diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 1601045..619e58c 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -1802,7 +1802,7 @@ index c6ca761..0c86bfd 100644
')
diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te
-index c44c359..bb78970 100644
+index c44c359..e679c18 100644
--- a/policy/modules/admin/netutils.te
+++ b/policy/modules/admin/netutils.te
@@ -7,10 +7,10 @@ policy_module(netutils, 1.12.1)
@@ -1857,11 +1857,15 @@ index c44c359..bb78970 100644
fs_getattr_xattr_fs(netutils_t)
-@@ -82,10 +86,9 @@ auth_use_nsswitch(netutils_t)
+@@ -80,12 +84,12 @@ init_use_script_ptys(netutils_t)
- logging_send_syslog_msg(netutils_t)
+ auth_use_nsswitch(netutils_t)
+
+-logging_send_syslog_msg(netutils_t)
++libs_use_ld_so(netutils_t)
-miscfiles_read_localization(netutils_t)
++logging_send_syslog_msg(netutils_t)
term_dontaudit_use_console(netutils_t)
-userdom_use_user_terminals(netutils_t)
@@ -1869,7 +1873,7 @@ index c44c359..bb78970 100644
userdom_use_all_users_fds(netutils_t)
optional_policy(`
-@@ -110,11 +113,10 @@ allow ping_t self:capability { setuid net_raw };
+@@ -110,11 +114,10 @@ allow ping_t self:capability { setuid net_raw };
allow ping_t self:process { getcap setcap };
dontaudit ping_t self:capability sys_tty_config;
allow ping_t self:tcp_socket create_socket_perms;
@@ -1883,7 +1887,7 @@ index c44c359..bb78970 100644
corenet_all_recvfrom_netlabel(ping_t)
corenet_tcp_sendrecv_generic_if(ping_t)
corenet_raw_sendrecv_generic_if(ping_t)
-@@ -124,6 +126,9 @@ corenet_raw_bind_generic_node(ping_t)
+@@ -124,6 +127,9 @@ corenet_raw_bind_generic_node(ping_t)
corenet_tcp_sendrecv_all_ports(ping_t)
fs_dontaudit_getattr_xattr_fs(ping_t)
@@ -1893,7 +1897,7 @@ index c44c359..bb78970 100644
domain_use_interactive_fds(ping_t)
-@@ -131,14 +136,13 @@ files_read_etc_files(ping_t)
+@@ -131,14 +137,13 @@ files_read_etc_files(ping_t)
files_dontaudit_search_var(ping_t)
kernel_read_system_state(ping_t)
@@ -1911,7 +1915,7 @@ index c44c359..bb78970 100644
ifdef(`hide_broken_symptoms',`
init_dontaudit_use_fds(ping_t)
-@@ -149,11 +153,25 @@ ifdef(`hide_broken_symptoms',`
+@@ -149,11 +154,25 @@ ifdef(`hide_broken_symptoms',`
')
')
@@ -1937,7 +1941,7 @@ index c44c359..bb78970 100644
pcmcia_use_cardmgr_fds(ping_t)
')
-@@ -161,6 +179,15 @@ optional_policy(`
+@@ -161,6 +180,15 @@ optional_policy(`
hotplug_use_fds(ping_t)
')
@@ -1953,7 +1957,7 @@ index c44c359..bb78970 100644
########################################
#
# Traceroute local policy
-@@ -174,7 +201,6 @@ allow traceroute_t self:udp_socket create_socket_perms;
+@@ -174,7 +202,6 @@ allow traceroute_t self:udp_socket create_socket_perms;
kernel_read_system_state(traceroute_t)
kernel_read_network_state(traceroute_t)
@@ -1961,7 +1965,7 @@ index c44c359..bb78970 100644
corenet_all_recvfrom_netlabel(traceroute_t)
corenet_tcp_sendrecv_generic_if(traceroute_t)
corenet_udp_sendrecv_generic_if(traceroute_t)
-@@ -198,6 +224,7 @@ fs_dontaudit_getattr_xattr_fs(traceroute_t)
+@@ -198,6 +225,7 @@ fs_dontaudit_getattr_xattr_fs(traceroute_t)
domain_use_interactive_fds(traceroute_t)
files_read_etc_files(traceroute_t)
@@ -1969,7 +1973,7 @@ index c44c359..bb78970 100644
files_dontaudit_search_var(traceroute_t)
init_use_fds(traceroute_t)
-@@ -206,11 +233,17 @@ auth_use_nsswitch(traceroute_t)
+@@ -206,11 +234,17 @@ auth_use_nsswitch(traceroute_t)
logging_send_syslog_msg(traceroute_t)
@@ -2752,7 +2756,7 @@ index 99e3903..fa68362 100644
## </summary>
## <param name="domain">
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
-index 1d732f1..6a6da75 100644
+index 1d732f1..f6ff7aa 100644
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -26,6 +26,7 @@ type chfn_exec_t;
@@ -3127,10 +3131,10 @@ index 1d732f1..6a6da75 100644
userdom_use_unpriv_users_fds(useradd_t)
# Add/remove user home directories
-userdom_manage_user_home_dirs(useradd_t)
- userdom_home_filetrans_user_home_dir(useradd_t)
+-userdom_home_filetrans_user_home_dir(useradd_t)
-userdom_manage_user_home_content_dirs(useradd_t)
-userdom_manage_user_home_content_files(useradd_t)
--userdom_home_filetrans_user_home_dir(useradd_t)
+ userdom_home_filetrans_user_home_dir(useradd_t)
-userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
+userdom_manage_home_role(system_r, useradd_t)
+userdom_delete_all_user_home_content(useradd_t)
@@ -3148,7 +3152,15 @@ index 1d732f1..6a6da75 100644
optional_policy(`
apache_manage_all_user_content(useradd_t)
')
-@@ -549,10 +593,19 @@ optional_policy(`
+@@ -545,14 +589,27 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ kerberos_manage_kdc_var_lib(useradd_t)
++')
++
++optional_policy(`
+ nscd_run(useradd_t, useradd_roles)
')
optional_policy(`
@@ -3168,7 +3180,7 @@ index 1d732f1..6a6da75 100644
tunable_policy(`samba_domain_controller',`
samba_append_log(useradd_t)
')
-@@ -562,3 +615,12 @@ optional_policy(`
+@@ -562,3 +619,12 @@ optional_policy(`
rpm_use_fds(useradd_t)
rpm_rw_pipes(useradd_t)
')
@@ -6035,7 +6047,7 @@ index 3f6e168..340e49f 100644
')
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
-index b31c054..1f28afb 100644
+index b31c054..d500876 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -15,15 +15,18 @@
@@ -6068,7 +6080,7 @@ index b31c054..1f28afb 100644
/dev/ipmi[0-9]+ -c gen_context(system_u:object_r:ipmi_device_t,s0)
/dev/ipmi/[0-9]+ -c gen_context(system_u:object_r:ipmi_device_t,s0)
/dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0)
-@@ -61,7 +66,8 @@
+@@ -61,8 +66,10 @@
/dev/loop-control -c gen_context(system_u:object_r:loop_control_device_t,s0)
/dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/mcelog -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
@@ -6076,9 +6088,11 @@ index b31c054..1f28afb 100644
+/dev/media.* -c gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/mei -c gen_context(system_u:object_r:mei_device_t,s0)
/dev/mem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
++/dev/memory_bandwidth -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/mga_vid.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
-@@ -72,6 +78,7 @@
+ /dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0)
+@@ -72,6 +79,7 @@
/dev/mixer.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/modem -c gen_context(system_u:object_r:modem_device_t,s0)
@@ -6086,7 +6100,7 @@ index b31c054..1f28afb 100644
/dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/msr.* -c gen_context(system_u:object_r:cpu_device_t,s0)
/dev/net/vhost -c gen_context(system_u:object_r:vhost_device_t,s0)
-@@ -80,6 +87,8 @@
+@@ -80,6 +88,8 @@
/dev/noz.* -c gen_context(system_u:object_r:modem_device_t,s0)
/dev/null -c gen_context(system_u:object_r:null_device_t,s0)
/dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
@@ -6095,7 +6109,7 @@ index b31c054..1f28afb 100644
/dev/nvram -c gen_context(system_u:object_r:nvram_device_t,mls_systemhigh)
/dev/oldmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
-@@ -90,6 +99,7 @@
+@@ -90,6 +100,7 @@
/dev/pmu -c gen_context(system_u:object_r:power_device_t,s0)
/dev/port -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/pps.* -c gen_context(system_u:object_r:clock_device_t,s0)
@@ -6103,7 +6117,7 @@ index b31c054..1f28afb 100644
/dev/(misc/)?psaux -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0)
-@@ -106,6 +116,7 @@
+@@ -106,6 +117,7 @@
/dev/snapshot -c gen_context(system_u:object_r:apm_bios_t,s0)
/dev/sndstat -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0)
@@ -6111,10 +6125,11 @@ index b31c054..1f28afb 100644
/dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/tpm[0-9]* -c gen_context(system_u:object_r:tpm_device_t,s0)
/dev/uinput -c gen_context(system_u:object_r:event_device_t,s0)
-@@ -118,6 +129,11 @@
+@@ -118,6 +130,12 @@
ifdef(`distro_suse', `
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
')
++/dev/vhci -c gen_context(system_u:object_r:vhost_device_t,s0)
+/dev/vchiq -c gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vc-mem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
+/dev/vfio/(vfio)?[0-9]* -c gen_context(system_u:object_r:vfio_device_t,s0)
@@ -6123,7 +6138,7 @@ index b31c054..1f28afb 100644
/dev/vhost-net -c gen_context(system_u:object_r:vhost_device_t,s0)
/dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
-@@ -129,12 +145,14 @@ ifdef(`distro_suse', `
+@@ -129,12 +147,14 @@ ifdef(`distro_suse', `
/dev/vttuner -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/vtx.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/watchdog.* -c gen_context(system_u:object_r:watchdog_device_t,s0)
@@ -6138,7 +6153,7 @@ index b31c054..1f28afb 100644
/dev/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0)
-@@ -172,6 +190,8 @@ ifdef(`distro_suse', `
+@@ -172,6 +192,8 @@ ifdef(`distro_suse', `
/dev/touchscreen/ucb1x00 -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/touchscreen/mk712 -c gen_context(system_u:object_r:mouse_device_t,s0)
@@ -6147,7 +6162,7 @@ index b31c054..1f28afb 100644
/dev/usb/dc2xx.* -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
-@@ -198,12 +218,27 @@ ifdef(`distro_debian',`
+@@ -198,12 +220,27 @@ ifdef(`distro_debian',`
/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
@@ -6178,7 +6193,7 @@ index b31c054..1f28afb 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..99f01e2 100644
+index 76f285e..450a2b7 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -7727,7 +7742,32 @@ index 76f285e..99f01e2 100644
## Read and write VMWare devices.
## </summary>
## <param name="domain">
-@@ -4762,6 +5715,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4630,6 +5583,24 @@ interface(`dev_write_watchdog',`
+
+ ########################################
+ ## <summary>
++## RW to watchdog devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_watchdog',`
++ gen_require(`
++ type device_t, watchdog_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, watchdog_device_t)
++')
++
++########################################
++## <summary>
+ ## Read and write the the wireless device.
+ ## </summary>
+ ## <param name="domain">
+@@ -4762,6 +5733,44 @@ interface(`dev_rw_xserver_misc',`
########################################
## <summary>
@@ -7772,7 +7812,7 @@ index 76f285e..99f01e2 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
-@@ -4851,3 +5842,966 @@ interface(`dev_unconfined',`
+@@ -4851,3 +5860,966 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -9190,7 +9230,7 @@ index 6a1e4d1..26e5558 100644
+ dontaudit $1 domain:dir_file_class_set audit_access;
')
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
-index cf04cb5..ed54d58 100644
+index cf04cb5..e8da15e 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -4,17 +4,41 @@ policy_module(domain, 1.11.0)
@@ -9343,7 +9383,7 @@ index cf04cb5..ed54d58 100644
# Create/access any System V IPC objects.
allow unconfined_domain_type domain:{ sem msgq shm } *;
-@@ -166,5 +242,361 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
+@@ -166,5 +242,365 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
# act on all domains keys
allow unconfined_domain_type domain:key *;
@@ -9363,6 +9403,10 @@ index cf04cb5..ed54d58 100644
+ kdump_filetrans_named_content(unconfined_domain_type)
+')
+
++optional_policy(`
++ fstools_filetrans_named_content_fsadm(named_filetrans_domain)
++')
++
+#optional_policy(`
+# docker_filetrans_named_content(named_filetrans_domain)
+#')
@@ -21446,7 +21490,7 @@ index ff92430..36740ea 100644
## <summary>
## Execute a generic bin program in the sysadm domain.
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index 2522ca6..85c5be2 100644
+index 2522ca6..f2029b6 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -5,39 +5,88 @@ policy_module(sysadm, 2.6.1)
@@ -21855,7 +21899,7 @@ index 2522ca6..85c5be2 100644
')
optional_policy(`
-@@ -345,7 +473,18 @@ optional_policy(`
+@@ -345,30 +473,37 @@ optional_policy(`
')
optional_policy(`
@@ -21868,35 +21912,41 @@ index 2522ca6..85c5be2 100644
+ systemd_login_reboot(sysadm_t)
+ systemd_login_halt(sysadm_t)
+ systemd_login_undefined(sysadm_t)
-+')
-+
-+optional_policy(`
-+ tftp_filetrans_named_content(sysadm_t)
')
optional_policy(`
-@@ -356,19 +495,11 @@ optional_policy(`
+- tripwire_run_siggen(sysadm_t, sysadm_r)
+- tripwire_run_tripwire(sysadm_t, sysadm_r)
+- tripwire_run_twadmin(sysadm_t, sysadm_r)
+- tripwire_run_twprint(sysadm_t, sysadm_r)
++ systemd_exec_sysctl(sysadm_t)
')
optional_policy(`
- tvtime_role(sysadm_r, sysadm_t)
--')
--
--optional_policy(`
- tzdata_domtrans(sysadm_t)
++ tftp_filetrans_named_content(sysadm_t)
+ ')
+
+ optional_policy(`
+- tzdata_domtrans(sysadm_t)
++ tripwire_run_siggen(sysadm_t, sysadm_r)
++ tripwire_run_tripwire(sysadm_t, sysadm_r)
++ tripwire_run_twadmin(sysadm_t, sysadm_r)
++ tripwire_run_twprint(sysadm_t, sysadm_r)
')
optional_policy(`
- uml_role(sysadm_r, sysadm_t)
--')
--
--optional_policy(`
++ tzdata_domtrans(sysadm_t)
+ ')
+
+ optional_policy(`
- unconfined_domtrans(sysadm_t)
+ udev_run(sysadm_t, sysadm_r)
')
optional_policy(`
-@@ -380,10 +511,6 @@ optional_policy(`
+@@ -380,10 +515,6 @@ optional_policy(`
')
optional_policy(`
@@ -21907,7 +21957,7 @@ index 2522ca6..85c5be2 100644
usermanage_run_admin_passwd(sysadm_t, sysadm_r)
usermanage_run_groupadd(sysadm_t, sysadm_r)
usermanage_run_useradd(sysadm_t, sysadm_r)
-@@ -391,6 +518,9 @@ optional_policy(`
+@@ -391,6 +522,9 @@ optional_policy(`
optional_policy(`
virt_stream_connect(sysadm_t)
@@ -21917,7 +21967,7 @@ index 2522ca6..85c5be2 100644
')
optional_policy(`
-@@ -398,31 +528,34 @@ optional_policy(`
+@@ -398,31 +532,34 @@ optional_policy(`
')
optional_policy(`
@@ -21958,7 +22008,7 @@ index 2522ca6..85c5be2 100644
auth_role(sysadm_r, sysadm_t)
')
-@@ -435,10 +568,6 @@ ifndef(`distro_redhat',`
+@@ -435,10 +572,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
@@ -21969,7 +22019,7 @@ index 2522ca6..85c5be2 100644
dbus_role_template(sysadm, sysadm_r, sysadm_t)
optional_policy(`
-@@ -459,15 +588,79 @@ ifndef(`distro_redhat',`
+@@ -459,15 +592,79 @@ ifndef(`distro_redhat',`
')
optional_policy(`
@@ -30557,10 +30607,10 @@ index 948ce2a..8cab8ae 100644
+
+/var/run/blkid(/.*)? gen_context(system_u:object_r:fsadm_var_run_t,s0)
diff --git a/policy/modules/system/fstools.if b/policy/modules/system/fstools.if
-index 016a770..1effeb4 100644
+index 016a770..3fce820 100644
--- a/policy/modules/system/fstools.if
+++ b/policy/modules/system/fstools.if
-@@ -154,3 +154,24 @@ interface(`fstools_getattr_swap_files',`
+@@ -154,3 +154,42 @@ interface(`fstools_getattr_swap_files',`
allow $1 swapfile_t:file getattr;
')
@@ -30583,10 +30633,28 @@ index 016a770..1effeb4 100644
+ files_search_pids($1)
+ manage_dirs_pattern($1, fsadm_var_run_t, fsadm_var_run_t)
+ manage_files_pattern($1, fsadm_var_run_t, fsadm_var_run_t)
++ fstools_filetrans_named_content_fsadm($1)
++')
++
++########################################
++## <summary>
++## Transition to systemd content
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fstools_filetrans_named_content_fsadm',`
++ gen_require(`
++ type fsadm_var_run_t;
++ ')
++
+ files_pid_filetrans($1, fsadm_var_run_t, dir, "blkid")
+')
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
-index 3f48d30..1fb0cde 100644
+index 3f48d30..cb4f966 100644
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -13,9 +13,15 @@ role system_r types fsadm_t;
@@ -30672,7 +30740,7 @@ index 3f48d30..1fb0cde 100644
# Recreate /mnt/cdrom.
files_manage_mnt_dirs(fsadm_t)
# for tune2fs
-@@ -133,21 +156,27 @@ storage_raw_write_fixed_disk(fsadm_t)
+@@ -133,21 +156,28 @@ storage_raw_write_fixed_disk(fsadm_t)
storage_raw_read_removable_device(fsadm_t)
storage_raw_write_removable_device(fsadm_t)
storage_read_scsi_generic(fsadm_t)
@@ -30690,19 +30758,21 @@ index 3f48d30..1fb0cde 100644
+init_stream_connect(fsadm_t)
logging_send_syslog_msg(fsadm_t)
+-
+-miscfiles_read_localization(fsadm_t)
+logging_send_audit_msgs(fsadm_t)
+logging_stream_connect_syslog(fsadm_t)
--miscfiles_read_localization(fsadm_t)
-
seutil_read_config(fsadm_t)
-userdom_use_user_terminals(fsadm_t)
+term_use_all_inherited_terms(fsadm_t)
++
++userdom_rw_inherited_user_tmp_pipes(fsadm_t)
ifdef(`distro_redhat',`
optional_policy(`
-@@ -166,6 +195,11 @@ optional_policy(`
+@@ -166,6 +196,11 @@ optional_policy(`
')
optional_policy(`
@@ -30714,7 +30784,7 @@ index 3f48d30..1fb0cde 100644
hal_dontaudit_write_log(fsadm_t)
')
-@@ -179,6 +213,10 @@ optional_policy(`
+@@ -179,6 +214,10 @@ optional_policy(`
')
optional_policy(`
@@ -30725,7 +30795,7 @@ index 3f48d30..1fb0cde 100644
nis_use_ypbind(fsadm_t)
')
-@@ -192,6 +230,10 @@ optional_policy(`
+@@ -192,6 +231,10 @@ optional_policy(`
')
optional_policy(`
@@ -34723,7 +34793,7 @@ index c42fbc3..277fe6c 100644
## <summary>
## Set the attributes of iptables config files.
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
-index be8ed1e..750839c 100644
+index be8ed1e..e93440e 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -16,15 +16,18 @@ role iptables_roles types iptables_t;
@@ -34748,7 +34818,7 @@ index be8ed1e..750839c 100644
########################################
#
# Iptables local policy
-@@ -37,23 +40,28 @@ allow iptables_t self:process { sigchld sigkill sigstop signull signal };
+@@ -37,23 +40,29 @@ allow iptables_t self:process { sigchld sigkill sigstop signull signal };
allow iptables_t self:netlink_socket create_socket_perms;
allow iptables_t self:rawip_socket create_socket_perms;
@@ -34763,6 +34833,7 @@ index be8ed1e..750839c 100644
+manage_dirs_pattern(iptables_t, iptables_var_lib_t, iptables_var_lib_t)
+manage_files_pattern(iptables_t, iptables_var_lib_t, iptables_var_lib_t)
+manage_lnk_files_pattern(iptables_t, iptables_var_lib_t, iptables_var_lib_t)
++files_var_lib_filetrans(iptables_t, iptables_var_lib_t, { file dir lnk_file })
+
can_exec(iptables_t, iptables_exec_t)
@@ -34780,7 +34851,7 @@ index be8ed1e..750839c 100644
kernel_use_fds(iptables_t)
# needed by ipvsadm
-@@ -64,6 +72,8 @@ corenet_relabelto_all_packets(iptables_t)
+@@ -64,6 +73,8 @@ corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t)
dev_read_sysfs(iptables_t)
@@ -34789,7 +34860,7 @@ index be8ed1e..750839c 100644
fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
-@@ -72,11 +82,12 @@ fs_list_inotifyfs(iptables_t)
+@@ -72,11 +83,12 @@ fs_list_inotifyfs(iptables_t)
mls_file_read_all_levels(iptables_t)
term_dontaudit_use_console(iptables_t)
@@ -34804,7 +34875,7 @@ index be8ed1e..750839c 100644
auth_use_nsswitch(iptables_t)
-@@ -85,15 +96,14 @@ init_use_script_ptys(iptables_t)
+@@ -85,15 +97,14 @@ init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
init_rw_script_stream_sockets(iptables_t)
@@ -34822,7 +34893,7 @@ index be8ed1e..750839c 100644
userdom_use_all_users_fds(iptables_t)
ifdef(`hide_broken_symptoms',`
-@@ -102,6 +112,9 @@ ifdef(`hide_broken_symptoms',`
+@@ -102,6 +113,9 @@ ifdef(`hide_broken_symptoms',`
optional_policy(`
fail2ban_append_log(iptables_t)
@@ -34832,7 +34903,7 @@ index be8ed1e..750839c 100644
')
optional_policy(`
-@@ -110,6 +123,11 @@ optional_policy(`
+@@ -110,6 +124,11 @@ optional_policy(`
')
optional_policy(`
@@ -34844,7 +34915,7 @@ index be8ed1e..750839c 100644
modutils_run_insmod(iptables_t, iptables_roles)
')
-@@ -124,6 +142,16 @@ optional_policy(`
+@@ -124,6 +143,16 @@ optional_policy(`
optional_policy(`
psad_rw_tmp_files(iptables_t)
@@ -34861,7 +34932,7 @@ index be8ed1e..750839c 100644
')
optional_policy(`
-@@ -135,9 +163,9 @@ optional_policy(`
+@@ -135,9 +164,9 @@ optional_policy(`
')
optional_policy(`
@@ -37060,7 +37131,7 @@ index 6b91740..5c1669a 100644
+/var/run/clvmd\.pid -- gen_context(system_u:object_r:clvmd_var_run_t,s0)
/var/run/dmevent.* gen_context(system_u:object_r:lvm_var_run_t,s0)
diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if
-index 58bc27f..4e1936d 100644
+index 58bc27f..6293110 100644
--- a/policy/modules/system/lvm.if
+++ b/policy/modules/system/lvm.if
@@ -1,5 +1,22 @@
@@ -37163,7 +37234,7 @@ index 58bc27f..4e1936d 100644
######################################
## <summary>
## Execute a domain transition to run clvmd.
-@@ -123,3 +203,154 @@ interface(`lvm_domtrans_clvmd',`
+@@ -123,3 +203,157 @@ interface(`lvm_domtrans_clvmd',`
corecmd_search_bin($1)
domtrans_pattern($1, clvmd_exec_t, clvmd_t)
')
@@ -37311,15 +37382,18 @@ index 58bc27f..4e1936d 100644
+ type lvm_lock_t;
+ ')
+
++ files_lock_filetrans($1, lvm_lock_t, dir, "lvm")
++
+ files_search_locks($1)
+ manage_files_pattern($1, lvm_lock_t, lvm_lock_t)
+ manage_dirs_pattern($1, lvm_lock_t, lvm_lock_t)
++
+')
+
+
+
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
-index 79048c4..6cf8b94 100644
+index 79048c4..14497e9 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -12,6 +12,9 @@ init_daemon_domain(clvmd_t, clvmd_exec_t)
@@ -37514,7 +37588,7 @@ index 79048c4..6cf8b94 100644
init_use_fds(lvm_t)
init_dontaudit_getattr_initctl(lvm_t)
-@@ -293,15 +323,22 @@ init_use_script_ptys(lvm_t)
+@@ -293,15 +323,23 @@ init_use_script_ptys(lvm_t)
init_read_script_state(lvm_t)
logging_send_syslog_msg(lvm_t)
@@ -37531,6 +37605,7 @@ index 79048c4..6cf8b94 100644
+userdom_use_inherited_user_terminals(lvm_t)
userdom_use_user_terminals(lvm_t)
++userdom_rw_inherited_user_tmp_pipes(lvm_t)
+userdom_rw_semaphores(lvm_t)
+userdom_search_user_home_dirs(lvm_t)
+
@@ -37538,7 +37613,7 @@ index 79048c4..6cf8b94 100644
ifdef(`distro_redhat',`
# this is from the initrd:
-@@ -313,6 +350,11 @@ ifdef(`distro_redhat',`
+@@ -313,6 +351,11 @@ ifdef(`distro_redhat',`
')
optional_policy(`
@@ -37550,7 +37625,7 @@ index 79048c4..6cf8b94 100644
bootloader_rw_tmp_files(lvm_t)
')
-@@ -320,6 +362,10 @@ optional_policy(`
+@@ -320,6 +363,10 @@ optional_policy(`
ccs_stream_connect(lvm_t)
')
@@ -37561,7 +37636,7 @@ index 79048c4..6cf8b94 100644
optional_policy(`
gpm_dontaudit_getattr_gpmctl(lvm_t)
')
-@@ -333,14 +379,30 @@ optional_policy(`
+@@ -333,14 +380,30 @@ optional_policy(`
')
optional_policy(`
@@ -38128,7 +38203,7 @@ index 7449974..23bbbf2 100644
+ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.dep.bin")
+')
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
-index 7a363b8..ba534ac 100644
+index 7a363b8..3f02a36 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -5,7 +5,7 @@ policy_module(modutils, 1.14.0)
@@ -38282,7 +38357,7 @@ index 7a363b8..ba534ac 100644
domain_signal_all_domains(insmod_t)
domain_use_interactive_fds(insmod_t)
-@@ -151,30 +169,38 @@ files_read_etc_runtime_files(insmod_t)
+@@ -151,31 +169,44 @@ files_read_etc_runtime_files(insmod_t)
files_read_etc_files(insmod_t)
files_read_usr_files(insmod_t)
files_exec_etc_files(insmod_t)
@@ -38323,9 +38398,15 @@ index 7a363b8..ba534ac 100644
-
+term_use_all_inherited_terms(insmod_t)
userdom_dontaudit_search_user_home_dirs(insmod_t)
++# needed by depmod in MLS
++userdom_manage_user_tmp_files(insmod_t)
++userdom_manage_user_tmp_pipes(insmod_t)
++userdom_manage_user_tmp_symlinks(insmod_t)
++userdom_manage_user_tmp_dirs(insmod_t)
kernel_domtrans_to(insmod_t, insmod_exec_t)
-@@ -184,28 +210,33 @@ optional_policy(`
+
+@@ -184,28 +215,33 @@ optional_policy(`
')
optional_policy(`
@@ -38366,7 +38447,7 @@ index 7a363b8..ba534ac 100644
')
optional_policy(`
-@@ -225,6 +256,7 @@ optional_policy(`
+@@ -225,6 +261,7 @@ optional_policy(`
optional_policy(`
rpm_rw_pipes(insmod_t)
@@ -38374,7 +38455,7 @@ index 7a363b8..ba534ac 100644
')
optional_policy(`
-@@ -233,6 +265,10 @@ optional_policy(`
+@@ -233,6 +270,10 @@ optional_policy(`
')
optional_policy(`
@@ -38385,7 +38466,7 @@ index 7a363b8..ba534ac 100644
# cjp: why is this needed:
dev_rw_xserver_misc(insmod_t)
-@@ -291,11 +327,10 @@ init_use_script_ptys(update_modules_t)
+@@ -291,11 +332,10 @@ init_use_script_ptys(update_modules_t)
logging_send_syslog_msg(update_modules_t)
@@ -42065,10 +42146,10 @@ index 0000000..a03b5ee
+/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
-index 0000000..d2a8fc7
+index 0000000..cde0261
--- /dev/null
+++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1460 @@
+@@ -0,0 +1,1497 @@
+## <summary>SELinux policy for systemd components</summary>
+
+######################################
@@ -42502,6 +42583,43 @@ index 0000000..d2a8fc7
+
+#######################################
+## <summary>
++## Execute a domain transition to run systemd-sysctl.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_domtrans_sysctl',`
++ gen_require(`
++ type systemd_sysctl_t, systemd_sysctl_exec_t;
++ ')
++
++ domtrans_pattern($1, systemd_sysctl_exec_t, systemd_sysctl_t)
++')
++
++#######################################
++## <summary>
++## Allow a domain to execute systemd-sysctl in the caller domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_exec_sysctl',`
++ gen_require(`
++ type systemd_sysctl_exec_t;
++ ')
++
++ can_exec($1,systemd_sysctl_exec_t)
++
++')
++
++#######################################
++## <summary>
+## Execute a domain transition to run systemd-tmpfiles.
+## </summary>
+## <param name="domain">
@@ -44554,7 +44672,7 @@ index 9a1650d..d7e8a01 100644
########################################
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
-index 39f185f..a253f3f 100644
+index 39f185f..703b804 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t)
@@ -44713,7 +44831,7 @@ index 39f185f..a253f3f 100644
seutil_read_config(udev_t)
seutil_read_default_contexts(udev_t)
-@@ -169,7 +191,10 @@ sysnet_read_dhcpc_pid(udev_t)
+@@ -169,9 +191,13 @@ sysnet_read_dhcpc_pid(udev_t)
sysnet_delete_dhcpc_pid(udev_t)
sysnet_signal_dhcpc(udev_t)
sysnet_manage_config(udev_t)
@@ -44724,8 +44842,11 @@ index 39f185f..a253f3f 100644
+systemd_getattr_unit_files(udev_t)
userdom_dontaudit_search_user_home_content(udev_t)
++userdom_rw_inherited_user_tmp_pipes(udev_t)
-@@ -195,16 +220,9 @@ ifdef(`distro_gentoo',`
+ ifdef(`distro_debian',`
+ files_pid_filetrans(udev_t, udev_var_run_t, dir, "xen-hotplug")
+@@ -195,16 +221,9 @@ ifdef(`distro_gentoo',`
')
ifdef(`distro_redhat',`
@@ -44744,7 +44865,7 @@ index 39f185f..a253f3f 100644
# for arping used for static IP addresses on PCMCIA ethernet
netutils_domtrans(udev_t)
-@@ -242,6 +260,7 @@ optional_policy(`
+@@ -242,6 +261,7 @@ optional_policy(`
optional_policy(`
cups_domtrans_config(udev_t)
@@ -44752,7 +44873,7 @@ index 39f185f..a253f3f 100644
')
optional_policy(`
-@@ -249,17 +268,31 @@ optional_policy(`
+@@ -249,17 +269,31 @@ optional_policy(`
dbus_use_system_bus_fds(udev_t)
optional_policy(`
@@ -44786,7 +44907,7 @@ index 39f185f..a253f3f 100644
')
optional_policy(`
-@@ -289,6 +322,10 @@ optional_policy(`
+@@ -289,6 +323,10 @@ optional_policy(`
')
optional_policy(`
@@ -44797,7 +44918,7 @@ index 39f185f..a253f3f 100644
openct_read_pid_files(udev_t)
openct_domtrans(udev_t)
')
-@@ -303,6 +340,15 @@ optional_policy(`
+@@ -303,6 +341,15 @@ optional_policy(`
')
optional_policy(`
@@ -44813,7 +44934,7 @@ index 39f185f..a253f3f 100644
unconfined_signal(udev_t)
')
-@@ -315,6 +361,7 @@ optional_policy(`
+@@ -315,6 +362,7 @@ optional_policy(`
kernel_read_xen_state(udev_t)
xen_manage_log(udev_t)
xen_read_image_files(udev_t)
@@ -45659,7 +45780,7 @@ index db75976..c54480a 100644
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
+
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 9dc60c6..a24e48e 100644
+index 9dc60c6..7811266 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@@ -47134,15 +47255,16 @@ index 9dc60c6..a24e48e 100644
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
-@@ -1128,6 +1536,7 @@ template(`userdom_admin_user_template',`
+@@ -1128,6 +1536,8 @@ template(`userdom_admin_user_template',`
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
+ kernel_signal($1_t)
++ kernel_stream_connect($1_t)
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1145,10 +1554,15 @@ template(`userdom_admin_user_template',`
+@@ -1145,10 +1555,15 @@ template(`userdom_admin_user_template',`
dev_rename_all_blk_files($1_t)
dev_rename_all_chr_files($1_t)
dev_create_generic_symlinks($1_t)
@@ -47158,7 +47280,7 @@ index 9dc60c6..a24e48e 100644
domain_dontaudit_ptrace_all_domains($1_t)
# signal all domains:
domain_kill_all_domains($1_t)
-@@ -1159,29 +1573,40 @@ template(`userdom_admin_user_template',`
+@@ -1159,29 +1574,40 @@ template(`userdom_admin_user_template',`
domain_sigchld_all_domains($1_t)
# for lsof
domain_getattr_all_sockets($1_t)
@@ -47203,7 +47325,7 @@ index 9dc60c6..a24e48e 100644
# The following rule is temporary until such time that a complete
# policy management infrastructure is in place so that an administrator
-@@ -1191,6 +1616,8 @@ template(`userdom_admin_user_template',`
+@@ -1191,6 +1617,8 @@ template(`userdom_admin_user_template',`
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -47212,7 +47334,7 @@ index 9dc60c6..a24e48e 100644
userdom_manage_user_home_content_dirs($1_t)
userdom_manage_user_home_content_files($1_t)
userdom_manage_user_home_content_symlinks($1_t)
-@@ -1198,13 +1625,21 @@ template(`userdom_admin_user_template',`
+@@ -1198,13 +1626,21 @@ template(`userdom_admin_user_template',`
userdom_manage_user_home_content_sockets($1_t)
userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
@@ -47235,7 +47357,7 @@ index 9dc60c6..a24e48e 100644
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1240,7 +1675,7 @@ template(`userdom_admin_user_template',`
+@@ -1240,7 +1676,7 @@ template(`userdom_admin_user_template',`
## </summary>
## </param>
#
@@ -47244,7 +47366,7 @@ index 9dc60c6..a24e48e 100644
allow $1 self:capability { dac_read_search dac_override };
corecmd_exec_shell($1)
-@@ -1250,6 +1685,8 @@ template(`userdom_security_admin_template',`
+@@ -1250,6 +1686,8 @@ template(`userdom_security_admin_template',`
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -47253,7 +47375,7 @@ index 9dc60c6..a24e48e 100644
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1262,8 +1699,10 @@ template(`userdom_security_admin_template',`
+@@ -1262,8 +1700,10 @@ template(`userdom_security_admin_template',`
selinux_set_enforce_mode($1)
selinux_set_all_booleans($1)
selinux_set_parameters($1)
@@ -47265,7 +47387,7 @@ index 9dc60c6..a24e48e 100644
auth_relabel_shadow($1)
init_exec($1)
-@@ -1274,29 +1713,31 @@ template(`userdom_security_admin_template',`
+@@ -1274,29 +1714,31 @@ template(`userdom_security_admin_template',`
logging_read_audit_config($1)
seutil_manage_bin_policy($1)
@@ -47308,7 +47430,7 @@ index 9dc60c6..a24e48e 100644
')
optional_policy(`
-@@ -1357,14 +1798,17 @@ interface(`userdom_user_home_content',`
+@@ -1357,14 +1799,17 @@ interface(`userdom_user_home_content',`
gen_require(`
attribute user_home_content_type;
type user_home_t;
@@ -47327,7 +47449,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -1397,12 +1841,51 @@ interface(`userdom_user_tmp_file',`
+@@ -1397,12 +1842,51 @@ interface(`userdom_user_tmp_file',`
## </param>
#
interface(`userdom_user_tmpfs_file',`
@@ -47380,7 +47502,7 @@ index 9dc60c6..a24e48e 100644
## Allow domain to attach to TUN devices created by administrative users.
## </summary>
## <param name="domain">
-@@ -1509,11 +1992,31 @@ interface(`userdom_search_user_home_dirs',`
+@@ -1509,11 +1993,31 @@ interface(`userdom_search_user_home_dirs',`
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -47412,7 +47534,7 @@ index 9dc60c6..a24e48e 100644
## Do not audit attempts to search user home directories.
## </summary>
## <desc>
-@@ -1555,6 +2058,14 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1555,6 +2059,14 @@ interface(`userdom_list_user_home_dirs',`
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -47427,7 +47549,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -1570,9 +2081,11 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1570,9 +2082,11 @@ interface(`userdom_list_user_home_dirs',`
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -47439,7 +47561,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -1613,6 +2126,24 @@ interface(`userdom_manage_user_home_dirs',`
+@@ -1613,6 +2127,24 @@ interface(`userdom_manage_user_home_dirs',`
########################################
## <summary>
@@ -47464,7 +47586,7 @@ index 9dc60c6..a24e48e 100644
## Relabel to user home directories.
## </summary>
## <param name="domain">
-@@ -1631,6 +2162,59 @@ interface(`userdom_relabelto_user_home_dirs',`
+@@ -1631,6 +2163,59 @@ interface(`userdom_relabelto_user_home_dirs',`
########################################
## <summary>
@@ -47524,7 +47646,7 @@ index 9dc60c6..a24e48e 100644
## Create directories in the home dir root with
## the user home directory type.
## </summary>
-@@ -1704,10 +2288,12 @@ interface(`userdom_user_home_domtrans',`
+@@ -1704,10 +2289,12 @@ interface(`userdom_user_home_domtrans',`
#
interface(`userdom_dontaudit_search_user_home_content',`
gen_require(`
@@ -47539,7 +47661,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -1741,10 +2327,12 @@ interface(`userdom_list_all_user_home_content',`
+@@ -1741,10 +2328,12 @@ interface(`userdom_list_all_user_home_content',`
#
interface(`userdom_list_user_home_content',`
gen_require(`
@@ -47554,7 +47676,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -1769,7 +2357,7 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1769,7 +2358,7 @@ interface(`userdom_manage_user_home_content_dirs',`
########################################
## <summary>
@@ -47563,7 +47685,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1777,19 +2365,17 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1777,19 +2366,17 @@ interface(`userdom_manage_user_home_content_dirs',`
## </summary>
## </param>
#
@@ -47587,7 +47709,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1797,55 +2383,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
+@@ -1797,55 +2384,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
## </summary>
## </param>
#
@@ -47658,7 +47780,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1853,18 +2439,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
+@@ -1853,18 +2440,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
## </summary>
## </param>
#
@@ -47686,7 +47808,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1872,17 +2459,151 @@ interface(`userdom_mmap_user_home_content_files',`
+@@ -1872,17 +2460,151 @@ interface(`userdom_mmap_user_home_content_files',`
## </summary>
## </param>
#
@@ -47842,7 +47964,7 @@ index 9dc60c6..a24e48e 100644
## Do not audit attempts to read user home files.
## </summary>
## <param name="domain">
-@@ -1893,11 +2614,14 @@ interface(`userdom_read_user_home_content_files',`
+@@ -1893,11 +2615,14 @@ interface(`userdom_read_user_home_content_files',`
#
interface(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -47860,7 +47982,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -1938,7 +2662,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
+@@ -1938,7 +2663,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
########################################
## <summary>
@@ -47869,7 +47991,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1946,10 +2670,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
+@@ -1946,10 +2671,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
## </summary>
## </param>
#
@@ -47882,7 +48004,7 @@ index 9dc60c6..a24e48e 100644
')
userdom_search_user_home_content($1)
-@@ -1958,7 +2681,7 @@ interface(`userdom_delete_all_user_home_content_files',`
+@@ -1958,7 +2682,7 @@ interface(`userdom_delete_all_user_home_content_files',`
########################################
## <summary>
@@ -47891,7 +48013,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1966,12 +2689,66 @@ interface(`userdom_delete_all_user_home_content_files',`
+@@ -1966,12 +2690,66 @@ interface(`userdom_delete_all_user_home_content_files',`
## </summary>
## </param>
#
@@ -47960,7 +48082,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2007,8 +2784,7 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2007,8 +2785,7 @@ interface(`userdom_read_user_home_content_symlinks',`
type user_home_dir_t, user_home_t;
')
@@ -47970,7 +48092,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2024,20 +2800,14 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2024,20 +2801,14 @@ interface(`userdom_read_user_home_content_symlinks',`
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -47995,7 +48117,7 @@ index 9dc60c6..a24e48e 100644
########################################
## <summary>
-@@ -2120,7 +2890,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2120,7 +2891,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
########################################
## <summary>
@@ -48004,7 +48126,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2128,19 +2898,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2128,19 +2899,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
## </summary>
## </param>
#
@@ -48028,7 +48150,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2148,12 +2916,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
+@@ -2148,12 +2917,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
## </summary>
## </param>
#
@@ -48044,7 +48166,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2388,18 +3156,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
+@@ -2388,18 +3157,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
## </summary>
## </param>
#
@@ -48102,7 +48224,7 @@ index 9dc60c6..a24e48e 100644
## Do not audit attempts to read users
## temporary files.
## </summary>
-@@ -2414,7 +3218,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
+@@ -2414,7 +3219,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
type user_tmp_t;
')
@@ -48111,7 +48233,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2455,6 +3259,25 @@ interface(`userdom_rw_user_tmp_files',`
+@@ -2455,6 +3260,25 @@ interface(`userdom_rw_user_tmp_files',`
rw_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
')
@@ -48137,7 +48259,7 @@ index 9dc60c6..a24e48e 100644
########################################
## <summary>
-@@ -2538,7 +3361,7 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2538,7 +3362,7 @@ interface(`userdom_manage_user_tmp_files',`
########################################
## <summary>
## Create, read, write, and delete user
@@ -48146,7 +48268,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2546,19 +3369,19 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2546,19 +3370,19 @@ interface(`userdom_manage_user_tmp_files',`
## </summary>
## </param>
#
@@ -48169,7 +48291,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2566,19 +3389,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
+@@ -2566,19 +3390,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
## </summary>
## </param>
#
@@ -48192,7 +48314,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2586,19 +3409,60 @@ interface(`userdom_manage_user_tmp_pipes',`
+@@ -2586,19 +3410,60 @@ interface(`userdom_manage_user_tmp_pipes',`
## </summary>
## </param>
#
@@ -48257,7 +48379,7 @@ index 9dc60c6..a24e48e 100644
## a specified private type.
## </summary>
## <param name="domain">
-@@ -2661,6 +3525,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+@@ -2661,6 +3526,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
files_tmp_filetrans($1, user_tmp_t, $2, $3)
')
@@ -48279,7 +48401,7 @@ index 9dc60c6..a24e48e 100644
########################################
## <summary>
## Read user tmpfs files.
-@@ -2672,18 +3551,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+@@ -2672,18 +3552,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
## </param>
#
interface(`userdom_read_user_tmpfs_files',`
@@ -48301,7 +48423,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2692,19 +3566,13 @@ interface(`userdom_read_user_tmpfs_files',`
+@@ -2692,19 +3567,13 @@ interface(`userdom_read_user_tmpfs_files',`
## </param>
#
interface(`userdom_rw_user_tmpfs_files',`
@@ -48324,7 +48446,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2713,13 +3581,56 @@ interface(`userdom_rw_user_tmpfs_files',`
+@@ -2713,13 +3582,56 @@ interface(`userdom_rw_user_tmpfs_files',`
## </param>
#
interface(`userdom_manage_user_tmpfs_files',`
@@ -48385,7 +48507,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2814,6 +3725,24 @@ interface(`userdom_use_user_ttys',`
+@@ -2814,6 +3726,24 @@ interface(`userdom_use_user_ttys',`
########################################
## <summary>
@@ -48410,7 +48532,7 @@ index 9dc60c6..a24e48e 100644
## Read and write a user domain pty.
## </summary>
## <param name="domain">
-@@ -2832,22 +3761,34 @@ interface(`userdom_use_user_ptys',`
+@@ -2832,22 +3762,34 @@ interface(`userdom_use_user_ptys',`
########################################
## <summary>
@@ -48453,7 +48575,7 @@ index 9dc60c6..a24e48e 100644
## </desc>
## <param name="domain">
## <summary>
-@@ -2856,14 +3797,33 @@ interface(`userdom_use_user_ptys',`
+@@ -2856,14 +3798,33 @@ interface(`userdom_use_user_ptys',`
## </param>
## <infoflow type="both" weight="10"/>
#
@@ -48491,7 +48613,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2882,8 +3842,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
+@@ -2882,8 +3843,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
type user_tty_device_t, user_devpts_t;
')
@@ -48521,7 +48643,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -2955,69 +3934,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
+@@ -2955,69 +3935,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
allow unpriv_userdomain $1:process sigchld;
')
@@ -48622,7 +48744,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3025,12 +4003,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
+@@ -3025,12 +4004,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
## </summary>
## </param>
#
@@ -48637,7 +48759,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -3094,7 +4072,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3094,7 +4073,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -48646,7 +48768,7 @@ index 9dc60c6..a24e48e 100644
allow unpriv_userdomain $1:process sigchld;
')
-@@ -3110,29 +4088,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3110,29 +4089,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -48680,7 +48802,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -3214,7 +4176,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
+@@ -3214,7 +4177,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
type user_devpts_t;
')
@@ -48707,7 +48829,7 @@ index 9dc60c6..a24e48e 100644
')
########################################
-@@ -3269,12 +4249,13 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3269,12 +4250,13 @@ interface(`userdom_write_user_tmp_files',`
type user_tmp_t;
')
@@ -48723,7 +48845,7 @@ index 9dc60c6..a24e48e 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3282,46 +4263,122 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3282,46 +4264,122 @@ interface(`userdom_write_user_tmp_files',`
## </summary>
## </param>
#
@@ -48859,7 +48981,7 @@ index 9dc60c6..a24e48e 100644
')
allow $1 userdomain:process getattr;
-@@ -3382,6 +4439,42 @@ interface(`userdom_signal_all_users',`
+@@ -3382,6 +4440,42 @@ interface(`userdom_signal_all_users',`
allow $1 userdomain:process signal;
')
@@ -48902,7 +49024,7 @@ index 9dc60c6..a24e48e 100644
########################################
## <summary>
## Send a SIGCHLD signal to all user domains.
-@@ -3402,6 +4495,60 @@ interface(`userdom_sigchld_all_users',`
+@@ -3402,6 +4496,60 @@ interface(`userdom_sigchld_all_users',`
########################################
## <summary>
@@ -48963,7 +49085,7 @@ index 9dc60c6..a24e48e 100644
## Create keys for all user domains.
## </summary>
## <param name="domain">
-@@ -3435,4 +4582,1691 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3435,4 +4583,1691 @@ interface(`userdom_dbus_send_all_users',`
')
allow $1 userdomain:dbus send_msg;
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index d819bb5..1fd3df8 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -7703,7 +7703,7 @@ index f3c0aba..f6e25ed 100644
+ files_etc_filetrans(apcupsd_t, apcupsd_power_t, file, "powerfail")
')
diff --git a/apcupsd.te b/apcupsd.te
-index 080bc4d..12d701e 100644
+index 080bc4d..5db6cde 100644
--- a/apcupsd.te
+++ b/apcupsd.te
@@ -24,6 +24,12 @@ files_tmp_file(apcupsd_tmp_t)
@@ -7741,7 +7741,7 @@ index 080bc4d..12d701e 100644
corenet_all_recvfrom_netlabel(apcupsd_t)
corenet_tcp_sendrecv_generic_if(apcupsd_t)
corenet_tcp_sendrecv_generic_node(apcupsd_t)
-@@ -67,26 +73,36 @@ corenet_tcp_bind_apcupsd_port(apcupsd_t)
+@@ -67,26 +73,38 @@ corenet_tcp_bind_apcupsd_port(apcupsd_t)
corenet_sendrecv_apcupsd_server_packets(apcupsd_t)
corenet_tcp_sendrecv_apcupsd_port(apcupsd_t)
corenet_tcp_connect_apcupsd_port(apcupsd_t)
@@ -7754,6 +7754,8 @@ index 080bc4d..12d701e 100644
+fs_getattr_xattr_fs(apcupsd_t)
+
++dev_read_sysfs(apcupsd_t)
++
dev_rw_generic_usb_dev(apcupsd_t)
-files_read_etc_files(apcupsd_t)
@@ -7770,10 +7772,10 @@ index 080bc4d..12d701e 100644
+#apcupsd runs shutdown, probably need a shutdown domain
+init_rw_utmp(apcupsd_t)
+init_telinit(apcupsd_t)
++
++auth_use_nsswitch(apcupsd_t)
-miscfiles_read_localization(apcupsd_t)
-+auth_use_nsswitch(apcupsd_t)
-+
+logging_send_syslog_msg(apcupsd_t)
sysnet_dns_name_resolve(apcupsd_t)
@@ -7783,7 +7785,7 @@ index 080bc4d..12d701e 100644
optional_policy(`
hostname_exec(apcupsd_t)
-@@ -101,6 +117,11 @@ optional_policy(`
+@@ -101,6 +119,11 @@ optional_policy(`
shutdown_domtrans(apcupsd_t)
')
@@ -7795,7 +7797,7 @@ index 080bc4d..12d701e 100644
########################################
#
# CGI local policy
-@@ -108,20 +129,20 @@ optional_policy(`
+@@ -108,20 +131,20 @@ optional_policy(`
optional_policy(`
apache_content_template(apcupsd_cgi)
@@ -12738,10 +12740,10 @@ index 0000000..5955ff0
+ gnome_dontaudit_write_config_files(chrome_sandbox_nacl_t)
+')
diff --git a/chronyd.fc b/chronyd.fc
-index 4e4143e..d5e0260 100644
+index 4e4143e..e20f1b4 100644
--- a/chronyd.fc
+++ b/chronyd.fc
-@@ -1,7 +1,9 @@
+@@ -1,8 +1,11 @@
-/etc/chrony\.keys -- gen_context(system_u:object_r:chronyd_keys_t,s0)
+/etc/chrony\.keys.* -- gen_context(system_u:object_r:chronyd_keys_t,s0)
@@ -12750,8 +12752,10 @@ index 4e4143e..d5e0260 100644
+/usr/lib/systemd/system/chrony.* -- gen_context(system_u:object_r:chronyd_unit_file_t,s0)
+
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)
++/usr/libexec/chrony-helper -- gen_context(system_u:object_r:chronyd_exec_t,s0)
/var/lib/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_lib_t,s0)
+
diff --git a/chronyd.if b/chronyd.if
index 32e8265..74fd151 100644
--- a/chronyd.if
@@ -12923,7 +12927,7 @@ index 32e8265..74fd151 100644
+ allow $1 chronyd_unit_file_t:service all_service_perms;
')
diff --git a/chronyd.te b/chronyd.te
-index e5b621c..e8b9178 100644
+index e5b621c..08ecb52 100644
--- a/chronyd.te
+++ b/chronyd.te
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
@@ -12954,7 +12958,7 @@ index e5b621c..e8b9178 100644
allow chronyd_t chronyd_keys_t:file read_file_perms;
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
-@@ -76,18 +83,30 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
+@@ -76,18 +83,34 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
corenet_udp_bind_chronyd_port(chronyd_t)
corenet_udp_sendrecv_chronyd_port(chronyd_t)
@@ -12968,10 +12972,14 @@ index e5b621c..e8b9178 100644
auth_use_nsswitch(chronyd_t)
++corecmd_exec_bin(chronyd_t)
++
logging_send_syslog_msg(chronyd_t)
-miscfiles_read_localization(chronyd_t)
+mta_send_mail(chronyd_t)
++
++sysnet_read_dhcpc_state(chronyd_t)
optional_policy(`
gpsd_rw_shm(chronyd_t)
@@ -22180,7 +22188,7 @@ index 62d22cb..f8ab4af 100644
+ files_var_filetrans($1, system_dbusd_var_lib_t, dir, "ibus")
')
diff --git a/dbus.te b/dbus.te
-index c9998c8..011faba 100644
+index c9998c8..44c6283 100644
--- a/dbus.te
+++ b/dbus.te
@@ -4,17 +4,15 @@ gen_require(`
@@ -22304,7 +22312,7 @@ index c9998c8..011faba 100644
mls_fd_use_all_levels(system_dbusd_t)
mls_rangetrans_target(system_dbusd_t)
mls_file_read_all_levels(system_dbusd_t)
-@@ -123,66 +122,166 @@ term_dontaudit_use_console(system_dbusd_t)
+@@ -123,66 +122,170 @@ term_dontaudit_use_console(system_dbusd_t)
auth_use_nsswitch(system_dbusd_t)
auth_read_pam_console_data(system_dbusd_t)
@@ -22357,10 +22365,9 @@ index c9998c8..011faba 100644
+
+optional_policy(`
+ getty_start_services(system_dbusd_t)
- ')
-
- optional_policy(`
-- seutil_sigchld_newrole(system_dbusd_t)
++')
++
++optional_policy(`
+ gnome_exec_gconf(system_dbusd_t)
+ gnome_read_inherited_home_icc_data_files(system_dbusd_t)
+')
@@ -22381,10 +22388,15 @@ index c9998c8..011faba 100644
+')
+
+optional_policy(`
-+ sysnet_domtrans_dhcpc(system_dbusd_t)
++ snapper_read_inherited_pipe(system_dbusd_t)
+')
+
+optional_policy(`
++ sysnet_domtrans_dhcpc(system_dbusd_t)
+ ')
+
+ optional_policy(`
+- seutil_sigchld_newrole(system_dbusd_t)
+ systemd_use_fds_logind(system_dbusd_t)
+ systemd_write_inherited_logind_sessions_pipes(system_dbusd_t)
+ systemd_write_inhibit_pipes(system_dbusd_t)
@@ -22444,11 +22456,11 @@ index c9998c8..011faba 100644
+optional_policy(`
+ unconfined_dbus_send(system_bus_type)
+')
-
++
+ifdef(`hide_broken_symptoms',`
+ dontaudit system_bus_type system_dbusd_t:netlink_selinux_socket { read write };
+')
-+
+
+########################################
+#
+# session_bus_type rules
@@ -22485,7 +22497,7 @@ index c9998c8..011faba 100644
kernel_read_kernel_sysctls(session_bus_type)
corecmd_list_bin(session_bus_type)
-@@ -191,23 +290,18 @@ corecmd_read_bin_files(session_bus_type)
+@@ -191,23 +294,18 @@ corecmd_read_bin_files(session_bus_type)
corecmd_read_bin_pipes(session_bus_type)
corecmd_read_bin_sockets(session_bus_type)
@@ -22510,7 +22522,7 @@ index c9998c8..011faba 100644
files_dontaudit_search_var(session_bus_type)
fs_getattr_romfs(session_bus_type)
-@@ -215,7 +309,6 @@ fs_getattr_xattr_fs(session_bus_type)
+@@ -215,7 +313,6 @@ fs_getattr_xattr_fs(session_bus_type)
fs_list_inotifyfs(session_bus_type)
fs_dontaudit_list_nfs(session_bus_type)
@@ -22518,7 +22530,7 @@ index c9998c8..011faba 100644
selinux_validate_context(session_bus_type)
selinux_compute_access_vector(session_bus_type)
selinux_compute_create_context(session_bus_type)
-@@ -225,18 +318,36 @@ selinux_compute_user_contexts(session_bus_type)
+@@ -225,18 +322,36 @@ selinux_compute_user_contexts(session_bus_type)
auth_read_pam_console_data(session_bus_type)
logging_send_audit_msgs(session_bus_type)
@@ -22560,7 +22572,7 @@ index c9998c8..011faba 100644
')
########################################
-@@ -244,5 +355,9 @@ optional_policy(`
+@@ -244,5 +359,9 @@ optional_policy(`
# Unconfined access to this module
#
@@ -39410,10 +39422,10 @@ index 0000000..20adcb3
+ ')
+')
diff --git a/kerberos.fc b/kerberos.fc
-index 4fe75fd..b9f07ae 100644
+index 4fe75fd..f01d946 100644
--- a/kerberos.fc
+++ b/kerberos.fc
-@@ -1,52 +1,52 @@
+@@ -1,52 +1,54 @@
-HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0)
-/root/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0)
+HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0)
@@ -39451,25 +39463,33 @@ index 4fe75fd..b9f07ae 100644
-/usr/local/kerberos/sbin/krb5kdc -- gen_context(system_u:object_r:krb5kdc_exec_t,s0)
-/usr/local/kerberos/sbin/kadmind -- gen_context(system_u:object_r:kadmind_exec_t,s0)
--
++/usr/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
++/usr/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
+
-/usr/sbin/krb5kdc -- gen_context(system_u:object_r:krb5kdc_exec_t,s0)
-/usr/sbin/kadmind -- gen_context(system_u:object_r:kadmind_exec_t,s0)
--
++/var/kerberos/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
++/var/kerberos/krb5kdc/from_master.* gen_context(system_u:object_r:krb5kdc_lock_t,s0)
++/var/kerberos/krb5kdc/kadm5\.keytab -- gen_context(system_u:object_r:krb5_keytab_t,s0)
++/var/kerberos/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
++/var/kerberos/krb5kdc/principal.*\.ok gen_context(system_u:object_r:krb5kdc_lock_t,s0)
+
-/usr/local/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
-/usr/local/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
--
++/var/lib/kdcproxy(/.*)? gen_context(system_u:object_r:krb5kdc_var_lib_t,s0)
+
-/usr/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
-+/usr/var/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
- /usr/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
+-/usr/var/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
++/var/log/krb5kdc\.log.* gen_context(system_u:object_r:krb5kdc_log_t,s0)
++/var/log/kadmin(d)?\.log.* gen_context(system_u:object_r:kadmind_log_t,s0)
-/var/cache/krb5rcache(/.*)? gen_context(system_u:object_r:krb5_host_rcache_t,s0)
--
++/var/cache/krb5rcache(/.*)? gen_context(system_u:object_r:krb5_host_rcache_t,s0)
+
-/var/kerberos/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
-+/var/kerberos/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_conf_t,s0)
- /var/kerberos/krb5kdc/from_master.* gen_context(system_u:object_r:krb5kdc_lock_t,s0)
+-/var/kerberos/krb5kdc/from_master.* gen_context(system_u:object_r:krb5kdc_lock_t,s0)
-/var/kerberos/krb5kdc/kadm5\.keytab -- gen_context(system_u:object_r:krb5_keytab_t,s0)
-+/var/kerberos/krb5kdc/kadm5\.keytab -- gen_context(system_u:object_r:krb5_keytab_t,s0)
- /var/kerberos/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
+-/var/kerberos/krb5kdc/principal.* gen_context(system_u:object_r:krb5kdc_principal_t,s0)
-/var/kerberos/krb5kdc/principal.*\.ok -- gen_context(system_u:object_r:krb5kdc_lock_t,s0)
-
-/var/log/krb5kdc\.log.* -- gen_context(system_u:object_r:krb5kdc_log_t,s0)
@@ -39484,13 +39504,6 @@ index 4fe75fd..b9f07ae 100644
-/var/tmp/ldapmap1_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
-/var/tmp/ldap_487 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
-/var/tmp/ldap_55 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
-+/var/kerberos/krb5kdc/principal.*\.ok gen_context(system_u:object_r:krb5kdc_lock_t,s0)
-+
-+/var/log/krb5kdc\.log.* gen_context(system_u:object_r:krb5kdc_log_t,s0)
-+/var/log/kadmin(d)?\.log.* gen_context(system_u:object_r:kadmind_log_t,s0)
-+
-+/var/cache/krb5rcache(/.*)? gen_context(system_u:object_r:krb5_host_rcache_t,s0)
-+
+/var/run/krb5kdc(/.*)? gen_context(system_u:object_r:krb5kdc_var_run_t,s0)
+
+/var/tmp/DNS_25 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
@@ -39505,7 +39518,7 @@ index 4fe75fd..b9f07ae 100644
+/var/tmp/ldap_487 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
+/var/tmp/ldap_55 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
diff --git a/kerberos.if b/kerberos.if
-index f6c00d8..7b777ab 100644
+index f6c00d8..e3cb4f1 100644
--- a/kerberos.if
+++ b/kerberos.if
@@ -1,27 +1,29 @@
@@ -39823,7 +39836,7 @@ index f6c00d8..7b777ab 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -278,254 +290,255 @@ interface(`kerberos_read_keytab',`
+@@ -278,49 +290,122 @@ interface(`kerberos_read_keytab',`
## </summary>
## </param>
#
@@ -39893,31 +39906,23 @@ index f6c00d8..7b777ab 100644
## </summary>
## </param>
-## <param name="object_class">
--## <summary>
--## Class of the object being created.
--## </summary>
--## </param>
--## <param name="name" optional="true">
+## <param name="role">
## <summary>
--## The name of the object being created.
+-## Class of the object being created.
+## The role to be allowed to manage the kerberos domain.
- ## </summary>
- ## </param>
++## </summary>
++## </param>
+## <rolecap/>
- #
--interface(`kerberos_etc_filetrans_keytab',`
++#
+interface(`kerberos_admin',`
- gen_require(`
-- type krb5_keytab_t;
++ gen_require(`
+ type kadmind_t, krb5kdc_t, kerberos_initrc_exec_t;
+ type kadmind_log_t, kadmind_tmp_t, kadmind_var_run_t;
+ type krb5_conf_t, krb5_keytab_t, krb5kdc_conf_t;
+ type krb5kdc_principal_t, krb5kdc_tmp_t, kpropd_t;
+ type krb5kdc_var_run_t, krb5_host_rcache_t;
- ')
-
-- files_etc_filetrans($1, krb5_keytab_t, $2, $3)
++ ')
++
+ allow $1 kadmind_t:process signal_perms;
+ ps_process_pattern($1, kadmind_t)
+ tunable_policy(`deny_ptrace',`',`
@@ -39957,6 +39962,33 @@ index f6c00d8..7b777ab 100644
+ admin_pattern($1, krb5kdc_tmp_t)
+
+ admin_pattern($1, krb5kdc_var_run_t)
++')
++
++########################################
++## <summary>
++## Type transition files created in /tmp
++## to the krb5_host_rcache type.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
+ ## </summary>
+ ## </param>
+ ## <param name="name" optional="true">
+@@ -329,60 +414,63 @@ interface(`kerberos_manage_keytab_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`kerberos_etc_filetrans_keytab',`
++interface(`kerberos_tmp_filetrans_host_rcache',`
+ gen_require(`
+- type krb5_keytab_t;
++ type krb5_host_rcache_t;
+ ')
+
+- files_etc_filetrans($1, krb5_keytab_t, $2, $3)
++ manage_files_pattern($1, krb5_host_rcache_t, krb5_host_rcache_t)
++ files_tmp_filetrans($1, krb5_host_rcache_t, file, $2)
')
########################################
@@ -39964,7 +39996,7 @@ index f6c00d8..7b777ab 100644
-## Create a derived type for kerberos
-## keytab files.
+## Type transition files created in /tmp
-+## to the krb5_host_rcache type.
++## to the kadmind_tmp type.
## </summary>
-## <param name="prefix">
+## <param name="domain">
@@ -39985,20 +40017,19 @@ index f6c00d8..7b777ab 100644
- refpolicywarn(`$0($*) has been deprecated.')
- kerberos_read_keytab($2)
- kerberos_use($2)
-+interface(`kerberos_tmp_filetrans_host_rcache',`
++interface(`kerberos_tmp_filetrans_kadmin',`
+ gen_require(`
-+ type krb5_host_rcache_t;
++ type kadmind_tmp_t;
+ ')
+
-+ manage_files_pattern($1, krb5_host_rcache_t, krb5_host_rcache_t)
-+ files_tmp_filetrans($1, krb5_host_rcache_t, file, $2)
++ manage_files_pattern($1, kadmind_tmp_t, kadmind_tmp_t)
++ files_tmp_filetrans($1, kadmind_tmp_t, file, $2)
')
########################################
## <summary>
-## Read kerberos kdc configuration files.
-+## Type transition files created in /tmp
-+## to the kadmind_tmp type.
++## read kerberos homedir content (.k5login)
## </summary>
## <param name="domain">
## <summary>
@@ -40006,43 +40037,38 @@ index f6c00d8..7b777ab 100644
## </summary>
## </param>
-## <rolecap/>
-+## <param name="name" optional="true">
-+## <summary>
-+## The name of the object being created.
-+## </summary>
-+## </param>
#
-interface(`kerberos_read_kdc_config',`
-+interface(`kerberos_tmp_filetrans_kadmin',`
++interface(`kerberos_read_home_content',`
gen_require(`
- type krb5kdc_conf_t;
-+ type kadmind_tmp_t;
++ type krb5_home_t;
')
- files_search_etc($1)
- read_files_pattern($1, krb5kdc_conf_t, krb5kdc_conf_t)
-+ manage_files_pattern($1, kadmind_tmp_t, kadmind_tmp_t)
-+ files_tmp_filetrans($1, kadmind_tmp_t, file, $2)
++ userdom_search_user_home_dirs($1)
++ read_files_pattern($1, krb5_home_t, krb5_home_t)
')
########################################
## <summary>
-## Create, read, write, and delete
-## kerberos host rcache files.
-+## read kerberos homedir content (.k5login)
++## Manage the kerberos kdc /var/lib files
++## and directories.
## </summary>
## <param name="domain">
## <summary>
- ## Domain allowed access.
- ## </summary>
+@@ -391,141 +479,88 @@ interface(`kerberos_read_kdc_config',`
## </param>
--## <rolecap/>
+ ## <rolecap/>
#
-interface(`kerberos_manage_host_rcache',`
-+interface(`kerberos_read_home_content',`
++interface(`kerberos_manage_kdc_var_lib',`
gen_require(`
- type krb5_host_rcache_t;
-+ type krb5_home_t;
++ type krb5kdc_var_lib_t;
')
- domain_obj_id_change_exemption($1)
@@ -40057,8 +40083,9 @@ index f6c00d8..7b777ab 100644
- files_search_tmp($1)
- allow $1 krb5_host_rcache_t:file manage_file_perms;
- ')
-+ userdom_search_user_home_dirs($1)
-+ read_files_pattern($1, krb5_home_t, krb5_home_t)
++ files_search_etc($1)
++ manage_files_pattern($1, krb5kdc_var_lib_t, krb5kdc_var_lib_t)
++ manage_dirs_pattern($1, krb5kdc_var_lib_t, krb5kdc_var_lib_t)
')
########################################
@@ -40139,14 +40166,14 @@ index f6c00d8..7b777ab 100644
## <param name="domain">
## <summary>
-## Domain allowed access.
--## </summary>
--## </param>
--## <param name="role">
--## <summary>
--## Role allowed access.
+## Domain allowed access.
## </summary>
## </param>
+-## <param name="role">
+-## <summary>
+-## Role allowed access.
+-## </summary>
+-## </param>
-## <rolecap/>
#
-interface(`kerberos_admin',`
@@ -40215,7 +40242,7 @@ index f6c00d8..7b777ab 100644
+ kerberos_tmp_filetrans_host_rcache($1, "ldap_55")
')
diff --git a/kerberos.te b/kerberos.te
-index 8833d59..462e466 100644
+index 8833d59..1d0599a 100644
--- a/kerberos.te
+++ b/kerberos.te
@@ -6,11 +6,11 @@ policy_module(kerberos, 1.12.0)
@@ -40234,7 +40261,7 @@ index 8833d59..462e466 100644
type kadmind_t;
type kadmind_exec_t;
-@@ -35,23 +35,27 @@ init_daemon_domain(kpropd_t, kpropd_exec_t)
+@@ -35,23 +35,29 @@ init_daemon_domain(kpropd_t, kpropd_exec_t)
domain_obj_id_change_exemption(kpropd_t)
type krb5_conf_t;
@@ -40261,12 +40288,14 @@ index 8833d59..462e466 100644
-files_type(krb5kdc_lock_t)
+files_lock_file(krb5kdc_lock_t)
++type krb5kdc_var_lib_t;
++files_type(krb5kdc_var_lib_t)
+
+# types for KDC principal file(s)
type krb5kdc_principal_t;
files_type(krb5kdc_principal_t)
-@@ -74,28 +78,33 @@ files_pid_file(krb5kdc_var_run_t)
+@@ -74,28 +80,33 @@ files_pid_file(krb5kdc_var_run_t)
# kadmind local policy
#
@@ -40306,7 +40335,7 @@ index 8833d59..462e466 100644
manage_dirs_pattern(kadmind_t, kadmind_tmp_t, kadmind_tmp_t)
manage_files_pattern(kadmind_t, kadmind_tmp_t, kadmind_tmp_t)
files_tmp_filetrans(kadmind_t, kadmind_tmp_t, { file dir })
-@@ -103,13 +112,15 @@ files_tmp_filetrans(kadmind_t, kadmind_tmp_t, { file dir })
+@@ -103,13 +114,15 @@ files_tmp_filetrans(kadmind_t, kadmind_tmp_t, { file dir })
manage_files_pattern(kadmind_t, kadmind_var_run_t, kadmind_var_run_t)
files_pid_filetrans(kadmind_t, kadmind_var_run_t, file)
@@ -40325,7 +40354,7 @@ index 8833d59..462e466 100644
corenet_all_recvfrom_netlabel(kadmind_t)
corenet_tcp_sendrecv_generic_if(kadmind_t)
corenet_udp_sendrecv_generic_if(kadmind_t)
-@@ -119,31 +130,44 @@ corenet_tcp_sendrecv_all_ports(kadmind_t)
+@@ -119,31 +132,44 @@ corenet_tcp_sendrecv_all_ports(kadmind_t)
corenet_udp_sendrecv_all_ports(kadmind_t)
corenet_tcp_bind_generic_node(kadmind_t)
corenet_udp_bind_generic_node(kadmind_t)
@@ -40373,7 +40402,7 @@ index 8833d59..462e466 100644
sysnet_use_ldap(kadmind_t)
userdom_dontaudit_use_unpriv_user_fds(kadmind_t)
-@@ -154,11 +178,16 @@ optional_policy(`
+@@ -154,11 +180,16 @@ optional_policy(`
')
optional_policy(`
@@ -40390,7 +40419,7 @@ index 8833d59..462e466 100644
')
optional_policy(`
-@@ -174,24 +203,27 @@ optional_policy(`
+@@ -174,24 +205,27 @@ optional_policy(`
# Krb5kdc local policy
#
@@ -40422,17 +40451,19 @@ index 8833d59..462e466 100644
logging_log_filetrans(krb5kdc_t, krb5kdc_log_t, file)
allow krb5kdc_t krb5kdc_principal_t:file rw_file_perms;
-@@ -201,71 +233,76 @@ manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
+@@ -201,71 +235,79 @@ manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
files_tmp_filetrans(krb5kdc_t, krb5kdc_tmp_t, { file dir })
manage_files_pattern(krb5kdc_t, krb5kdc_var_run_t, krb5kdc_var_run_t)
-files_pid_filetrans(krb5kdc_t, krb5kdc_var_run_t, file)
--
--can_exec(krb5kdc_t, krb5kdc_exec_t)
+manage_sock_files_pattern(krb5kdc_t, krb5kdc_var_run_t, krb5kdc_var_run_t)
+manage_dirs_pattern(krb5kdc_t, krb5kdc_var_run_t, krb5kdc_var_run_t)
+files_pid_filetrans(krb5kdc_t, krb5kdc_var_run_t, { dir file sock_file })
+-can_exec(krb5kdc_t, krb5kdc_exec_t)
++manage_files_pattern(krb5kdc_t, krb5kdc_var_lib_t, krb5kdc_var_lib_t)
++manage_dirs_pattern(krb5kdc_t, krb5kdc_var_lib_t, krb5kdc_var_lib_t)
+
kernel_read_system_state(krb5kdc_t)
kernel_read_kernel_sysctls(krb5kdc_t)
+kernel_list_proc(krb5kdc_t)
@@ -40514,7 +40545,7 @@ index 8833d59..462e466 100644
')
optional_policy(`
-@@ -273,6 +310,10 @@ optional_policy(`
+@@ -273,6 +315,10 @@ optional_policy(`
')
optional_policy(`
@@ -40525,7 +40556,7 @@ index 8833d59..462e466 100644
udev_read_db(krb5kdc_t)
')
-@@ -281,10 +322,12 @@ optional_policy(`
+@@ -281,10 +327,12 @@ optional_policy(`
# kpropd local policy
#
@@ -40541,7 +40572,7 @@ index 8833d59..462e466 100644
allow kpropd_t krb5_host_rcache_t:file manage_file_perms;
-@@ -301,27 +344,25 @@ manage_dirs_pattern(kpropd_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
+@@ -301,27 +349,26 @@ manage_dirs_pattern(kpropd_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
manage_files_pattern(kpropd_t, krb5kdc_tmp_t, krb5kdc_tmp_t)
files_tmp_filetrans(kpropd_t, krb5kdc_tmp_t, { file dir })
@@ -40558,6 +40589,7 @@ index 8833d59..462e466 100644
-corenet_sendrecv_kprop_server_packets(kpropd_t)
corenet_tcp_bind_kprop_port(kpropd_t)
-corenet_tcp_sendrecv_kprop_port(kpropd_t)
++corenet_tcp_connect_kprop_port(kpropd_t)
dev_read_urand(kpropd_t)
@@ -43365,7 +43397,7 @@ index dd8e01a..9cd6b0b 100644
## <param name="domain">
## <summary>
diff --git a/logrotate.te b/logrotate.te
-index be0ab84..ce57aac 100644
+index be0ab84..08c168f 100644
--- a/logrotate.te
+++ b/logrotate.te
@@ -5,16 +5,22 @@ policy_module(logrotate, 1.15.0)
@@ -43487,7 +43519,7 @@ index be0ab84..ce57aac 100644
files_manage_generic_spool(logrotate_t)
files_manage_generic_spool_dirs(logrotate_t)
files_getattr_generic_locks(logrotate_t)
-@@ -95,6 +123,8 @@ mls_process_write_to_clearance(logrotate_t)
+@@ -95,32 +123,51 @@ mls_process_write_to_clearance(logrotate_t)
selinux_get_fs_mount(logrotate_t)
selinux_get_enforce_mode(logrotate_t)
@@ -43496,7 +43528,9 @@ index be0ab84..ce57aac 100644
auth_manage_login_records(logrotate_t)
auth_use_nsswitch(logrotate_t)
-@@ -103,24 +133,40 @@ init_all_labeled_script_domtrans(logrotate_t)
+ init_all_labeled_script_domtrans(logrotate_t)
++init_reload_services(logrotate_t)
+
logging_manage_all_logs(logrotate_t)
logging_send_syslog_msg(logrotate_t)
logging_send_audit_msgs(logrotate_t)
@@ -43543,7 +43577,7 @@ index be0ab84..ce57aac 100644
')
optional_policy(`
-@@ -135,16 +181,17 @@ optional_policy(`
+@@ -135,16 +182,17 @@ optional_policy(`
optional_policy(`
apache_read_config(logrotate_t)
@@ -43563,7 +43597,7 @@ index be0ab84..ce57aac 100644
')
optional_policy(`
-@@ -170,6 +217,11 @@ optional_policy(`
+@@ -170,6 +218,11 @@ optional_policy(`
')
optional_policy(`
@@ -43575,7 +43609,7 @@ index be0ab84..ce57aac 100644
fail2ban_stream_connect(logrotate_t)
')
-@@ -178,7 +230,7 @@ optional_policy(`
+@@ -178,7 +231,7 @@ optional_policy(`
')
optional_policy(`
@@ -43584,7 +43618,7 @@ index be0ab84..ce57aac 100644
')
optional_policy(`
-@@ -198,17 +250,18 @@ optional_policy(`
+@@ -198,17 +251,18 @@ optional_policy(`
')
optional_policy(`
@@ -43606,7 +43640,7 @@ index be0ab84..ce57aac 100644
')
optional_policy(`
-@@ -216,6 +269,14 @@ optional_policy(`
+@@ -216,6 +270,14 @@ optional_policy(`
')
optional_policy(`
@@ -43621,7 +43655,7 @@ index be0ab84..ce57aac 100644
samba_exec_log(logrotate_t)
')
-@@ -228,26 +289,43 @@ optional_policy(`
+@@ -228,26 +290,43 @@ optional_policy(`
')
optional_policy(`
@@ -44249,7 +44283,7 @@ index d314333..27ede09 100644
+ ')
')
diff --git a/lsm.te b/lsm.te
-index 4ec0eea..022172c 100644
+index 4ec0eea..996fdc8 100644
--- a/lsm.te
+++ b/lsm.te
@@ -4,6 +4,13 @@ policy_module(lsm, 1.0.0)
@@ -44266,7 +44300,7 @@ index 4ec0eea..022172c 100644
type lsmd_t;
type lsmd_exec_t;
-@@ -12,6 +19,17 @@ init_daemon_domain(lsmd_t, lsmd_exec_t)
+@@ -12,12 +19,23 @@ init_daemon_domain(lsmd_t, lsmd_exec_t)
type lsmd_var_run_t;
files_pid_file(lsmd_var_run_t)
@@ -44284,6 +44318,13 @@ index 4ec0eea..022172c 100644
########################################
#
# Local policy
+ #
+
+-allow lsmd_t self:capability setgid;
++allow lsmd_t self:capability { setuid setgid };
+ allow lsmd_t self:unix_stream_socket create_stream_socket_perms;
+
+ manage_dirs_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
@@ -26,4 +44,67 @@ manage_lnk_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
manage_sock_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
files_pid_filetrans(lsmd_t, lsmd_var_run_t, { dir file sock_file })
@@ -61205,10 +61246,10 @@ index 0000000..598789a
+
diff --git a/openhpid.te b/openhpid.te
new file mode 100644
-index 0000000..51acfae
+index 0000000..ade6576
--- /dev/null
+++ b/openhpid.te
-@@ -0,0 +1,47 @@
+@@ -0,0 +1,52 @@
+policy_module(openhpid, 1.0.0)
+
+########################################
@@ -61254,8 +61295,13 @@ index 0000000..51acfae
+corenet_tcp_bind_openhpid_port(openhpid_t)
+
+dev_read_urand(openhpid_t)
++dev_rw_watchdog(openhpid_t)
+
+logging_send_syslog_msg(openhpid_t)
++
++miscfiles_read_generic_certs(openhpid_t)
++
++sysnet_read_config(openhpid_t)
diff --git a/openshift-origin.fc b/openshift-origin.fc
new file mode 100644
index 0000000..30ca148
@@ -79848,10 +79894,10 @@ index 951db7f..04b6dde 100644
+ files_etc_filetrans($1, mdadm_conf_t, file, "mdadm.conf")
')
diff --git a/raid.te b/raid.te
-index c99753f..0d4e845 100644
+index c99753f..f6bd1c6 100644
--- a/raid.te
+++ b/raid.te
-@@ -15,54 +15,92 @@ role mdadm_roles types mdadm_t;
+@@ -15,54 +15,100 @@ role mdadm_roles types mdadm_t;
type mdadm_initrc_exec_t;
init_script_file(mdadm_initrc_exec_t)
@@ -79862,7 +79908,10 @@ index c99753f..0d4e845 100644
+systemd_unit_file(mdadm_unit_file_t)
+
+type mdadm_tmp_t;
-+files_tmpfs_file(mdadm_tmp_t)
++files_tmp_file(mdadm_tmp_t)
++
++type mdadm_tmpfs_t;
++files_tmpfs_file(mdadm_tmpfs_t)
+
type mdadm_var_run_t alias mdadm_map_t;
files_pid_file(mdadm_var_run_t)
@@ -79891,6 +79940,10 @@ index c99753f..0d4e845 100644
+manage_files_pattern(mdadm_t, mdadm_tmp_t, mdadm_tmp_t)
+manage_dirs_pattern(mdadm_t, mdadm_tmp_t, mdadm_tmp_t)
+files_tmp_filetrans(mdadm_t, mdadm_tmp_t, file)
++
++manage_files_pattern(mdadm_t, mdadm_tmpfs_t, mdadm_tmpfs_t)
++manage_dirs_pattern(mdadm_t, mdadm_tmpfs_t, mdadm_tmpfs_t)
++fs_tmpfs_filetrans(mdadm_t, mdadm_tmpfs_t, { dir file })
manage_dirs_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
@@ -79935,6 +79988,7 @@ index c99753f..0d4e845 100644
+dev_read_generic_files(mdadm_t)
+dev_read_generic_usb_dev(mdadm_t)
+dev_read_urand(mdadm_t)
++dev_read_rand(mdadm_t)
+
+domain_read_all_domains_state(mdadm_t)
domain_use_interactive_fds(mdadm_t)
@@ -79953,7 +80007,7 @@ index c99753f..0d4e845 100644
mls_file_read_all_levels(mdadm_t)
mls_file_write_all_levels(mdadm_t)
-@@ -71,15 +109,22 @@ storage_dev_filetrans_fixed_disk(mdadm_t)
+@@ -71,15 +117,22 @@ storage_dev_filetrans_fixed_disk(mdadm_t)
storage_manage_fixed_disk(mdadm_t)
storage_read_scsi_generic(mdadm_t)
storage_write_scsi_generic(mdadm_t)
@@ -79977,7 +80031,7 @@ index c99753f..0d4e845 100644
userdom_dontaudit_use_unpriv_user_fds(mdadm_t)
userdom_dontaudit_search_user_home_content(mdadm_t)
-@@ -90,17 +135,38 @@ optional_policy(`
+@@ -90,17 +143,38 @@ optional_policy(`
')
optional_policy(`
@@ -92507,14 +92561,16 @@ index 0000000..a3319b0
+userdom_dontaudit_open_user_ptys(sandbox_x_domain)
+
diff --git a/sanlock.fc b/sanlock.fc
-index 3df2a0f..9059165 100644
+index 3df2a0f..4eb82b8 100644
--- a/sanlock.fc
+++ b/sanlock.fc
-@@ -1,7 +1,10 @@
+@@ -1,7 +1,12 @@
+
/etc/rc\.d/init\.d/sanlock -- gen_context(system_u:object_r:sanlock_initrc_exec_t,s0)
-/usr/sbin/sanlock -- gen_context(system_u:object_r:sanlock_exec_t,s0)
++/etc/sanlock(/.*)? gen_context(system_u:object_r:sanlock_conf_t,s0)
++
+/var/run/sanlock(/.*)? gen_context(system_u:object_r:sanlock_var_run_t,s0)
+
+/var/log/sanlock\.log.* gen_context(system_u:object_r:sanlock_log_t,s0)
@@ -92661,10 +92717,10 @@ index cd6c213..82a5ff0 100644
+ allow $1 sanlock_unit_file_t:service all_service_perms;
')
diff --git a/sanlock.te b/sanlock.te
-index 0045465..61da47f 100644
+index 0045465..2059657 100644
--- a/sanlock.te
+++ b/sanlock.te
-@@ -6,21 +6,26 @@ policy_module(sanlock, 1.1.0)
+@@ -6,25 +6,33 @@ policy_module(sanlock, 1.1.0)
#
## <desc>
@@ -92699,7 +92755,14 @@ index 0045465..61da47f 100644
type sanlock_t;
type sanlock_exec_t;
init_daemon_domain(sanlock_t, sanlock_exec_t)
-@@ -34,6 +39,9 @@ logging_log_file(sanlock_log_t)
+
++type sanlock_conf_t;
++files_config_file(sanlock_conf_t)
++
+ type sanlock_var_run_t;
+ files_pid_file(sanlock_var_run_t)
+
+@@ -34,6 +42,9 @@ logging_log_file(sanlock_log_t)
type sanlock_initrc_exec_t;
init_script_file(sanlock_initrc_exec_t)
@@ -92709,7 +92772,7 @@ index 0045465..61da47f 100644
ifdef(`enable_mcs',`
init_ranged_daemon_domain(sanlock_t, sanlock_exec_t, s0 - mcs_systemhigh)
')
-@@ -44,17 +52,15 @@ ifdef(`enable_mls',`
+@@ -44,17 +55,18 @@ ifdef(`enable_mls',`
########################################
#
@@ -92723,6 +92786,9 @@ index 0045465..61da47f 100644
allow sanlock_t self:fifo_file rw_fifo_file_perms;
-allow sanlock_t self:unix_stream_socket { accept listen };
+allow sanlock_t self:unix_stream_socket create_stream_socket_perms;
++
++manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t)
++manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t)
-append_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t)
-create_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t)
@@ -92731,7 +92797,7 @@ index 0045465..61da47f 100644
logging_log_filetrans(sanlock_t, sanlock_log_t, file)
manage_dirs_pattern(sanlock_t, sanlock_var_run_t, sanlock_var_run_t)
-@@ -65,13 +71,16 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file })
+@@ -65,13 +77,16 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file })
kernel_read_system_state(sanlock_t)
kernel_read_kernel_sysctls(sanlock_t)
@@ -92751,7 +92817,7 @@ index 0045465..61da47f 100644
auth_use_nsswitch(sanlock_t)
init_read_utmp(sanlock_t)
-@@ -79,20 +88,29 @@ init_dontaudit_write_utmp(sanlock_t)
+@@ -79,20 +94,29 @@ init_dontaudit_write_utmp(sanlock_t)
logging_send_syslog_msg(sanlock_t)
@@ -92790,7 +92856,7 @@ index 0045465..61da47f 100644
')
optional_policy(`
-@@ -100,7 +118,10 @@ optional_policy(`
+@@ -100,7 +124,10 @@ optional_policy(`
')
optional_policy(`
@@ -96334,10 +96400,10 @@ index 0000000..4f4bdb3
+/home/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
diff --git a/snapper.if b/snapper.if
new file mode 100644
-index 0000000..5a3cb30
+index 0000000..ed76979
--- /dev/null
+++ b/snapper.if
-@@ -0,0 +1,62 @@
+@@ -0,0 +1,80 @@
+
+## <summary>policy for snapperd</summary>
+
@@ -96381,6 +96447,24 @@ index 0000000..5a3cb30
+ allow snapperd_t $1:dbus send_msg;
+')
+
++########################################
++## <summary>
++## Allow a domain to read inherited snapper pipe.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`snapper_read_inherited_pipe',`
++ gen_require(`
++ type snapperd_t;
++ ')
++
++ allow $1 snapperd_t:fifo_file read_inherited_file_perms;
++')
++
+#######################################
+## <summary>
+## Allow domain to create .smapshot
@@ -101164,7 +101248,7 @@ index 0000000..a6e216c
+
diff --git a/targetd.te b/targetd.te
new file mode 100644
-index 0000000..a2cb50c
+index 0000000..6768bda
--- /dev/null
+++ b/targetd.te
@@ -0,0 +1,62 @@
@@ -101214,8 +101298,8 @@ index 0000000..a2cb50c
+
+libs_exec_ldconfig(targetd_t)
+
-+storage_getattr_fixed_disk_dev(targetd_t)
-+storage_getattr_removable_dev(targetd_t)
++storage_raw_read_fixed_disk(targetd_t)
++storage_raw_read_removable_device(targetd_t)
+
+sysnet_read_config(targetd_t)
+
diff --git a/selinux-policy.spec b/selinux-policy.spec
index d1c3aac..b88f90a 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 140%{?dist}
+Release: 141%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -647,6 +647,37 @@ exit 0
%endif
%changelog
+* Mon Aug 10 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-141
+- Allow chronyd to execute mkdir command.
+- Allow chronyd_t to read dhcpc state.
+- Label /usr/libexec/chrony-helper as chronyd_exec_t
+- Allow openhpid liboa_soap plugin to read resolv.conf file.
+- Allow openhpid liboa_soap plugin to read generic certs.
+- Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
+- Allow logrotate to reload services.
+- Allow apcupsd_t to read /sys/devices
+- Allow kpropd to connect to kropd tcp port.
+- Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.
+- Allow snapperd to pass data (one way only) via pipe negotiated over dbus.
+- Add snapper_read_inherited_pipe() interface.
+- Add missing ";" in kerberos.te
+- Add support for /var/lib/kdcproxy and label it as krb5kdc_var_lib_t. It needs to be accessible by useradd_t.
+- Add support for /etc/sanlock which is writable by sanlock daemon.
+- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
+- Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
+- Add interface to read/write watchdog device.
+- Add transition rule for iptables_var_lib_t
+- Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
+- Revert "Allow grubby to manage and create /run/blkid with correct labeling"
+- Allow grubby to manage and create /run/blkid with correct labeling
+- Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
+- arping running as netutils_t needs to access /etc/ld.so.cache in MLS.
+- Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
+- Add systemd_exec_sysctl() and systemd_domtrans_sysctl() interfaces.
+- Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS.
+- Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users.
+- depmod runs as insmod_t and it needs to manage user tmp files which was allowed for depmod_t. It is needed by dracut command for SELinux restrictive policy (confined users, MLS).
+
* Wed Aug 05 2015 Miroslav Grepl <mgrepl@redhat.com> 3.13.1-140
- firewalld needs to relabel own config files. BZ(#1250537)
- Allow rhsmcertd to send signull to unconfined_service