diff --git a/container-selinux.tgz b/container-selinux.tgz
index cbeb3df..a7e7037 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 9a64a86..5fc6730 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -31132,7 +31132,7 @@ index 6bf0ecc2d..29db5fd25 100644
+')
+
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 8b403774f..fc04c66d5 100644
+index 8b403774f..a03fa4661 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -26,28 +26,66 @@ gen_require(`
@@ -31733,7 +31733,7 @@ index 8b403774f..fc04c66d5 100644
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,28 +650,48 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
+@@ -442,28 +650,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -31773,20 +31773,23 @@ index 8b403774f..fc04c66d5 100644
-miscfiles_read_localization(xdm_t)
+miscfiles_search_man_pages(xdm_t)
miscfiles_read_fonts(xdm_t)
+-
+-sysnet_read_config(xdm_t)
+miscfiles_manage_fonts_cache(xdm_t)
+miscfiles_manage_localization(xdm_t)
+miscfiles_read_hwdata(xdm_t)
-
--sysnet_read_config(xdm_t)
++
+systemd_write_inhibit_pipes(xdm_t)
+systemd_dbus_chat_localed(xdm_t)
+systemd_dbus_chat_hostnamed(xdm_t)
+systemd_start_power_services(xdm_t)
+systemd_status_power_services(xdm_t)
++systemd_hwdb_mmap_config(xdm_t)
++systemd_hwdb_read_config(xdm_t)
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -472,24 +700,167 @@ userdom_read_user_home_content_files(xdm_t)
+@@ -472,24 +702,167 @@ userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -31960,7 +31963,7 @@ index 8b403774f..fc04c66d5 100644
tunable_policy(`xdm_sysadm_login',`
userdom_xsession_spec_domtrans_all_users(xdm_t)
# FIXME:
-@@ -502,12 +873,31 @@ tunable_policy(`xdm_sysadm_login',`
+@@ -502,12 +875,31 @@ tunable_policy(`xdm_sysadm_login',`
# allow xserver_t xdm_tmpfs_t:file rw_file_perms;
')
@@ -31992,7 +31995,7 @@ index 8b403774f..fc04c66d5 100644
')
optional_policy(`
-@@ -518,8 +908,36 @@ optional_policy(`
+@@ -518,8 +910,36 @@ optional_policy(`
dbus_system_bus_client(xdm_t)
dbus_connect_system_bus(xdm_t)
@@ -32016,12 +32019,12 @@ index 8b403774f..fc04c66d5 100644
+ devicekit_dbus_chat_power(xdm_t)
+ ')
+
- optional_policy(`
-- accountsd_dbus_chat(xdm_t)
++ optional_policy(`
+ hal_dbus_chat(xdm_t)
+ ')
+
-+ optional_policy(`
+ optional_policy(`
+- accountsd_dbus_chat(xdm_t)
+ gnomeclock_dbus_chat(xdm_t)
+ ')
+
@@ -32030,7 +32033,7 @@ index 8b403774f..fc04c66d5 100644
')
')
-@@ -530,6 +948,20 @@ optional_policy(`
+@@ -530,6 +950,20 @@ optional_policy(`
')
optional_policy(`
@@ -32051,7 +32054,7 @@ index 8b403774f..fc04c66d5 100644
hostname_exec(xdm_t)
')
-@@ -547,28 +979,78 @@ optional_policy(`
+@@ -547,28 +981,78 @@ optional_policy(`
')
optional_policy(`
@@ -32139,7 +32142,7 @@ index 8b403774f..fc04c66d5 100644
')
optional_policy(`
-@@ -580,6 +1062,14 @@ optional_policy(`
+@@ -580,6 +1064,14 @@ optional_policy(`
')
optional_policy(`
@@ -32154,7 +32157,7 @@ index 8b403774f..fc04c66d5 100644
xfs_stream_connect(xdm_t)
')
-@@ -594,7 +1084,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+@@ -594,7 +1086,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@@ -32163,7 +32166,7 @@ index 8b403774f..fc04c66d5 100644
# setuid/setgid for the wrapper program to change UID
# sys_rawio is for iopl access - should not be needed for frame-buffer
-@@ -604,8 +1094,11 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -604,8 +1096,11 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -32176,7 +32179,7 @@ index 8b403774f..fc04c66d5 100644
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
-@@ -618,8 +1111,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -618,8 +1113,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -32192,7 +32195,7 @@ index 8b403774f..fc04c66d5 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -627,6 +1127,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+@@ -627,6 +1129,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
@@ -32203,7 +32206,7 @@ index 8b403774f..fc04c66d5 100644
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -638,25 +1142,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+@@ -638,25 +1144,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -32245,7 +32248,7 @@ index 8b403774f..fc04c66d5 100644
corenet_all_recvfrom_netlabel(xserver_t)
corenet_tcp_sendrecv_generic_if(xserver_t)
corenet_udp_sendrecv_generic_if(xserver_t)
-@@ -677,23 +1193,28 @@ dev_rw_apm_bios(xserver_t)
+@@ -677,23 +1195,28 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -32277,7 +32280,7 @@ index 8b403774f..fc04c66d5 100644
# brought on by rhgb
files_search_mnt(xserver_t)
-@@ -705,6 +1226,14 @@ fs_search_nfs(xserver_t)
+@@ -705,6 +1228,14 @@ fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -32292,7 +32295,7 @@ index 8b403774f..fc04c66d5 100644
mls_xwin_read_to_clearance(xserver_t)
selinux_validate_context(xserver_t)
-@@ -718,20 +1247,18 @@ init_getpgid(xserver_t)
+@@ -718,20 +1249,18 @@ init_getpgid(xserver_t)
term_setattr_unallocated_ttys(xserver_t)
term_use_unallocated_ttys(xserver_t)
@@ -32316,7 +32319,7 @@ index 8b403774f..fc04c66d5 100644
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -739,8 +1266,6 @@ userdom_setattr_user_ttys(xserver_t)
+@@ -739,8 +1268,6 @@ userdom_setattr_user_ttys(xserver_t)
userdom_read_user_tmp_files(xserver_t)
userdom_rw_user_tmpfs_files(xserver_t)
@@ -32325,7 +32328,7 @@ index 8b403774f..fc04c66d5 100644
ifndef(`distro_redhat',`
allow xserver_t self:process { execmem execheap execstack };
domain_mmap_low_uncond(xserver_t)
-@@ -785,17 +1310,54 @@ optional_policy(`
+@@ -785,17 +1312,54 @@ optional_policy(`
')
optional_policy(`
@@ -32382,7 +32385,7 @@ index 8b403774f..fc04c66d5 100644
')
optional_policy(`
-@@ -803,6 +1365,10 @@ optional_policy(`
+@@ -803,6 +1367,10 @@ optional_policy(`
')
optional_policy(`
@@ -32393,7 +32396,7 @@ index 8b403774f..fc04c66d5 100644
xfs_stream_connect(xserver_t)
')
-@@ -818,18 +1384,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -818,18 +1386,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!!
@@ -32418,7 +32421,7 @@ index 8b403774f..fc04c66d5 100644
can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server
-@@ -842,26 +1407,21 @@ init_use_fds(xserver_t)
+@@ -842,26 +1409,21 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -32453,7 +32456,7 @@ index 8b403774f..fc04c66d5 100644
')
optional_policy(`
-@@ -912,7 +1472,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -912,7 +1474,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -32462,7 +32465,7 @@ index 8b403774f..fc04c66d5 100644
# operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
-@@ -966,11 +1526,31 @@ allow x_domain self:x_resource { read write };
+@@ -966,11 +1528,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr };
@@ -32494,7 +32497,7 @@ index 8b403774f..fc04c66d5 100644
tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals
-@@ -992,18 +1572,148 @@ tunable_policy(`! xserver_object_manager',`
+@@ -992,18 +1574,148 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *;
')
@@ -41166,7 +41169,7 @@ index 4e9488463..e7d5f42a5 100644
+')
+
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 59b04c1a2..483fb780e 100644
+index 59b04c1a2..370f8a825 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -4,6 +4,29 @@ policy_module(logging, 1.20.1)
@@ -41269,9 +41272,12 @@ index 59b04c1a2..483fb780e 100644
init_dontaudit_use_fds(auditctl_t)
-@@ -136,9 +175,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms;
+@@ -134,11 +173,12 @@ allow auditd_t self:fifo_file rw_fifo_file_perms;
+ allow auditd_t self:tcp_socket create_stream_socket_perms;
+
allow auditd_t auditd_etc_t:dir list_dir_perms;
- allow auditd_t auditd_etc_t:file read_file_perms;
+-allow auditd_t auditd_etc_t:file read_file_perms;
++allow auditd_t auditd_etc_t:file { read_file_perms map };
+manage_dirs_pattern(auditd_t, auditd_log_t, auditd_log_t)
manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
@@ -47157,10 +47163,10 @@ index 000000000..121b42208
+/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
-index 000000000..278a1f69b
+index 000000000..634d9596a
--- /dev/null
+++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1843 @@
+@@ -0,0 +1,1862 @@
+## <summary>SELinux policy for systemd components</summary>
+
+######################################
@@ -48944,6 +48950,25 @@ index 000000000..278a1f69b
+
+########################################
+## <summary>
++## Allow process to mmap hwdb config file.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`systemd_hwdb_mmap_config',`
++ gen_require(`
++ type systemd_hwdb_etc_t;
++ ')
++
++ allow $1 systemd_hwdb_etc_t:file map;
++')
++
++########################################
++## <summary>
+## Allow process to manage hwdb config file.
+## </summary>
+## <param name="domain">
@@ -57067,15 +57092,22 @@ index f4ac38dc7..1589d6065 100644
+ ssh_signal(confined_admindomain)
+')
diff --git a/policy/policy_capabilities b/policy/policy_capabilities
-index db3cbca45..710bd7cd2 100644
+index db3cbca45..0728639e8 100644
--- a/policy/policy_capabilities
+++ b/policy/policy_capabilities
-@@ -31,3 +31,14 @@ policycap network_peer_controls;
+@@ -31,3 +31,21 @@ policycap network_peer_controls;
# blk_file: open
#
policycap open_perms;
+
+
++# Enable fine-grained labeling of cgroup and cgroup2 filesystems.
++# Requires Linux v4.11 and later.
++#
++# Added checks:
++# (none)
++#policycap cgroup_seclabel;
++
+# Enable NoNewPrivileges support. Requires libsepol 2.7+
+# and kernel 4.14 (estimated).
+#
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index b27035a..0a5c4e1 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -21269,7 +21269,7 @@ index 3023be7f6..5afde8039 100644
+ files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
')
diff --git a/cups.te b/cups.te
-index c91813ccb..8c014f781 100644
+index c91813ccb..e0ba2f7d9 100644
--- a/cups.te
+++ b/cups.te
@@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -21546,7 +21546,7 @@ index c91813ccb..8c014f781 100644
selinux_compute_access_vector(cupsd_t)
selinux_validate_context(cupsd_t)
-@@ -244,22 +289,28 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,22 +289,29 @@ auth_dontaudit_read_pam_pid(cupsd_t)
auth_rw_faillog(cupsd_t)
auth_use_nsswitch(cupsd_t)
@@ -21554,6 +21554,7 @@ index c91813ccb..8c014f781 100644
libs_exec_lib_files(cupsd_t)
+libs_exec_ldconfig(cupsd_t)
+libs_exec_ld_so(cupsd_t)
++libs_use_ld_so(cupsd_t)
logging_send_audit_msgs(cupsd_t)
logging_send_syslog_msg(cupsd_t)
@@ -21580,7 +21581,7 @@ index c91813ccb..8c014f781 100644
optional_policy(`
apm_domtrans_client(cupsd_t)
-@@ -272,6 +323,8 @@ optional_policy(`
+@@ -272,6 +324,8 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(cupsd_t)
@@ -21589,7 +21590,7 @@ index c91813ccb..8c014f781 100644
userdom_dbus_send_all_users(cupsd_t)
optional_policy(`
-@@ -279,11 +332,17 @@ optional_policy(`
+@@ -279,11 +333,17 @@ optional_policy(`
')
optional_policy(`
@@ -21607,7 +21608,7 @@ index c91813ccb..8c014f781 100644
')
')
-@@ -296,8 +355,8 @@ optional_policy(`
+@@ -296,8 +356,8 @@ optional_policy(`
')
optional_policy(`
@@ -21617,7 +21618,7 @@ index c91813ccb..8c014f781 100644
')
optional_policy(`
-@@ -306,7 +365,6 @@ optional_policy(`
+@@ -306,7 +366,6 @@ optional_policy(`
optional_policy(`
lpd_exec_lpr(cupsd_t)
@@ -21625,7 +21626,7 @@ index c91813ccb..8c014f781 100644
lpd_read_config(cupsd_t)
lpd_relabel_spool(cupsd_t)
')
-@@ -316,6 +374,10 @@ optional_policy(`
+@@ -316,6 +375,10 @@ optional_policy(`
')
optional_policy(`
@@ -21636,7 +21637,7 @@ index c91813ccb..8c014f781 100644
samba_read_config(cupsd_t)
samba_rw_var_files(cupsd_t)
samba_stream_connect_nmbd(cupsd_t)
-@@ -326,7 +388,7 @@ optional_policy(`
+@@ -326,7 +389,7 @@ optional_policy(`
')
optional_policy(`
@@ -21645,7 +21646,7 @@ index c91813ccb..8c014f781 100644
')
optional_policy(`
-@@ -334,7 +396,11 @@ optional_policy(`
+@@ -334,7 +397,11 @@ optional_policy(`
')
optional_policy(`
@@ -21658,7 +21659,7 @@ index c91813ccb..8c014f781 100644
')
########################################
-@@ -342,12 +408,11 @@ optional_policy(`
+@@ -342,12 +409,11 @@ optional_policy(`
# Configuration daemon local policy
#
@@ -21674,7 +21675,7 @@ index c91813ccb..8c014f781 100644
allow cupsd_config_t cupsd_t:process signal;
ps_process_pattern(cupsd_config_t, cupsd_t)
-@@ -367,23 +432,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
+@@ -367,23 +433,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@@ -21702,7 +21703,7 @@ index c91813ccb..8c014f781 100644
corenet_all_recvfrom_netlabel(cupsd_config_t)
corenet_tcp_sendrecv_generic_if(cupsd_config_t)
corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -392,20 +457,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -392,20 +458,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
corenet_sendrecv_all_client_packets(cupsd_config_t)
corenet_tcp_connect_all_ports(cupsd_config_t)
@@ -21723,7 +21724,7 @@ index c91813ccb..8c014f781 100644
fs_search_auto_mountpoints(cupsd_config_t)
domain_use_interactive_fds(cupsd_config_t)
-@@ -417,11 +474,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,11 +475,6 @@ auth_use_nsswitch(cupsd_config_t)
logging_send_syslog_msg(cupsd_config_t)
@@ -21735,7 +21736,7 @@ index c91813ccb..8c014f781 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t)
-@@ -449,9 +501,12 @@ optional_policy(`
+@@ -449,9 +502,12 @@ optional_policy(`
')
optional_policy(`
@@ -21749,7 +21750,7 @@ index c91813ccb..8c014f781 100644
')
optional_policy(`
-@@ -467,6 +522,10 @@ optional_policy(`
+@@ -467,6 +523,10 @@ optional_policy(`
')
optional_policy(`
@@ -21760,7 +21761,7 @@ index c91813ccb..8c014f781 100644
rpm_read_db(cupsd_config_t)
')
-@@ -487,10 +546,6 @@ optional_policy(`
+@@ -487,10 +547,6 @@ optional_policy(`
# Lpd local policy
#
@@ -21771,7 +21772,7 @@ index c91813ccb..8c014f781 100644
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +563,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +564,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
kernel_read_kernel_sysctls(cupsd_lpd_t)
kernel_read_system_state(cupsd_lpd_t)
@@ -21789,7 +21790,7 @@ index c91813ccb..8c014f781 100644
corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +592,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +593,6 @@ auth_use_nsswitch(cupsd_lpd_t)
logging_send_syslog_msg(cupsd_lpd_t)
@@ -21799,7 +21800,7 @@ index c91813ccb..8c014f781 100644
optional_policy(`
inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
')
-@@ -549,9 +601,9 @@ optional_policy(`
+@@ -549,9 +602,9 @@ optional_policy(`
# Pdf local policy
#
@@ -21811,7 +21812,7 @@ index c91813ccb..8c014f781 100644
append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +618,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +619,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
kernel_read_system_state(cups_pdf_t)
@@ -21963,7 +21964,7 @@ index c91813ccb..8c014f781 100644
########################################
#
-@@ -735,7 +662,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +663,6 @@ kernel_read_kernel_sysctls(ptal_t)
kernel_list_proc(ptal_t)
kernel_read_proc_symlinks(ptal_t)
@@ -21971,7 +21972,7 @@ index c91813ccb..8c014f781 100644
corenet_all_recvfrom_netlabel(ptal_t)
corenet_tcp_sendrecv_generic_if(ptal_t)
corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +671,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +672,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
corenet_tcp_bind_ptal_port(ptal_t)
corenet_tcp_sendrecv_ptal_port(ptal_t)
@@ -21985,7 +21986,7 @@ index c91813ccb..8c014f781 100644
files_read_etc_runtime_files(ptal_t)
fs_getattr_all_fs(ptal_t)
-@@ -759,8 +683,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +684,6 @@ fs_search_auto_mountpoints(ptal_t)
logging_send_syslog_msg(ptal_t)
@@ -21994,7 +21995,7 @@ index c91813ccb..8c014f781 100644
sysnet_read_config(ptal_t)
userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +695,4 @@ optional_policy(`
+@@ -773,3 +696,4 @@ optional_policy(`
optional_policy(`
udev_read_db(ptal_t)
')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 56debab..dfdb9a1 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 276%{?dist}
+Release: 277%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -681,6 +681,13 @@ exit 0
%endif
%changelog
+* Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277
+- Allow cupsd_t to execute ld_so_cache
+- Add cgroup_seclabel policycap.
+- Allow xdm_t to read systemd hwdb
+- Add new interface systemd_hwdb_mmap_config()
+- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
+
* Sat Aug 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-276
- Allow couple map rules