diff --git a/container-selinux.tgz b/container-selinux.tgz
index cbeb3df..a7e7037 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 9a64a86..5fc6730 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -31132,7 +31132,7 @@ index 6bf0ecc2d..29db5fd25 100644
 +')
 +
 diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 8b403774f..fc04c66d5 100644
+index 8b403774f..a03fa4661 100644
 --- a/policy/modules/services/xserver.te
 +++ b/policy/modules/services/xserver.te
 @@ -26,28 +26,66 @@ gen_require(`
@@ -31733,7 +31733,7 @@ index 8b403774f..fc04c66d5 100644
  
  storage_dontaudit_read_fixed_disk(xdm_t)
  storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,28 +650,48 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
+@@ -442,28 +650,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
  storage_dontaudit_raw_write_removable_device(xdm_t)
  storage_dontaudit_setattr_removable_dev(xdm_t)
  storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -31773,20 +31773,23 @@ index 8b403774f..fc04c66d5 100644
 -miscfiles_read_localization(xdm_t)
 +miscfiles_search_man_pages(xdm_t)
  miscfiles_read_fonts(xdm_t)
+-
+-sysnet_read_config(xdm_t)
 +miscfiles_manage_fonts_cache(xdm_t)
 +miscfiles_manage_localization(xdm_t)
 +miscfiles_read_hwdata(xdm_t)
- 
--sysnet_read_config(xdm_t)
++
 +systemd_write_inhibit_pipes(xdm_t)
 +systemd_dbus_chat_localed(xdm_t)
 +systemd_dbus_chat_hostnamed(xdm_t)
 +systemd_start_power_services(xdm_t)
 +systemd_status_power_services(xdm_t)
++systemd_hwdb_mmap_config(xdm_t)
++systemd_hwdb_read_config(xdm_t)
  
  userdom_dontaudit_use_unpriv_user_fds(xdm_t)
  userdom_create_all_users_keys(xdm_t)
-@@ -472,24 +700,167 @@ userdom_read_user_home_content_files(xdm_t)
+@@ -472,24 +702,167 @@ userdom_read_user_home_content_files(xdm_t)
  # Search /proc for any user domain processes.
  userdom_read_all_users_state(xdm_t)
  userdom_signal_all_users(xdm_t)
@@ -31960,7 +31963,7 @@ index 8b403774f..fc04c66d5 100644
  tunable_policy(`xdm_sysadm_login',`
  	userdom_xsession_spec_domtrans_all_users(xdm_t)
  	# FIXME:
-@@ -502,12 +873,31 @@ tunable_policy(`xdm_sysadm_login',`
+@@ -502,12 +875,31 @@ tunable_policy(`xdm_sysadm_login',`
  #	allow xserver_t xdm_tmpfs_t:file rw_file_perms;
  ')
  
@@ -31992,7 +31995,7 @@ index 8b403774f..fc04c66d5 100644
  ')
  
  optional_policy(`
-@@ -518,8 +908,36 @@ optional_policy(`
+@@ -518,8 +910,36 @@ optional_policy(`
  	dbus_system_bus_client(xdm_t)
  	dbus_connect_system_bus(xdm_t)
  
@@ -32016,12 +32019,12 @@ index 8b403774f..fc04c66d5 100644
 +		devicekit_dbus_chat_power(xdm_t)
 +	')
 +
- 	optional_policy(`
--		accountsd_dbus_chat(xdm_t)
++	optional_policy(`
 +		hal_dbus_chat(xdm_t)
 +	')
 +
-+	optional_policy(`
+ 	optional_policy(`
+-		accountsd_dbus_chat(xdm_t)
 +		gnomeclock_dbus_chat(xdm_t)
 +	')
 +
@@ -32030,7 +32033,7 @@ index 8b403774f..fc04c66d5 100644
  	')
  ')
  
-@@ -530,6 +948,20 @@ optional_policy(`
+@@ -530,6 +950,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -32051,7 +32054,7 @@ index 8b403774f..fc04c66d5 100644
  	hostname_exec(xdm_t)
  ')
  
-@@ -547,28 +979,78 @@ optional_policy(`
+@@ -547,28 +981,78 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -32139,7 +32142,7 @@ index 8b403774f..fc04c66d5 100644
  ')
  
  optional_policy(`
-@@ -580,6 +1062,14 @@ optional_policy(`
+@@ -580,6 +1064,14 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -32154,7 +32157,7 @@ index 8b403774f..fc04c66d5 100644
  	xfs_stream_connect(xdm_t)
  ')
  
-@@ -594,7 +1084,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+@@ -594,7 +1086,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
  type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
  
  allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@@ -32163,7 +32166,7 @@ index 8b403774f..fc04c66d5 100644
  
  # setuid/setgid for the wrapper program to change UID
  # sys_rawio is for iopl access - should not be needed for frame-buffer
-@@ -604,8 +1094,11 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -604,8 +1096,11 @@ allow xserver_t input_xevent_t:x_event send;
  # execheap needed until the X module loader is fixed.
  # NVIDIA Needs execstack
  
@@ -32176,7 +32179,7 @@ index 8b403774f..fc04c66d5 100644
  allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  allow xserver_t self:fd use;
  allow xserver_t self:fifo_file rw_fifo_file_perms;
-@@ -618,8 +1111,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -618,8 +1113,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
  allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
  allow xserver_t self:tcp_socket create_stream_socket_perms;
  allow xserver_t self:udp_socket create_socket_perms;
@@ -32192,7 +32195,7 @@ index 8b403774f..fc04c66d5 100644
  manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
  manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
  manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -627,6 +1127,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+@@ -627,6 +1129,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
  
  filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
  
@@ -32203,7 +32206,7 @@ index 8b403774f..fc04c66d5 100644
  manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
  manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
  manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -638,25 +1142,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+@@ -638,25 +1144,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  files_search_var_lib(xserver_t)
  
@@ -32245,7 +32248,7 @@ index 8b403774f..fc04c66d5 100644
  corenet_all_recvfrom_netlabel(xserver_t)
  corenet_tcp_sendrecv_generic_if(xserver_t)
  corenet_udp_sendrecv_generic_if(xserver_t)
-@@ -677,23 +1193,28 @@ dev_rw_apm_bios(xserver_t)
+@@ -677,23 +1195,28 @@ dev_rw_apm_bios(xserver_t)
  dev_rw_agp(xserver_t)
  dev_rw_framebuffer(xserver_t)
  dev_manage_dri_dev(xserver_t)
@@ -32277,7 +32280,7 @@ index 8b403774f..fc04c66d5 100644
  
  # brought on by rhgb
  files_search_mnt(xserver_t)
-@@ -705,6 +1226,14 @@ fs_search_nfs(xserver_t)
+@@ -705,6 +1228,14 @@ fs_search_nfs(xserver_t)
  fs_search_auto_mountpoints(xserver_t)
  fs_search_ramfs(xserver_t)
  
@@ -32292,7 +32295,7 @@ index 8b403774f..fc04c66d5 100644
  mls_xwin_read_to_clearance(xserver_t)
  
  selinux_validate_context(xserver_t)
-@@ -718,20 +1247,18 @@ init_getpgid(xserver_t)
+@@ -718,20 +1249,18 @@ init_getpgid(xserver_t)
  term_setattr_unallocated_ttys(xserver_t)
  term_use_unallocated_ttys(xserver_t)
  
@@ -32316,7 +32319,7 @@ index 8b403774f..fc04c66d5 100644
  
  userdom_search_user_home_dirs(xserver_t)
  userdom_use_user_ttys(xserver_t)
-@@ -739,8 +1266,6 @@ userdom_setattr_user_ttys(xserver_t)
+@@ -739,8 +1268,6 @@ userdom_setattr_user_ttys(xserver_t)
  userdom_read_user_tmp_files(xserver_t)
  userdom_rw_user_tmpfs_files(xserver_t)
  
@@ -32325,7 +32328,7 @@ index 8b403774f..fc04c66d5 100644
  ifndef(`distro_redhat',`
  	allow xserver_t self:process { execmem execheap execstack };
  	domain_mmap_low_uncond(xserver_t)
-@@ -785,17 +1310,54 @@ optional_policy(`
+@@ -785,17 +1312,54 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -32382,7 +32385,7 @@ index 8b403774f..fc04c66d5 100644
  ')
  
  optional_policy(`
-@@ -803,6 +1365,10 @@ optional_policy(`
+@@ -803,6 +1367,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -32393,7 +32396,7 @@ index 8b403774f..fc04c66d5 100644
  	xfs_stream_connect(xserver_t)
  ')
  
-@@ -818,18 +1384,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -818,18 +1386,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
  
  # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
  # handle of a file inside the dir!!!
@@ -32418,7 +32421,7 @@ index 8b403774f..fc04c66d5 100644
  can_exec(xserver_t, xkb_var_lib_t)
  
  # VNC v4 module in X server
-@@ -842,26 +1407,21 @@ init_use_fds(xserver_t)
+@@ -842,26 +1409,21 @@ init_use_fds(xserver_t)
  # to read ROLE_home_t - examine this in more detail
  # (xauth?)
  userdom_read_user_home_content_files(xserver_t)
@@ -32453,7 +32456,7 @@ index 8b403774f..fc04c66d5 100644
  ')
  
  optional_policy(`
-@@ -912,7 +1472,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -912,7 +1474,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
  allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
  # operations allowed on my windows
  allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -32462,7 +32465,7 @@ index 8b403774f..fc04c66d5 100644
  # operations allowed on all windows
  allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
  
-@@ -966,11 +1526,31 @@ allow x_domain self:x_resource { read write };
+@@ -966,11 +1528,31 @@ allow x_domain self:x_resource { read write };
  # can mess with the screensaver
  allow x_domain xserver_t:x_screen { getattr saver_getattr };
  
@@ -32494,7 +32497,7 @@ index 8b403774f..fc04c66d5 100644
  tunable_policy(`! xserver_object_manager',`
  	# should be xserver_unconfined(x_domain),
  	# but typeattribute doesnt work in conditionals
-@@ -992,18 +1572,148 @@ tunable_policy(`! xserver_object_manager',`
+@@ -992,18 +1574,148 @@ tunable_policy(`! xserver_object_manager',`
  	allow x_domain xevent_type:{ x_event x_synthetic_event } *;
  ')
  
@@ -41166,7 +41169,7 @@ index 4e9488463..e7d5f42a5 100644
 +')
 +
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 59b04c1a2..483fb780e 100644
+index 59b04c1a2..370f8a825 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
 @@ -4,6 +4,29 @@ policy_module(logging, 1.20.1)
@@ -41269,9 +41272,12 @@ index 59b04c1a2..483fb780e 100644
  
  init_dontaudit_use_fds(auditctl_t)
  
-@@ -136,9 +175,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms;
+@@ -134,11 +173,12 @@ allow auditd_t self:fifo_file rw_fifo_file_perms;
+ allow auditd_t self:tcp_socket create_stream_socket_perms;
+ 
  allow auditd_t auditd_etc_t:dir list_dir_perms;
- allow auditd_t auditd_etc_t:file read_file_perms;
+-allow auditd_t auditd_etc_t:file read_file_perms;
++allow auditd_t auditd_etc_t:file { read_file_perms map };
  
 +manage_dirs_pattern(auditd_t, auditd_log_t, auditd_log_t)
  manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
@@ -47157,10 +47163,10 @@ index 000000000..121b42208
 +/var/run/initramfs(/.*)?	<<none>>
 diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
 new file mode 100644
-index 000000000..278a1f69b
+index 000000000..634d9596a
 --- /dev/null
 +++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1843 @@
+@@ -0,0 +1,1862 @@
 +## <summary>SELinux policy for systemd components</summary>
 +
 +######################################
@@ -48944,6 +48950,25 @@ index 000000000..278a1f69b
 +
 +########################################
 +## <summary>
++##	Allow process to mmap hwdb config file.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`systemd_hwdb_mmap_config',`
++	gen_require(`
++		type systemd_hwdb_etc_t;
++	')
++
++	allow $1 systemd_hwdb_etc_t:file map;
++')
++
++########################################
++## <summary>
 +##	Allow process to manage hwdb config file.
 +## </summary>
 +## <param name="domain">
@@ -57067,15 +57092,22 @@ index f4ac38dc7..1589d6065 100644
 +	ssh_signal(confined_admindomain)
 +')
 diff --git a/policy/policy_capabilities b/policy/policy_capabilities
-index db3cbca45..710bd7cd2 100644
+index db3cbca45..0728639e8 100644
 --- a/policy/policy_capabilities
 +++ b/policy/policy_capabilities
-@@ -31,3 +31,14 @@ policycap network_peer_controls;
+@@ -31,3 +31,21 @@ policycap network_peer_controls;
  # blk_file: open
  #
  policycap open_perms;
 +
 +
++# Enable fine-grained labeling of cgroup and cgroup2 filesystems.
++# Requires Linux v4.11 and later.
++#
++# Added checks:
++# (none)
++#policycap cgroup_seclabel;
++
 +# Enable NoNewPrivileges support.  Requires libsepol 2.7+
 +# and kernel 4.14 (estimated).
 +#
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index b27035a..0a5c4e1 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -21269,7 +21269,7 @@ index 3023be7f6..5afde8039 100644
 +	files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
  ')
 diff --git a/cups.te b/cups.te
-index c91813ccb..8c014f781 100644
+index c91813ccb..e0ba2f7d9 100644
 --- a/cups.te
 +++ b/cups.te
 @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -21546,7 +21546,7 @@ index c91813ccb..8c014f781 100644
  
  selinux_compute_access_vector(cupsd_t)
  selinux_validate_context(cupsd_t)
-@@ -244,22 +289,28 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,22 +289,29 @@ auth_dontaudit_read_pam_pid(cupsd_t)
  auth_rw_faillog(cupsd_t)
  auth_use_nsswitch(cupsd_t)
  
@@ -21554,6 +21554,7 @@ index c91813ccb..8c014f781 100644
  libs_exec_lib_files(cupsd_t)
 +libs_exec_ldconfig(cupsd_t)
 +libs_exec_ld_so(cupsd_t)
++libs_use_ld_so(cupsd_t)
  
  logging_send_audit_msgs(cupsd_t)
  logging_send_syslog_msg(cupsd_t)
@@ -21580,7 +21581,7 @@ index c91813ccb..8c014f781 100644
  
  optional_policy(`
  	apm_domtrans_client(cupsd_t)
-@@ -272,6 +323,8 @@ optional_policy(`
+@@ -272,6 +324,8 @@ optional_policy(`
  optional_policy(`
  	dbus_system_bus_client(cupsd_t)
  
@@ -21589,7 +21590,7 @@ index c91813ccb..8c014f781 100644
  	userdom_dbus_send_all_users(cupsd_t)
  
  	optional_policy(`
-@@ -279,11 +332,17 @@ optional_policy(`
+@@ -279,11 +333,17 @@ optional_policy(`
  	')
  
  	optional_policy(`
@@ -21607,7 +21608,7 @@ index c91813ccb..8c014f781 100644
  	')
  ')
  
-@@ -296,8 +355,8 @@ optional_policy(`
+@@ -296,8 +356,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21617,7 +21618,7 @@ index c91813ccb..8c014f781 100644
  ')
  
  optional_policy(`
-@@ -306,7 +365,6 @@ optional_policy(`
+@@ -306,7 +366,6 @@ optional_policy(`
  
  optional_policy(`
  	lpd_exec_lpr(cupsd_t)
@@ -21625,7 +21626,7 @@ index c91813ccb..8c014f781 100644
  	lpd_read_config(cupsd_t)
  	lpd_relabel_spool(cupsd_t)
  ')
-@@ -316,6 +374,10 @@ optional_policy(`
+@@ -316,6 +375,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21636,7 +21637,7 @@ index c91813ccb..8c014f781 100644
  	samba_read_config(cupsd_t)
  	samba_rw_var_files(cupsd_t)
  	samba_stream_connect_nmbd(cupsd_t)
-@@ -326,7 +388,7 @@ optional_policy(`
+@@ -326,7 +389,7 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21645,7 +21646,7 @@ index c91813ccb..8c014f781 100644
  ')
  
  optional_policy(`
-@@ -334,7 +396,11 @@ optional_policy(`
+@@ -334,7 +397,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21658,7 +21659,7 @@ index c91813ccb..8c014f781 100644
  ')
  
  ########################################
-@@ -342,12 +408,11 @@ optional_policy(`
+@@ -342,12 +409,11 @@ optional_policy(`
  # Configuration daemon local policy
  #
  
@@ -21674,7 +21675,7 @@ index c91813ccb..8c014f781 100644
  allow cupsd_config_t cupsd_t:process signal;
  ps_process_pattern(cupsd_config_t, cupsd_t)
  
-@@ -367,23 +432,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
+@@ -367,23 +433,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
  files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
  
  allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@@ -21702,7 +21703,7 @@ index c91813ccb..8c014f781 100644
  corenet_all_recvfrom_netlabel(cupsd_config_t)
  corenet_tcp_sendrecv_generic_if(cupsd_config_t)
  corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -392,20 +457,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -392,20 +458,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
  corenet_sendrecv_all_client_packets(cupsd_config_t)
  corenet_tcp_connect_all_ports(cupsd_config_t)
  
@@ -21723,7 +21724,7 @@ index c91813ccb..8c014f781 100644
  fs_search_auto_mountpoints(cupsd_config_t)
  
  domain_use_interactive_fds(cupsd_config_t)
-@@ -417,11 +474,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,11 +475,6 @@ auth_use_nsswitch(cupsd_config_t)
  
  logging_send_syslog_msg(cupsd_config_t)
  
@@ -21735,7 +21736,7 @@ index c91813ccb..8c014f781 100644
  userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
  userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
  userdom_read_all_users_state(cupsd_config_t)
-@@ -449,9 +501,12 @@ optional_policy(`
+@@ -449,9 +502,12 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21749,7 +21750,7 @@ index c91813ccb..8c014f781 100644
  ')
  
  optional_policy(`
-@@ -467,6 +522,10 @@ optional_policy(`
+@@ -467,6 +523,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21760,7 +21761,7 @@ index c91813ccb..8c014f781 100644
  	rpm_read_db(cupsd_config_t)
  ')
  
-@@ -487,10 +546,6 @@ optional_policy(`
+@@ -487,10 +547,6 @@ optional_policy(`
  # Lpd local policy
  #
  
@@ -21771,7 +21772,7 @@ index c91813ccb..8c014f781 100644
  allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
  
  allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +563,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +564,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
  
  kernel_read_kernel_sysctls(cupsd_lpd_t)
  kernel_read_system_state(cupsd_lpd_t)
@@ -21789,7 +21790,7 @@ index c91813ccb..8c014f781 100644
  corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
  
  corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +592,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +593,6 @@ auth_use_nsswitch(cupsd_lpd_t)
  
  logging_send_syslog_msg(cupsd_lpd_t)
  
@@ -21799,7 +21800,7 @@ index c91813ccb..8c014f781 100644
  optional_policy(`
  	inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
  ')
-@@ -549,9 +601,9 @@ optional_policy(`
+@@ -549,9 +602,9 @@ optional_policy(`
  # Pdf local policy
  #
  
@@ -21811,7 +21812,7 @@ index c91813ccb..8c014f781 100644
  
  append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
  create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +618,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +619,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
  
  kernel_read_system_state(cups_pdf_t)
  
@@ -21963,7 +21964,7 @@ index c91813ccb..8c014f781 100644
  
  ########################################
  #
-@@ -735,7 +662,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +663,6 @@ kernel_read_kernel_sysctls(ptal_t)
  kernel_list_proc(ptal_t)
  kernel_read_proc_symlinks(ptal_t)
  
@@ -21971,7 +21972,7 @@ index c91813ccb..8c014f781 100644
  corenet_all_recvfrom_netlabel(ptal_t)
  corenet_tcp_sendrecv_generic_if(ptal_t)
  corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +671,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +672,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
  corenet_tcp_bind_ptal_port(ptal_t)
  corenet_tcp_sendrecv_ptal_port(ptal_t)
  
@@ -21985,7 +21986,7 @@ index c91813ccb..8c014f781 100644
  files_read_etc_runtime_files(ptal_t)
  
  fs_getattr_all_fs(ptal_t)
-@@ -759,8 +683,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +684,6 @@ fs_search_auto_mountpoints(ptal_t)
  
  logging_send_syslog_msg(ptal_t)
  
@@ -21994,7 +21995,7 @@ index c91813ccb..8c014f781 100644
  sysnet_read_config(ptal_t)
  
  userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +695,4 @@ optional_policy(`
+@@ -773,3 +696,4 @@ optional_policy(`
  optional_policy(`
  	udev_read_db(ptal_t)
  ')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 56debab..dfdb9a1 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 276%{?dist}
+Release: 277%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -681,6 +681,13 @@ exit 0
 %endif
 
 %changelog
+* Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277
+- Allow cupsd_t to execute ld_so_cache
+- Add cgroup_seclabel policycap.
+- Allow xdm_t to read systemd hwdb
+- Add new interface systemd_hwdb_mmap_config()
+- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
+
 * Sat Aug 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-276
 - Allow couple map rules