user_tmp_files',`
########################################
## <summary>
## Create, read, write, and delete user
@@ -45754,7 +45792,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2546,19 +3327,19 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2546,19 +3345,19 @@ interface(`userdom_manage_user_tmp_files',`
## </summary>
## </param>
#
@@ -45777,7 +45815,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2566,19 +3347,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
+@@ -2566,19 +3365,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
## </summary>
## </param>
#
@@ -45800,7 +45838,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2586,27 +3367,68 @@ interface(`userdom_manage_user_tmp_pipes',`
+@@ -2586,12 +3385,53 @@ interface(`userdom_manage_user_tmp_pipes',`
## </summary>
## </param>
#
@@ -45812,24 +45850,20 @@ index 9dc60c6..0bed312 100644
- manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
+ allow $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
- files_search_tmp($1)
- ')
-
++ files_search_tmp($1)
++')
+
- ########################################
- ## <summary>
--## Create objects in a user temporary directory
--## with an automatic type transition to
--## a specified private type.
++
++########################################
++## <summary>
+## Create, read, write, and delete user
+## temporary named pipes.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
--## <param name="private_type">
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
+#
+interface(`userdom_manage_user_tmp_pipes',`
+ gen_require(`
@@ -45857,25 +45891,10 @@ index 9dc60c6..0bed312 100644
+ ')
+
+ manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
-+ files_search_tmp($1)
-+')
-+
-+########################################
-+## <summary>
-+## Create objects in a user temporary directory
-+## with an automatic type transition to
-+## a specified private type.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="private_type">
- ## <summary>
- ## The type of the object to create.
- ## </summary>
-@@ -2661,6 +3483,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+ files_search_tmp($1)
+ ')
+
+@@ -2661,6 +3501,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
files_tmp_filetrans($1, user_tmp_t, $2, $3)
')
@@ -45897,7 +45916,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
## Read user tmpfs files.
-@@ -2672,18 +3509,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+@@ -2672,18 +3527,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
## </param>
#
interface(`userdom_read_user_tmpfs_files',`
@@ -45919,7 +45938,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2692,19 +3524,13 @@ interface(`userdom_read_user_tmpfs_files',`
+@@ -2692,19 +3542,13 @@ interface(`userdom_read_user_tmpfs_files',`
## </param>
#
interface(`userdom_rw_user_tmpfs_files',`
@@ -45942,7 +45961,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2713,13 +3539,56 @@ interface(`userdom_rw_user_tmpfs_files',`
+@@ -2713,13 +3557,56 @@ interface(`userdom_rw_user_tmpfs_files',`
## </param>
#
interface(`userdom_manage_user_tmpfs_files',`
@@ -46003,7 +46022,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2814,6 +3683,24 @@ interface(`userdom_use_user_ttys',`
+@@ -2814,6 +3701,24 @@ interface(`userdom_use_user_ttys',`
########################################
## <summary>
@@ -46028,7 +46047,7 @@ index 9dc60c6..0bed312 100644
## Read and write a user domain pty.
## </summary>
## <param name="domain">
-@@ -2832,22 +3719,34 @@ interface(`userdom_use_user_ptys',`
+@@ -2832,22 +3737,34 @@ interface(`userdom_use_user_ptys',`
########################################
## <summary>
@@ -46071,7 +46090,7 @@ index 9dc60c6..0bed312 100644
## </desc>
## <param name="domain">
## <summary>
-@@ -2856,14 +3755,33 @@ interface(`userdom_use_user_ptys',`
+@@ -2856,14 +3773,33 @@ interface(`userdom_use_user_ptys',`
## </param>
## <infoflow type="both" weight="10"/>
#
@@ -46109,7 +46128,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2882,8 +3800,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
+@@ -2882,8 +3818,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
type user_tty_device_t, user_devpts_t;
')
@@ -46139,7 +46158,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2955,69 +3892,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
+@@ -2955,69 +3910,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
allow unpriv_userdomain $1:process sigchld;
')
@@ -46240,7 +46259,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3025,12 +3961,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
+@@ -3025,12 +3979,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
## </summary>
## </param>
#
@@ -46255,7 +46274,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -3094,7 +4030,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3094,7 +4048,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -46264,7 +46283,7 @@ index 9dc60c6..0bed312 100644
allow unpriv_userdomain $1:process sigchld;
')
-@@ -3110,29 +4046,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3110,29 +4064,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -46298,7 +46317,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -3214,7 +4134,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
+@@ -3214,7 +4152,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
type user_devpts_t;
')
@@ -46325,7 +46344,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -3269,12 +4207,13 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3269,12 +4225,13 @@ interface(`userdom_write_user_tmp_files',`
type user_tmp_t;
')
@@ -46341,7 +46360,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3282,46 +4221,122 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3282,49 +4239,125 @@ interface(`userdom_write_user_tmp_files',`
## </summary>
## </param>
#
@@ -46399,8 +46418,9 @@ index 9dc60c6..0bed312 100644
gen_require(`
- attribute userdomain;
+ type user_tmp_t;
-+ ')
-+
+ ')
+
+- allow $1 userdomain:process getattr;
+ dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
+')
+
@@ -46474,10 +46494,13 @@ index 9dc60c6..0bed312 100644
+interface(`userdom_getattr_all_users',`
+ gen_require(`
+ attribute userdomain;
- ')
++ ')
++
++ allow $1 userdomain:process getattr;
+ ')
- allow $1 userdomain:process getattr;
-@@ -3382,6 +4397,42 @@ interface(`userdom_signal_all_users',`
+ ########################################
+@@ -3382,6 +4415,42 @@ interface(`userdom_signal_all_users',`
allow $1 userdomain:process signal;
')
@@ -46520,7 +46543,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
## Send a SIGCHLD signal to all user domains.
-@@ -3402,6 +4453,60 @@ interface(`userdom_sigchld_all_users',`
+@@ -3402,6 +4471,60 @@ interface(`userdom_sigchld_all_users',`
########################################
## <summary>
@@ -46581,7 +46604,7 @@ index 9dc60c6..0bed312 100644
## Create keys for all user domains.
## </summary>
## <param name="domain">
-@@ -3435,4 +4540,1686 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3435,4 +4558,1686 @@ interface(`userdom_dbus_send_all_users',`
')
allow $1 userdomain:dbus send_msg;
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 7d8b345..9cc8bac 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -9707,7 +9707,7 @@ index c723a0a..3e8a553 100644
+ allow $1 bluetooth_unit_file_t:service all_service_perms;
')
diff --git a/bluetooth.te b/bluetooth.te
-index 851769e..055c97c 100644
+index 851769e..a069dc3 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -49,6 +49,9 @@ files_type(bluetooth_var_lib_t)
@@ -9757,7 +9757,13 @@ index 851769e..055c97c 100644
dev_read_sysfs(bluetooth_t)
dev_rw_usbfs(bluetooth_t)
-@@ -110,7 +124,6 @@ domain_use_interactive_fds(bluetooth_t)
+@@ -105,12 +119,12 @@ dev_rw_generic_usb_dev(bluetooth_t)
+ dev_read_urand(bluetooth_t)
+ dev_rw_input_dev(bluetooth_t)
+ dev_rw_wireless(bluetooth_t)
++dev_rw_uhid_dev(bluetooth_t)
+
+ domain_use_interactive_fds(bluetooth_t)
domain_dontaudit_search_all_domains_state(bluetooth_t)
files_read_etc_runtime_files(bluetooth_t)
@@ -9765,7 +9771,7 @@ index 851769e..055c97c 100644
fs_getattr_all_fs(bluetooth_t)
fs_search_auto_mountpoints(bluetooth_t)
-@@ -122,7 +135,6 @@ auth_use_nsswitch(bluetooth_t)
+@@ -122,7 +136,6 @@ auth_use_nsswitch(bluetooth_t)
logging_send_syslog_msg(bluetooth_t)
@@ -9773,7 +9779,7 @@ index 851769e..055c97c 100644
miscfiles_read_fonts(bluetooth_t)
miscfiles_read_hwdata(bluetooth_t)
-@@ -130,6 +142,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
+@@ -130,6 +143,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
userdom_dontaudit_use_user_terminals(bluetooth_t)
userdom_dontaudit_search_user_home_dirs(bluetooth_t)
@@ -9784,7 +9790,7 @@ index 851769e..055c97c 100644
optional_policy(`
dbus_system_bus_client(bluetooth_t)
dbus_connect_system_bus(bluetooth_t)
-@@ -200,7 +216,6 @@ dev_read_urand(bluetooth_helper_t)
+@@ -200,7 +217,6 @@ dev_read_urand(bluetooth_helper_t)
domain_read_all_domains_state(bluetooth_helper_t)
files_read_etc_runtime_files(bluetooth_helper_t)
@@ -10317,15 +10323,23 @@ index 687d4c4..3c5a83a 100644
+ unconfined_domain(boinc_project_t)
+')
diff --git a/brctl.te b/brctl.te
-index c5a9113..6ad8ccb 100644
+index c5a9113..1919abd 100644
--- a/brctl.te
+++ b/brctl.te
-@@ -34,12 +34,9 @@ dev_write_sysfs_dirs(brctl_t)
+@@ -24,6 +24,7 @@ allow brctl_t self:unix_dgram_socket create_socket_perms;
+ allow brctl_t self:tcp_socket create_socket_perms;
+
+ kernel_request_load_module(brctl_t)
++kernel_read_system_state(brctl_t)
+ kernel_read_network_state(brctl_t)
+ kernel_read_sysctl(brctl_t)
+
+@@ -34,12 +35,8 @@ dev_write_sysfs_dirs(brctl_t)
domain_use_interactive_fds(brctl_t)
-files_read_etc_files(brctl_t)
-
+-
term_dontaudit_use_console(brctl_t)
-miscfiles_read_localization(brctl_t)
@@ -12488,7 +12502,7 @@ index 32e8265..0de4af3 100644
+ allow $1 chronyd_unit_file_t:service all_service_perms;
')
diff --git a/chronyd.te b/chronyd.te
-index e5b621c..e7c249d 100644
+index e5b621c..f975594 100644
--- a/chronyd.te
+++ b/chronyd.te
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
@@ -12519,7 +12533,7 @@ index e5b621c..e7c249d 100644
allow chronyd_t chronyd_keys_t:file read_file_perms;
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
-@@ -76,18 +83,20 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
+@@ -76,18 +83,24 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
corenet_udp_bind_chronyd_port(chronyd_t)
corenet_udp_sendrecv_chronyd_port(chronyd_t)
@@ -12541,10 +12555,11 @@ index e5b621c..e7c249d 100644
optional_policy(`
gpsd_rw_shm(chronyd_t)
')
--
--optional_policy(`
+
+ optional_policy(`
- mta_send_mail(chronyd_t)
--')
++ timemaster_stream_connect(chronyd_t)
+ ')
diff --git a/cinder.fc b/cinder.fc
new file mode 100644
index 0000000..4b318b7
@@ -15514,7 +15529,7 @@ index 0000000..54b4b04
+')
diff --git a/conman.te b/conman.te
new file mode 100644
-index 0000000..ccff09f
+index 0000000..4772f64
--- /dev/null
+++ b/conman.te
@@ -0,0 +1,55 @@
@@ -15557,7 +15572,7 @@ index 0000000..ccff09f
+manage_files_pattern(conman_t, conman_var_run_t, conman_var_run_t)
+files_pid_filetrans(conman_t, conman_var_run_t, file)
+
-+auth_read_passwd(conman_t)
++auth_use_nsswitch(conman_t)
+
+corenet_tcp_bind_generic_node(conman_t)
+corenet_tcp_bind_conman_port(conman_t)
@@ -20732,7 +20747,7 @@ index dda905b..ccd0ba9 100644
/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
+')
diff --git a/dbus.if b/dbus.if
-index 62d22cb..e1b35aa 100644
+index 62d22cb..f8ab4af 100644
--- a/dbus.if
+++ b/dbus.if
@@ -1,4 +1,4 @@
@@ -20858,7 +20873,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -103,91 +129,84 @@ template(`dbus_role_template',`
+@@ -103,91 +129,88 @@ template(`dbus_role_template',`
#
interface(`dbus_system_bus_client',`
gen_require(`
@@ -20888,6 +20903,10 @@ index 62d22cb..e1b35aa 100644
stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
-
dbus_read_config($1)
++
++ optional_policy(`
++ unconfined_server_dbus_chat($1)
++ ')
')
#######################################
@@ -20984,7 +21003,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -195,15 +214,18 @@ interface(`dbus_connect_spec_session_bus',`
+@@ -195,15 +218,18 @@ interface(`dbus_connect_spec_session_bus',`
## </summary>
## </param>
#
@@ -21009,7 +21028,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -211,57 +233,39 @@ interface(`dbus_session_bus_client',`
+@@ -211,57 +237,39 @@ interface(`dbus_session_bus_client',`
## </summary>
## </param>
#
@@ -21081,7 +21100,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -269,15 +273,19 @@ interface(`dbus_spec_session_bus_client',`
+@@ -269,15 +277,19 @@ interface(`dbus_spec_session_bus_client',`
## </summary>
## </param>
#
@@ -21107,7 +21126,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -285,44 +293,52 @@ interface(`dbus_send_session_bus',`
+@@ -285,44 +297,52 @@ interface(`dbus_send_session_bus',`
## </summary>
## </param>
#
@@ -21174,7 +21193,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -330,18 +346,18 @@ interface(`dbus_send_spec_session_bus',`
+@@ -330,18 +350,18 @@ interface(`dbus_send_spec_session_bus',`
## </summary>
## </param>
#
@@ -21198,7 +21217,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -349,20 +365,18 @@ interface(`dbus_read_config',`
+@@ -349,20 +369,18 @@ interface(`dbus_read_config',`
## </summary>
## </param>
#
@@ -21224,7 +21243,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -370,26 +384,20 @@ interface(`dbus_read_lib_files',`
+@@ -370,26 +388,20 @@ interface(`dbus_read_lib_files',`
## </summary>
## </param>
#
@@ -21257,7 +21276,7 @@ index 62d22cb..e1b35aa 100644
## <param name="domain">
## <summary>
## Type to be used as a domain.
-@@ -397,81 +405,67 @@ interface(`dbus_manage_lib_files',`
+@@ -397,81 +409,67 @@ interface(`dbus_manage_lib_files',`
## </param>
## <param name="entry_point">
## <summary>
@@ -21367,7 +21386,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -479,18 +473,18 @@ interface(`dbus_spec_session_domain',`
+@@ -479,18 +477,18 @@ interface(`dbus_spec_session_domain',`
## </summary>
## </param>
#
@@ -21391,7 +21410,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -498,98 +492,100 @@ interface(`dbus_connect_system_bus',`
+@@ -498,98 +496,100 @@ interface(`dbus_connect_system_bus',`
## </summary>
## </param>
#
@@ -21535,7 +21554,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -597,28 +593,50 @@ interface(`dbus_use_system_bus_fds',`
+@@ -597,28 +597,50 @@ interface(`dbus_use_system_bus_fds',`
## </summary>
## </param>
#
@@ -26210,7 +26229,7 @@ index 9a21639..26c5986 100644
')
+
diff --git a/drbd.te b/drbd.te
-index f2516cc..6f78534 100644
+index f2516cc..70ddc24 100644
--- a/drbd.te
+++ b/drbd.te
@@ -18,17 +18,20 @@ files_type(drbd_var_lib_t)
@@ -26247,7 +26266,7 @@ index f2516cc..6f78534 100644
kernel_read_system_state(drbd_t)
-+auth_read_passwd(drbd_t)
++auth_use_nsswitch(drbd_t)
+
+can_exec(drbd_t, drbd_exec_t)
+
@@ -35169,10 +35188,10 @@ index 6517fad..b7ca833 100644
+ allow $1 hypervkvp_unit_file_t:service all_service_perms;
')
diff --git a/hypervkvp.te b/hypervkvp.te
-index 4eb7041..6f859e1 100644
+index 4eb7041..ccb563e 100644
--- a/hypervkvp.te
+++ b/hypervkvp.te
-@@ -5,24 +5,72 @@ policy_module(hypervkvp, 1.0.0)
+@@ -5,24 +5,81 @@ policy_module(hypervkvp, 1.0.0)
# Declarations
#
@@ -35207,7 +35226,7 @@ index 4eb7041..6f859e1 100644
#
-# Local policy
+# hyperv domain local policy
- #
++#
+
+allow hyperv_domain self:capability net_admin;
+allow hyperv_domain self:netlink_socket create_socket_perms;
@@ -35223,23 +35242,32 @@ index 4eb7041..6f859e1 100644
+########################################
#
+# hypervkvp local policy
-+#
-+
+ #
+
+-allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
+-allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
+manage_dirs_pattern(hypervkvp_t, hypervkvp_var_lib_t, hypervkvp_var_lib_t)
+manage_files_pattern(hypervkvp_t, hypervkvp_var_lib_t, hypervkvp_var_lib_t)
+files_var_lib_filetrans(hypervkvp_t, hypervkvp_var_lib_t, dir)
+
++domain_read_all_domains_state(hypervkvp_t)
++
+files_dontaudit_search_home(hypervkvp_t)
+
+logging_send_syslog_msg(hypervkvp_t)
+
+sysnet_dns_name_resolve(hypervkvp_t)
-
--allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
--allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
++sysnet_domtrans_dhcpc(hypervkvp_t)
++
++systemd_exec_systemctl(hypervkvp_t)
++
+userdom_dontaudit_search_admin_dir(hypervkvp_t)
+
+optional_policy(`
++ netutils_domtrans_ping(hypervkvp_t)
++')
++
++optional_policy(`
+ sysnet_exec_ifconfig(hypervkvp_t)
+')
+
@@ -35414,7 +35442,7 @@ index fbb54e7..05c3777 100644
########################################
diff --git a/inetd.te b/inetd.te
-index c6450df..93445b7 100644
+index c6450df..a28aa13 100644
--- a/inetd.te
+++ b/inetd.te
@@ -37,9 +37,9 @@ ifdef(`enable_mcs',`
@@ -35487,7 +35515,7 @@ index c6450df..93445b7 100644
########################################
#
# Child local policy
-@@ -220,6 +223,14 @@ kernel_read_kernel_sysctls(inetd_child_t)
+@@ -220,6 +223,16 @@ kernel_read_kernel_sysctls(inetd_child_t)
kernel_read_network_state(inetd_child_t)
kernel_read_system_state(inetd_child_t)
@@ -35499,10 +35527,12 @@ index c6450df..93445b7 100644
+corenet_tcp_sendrecv_all_ports(inetd_child_t)
+corenet_udp_sendrecv_all_ports(inetd_child_t)
+
++corecmd_bin_entry_type(inetd_child_t)
++
dev_read_urand(inetd_child_t)
fs_getattr_xattr_fs(inetd_child_t)
-@@ -230,7 +241,11 @@ auth_use_nsswitch(inetd_child_t)
+@@ -230,7 +243,11 @@ auth_use_nsswitch(inetd_child_t)
logging_send_syslog_msg(inetd_child_t)
@@ -41863,6 +41893,238 @@ index d8c2442..ef30d42 100644
corenet_sendrecv_generic_server_packets(srvsvcd_t)
corenet_tcp_sendrecv_generic_if(srvsvcd_t)
corenet_tcp_sendrecv_generic_node(srvsvcd_t)
+diff --git a/linuxptp.fc b/linuxptp.fc
+new file mode 100644
+index 0000000..d2061a9
+--- /dev/null
++++ b/linuxptp.fc
+@@ -0,0 +1,11 @@
++/usr/lib/systemd/system/phc2sys.* -- gen_context(system_u:object_r:phc2sys_unit_file_t,s0)
++
++/usr/lib/systemd/system/ptp4l.* -- gen_context(system_u:object_r:ptp4l_unit_file_t,s0)
++
++/usr/lib/systemd/system/timemaster.* -- gen_context(system_u:object_r:timemaster_unit_file_t,s0)
++
++/usr/sbin/ptp4l -- gen_context(system_u:object_r:ptp4l_exec_t,s0)
++/usr/sbin/phc2sys -- gen_context(system_u:object_r:phc2sys_exec_t,s0)
++/usr/sbin/timemaster -- gen_context(system_u:object_r:timemaster_exec_t,s0)
++
++/var/run/timemaster(/.*)? gen_context(system_u:object_r:timemaster_var_run_t,s0)
+diff --git a/linuxptp.if b/linuxptp.if
+new file mode 100644
+index 0000000..8d6873f
+--- /dev/null
++++ b/linuxptp.if
+@@ -0,0 +1,59 @@
++## <summary>implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux.</summary>
++
++########################################
++## <summary>
++## Execute domain in the phc2sys domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`linuxptp_domtrans_phc2sys',`
++ gen_require(`
++ type phc2sys_t, phc2sys_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, phc2sys_exec_t, phc2sys_t)
++')
++
++########################################
++## <summary>
++## Execute domain in the phc2sys domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`linuxptp_domtrans_ptp4l',`
++ gen_require(`
++ type ptp4l_t, ptp4l_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, ptp4l_exec_t, ptp4l_t)
++')
++######################################
++## <summary>
++## Connect to timemaster using a unix
++## domain stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`timemaster_stream_connect',`
++ gen_require(`
++ type timemaster_t, timemaster_var_run_t;
++ ')
++
++ files_search_pids($1)
++ stream_connect_pattern($1, timemaster_var_run_t, timemaster_var_run_t, timemaster_t)
++')
++
+diff --git a/linuxptp.te b/linuxptp.te
+new file mode 100644
+index 0000000..5a1445c
+--- /dev/null
++++ b/linuxptp.te
+@@ -0,0 +1,144 @@
++policy_module(linuxptp, 1.0.0)
++
++
++########################################
++#
++# Declarations
++#
++
++type timemaster_t;
++type timemaster_exec_t;
++init_daemon_domain(timemaster_t, timemaster_exec_t)
++
++type timemaster_var_run_t;
++files_pid_file(timemaster_var_run_t)
++
++type timemaster_unit_file_t;
++systemd_unit_file(timemaster_unit_file_t)
++
++type phc2sys_t;
++type phc2sys_exec_t;
++init_daemon_domain(phc2sys_t, phc2sys_exec_t)
++
++type phc2sys_unit_file_t;
++systemd_unit_file(phc2sys_unit_file_t)
++
++type ptp4l_t;
++type ptp4l_exec_t;
++init_daemon_domain(ptp4l_t, ptp4l_exec_t)
++
++type ptp4l_unit_file_t;
++systemd_unit_file(ptp4l_unit_file_t)
++
++########################################
++#
++# timemaster local policy
++#
++
++allow timemaster_t self:process { signal_perms setcap};
++allow timemaster_t self:fifo_file rw_fifo_file_perms;
++allow timemaster_t self:capability { setuid sys_time kill setgid };
++allow timemaster_t self:unix_stream_socket create_stream_socket_perms;
++allow timemaster_t self:shm create_shm_perms;
++allow timemaster_t self:udp_socket create_socket_perms;
++
++allow timemaster_t ptp4l_t:process signal;
++allow timemaster_t phc2sys_t:process signal;
++
++manage_dirs_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t)
++manage_files_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t)
++manage_sock_files_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t)
++files_pid_filetrans(timemaster_t, timemaster_var_run_t, { dir file sock_file })
++
++kernel_read_network_state(timemaster_t)
++
++auth_use_nsswitch(timemaster_t)
++
++corenet_udp_bind_generic_node(timemaster_t)
++corenet_udp_bind_ntp_port(timemaster_t)
++
++logging_send_syslog_msg(timemaster_t)
++
++sysnet_read_config(timemaster_t)
++
++optional_policy(`
++ chronyd_domtrans(timemaster_t)
++ chronyd_rw_shm(timemaster_t)
++')
++
++optional_policy(`
++ gpsd_rw_shm(timemaster_t)
++')
++
++optional_policy(`
++ linuxptp_domtrans_ptp4l(timemaster_t)
++')
++
++optional_policy(`
++ linuxptp_domtrans_phc2sys(timemaster_t)
++')
++
++########################################
++#
++# phc2sys local policy
++#
++
++allow phc2sys_t self:capability sys_time;
++allow phc2sys_t self:fifo_file rw_fifo_file_perms;
++allow phc2sys_t self:unix_stream_socket create_stream_socket_perms;
++allow phc2sys_t self:shm create_shm_perms;
++allow phc2sys_t self:udp_socket create_socket_perms;
++
++allow phc2sys_t ptp4l_t:unix_dgram_socket sendto;
++
++manage_dirs_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t)
++manage_files_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t)
++manage_sock_files_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t)
++files_pid_filetrans(phc2sys_t, timemaster_var_run_t, { dir file sock_file })
++
++logging_send_syslog_msg(phc2sys_t)
++
++optional_policy(`
++ chronyd_rw_shm(phc2sys_t)
++')
++
++optional_policy(`
++ gpsd_rw_shm(phc2sys_t)
++')
++
++optional_policy(`
++ ntp_rw_shm(phc2sys_t)
++')
++
++########################################
++#
++# ptp4l local policy
++#
++
++allow ptp4l_t self:fifo_file rw_fifo_file_perms;
++allow ptp4l_t self:unix_stream_socket create_stream_socket_perms;
++allow ptp4l_t self:shm create_shm_perms;
++allow ptp4l_t self:udp_socket create_socket_perms;
++allow ptp4l_t self:capability { net_admin net_raw sys_time };
++allow ptp4l_t self:netlink_route_socket { bind create getattr nlmsg_read };
++
++allow ptp4l_t phc2sys_t:unix_dgram_socket sendto;
++
++manage_dirs_pattern(ptp4l_t, timemaster_var_run_t, timemaster_var_run_t)
++manage_files_pattern(ptp4l_t, timemaster_var_run_t, timemaster_var_run_t)
++manage_sock_files_pattern(ptp4l_t, timemaster_var_run_t, timemaster_var_run_t)
++files_pid_filetrans(ptp4l_t, timemaster_var_run_t, { dir file sock_file })
++
++corenet_udp_bind_generic_node(ptp4l_t)
++corenet_udp_bind_reserved_port(ptp4l_t)
++
++logging_send_syslog_msg(ptp4l_t)
++
++optional_policy(`
++ chronyd_rw_shm(ptp4l_t)
++')
++
++optional_policy(`
++ gpsd_rw_shm(ptp4l_t)
++')
++
diff --git a/lircd.if b/lircd.if
index dff21a7..b6981c8 100644
--- a/lircd.if
@@ -58029,18 +58291,20 @@ index 8ec7859..719cffd 100644
fs_getattr_all_fs(ntop_t)
fs_search_auto_mountpoints(ntop_t)
diff --git a/ntp.fc b/ntp.fc
-index af3c91e..6882a3f 100644
+index af3c91e..2d41c4c 100644
--- a/ntp.fc
+++ b/ntp.fc
-@@ -13,6 +13,8 @@
+@@ -13,7 +13,10 @@
/usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
/usr/sbin/sntp -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
+/usr/lib/systemd/system/ntpd.* -- gen_context(system_u:object_r:ntpd_unit_file_t,s0)
+
/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
++/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+ /var/log/ntp.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
diff --git a/ntp.if b/ntp.if
index e96a309..2bacc3f 100644
--- a/ntp.if
@@ -58242,7 +58506,7 @@ index e96a309..2bacc3f 100644
+ files_var_lib_filetrans($1, ntp_drift_t, file, "sntp-kod")
')
diff --git a/ntp.te b/ntp.te
-index f81b113..5c71385 100644
+index f81b113..6f94328 100644
--- a/ntp.te
+++ b/ntp.te
@@ -18,6 +18,9 @@ role ntpd_roles types ntpd_t;
@@ -58255,15 +58519,16 @@ index f81b113..5c71385 100644
type ntp_conf_t;
files_config_file(ntp_conf_t)
-@@ -53,6 +56,7 @@ allow ntpd_t self:tcp_socket { accept listen };
+@@ -53,6 +56,8 @@ allow ntpd_t self:tcp_socket { accept listen };
manage_dirs_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
manage_files_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
++files_var_lib_filetrans(ntpd_t, ntp_drift_t, dir, "sntp")
+files_var_lib_filetrans(ntpd_t, ntp_drift_t, dir, "sntp-kod")
allow ntpd_t ntp_conf_t:file read_file_perms;
-@@ -60,9 +64,7 @@ read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
+@@ -60,9 +65,7 @@ read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
read_lnk_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
@@ -58274,7 +58539,7 @@ index f81b113..5c71385 100644
logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
manage_dirs_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
-@@ -83,21 +85,16 @@ kernel_read_system_state(ntpd_t)
+@@ -83,21 +86,16 @@ kernel_read_system_state(ntpd_t)
kernel_read_network_state(ntpd_t)
kernel_request_load_module(ntpd_t)
@@ -58298,7 +58563,7 @@ index f81b113..5c71385 100644
corecmd_exec_bin(ntpd_t)
corecmd_exec_shell(ntpd_t)
-@@ -110,13 +107,15 @@ domain_use_interactive_fds(ntpd_t)
+@@ -110,13 +108,15 @@ domain_use_interactive_fds(ntpd_t)
domain_dontaudit_list_all_domains_state(ntpd_t)
files_read_etc_runtime_files(ntpd_t)
@@ -58315,7 +58580,7 @@ index f81b113..5c71385 100644
auth_use_nsswitch(ntpd_t)
-@@ -124,8 +123,6 @@ init_exec_script_files(ntpd_t)
+@@ -124,8 +124,6 @@ init_exec_script_files(ntpd_t)
logging_send_syslog_msg(ntpd_t)
@@ -61437,7 +61702,7 @@ index 0000000..776fda7
+')
diff --git a/opensm.te b/opensm.te
new file mode 100644
-index 0000000..32d1db4
+index 0000000..de03e94
--- /dev/null
+++ b/opensm.te
@@ -0,0 +1,45 @@
@@ -61478,7 +61743,7 @@ index 0000000..32d1db4
+
+kernel_read_system_state(opensm_t)
+
-+auth_read_passwd(opensm_t)
++auth_use_nsswitch(opensm_t)
+
+corecmd_exec_bin(opensm_t)
+
@@ -66394,7 +66659,7 @@ index 30e751f..61feb3a 100644
admin_pattern($1, plymouthd_var_run_t)
')
diff --git a/plymouthd.te b/plymouthd.te
-index 3078ce9..d2f68fa 100644
+index 3078ce9..18872dc 100644
--- a/plymouthd.te
+++ b/plymouthd.te
@@ -15,7 +15,7 @@ type plymouthd_exec_t;
@@ -66451,7 +66716,7 @@ index 3078ce9..d2f68fa 100644
+logging_link_generic_logs(plymouthd_t)
+logging_delete_generic_logs(plymouthd_t)
+
-+auth_read_passwd(plymouthd_t)
++auth_use_nsswitch(plymouthd_t)
+
miscfiles_read_fonts(plymouthd_t)
miscfiles_manage_fonts_cache(plymouthd_t)
@@ -66836,7 +67101,7 @@ index 032a84d..be00a65 100644
+ allow $1 policykit_auth_t:process signal;
')
diff --git a/policykit.te b/policykit.te
-index ee91778..6df7cf0 100644
+index ee91778..b00a474 100644
--- a/policykit.te
+++ b/policykit.te
@@ -7,9 +7,6 @@ policy_module(policykit, 1.3.0)
@@ -67002,7 +67267,7 @@ index ee91778..6df7cf0 100644
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
-@@ -145,65 +159,79 @@ manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
+@@ -145,65 +159,80 @@ manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
@@ -67032,6 +67297,7 @@ index ee91778..6df7cf0 100644
userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
+userdom_dontaudit_write_user_tmp_files(policykit_auth_t)
++userdom_dontaudit_manage_user_home_dirs(policykit_auth_t)
+userdom_read_admin_home_files(policykit_auth_t)
optional_policy(`
@@ -67094,7 +67360,7 @@ index ee91778..6df7cf0 100644
rw_files_pattern(policykit_grant_t, policykit_reload_t, policykit_reload_t)
-@@ -211,23 +239,20 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t
+@@ -211,23 +240,20 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t
manage_files_pattern(policykit_grant_t, policykit_var_lib_t, policykit_var_lib_t)
@@ -67121,7 +67387,7 @@ index ee91778..6df7cf0 100644
optional_policy(`
consolekit_dbus_chat(policykit_grant_t)
')
-@@ -235,26 +260,28 @@ optional_policy(`
+@@ -235,26 +261,28 @@ optional_policy(`
########################################
#
@@ -67156,7 +67422,7 @@ index ee91778..6df7cf0 100644
userdom_read_all_users_state(policykit_resolve_t)
optional_policy(`
-@@ -266,6 +293,6 @@ optional_policy(`
+@@ -266,6 +294,6 @@ optional_policy(`
')
optional_policy(`
@@ -87926,7 +88192,7 @@ index 50d07fb..bada62f 100644
+ allow $1 samba_unit_file_t:service all_service_perms;
')
diff --git a/samba.te b/samba.te
-index 2b7c441..9c52c41 100644
+index 2b7c441..fdfd40f 100644
--- a/samba.te
+++ b/samba.te
@@ -6,100 +6,80 @@ policy_module(samba, 1.16.3)
@@ -88840,13 +89106,13 @@ index 2b7c441..9c52c41 100644
-allow swat_t { nmbd_t smbd_t }:process { signal signull };
+samba_domtrans_smbd(swat_t)
+allow swat_t smbd_t:process { signal signull };
-
--allow swat_t smbd_var_run_t:file read_file_perms;
--allow swat_t smbd_var_run_t:file { lock delete_file_perms };
++
+samba_domtrans_nmbd(swat_t)
+allow swat_t nmbd_t:process { signal signull };
+allow nmbd_t swat_t:process signal;
-+
+
+-allow swat_t smbd_var_run_t:file read_file_perms;
+-allow swat_t smbd_var_run_t:file { lock delete_file_perms };
+read_files_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t)
+stream_connect_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t)
+
@@ -89110,7 +89376,7 @@ index 2b7c441..9c52c41 100644
')
optional_policy(`
-@@ -959,31 +1017,29 @@ optional_policy(`
+@@ -959,31 +1017,35 @@ optional_policy(`
# Winbind helper local policy
#
@@ -89132,11 +89398,16 @@ index 2b7c441..9c52c41 100644
-domain_use_interactive_fds(winbind_helper_t)
-
-files_list_var_lib(winbind_helper_t)
--
++dev_read_urand(winbind_t)
+
term_list_ptys(winbind_helper_t)
++corecmd_exec_bin(winbind_helper_t)
++
+domain_use_interactive_fds(winbind_helper_t)
+
++files_list_tmp(winbind_helper_t)
++
auth_use_nsswitch(winbind_helper_t)
logging_send_syslog_msg(winbind_helper_t)
@@ -89148,7 +89419,7 @@ index 2b7c441..9c52c41 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -997,25 +1053,38 @@ optional_policy(`
+@@ -997,25 +1059,38 @@ optional_policy(`
########################################
#
@@ -101545,7 +101816,7 @@ index e29db63..061fb98 100644
domain_system_change_exemption($1)
role_transition $2 tuned_initrc_exec_t system_r;
diff --git a/tuned.te b/tuned.te
-index 393a330..b500795 100644
+index 393a330..6893547 100644
--- a/tuned.te
+++ b/tuned.te
@@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t)
@@ -101623,22 +101894,22 @@ index 393a330..b500795 100644
files_dontaudit_search_home(tuned_t)
-files_dontaudit_list_tmp(tuned_t)
+files_list_tmp(tuned_t)
-
--fs_getattr_xattr_fs(tuned_t)
++
+fs_getattr_all_fs(tuned_t)
+fs_search_all(tuned_t)
+fs_rw_hugetlbfs_files(tuned_t)
-+
+
+-fs_getattr_xattr_fs(tuned_t)
+auth_use_nsswitch(tuned_t)
logging_send_syslog_msg(tuned_t)
+#bug in tuned
+logging_manage_syslog_config(tuned_t)
+logging_filetrans_named_conf(tuned_t)
-+
-+mount_read_pid_files(tuned_t)
-miscfiles_read_localization(tuned_t)
++mount_read_pid_files(tuned_t)
++
+modutils_domtrans_insmod(tuned_t)
udev_read_pid_files(tuned_t)
@@ -101675,6 +101946,14 @@ index 393a330..b500795 100644
optional_policy(`
sysnet_domtrans_ifconfig(tuned_t)
')
+@@ -96,3 +139,7 @@ optional_policy(`
+ optional_policy(`
+ unconfined_dbus_send(tuned_t)
+ ')
++
++optional_policy(`
++ unconfined_domain(tuned_t)
++')
diff --git a/tvtime.if b/tvtime.if
index 1bb0f7c..372be2f 100644
--- a/tvtime.if
@@ -105209,7 +105488,7 @@ index facdee8..c7a2d97 100644
+ typeattribute $1 sandbox_caps_domain;
')
diff --git a/virt.te b/virt.te
-index f03dcf5..f960625 100644
+index f03dcf5..f3d6203 100644
--- a/virt.te
+++ b/virt.te
@@ -1,150 +1,241 @@
@@ -106214,7 +106493,7 @@ index f03dcf5..f960625 100644
+allow virt_domain self:process { setrlimit signal_perms getsched setsched };
+allow virt_domain self:fifo_file rw_fifo_file_perms;
+allow virt_domain self:shm create_shm_perms;
-+allow virt_domain self:unix_stream_socket create_stream_socket_perms;
++allow virt_domain self:unix_stream_socket { connectto create_stream_socket_perms };
+allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
+allow virt_domain self:tcp_socket create_stream_socket_perms;
+allow virt_domain self:udp_socket create_socket_perms;
@@ -112178,7 +112457,7 @@ index 0000000..fb0519e
+
diff --git a/zoneminder.te b/zoneminder.te
new file mode 100644
-index 0000000..b66e76d
+index 0000000..184e3d5
--- /dev/null
+++ b/zoneminder.te
@@ -0,0 +1,187 @@
@@ -112319,16 +112598,16 @@ index 0000000..b66e76d
+
+optional_policy(`
+ tunable_policy(`zoneminder_run_sudo',`
-+ dbus_system_bus_client(zoneminder_t)
++ sudo_exec(zoneminder_t)
++ su_exec(zoneminder_t)
+ ')
+')
+
+optional_policy(`
-+ tunable_policy(`zoneminder_run_sudo',`
-+ sudo_exec(zoneminder_t)
-+ su_exec(zoneminder_t)
-+ ')
++ dbus_system_bus_client(zoneminder_t)
+')
++
++
+optional_policy(`
+ mysql_stream_connect(zoneminder_t)
+')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 6674776..86271b7 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 90%{?dist}
+Release: 91%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -604,6 +604,28 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Fri Nov 07 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-91
+- Added interface userdom_dontaudit_manage_user_home_dirs
+- Fix unconfined_server_dbus_chat() interface.
+- Add unconfined_server_dbus_chat() inteface.
+- Allow login domains to create kernel keyring with different level.
+- Dontaudit policykit_auth_t to write to user home dirs. BZ (1157256)
+- Make tuned as unconfined domain.
+- Added support for linuxptp policy. BZ(1149693)
+- make zoneminder as dbus client by default.
+- Allow bluetooth read/write uhid devices. BZ (1161169)
+- Add fixes for hypervkvp daemon
+- Allow guest to connect to libvirt using unix_stream_socket.
+- Allow all bus client domains to dbus chat with unconfined_service_t.
+- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
+- Make opensm as nsswitch domain to make it working with sssd.
+- Allow brctl to read meminfo.
+- Allow winbind-helper to execute ntlm_auth in the caller domain.
+- Make plymouthd as nsswitch domain to make it working with sssd.
+- Make drbd as nsswitch domain to make it working with sssd.
+- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
+- Add support for /var/lib/sntp directory.
+
* Mon Nov 03 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-90
- Add support for /dev/nvme controllerdevice nodes created by nvme driver.
- Add 15672 as amqp_port_t