diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 73354c9..9aeb350 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -15386,7 +15386,7 @@ index d7c11a0..6b3331d 100644
  /var/run/shm/.*			<<none>>
 -')
 diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
-index 8416beb..b66e93a 100644
+index 8416beb..4d615ff 100644
 --- a/policy/modules/kernel/filesystem.if
 +++ b/policy/modules/kernel/filesystem.if
 @@ -631,6 +631,27 @@ interface(`fs_getattr_cgroup',`
@@ -15834,7 +15834,7 @@ index 8416beb..b66e93a 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1878,117 +2085,190 @@ interface(`fs_search_fusefs',`
+@@ -1878,135 +2085,151 @@ interface(`fs_search_fusefs',`
  ##	</summary>
  ## </param>
  #
@@ -16004,83 +16004,93 @@ index 8416beb..b66e93a 100644
 -##	read, write, and delete files
 -##	on a FUSEFS filesystem.
 +##	Unmount a FUSE filesystem.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+-##	Domain to not audit.
 +##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_dontaudit_manage_fusefs_files',`
 +interface(`fs_unmount_fusefs',`
-+	gen_require(`
-+		type fusefs_t;
-+	')
-+
+ 	gen_require(`
+ 		type fusefs_t;
+ 	')
+ 
+-	dontaudit $1 fusefs_t:file manage_file_perms;
 +	allow $1 fusefs_t:filesystem unmount;
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Read symbolic links on a FUSEFS filesystem.
 +##	Mounton a FUSEFS filesystem.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -2014,145 +2237,194 @@ interface(`fs_dontaudit_manage_fusefs_files',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_read_fusefs_symlinks',`
 +interface(`fs_mounton_fusefs',`
-+	gen_require(`
-+		type fusefs_t;
-+	')
-+
+ 	gen_require(`
+ 		type fusefs_t;
+ 	')
+ 
+-	allow $1 fusefs_t:dir list_dir_perms;
+-	read_lnk_files_pattern($1, fusefs_t, fusefs_t)
 +	allow $1 fusefs_t:dir mounton;
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Get the attributes of an hugetlbfs
+-##	filesystem.
 +##	Search directories
 +##	on a FUSEFS filesystem.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+ ##	Domain allowed access.
+ ##	</summary>
+ ## </param>
++## <rolecap/>
+ #
+-interface(`fs_getattr_hugetlbfs',`
++interface(`fs_search_fusefs',`
+ 	gen_require(`
+-		type hugetlbfs_t;
++		type fusefs_t;
+ 	')
+ 
+-	allow $1 hugetlbfs_t:filesystem getattr;
++	allow $1 fusefs_t:dir search_dir_perms;
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	List hugetlbfs.
++##	Do not audit attempts to list the contents
++##	of directories on a FUSEFS filesystem.
 +## </summary>
 +## <param name="domain">
 +##	<summary>
-+##	Domain allowed access.
++##	Domain to not audit.
 +##	</summary>
 +## </param>
-+## <rolecap/>
 +#
-+interface(`fs_search_fusefs',`
++interface(`fs_dontaudit_list_fusefs',`
 +	gen_require(`
 +		type fusefs_t;
 +	')
 +
-+	allow $1 fusefs_t:dir search_dir_perms;
++	dontaudit $1 fusefs_t:dir list_dir_perms;
 +')
 +
 +########################################
 +## <summary>
-+##	Do not audit attempts to list the contents
-+##	of directories on a FUSEFS filesystem.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -1996,91 +2276,173 @@ interface(`fs_manage_fusefs_files',`
- ##	</summary>
- ## </param>
- #
--interface(`fs_dontaudit_manage_fusefs_files',`
-+interface(`fs_dontaudit_list_fusefs',`
- 	gen_require(`
- 		type fusefs_t;
- 	')
- 
--	dontaudit $1 fusefs_t:file manage_file_perms;
-+	dontaudit $1 fusefs_t:dir list_dir_perms;
- ')
- 
- ########################################
- ## <summary>
--##	Read symbolic links on a FUSEFS filesystem.
 +##	Create, read, write, and delete directories
 +##	on a FUSEFS filesystem.
  ## </summary>
@@ -16091,21 +16101,20 @@ index 8416beb..b66e93a 100644
  ## </param>
 +## <rolecap/>
  #
--interface(`fs_read_fusefs_symlinks',`
+-interface(`fs_list_hugetlbfs',`
 +interface(`fs_manage_fusefs_dirs',`
  	gen_require(`
- 		type fusefs_t;
+-		type hugetlbfs_t;
++		type fusefs_t;
  	')
  
--	allow $1 fusefs_t:dir list_dir_perms;
--	read_lnk_files_pattern($1, fusefs_t, fusefs_t)
+-	allow $1 hugetlbfs_t:dir list_dir_perms;
 +	allow $1 fusefs_t:dir manage_dir_perms;
  ')
  
  ########################################
  ## <summary>
--##	Get the attributes of an hugetlbfs
--##	filesystem.
+-##	Manage hugetlbfs dirs.
 +##	Do not audit attempts to create, read,
 +##	write, and delete directories
 +##	on a FUSEFS filesystem.
@@ -16135,20 +16144,20 @@ index 8416beb..b66e93a 100644
  ## </param>
 +## <rolecap/>
  #
--interface(`fs_getattr_hugetlbfs',`
+-interface(`fs_manage_hugetlbfs_dirs',`
 +interface(`fs_read_fusefs_files',`
  	gen_require(`
 -		type hugetlbfs_t;
 +		type fusefs_t;
  	')
  
--	allow $1 hugetlbfs_t:filesystem getattr;
+-	manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t)
 +	read_files_pattern($1, fusefs_t, fusefs_t)
  ')
  
  ########################################
  ## <summary>
--##	List hugetlbfs.
+-##	Read and write hugetlbfs files.
 +##	Execute files on a FUSEFS filesystem.
  ## </summary>
  ## <param name="domain">
@@ -16158,58 +16167,69 @@ index 8416beb..b66e93a 100644
  ## </param>
 +## <rolecap/>
  #
--interface(`fs_list_hugetlbfs',`
+-interface(`fs_rw_hugetlbfs_files',`
 +interface(`fs_exec_fusefs_files',`
  	gen_require(`
 -		type hugetlbfs_t;
 +		type fusefs_t;
  	')
  
--	allow $1 hugetlbfs_t:dir list_dir_perms;
+-	rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
 +	exec_files_pattern($1, fusefs_t, fusefs_t)
  ')
  
  ########################################
  ## <summary>
--##	Manage hugetlbfs dirs.
+-##	Allow the type to associate to hugetlbfs filesystems.
 +##	Make general progams in FUSEFS an entrypoint for
 +##	the specified domain.
-+## </summary>
+ ## </summary>
+-## <param name="type">
 +## <param name="domain">
-+##	<summary>
+ ##	<summary>
+-##	The type of the object to be associated.
 +##	The domain for which fusefs_t is an entrypoint.
-+##	</summary>
-+## </param>
-+#
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_associate_hugetlbfs',`
 +interface(`fs_fusefs_entry_type',`
-+	gen_require(`
+ 	gen_require(`
+-		type hugetlbfs_t;
 +		type fusefs_t;
-+	')
-+
+ 	')
+ 
+-	allow $1 hugetlbfs_t:filesystem associate;
 +	domain_entry_file($1, fusefs_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Search inotifyfs filesystem.
 +##	Make general progams in FUSEFS an entrypoint for
 +##	the specified domain.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+-##	Domain allowed access.
 +##	The domain for which fusefs_t is an entrypoint.
-+##	</summary>
-+## </param>
-+#
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_search_inotifyfs',`
 +interface(`fs_fusefs_entrypoint',`
-+	gen_require(`
+ 	gen_require(`
+-		type inotifyfs_t;
 +		type fusefs_t;
-+	')
-+
+ 	')
+ 
+-	allow $1 inotifyfs_t:dir search_dir_perms;
 +    allow $1 fusefs_t:file entrypoint;
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	List inotifyfs filesystem.
 +##	Create, read, write, and delete files
 +##	on a FUSEFS filesystem.
  ## </summary>
@@ -16220,87 +16240,85 @@ index 8416beb..b66e93a 100644
  ## </param>
 +## <rolecap/>
  #
--interface(`fs_manage_hugetlbfs_dirs',`
+-interface(`fs_list_inotifyfs',`
 +interface(`fs_manage_fusefs_files',`
  	gen_require(`
--		type hugetlbfs_t;
+-		type inotifyfs_t;
 +		type fusefs_t;
  	')
  
--	manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t)
+-	allow $1 inotifyfs_t:dir list_dir_perms;
 +	manage_files_pattern($1, fusefs_t, fusefs_t)
  ')
  
  ########################################
  ## <summary>
--##	Read and write hugetlbfs files.
+-##	Dontaudit List inotifyfs filesystem.
 +##	Do not audit attempts to create,
 +##	read, write, and delete files
 +##	on a FUSEFS filesystem.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain to not audit.
-+##	</summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_manage_fusefs_files',`
-+	gen_require(`
-+		type fusefs_t;
-+	')
-+
-+	dontaudit $1 fusefs_t:file manage_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+##	Read symbolic links on a FUSEFS filesystem.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -2088,53 +2450,100 @@ interface(`fs_manage_hugetlbfs_dirs',`
+@@ -2160,53 +2432,136 @@ interface(`fs_list_inotifyfs',`
  ##	</summary>
  ## </param>
  #
--interface(`fs_rw_hugetlbfs_files',`
-+interface(`fs_read_fusefs_symlinks',`
+-interface(`fs_dontaudit_list_inotifyfs',`
++interface(`fs_dontaudit_manage_fusefs_files',`
  	gen_require(`
--		type hugetlbfs_t;
+-		type inotifyfs_t;
 +		type fusefs_t;
  	')
  
--	rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
-+	allow $1 fusefs_t:dir list_dir_perms;
-+	read_lnk_files_pattern($1, fusefs_t, fusefs_t)
+-	dontaudit $1 inotifyfs_t:dir list_dir_perms;
++	dontaudit $1 fusefs_t:file manage_file_perms;
  ')
  
  ########################################
  ## <summary>
--##	Allow the type to associate to hugetlbfs filesystems.
-+##	Manage symbolic links on a FUSEFS filesystem.
+-##	Create an object in a hugetlbfs filesystem, with a private
+-##	type using a type transition.
++##	Read symbolic links on a FUSEFS filesystem.
  ## </summary>
--## <param name="type">
+ ## <param name="domain">
+ ##	<summary>
+ ##	Domain allowed access.
+ ##	</summary>
+ ## </param>
+-## <param name="private type">
++#
++interface(`fs_read_fusefs_symlinks',`
++	gen_require(`
++		type fusefs_t;
++	')
++
++	allow $1 fusefs_t:dir list_dir_perms;
++	read_lnk_files_pattern($1, fusefs_t, fusefs_t)
++')
++
++########################################
++## <summary>
++##	Manage symbolic links on a FUSEFS filesystem.
++## </summary>
 +## <param name="domain">
  ##	<summary>
--##	The type of the object to be associated.
+-##	The type of the object to be created.
 +##	Domain allowed access.
  ##	</summary>
  ## </param>
- #
--interface(`fs_associate_hugetlbfs',`
+-## <param name="object">
++#
 +interface(`fs_manage_fusefs_symlinks',`
- 	gen_require(`
--		type hugetlbfs_t;
++	gen_require(`
 +		type fusefs_t;
- 	')
- 
--	allow $1 hugetlbfs_t:filesystem associate;
++	')
++
 +	manage_lnk_files_pattern($1, fusefs_t, fusefs_t)
- ')
- 
- ########################################
- ## <summary>
--##	Search inotifyfs filesystem.
++')
++
++########################################
++## <summary>
 +##	Execute a file on a FUSE filesystem
 +##	in the specified domain.
 +## </summary>
@@ -16324,16 +16342,20 @@ index 8416beb..b66e93a 100644
 +##	</p>
 +## </desc>
 +## <param name="domain">
-+##	<summary>
+ ##	<summary>
+-##	The object class of the object being created.
 +##	Domain allowed to transition.
-+##	</summary>
-+## </param>
+ ##	</summary>
+ ## </param>
+-## <param name="name" optional="true">
 +## <param name="target_domain">
-+##	<summary>
+ ##	<summary>
+-##	The name of the object being created.
 +##	The type of the new process.
-+##	</summary>
-+## </param>
-+#
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_hugetlbfs_filetrans',`
 +interface(`fs_fusefs_domtrans',`
 +	gen_require(`
 +		type fusefs_t;
@@ -16346,83 +16368,80 @@ index 8416beb..b66e93a 100644
 +########################################
 +## <summary>
 +##	Get the attributes of a FUSEFS filesystem.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
- ##	Domain allowed access.
- ##	</summary>
- ## </param>
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
 +## <rolecap/>
- #
--interface(`fs_search_inotifyfs',`
++#
 +interface(`fs_getattr_fusefs',`
- 	gen_require(`
--		type inotifyfs_t;
++	gen_require(`
 +		type fusefs_t;
- 	')
- 
--	allow $1 inotifyfs_t:dir search_dir_perms;
++	')
++
 +	allow $1 fusefs_t:filesystem getattr;
- ')
- 
- ########################################
- ## <summary>
--##	List inotifyfs filesystem.
++')
++
++########################################
++## <summary>
 +##	Get the attributes of an hugetlbfs
 +##	filesystem.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -2142,71 +2551,527 @@ interface(`fs_search_inotifyfs',`
- ##	</summary>
- ## </param>
- #
--interface(`fs_list_inotifyfs',`
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`fs_getattr_hugetlbfs',`
  	gen_require(`
--		type inotifyfs_t;
-+		type hugetlbfs_t;
+ 		type hugetlbfs_t;
  	')
  
--	allow $1 inotifyfs_t:dir list_dir_perms;
+-	allow $2 hugetlbfs_t:filesystem associate;
+-	filetrans_pattern($1, hugetlbfs_t, $2, $3, $4)
 +	allow $1 hugetlbfs_t:filesystem getattr;
  ')
  
  ########################################
  ## <summary>
--##	Dontaudit List inotifyfs filesystem.
+-##	Mount an iso9660 filesystem, which
+-##	is usually used on CDs.
 +##	List hugetlbfs.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
--##	Domain to not audit.
-+##	Domain allowed access.
+@@ -2214,19 +2569,17 @@ interface(`fs_hugetlbfs_filetrans',`
  ##	</summary>
  ## </param>
  #
--interface(`fs_dontaudit_list_inotifyfs',`
+-interface(`fs_mount_iso9660_fs',`
 +interface(`fs_list_hugetlbfs',`
  	gen_require(`
--		type inotifyfs_t;
+-		type iso9660_t;
 +		type hugetlbfs_t;
  	')
  
--	dontaudit $1 inotifyfs_t:dir list_dir_perms;
+-	allow $1 iso9660_t:filesystem mount;
 +	allow $1 hugetlbfs_t:dir list_dir_perms;
  ')
  
  ########################################
  ## <summary>
--##	Create an object in a hugetlbfs filesystem, with a private
--##	type using a type transition.
+-##	Remount an iso9660 filesystem, which
+-##	is usually used on CDs.  This allows
+-##	some mount options to be changed.
 +##	Manage hugetlbfs dirs.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -2234,18 +2587,533 @@ interface(`fs_mount_iso9660_fs',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_remount_iso9660_fs',`
 +interface(`fs_manage_hugetlbfs_dirs',`
 +	gen_require(`
 +		type hugetlbfs_t;
@@ -16888,84 +16907,55 @@ index 8416beb..b66e93a 100644
 +########################################
 +## <summary>
 +##	Manage kdbusfs directories.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
- ##	Domain allowed access.
- ##	</summary>
- ## </param>
--## <param name="private type">
--##	<summary>
--##	The type of the object to be created.
--##	</summary>
--## </param>
--## <param name="object">
--##	<summary>
--##	The object class of the object being created.
--##	</summary>
--## </param>
--## <param name="name" optional="true">
--##	<summary>
--##	The name of the object being created.
--##	</summary>
--## </param>
- #
--interface(`fs_hugetlbfs_filetrans',`
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`fs_manage_kdbus_dirs',`
- 	gen_require(`
--		type hugetlbfs_t;
--	')
++	gen_require(`
 +		type kdbusfs_t;
- 
--	allow $2 hugetlbfs_t:filesystem associate;
--	filetrans_pattern($1, hugetlbfs_t, $2, $3, $4)
++
 +	')
 +	manage_dirs_pattern($1, kdbusfs_t, kdbusfs_t)
 +	fs_search_tmpfs($1)
 +	dev_search_sysfs($1)
- ')
- 
- ########################################
- ## <summary>
--##	Mount an iso9660 filesystem, which
--##	is usually used on CDs.
++')
++
++########################################
++## <summary>
 +##	Read kdbusfs files.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -2214,19 +3079,21 @@ interface(`fs_hugetlbfs_filetrans',`
- ##	</summary>
- ## </param>
- #
--interface(`fs_mount_iso9660_fs',`
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`fs_read_kdbus_files',`
- 	gen_require(`
--		type iso9660_t;
++	gen_require(`
 +		type cgroup_t;
 +
- 	')
- 
--	allow $1 iso9660_t:filesystem mount;
++	')
++
 +	read_files_pattern($1, kdbusfs_t, kdbusfs_t)
 +	read_lnk_files_pattern($1, kdbusfs_t, kdbusfs_t)
 +	fs_search_tmpfs($1)
 +	dev_search_sysfs($1)
- ')
- 
- ########################################
- ## <summary>
--##	Remount an iso9660 filesystem, which
--##	is usually used on CDs.  This allows
--##	some mount options to be changed.
++')
++
++########################################
++## <summary>
 +##	Write kdbusfs files.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -2234,18 +3101,19 @@ interface(`fs_mount_iso9660_fs',`
- ##	</summary>
- ## </param>
- #
--interface(`fs_remount_iso9660_fs',`
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`fs_write_kdbus_files', `
  	gen_require(`
 -		type iso9660_t;
@@ -17437,209 +17427,270 @@ index 8416beb..b66e93a 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3769,17 +4833,53 @@ interface(`fs_rw_rpc_named_pipes',`
- ##	</summary>
- ## </param>
- #
--interface(`fs_mount_tmpfs',`
-+interface(`fs_mount_tmpfs',`
+@@ -3779,6 +4843,24 @@ interface(`fs_mount_tmpfs',`
+ 
+ ########################################
+ ## <summary>
++##	Dontaudit remount a tmpfs filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain to not audit.
++##	</summary>
++## </param>
++#
++interface(`fs_dontaudit_remount_tmpfs',`
 +	gen_require(`
 +		type tmpfs_t;
 +	')
 +
-+	allow $1 tmpfs_t:filesystem mount;
++	dontaudit $1 tmpfs_t:filesystem remount;
 +')
 +
 +########################################
 +## <summary>
-+##	Dontaudit remount a tmpfs filesystem.
+ ##	Remount a tmpfs filesystem.
+ ## </summary>
+ ## <param name="domain">
+@@ -3815,6 +4897,24 @@ interface(`fs_unmount_tmpfs',`
+ 
+ ########################################
+ ## <summary>
++##	Mount on tmpfs directories.
 +## </summary>
 +## <param name="domain">
 +##	<summary>
-+##	Domain to not audit.
++##	Domain allowed access.
 +##	</summary>
 +## </param>
 +#
-+interface(`fs_dontaudit_remount_tmpfs',`
++interface(`fs_mounton_tmpfs', `
 +	gen_require(`
 +		type tmpfs_t;
 +	')
 +
-+	dontaudit $1 tmpfs_t:filesystem remount;
++	allow $1 tmpfs_t:dir mounton;
++')
++
++########################################
++## <summary>
+ ##	Get the attributes of a tmpfs
+ ##	filesystem.
+ ## </summary>
+@@ -3839,39 +4939,76 @@ interface(`fs_getattr_tmpfs',`
+ ## </summary>
+ ## <param name="type">
+ ##	<summary>
+-##	The type of the object to be associated.
++##	The type of the object to be associated.
++##	</summary>
++## </param>
++#
++interface(`fs_associate_tmpfs',`
++	gen_require(`
++		type tmpfs_t;
++	')
++
++	allow $1 tmpfs_t:filesystem associate;
 +')
 +
 +########################################
 +## <summary>
-+##	Remount a tmpfs filesystem.
++##	Relabel from tmpfs filesystem.
 +## </summary>
-+## <param name="domain">
++## <param name="type">
 +##	<summary>
 +##	Domain allowed access.
 +##	</summary>
 +## </param>
 +#
-+interface(`fs_remount_tmpfs',`
++interface(`fs_relabelfrom_tmpfs',`
++	gen_require(`
++		type tmpfs_t;
++	')
++
++	allow $1 tmpfs_t:filesystem relabelfrom;
++')
++
++########################################
++## <summary>
++##	Get the attributes of tmpfs directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_associate_tmpfs',`
++interface(`fs_getattr_tmpfs_dirs',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
--	allow $1 tmpfs_t:filesystem mount;
-+	allow $1 tmpfs_t:filesystem remount;
+-	allow $1 tmpfs_t:filesystem associate;
++	allow $1 tmpfs_t:dir getattr;
  ')
  
  ########################################
  ## <summary>
--##	Remount a tmpfs filesystem.
-+##	Unmount a tmpfs filesystem.
+-##	Relabel from tmpfs filesystem.
++##	Do not audit attempts to get the attributes
++##	of tmpfs directories.
  ## </summary>
- ## <param name="domain">
+-## <param name="type">
++## <param name="domain">
  ##	<summary>
-@@ -3787,17 +4887,17 @@ interface(`fs_mount_tmpfs',`
+-##	Domain allowed access.
++##	Domain to not audit.
  ##	</summary>
  ## </param>
  #
--interface(`fs_remount_tmpfs',`
-+interface(`fs_unmount_tmpfs',`
+-interface(`fs_relabelfrom_tmpfs',`
++interface(`fs_dontaudit_getattr_tmpfs_dirs',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
--	allow $1 tmpfs_t:filesystem remount;
-+	allow $1 tmpfs_t:filesystem unmount;
+-	allow $1 tmpfs_t:filesystem relabelfrom;
++	dontaudit $1 tmpfs_t:dir getattr;
  ')
  
  ########################################
  ## <summary>
--##	Unmount a tmpfs filesystem.
-+##	Mount on tmpfs directories.
+-##	Get the attributes of tmpfs directories.
++##	Set the attributes of tmpfs directories.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3805,12 +4905,12 @@ interface(`fs_remount_tmpfs',`
+@@ -3879,36 +5016,35 @@ interface(`fs_relabelfrom_tmpfs',`
  ##	</summary>
  ## </param>
  #
--interface(`fs_unmount_tmpfs',`
-+interface(`fs_mounton_tmpfs', `
+-interface(`fs_getattr_tmpfs_dirs',`
++interface(`fs_setattr_tmpfs_dirs',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
--	allow $1 tmpfs_t:filesystem unmount;
-+	allow $1 tmpfs_t:dir mounton;
+-	allow $1 tmpfs_t:dir getattr;
++	allow $1 tmpfs_t:dir setattr;
  ')
  
  ########################################
-@@ -3908,7 +5008,7 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',`
+ ## <summary>
+-##	Do not audit attempts to get the attributes
+-##	of tmpfs directories.
++##	Search tmpfs directories.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+-##	Domain to not audit.
++##	Domain allowed access.
+ ##	</summary>
+ ## </param>
+ #
+-interface(`fs_dontaudit_getattr_tmpfs_dirs',`
++interface(`fs_search_tmpfs',`
+ 	gen_require(`
+ 		type tmpfs_t;
+ 	')
+ 
+-	dontaudit $1 tmpfs_t:dir getattr;
++	allow $1 tmpfs_t:dir search_dir_perms;
+ ')
  
  ########################################
  ## <summary>
 -##	Mount on tmpfs directories.
-+##	Set the attributes of tmpfs directories.
++##	List the contents of generic tmpfs directories.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3916,17 +5016,17 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',`
+@@ -3916,35 +5052,36 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',`
  ##	</summary>
  ## </param>
  #
 -interface(`fs_mounton_tmpfs',`
-+interface(`fs_setattr_tmpfs_dirs',`
++interface(`fs_list_tmpfs',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
 -	allow $1 tmpfs_t:dir mounton;
-+	allow $1 tmpfs_t:dir setattr;
++	allow $1 tmpfs_t:dir list_dir_perms;
  ')
  
  ########################################
  ## <summary>
 -##	Set the attributes of tmpfs directories.
-+##	Search tmpfs directories.
++##	Do not audit attempts to list the
++##	contents of generic tmpfs directories.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3934,17 +5034,17 @@ interface(`fs_mounton_tmpfs',`
+-##	Domain allowed access.
++##	Domain to not audit.
  ##	</summary>
  ## </param>
  #
 -interface(`fs_setattr_tmpfs_dirs',`
-+interface(`fs_search_tmpfs',`
++interface(`fs_dontaudit_list_tmpfs',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
 -	allow $1 tmpfs_t:dir setattr;
-+	allow $1 tmpfs_t:dir search_dir_perms;
++	dontaudit $1 tmpfs_t:dir list_dir_perms;
  ')
  
  ########################################
  ## <summary>
 -##	Search tmpfs directories.
-+##	List the contents of generic tmpfs directories.
++##	Relabel directory  on tmpfs filesystems.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3952,17 +5052,36 @@ interface(`fs_setattr_tmpfs_dirs',`
+@@ -3952,17 +5089,17 @@ interface(`fs_setattr_tmpfs_dirs',`
  ##	</summary>
  ## </param>
  #
 -interface(`fs_search_tmpfs',`
-+interface(`fs_list_tmpfs',`
++interface(`fs_relabel_tmpfs_dirs',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
 -	allow $1 tmpfs_t:dir search_dir_perms;
-+	allow $1 tmpfs_t:dir list_dir_perms;
++	relabel_dirs_pattern($1, tmpfs_t, tmpfs_t)
  ')
  
  ########################################
  ## <summary>
 -##	List the contents of generic tmpfs directories.
-+##	Do not audit attempts to list the
-+##	contents of generic tmpfs directories.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain to not audit.
-+##	</summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_list_tmpfs',`
-+	gen_require(`
-+		type tmpfs_t;
-+	')
-+
-+	dontaudit $1 tmpfs_t:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
-+##	Relabel directory  on tmpfs filesystems.
++##	Relabel fifo_file  on tmpfs filesystems.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3970,31 +5089,48 @@ interface(`fs_search_tmpfs',`
+@@ -3970,31 +5107,30 @@ interface(`fs_search_tmpfs',`
  ##	</summary>
  ## </param>
  #
 -interface(`fs_list_tmpfs',`
-+interface(`fs_relabel_tmpfs_dirs',`
++interface(`fs_relabel_tmpfs_fifo_files',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
 -	allow $1 tmpfs_t:dir list_dir_perms;
-+	relabel_dirs_pattern($1, tmpfs_t, tmpfs_t)
++	relabel_fifo_files_pattern($1, tmpfs_t, tmpfs_t)
  ')
  
  ########################################
  ## <summary>
 -##	Do not audit attempts to list the
 -##	contents of generic tmpfs directories.
-+##	Relabel fifo_file  on tmpfs filesystems.
++##	Relabel files  on tmpfs filesystems.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
@@ -17649,30 +17700,12 @@ index 8416beb..b66e93a 100644
  ## </param>
  #
 -interface(`fs_dontaudit_list_tmpfs',`
-+interface(`fs_relabel_tmpfs_fifo_files',`
++interface(`fs_relabel_tmpfs_files',`
  	gen_require(`
  		type tmpfs_t;
  	')
  
 -	dontaudit $1 tmpfs_t:dir list_dir_perms;
-+	relabel_fifo_files_pattern($1, tmpfs_t, tmpfs_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Relabel files  on tmpfs filesystems.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`fs_relabel_tmpfs_files',`
-+	gen_require(`
-+		type tmpfs_t;
-+	')
-+
 +	relabel_files_pattern($1, tmpfs_t, tmpfs_t)
  ')
  
@@ -17852,7 +17885,33 @@ index 8416beb..b66e93a 100644
  ##	Read and write, create and delete symbolic
  ##	links on tmpfs filesystems.
  ## </summary>
-@@ -4503,6 +5768,8 @@ interface(`fs_mount_all_fs',`
+@@ -4407,6 +5672,25 @@ interface(`fs_search_xenfs',`
+ 	allow $1 xenfs_t:dir search_dir_perms;
+ ')
+ 
++
++########################################
++## <summary>
++##	Read files on a XENFS filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`fs_read_xenfs_files',`
++	gen_require(`
++		type xenfs_t;
++	')
++
++	allow $1 xenfs_t:file read_file_perms;
++')
++
+ ########################################
+ ## <summary>
+ ##	Create, read, write, and delete directories
+@@ -4503,6 +5787,8 @@ interface(`fs_mount_all_fs',`
  	')
  
  	allow $1 filesystem_type:filesystem mount;
@@ -17861,7 +17920,7 @@ index 8416beb..b66e93a 100644
  ')
  
  ########################################
-@@ -4549,7 +5816,7 @@ interface(`fs_unmount_all_fs',`
+@@ -4549,7 +5835,7 @@ interface(`fs_unmount_all_fs',`
  ## <desc>
  ##	<p>
  ##	Allow the specified domain to
@@ -17870,7 +17929,7 @@ index 8416beb..b66e93a 100644
  ##	Example attributes:
  ##	</p>
  ##	<ul>
-@@ -4596,6 +5863,26 @@ interface(`fs_dontaudit_getattr_all_fs',`
+@@ -4596,6 +5882,26 @@ interface(`fs_dontaudit_getattr_all_fs',`
  
  ########################################
  ## <summary>
@@ -17897,7 +17956,7 @@ index 8416beb..b66e93a 100644
  ##	Get the quotas of all filesystems.
  ## </summary>
  ## <param name="domain">
-@@ -4671,6 +5958,25 @@ interface(`fs_getattr_all_dirs',`
+@@ -4671,6 +5977,25 @@ interface(`fs_getattr_all_dirs',`
  
  ########################################
  ## <summary>
@@ -17923,7 +17982,7 @@ index 8416beb..b66e93a 100644
  ##	Search all directories with a filesystem type.
  ## </summary>
  ## <param name="domain">
-@@ -4912,3 +6218,63 @@ interface(`fs_unconfined',`
+@@ -4912,3 +6237,63 @@ interface(`fs_unconfined',`
  
  	typeattribute $1 filesystem_unconfined_type;
  ')
@@ -33678,7 +33737,7 @@ index 79a45f6..9769b64 100644
 +	read_files_pattern($1, init_var_lib_t, init_var_lib_t)
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda24..0fe1650 100644
+index 17eda24..137676e 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -34031,7 +34090,7 @@ index 17eda24..0fe1650 100644
 +
 +allow init_t self:system all_system_perms;
 +allow init_t self:unix_dgram_socket { create_socket_perms sendto };
-+allow init_t self:process { setsockcreate setfscreate setrlimit setexec };
++allow init_t self:process { setkeycreate setsockcreate setfscreate setrlimit setexec };
 +allow init_t self:process { getcap setcap };
 +allow init_t self:unix_stream_socket { create_stream_socket_perms connectto };
 +allow init_t self:netlink_kobject_uevent_socket create_socket_perms; 
@@ -44877,10 +44936,10 @@ index 0000000..4f142e9
 +')
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
 new file mode 100644
-index 0000000..0920911
+index 0000000..ad113b6
 --- /dev/null
 +++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,775 @@
+@@ -0,0 +1,782 @@
 +policy_module(systemd, 1.0.0)
 +
 +#######################################
@@ -45163,6 +45222,10 @@ index 0000000..0920911
 +init_dbus_chat(systemd_machined_t)
 +init_status(systemd_machined_t)
 +
++userdom_dbus_send_all_users(systemd_machined_t)
++
++term_use_ptmx(systemd_machined_t)
++
 +optional_policy(`
 +	dbus_connect_system_bus(systemd_machined_t)
 +	dbus_system_bus_client(systemd_machined_t)
@@ -45194,12 +45257,15 @@ index 0000000..0920911
 +kernel_dgram_send(systemd_networkd_t)
 +kernel_request_load_module(systemd_networkd_t)
 +kernel_rw_net_sysctls(systemd_networkd_t)
++kernel_read_xen_state(systemd_networkd_t)
 +
 +corenet_tcp_bind_all_nodes(systemd_networkd_t)
 +corenet_udp_bind_all_nodes(systemd_networkd_t)
 +corenet_tcp_bind_dhcpc_port(systemd_networkd_t)
 +corenet_udp_bind_dhcpc_port(systemd_networkd_t)
 +
++fs_read_xenfs_files(systemd_networkd_t)
++
 +dev_read_sysfs(systemd_networkd_t)
 +
 +auth_use_nsswitch(systemd_networkd_t)
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 97bc967..98aaa5c 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -81,13 +81,29 @@ index 1a93dc5..e948aef 100644
 -/var/spool/abrt-retrace(/.*)?	gen_context(system_u:object_r:abrt_retrace_spool_t,s0)
 -/var/spool/retrace-server(/.*)?	gen_context(system_u:object_r:abrt_retrace_spool_t,s0)
 diff --git a/abrt.if b/abrt.if
-index 058d908..7da78c7 100644
+index 058d908..ee0c559 100644
 --- a/abrt.if
 +++ b/abrt.if
-@@ -1,4 +1,26 @@
+@@ -1,4 +1,42 @@
 -## <summary>Automated bug-reporting tool.</summary>
 +## <summary>ABRT - automated bug-reporting tool</summary>
 +
++########################################
++## <summary>
++##	abrt stub interface.  No access allowed.
++## </summary>
++## <param name="domain" unused="true">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`abrt_stub',`
++	gen_require(`
++		type abrt_t;
++	')
++')
++
 +######################################
 +## <summary>
 +##  Creates types and rules for a basic
@@ -112,7 +128,7 @@ index 058d908..7da78c7 100644
  
  ######################################
  ## <summary>
-@@ -21,6 +43,25 @@ interface(`abrt_domtrans',`
+@@ -21,6 +59,25 @@ interface(`abrt_domtrans',`
  
  ######################################
  ## <summary>
@@ -138,7 +154,7 @@ index 058d908..7da78c7 100644
  ##	Execute abrt in the caller domain.
  ## </summary>
  ## <param name="domain">
-@@ -40,7 +81,7 @@ interface(`abrt_exec',`
+@@ -40,7 +97,7 @@ interface(`abrt_exec',`
  
  ########################################
  ## <summary>
@@ -147,7 +163,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -58,7 +99,7 @@ interface(`abrt_signull',`
+@@ -58,7 +115,7 @@ interface(`abrt_signull',`
  
  ########################################
  ## <summary>
@@ -156,7 +172,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -71,12 +112,13 @@ interface(`abrt_read_state',`
+@@ -71,12 +128,13 @@ interface(`abrt_read_state',`
  		type abrt_t;
  	')
  
@@ -171,7 +187,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -116,8 +158,7 @@ interface(`abrt_dbus_chat',`
+@@ -116,8 +174,7 @@ interface(`abrt_dbus_chat',`
  
  #####################################
  ## <summary>
@@ -181,7 +197,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -130,15 +171,13 @@ interface(`abrt_domtrans_helper',`
+@@ -130,15 +187,13 @@ interface(`abrt_domtrans_helper',`
  		type abrt_helper_t, abrt_helper_exec_t;
  	')
  
@@ -199,20 +215,23 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -163,8 +202,45 @@ interface(`abrt_run_helper',`
+@@ -163,8 +218,7 @@ interface(`abrt_run_helper',`
  
  ########################################
  ## <summary>
 -##	Create, read, write, and delete
 -##	abrt cache files.
 +##	Read abrt cache
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -172,15 +226,56 @@ interface(`abrt_run_helper',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`abrt_cache_manage',`
+-	refpolicywarn(`$0($*) has been deprecated, use abrt_manage_cache() instead.')
+-	abrt_manage_cache($1)
 +interface(`abrt_read_cache',`
 +	gen_require(`
 +		type abrt_var_cache_t;
@@ -220,10 +239,12 @@ index 058d908..7da78c7 100644
 +
 +	read_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
 +	read_lnk_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Create, read, write, and delete
+-##	abrt cache content.
 +##	Append abrt cache
 +## </summary>
 +## <param name="domain">
@@ -244,16 +265,13 @@ index 058d908..7da78c7 100644
 +########################################
 +## <summary>
 +##	Read/Write inherited abrt cache
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -172,15 +248,18 @@ interface(`abrt_run_helper',`
- ##	</summary>
- ## </param>
- #
--interface(`abrt_cache_manage',`
--	refpolicywarn(`$0($*) has been deprecated, use abrt_manage_cache() instead.')
--	abrt_manage_cache($1)
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`abrt_rw_inherited_cache',`
 +	gen_require(`
 +		type abrt_var_cache_t;
@@ -261,17 +279,15 @@ index 058d908..7da78c7 100644
 +
 +	
 +	allow $1 abrt_var_cache_t:file rw_inherited_file_perms;
- ')
- 
- ########################################
- ## <summary>
--##	Create, read, write, and delete
--##	abrt cache content.
++')
++
++########################################
++## <summary>
 +##	Manage abrt cache
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -193,7 +272,6 @@ interface(`abrt_manage_cache',`
+@@ -193,7 +288,6 @@ interface(`abrt_manage_cache',`
  		type abrt_var_cache_t;
  	')
  
@@ -279,7 +295,7 @@ index 058d908..7da78c7 100644
  	manage_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
  	manage_lnk_files_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
  	manage_dirs_pattern($1, abrt_var_cache_t, abrt_var_cache_t)
-@@ -201,7 +279,7 @@ interface(`abrt_manage_cache',`
+@@ -201,7 +295,7 @@ interface(`abrt_manage_cache',`
  
  ####################################
  ## <summary>
@@ -288,7 +304,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -218,9 +296,29 @@ interface(`abrt_read_config',`
+@@ -218,9 +312,29 @@ interface(`abrt_read_config',`
  	read_files_pattern($1, abrt_etc_t, abrt_etc_t)
  ')
  
@@ -319,7 +335,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -258,8 +356,7 @@ interface(`abrt_read_pid_files',`
+@@ -258,8 +372,7 @@ interface(`abrt_read_pid_files',`
  
  ######################################
  ## <summary>
@@ -329,7 +345,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -276,10 +373,52 @@ interface(`abrt_manage_pid_files',`
+@@ -276,10 +389,52 @@ interface(`abrt_manage_pid_files',`
  	manage_files_pattern($1, abrt_var_run_t, abrt_var_run_t)
  ')
  
@@ -384,7 +400,7 @@ index 058d908..7da78c7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -288,39 +427,174 @@ interface(`abrt_manage_pid_files',`
+@@ -288,39 +443,174 @@ interface(`abrt_manage_pid_files',`
  ## </param>
  ## <param name="role">
  ##	<summary>
@@ -485,7 +501,7 @@ index 058d908..7da78c7 100644
 +	manage_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t)
 +	manage_lnk_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t)
 +    manage_sock_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t)
-+')
+ ')
 +
 +#####################################
 +## <summary>
@@ -505,7 +521,7 @@ index 058d908..7da78c7 100644
 +    list_dirs_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t)
 +    read_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t)
 +    read_lnk_files_pattern($1, abrt_retrace_spool_t, abrt_retrace_spool_t)
- ')
++')
 +
 +
 +#####################################
@@ -573,7 +589,7 @@ index 058d908..7da78c7 100644
 +')
 +
 diff --git a/abrt.te b/abrt.te
-index eb50f07..9bd797b 100644
+index eb50f07..853554d 100644
 --- a/abrt.te
 +++ b/abrt.te
 @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -721,7 +737,7 @@ index eb50f07..9bd797b 100644
  manage_files_pattern(abrt_t, abrt_var_log_t, abrt_var_log_t)
  logging_log_filetrans(abrt_t, abrt_var_log_t, file)
  
-@@ -125,48 +135,57 @@ manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
+@@ -125,48 +135,59 @@ manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
  manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
  manage_lnk_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
  files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
@@ -755,6 +771,8 @@ index eb50f07..9bd797b 100644
  kernel_request_load_module(abrt_t)
 +kernel_rw_usermodehelper_state(abrt_t)
  kernel_rw_kernel_sysctl(abrt_t)
++# needed by docker BZ #1194280
++kernel_read_net_sysctls(abrt_t)
 +kernel_rw_usermodehelper_state(abrt_t)
  
  corecmd_exec_bin(abrt_t)
@@ -786,7 +804,7 @@ index eb50f07..9bd797b 100644
  
  domain_getattr_all_domains(abrt_t)
  domain_read_all_domains_state(abrt_t)
-@@ -176,29 +195,43 @@ files_getattr_all_files(abrt_t)
+@@ -176,29 +197,43 @@ files_getattr_all_files(abrt_t)
  files_read_config_files(abrt_t)
  files_read_etc_runtime_files(abrt_t)
  files_read_var_symlinks(abrt_t)
@@ -833,7 +851,7 @@ index eb50f07..9bd797b 100644
  
  tunable_policy(`abrt_anon_write',`
  	miscfiles_manage_public_files(abrt_t)
-@@ -206,15 +239,11 @@ tunable_policy(`abrt_anon_write',`
+@@ -206,15 +241,11 @@ tunable_policy(`abrt_anon_write',`
  
  optional_policy(`
  	apache_list_modules(abrt_t)
@@ -850,7 +868,7 @@ index eb50f07..9bd797b 100644
  ')
  
  optional_policy(`
-@@ -222,6 +251,28 @@ optional_policy(`
+@@ -222,6 +253,28 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -879,7 +897,7 @@ index eb50f07..9bd797b 100644
  	policykit_domtrans_auth(abrt_t)
  	policykit_read_lib(abrt_t)
  	policykit_read_reload(abrt_t)
-@@ -234,6 +285,11 @@ optional_policy(`
+@@ -234,6 +287,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -891,7 +909,7 @@ index eb50f07..9bd797b 100644
  	rpm_exec(abrt_t)
  	rpm_dontaudit_manage_db(abrt_t)
  	rpm_manage_cache(abrt_t)
-@@ -243,6 +299,7 @@ optional_policy(`
+@@ -243,6 +301,7 @@ optional_policy(`
  	rpm_signull(abrt_t)
  ')
  
@@ -899,7 +917,7 @@ index eb50f07..9bd797b 100644
  optional_policy(`
  	sendmail_domtrans(abrt_t)
  ')
-@@ -253,9 +310,21 @@ optional_policy(`
+@@ -253,9 +312,21 @@ optional_policy(`
  	sosreport_delete_tmp_files(abrt_t)
  ')
  
@@ -922,7 +940,7 @@ index eb50f07..9bd797b 100644
  #
  
  allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms;
-@@ -266,9 +335,13 @@ tunable_policy(`abrt_handle_event',`
+@@ -266,9 +337,13 @@ tunable_policy(`abrt_handle_event',`
  	can_exec(abrt_t, abrt_handle_event_exec_t)
  ')
  
@@ -937,7 +955,7 @@ index eb50f07..9bd797b 100644
  #
  
  allow abrt_helper_t self:capability { chown setgid sys_nice };
-@@ -281,6 +354,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
+@@ -281,6 +356,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
  manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
  manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
  files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
@@ -945,7 +963,7 @@ index eb50f07..9bd797b 100644
  
  read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
  read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
-@@ -289,15 +363,20 @@ corecmd_read_all_executables(abrt_helper_t)
+@@ -289,15 +365,20 @@ corecmd_read_all_executables(abrt_helper_t)
  
  domain_read_all_domains_state(abrt_helper_t)
  
@@ -966,7 +984,7 @@ index eb50f07..9bd797b 100644
  	userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
  	userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
  	dev_dontaudit_read_all_blk_files(abrt_helper_t)
-@@ -305,11 +384,25 @@ ifdef(`hide_broken_symptoms',`
+@@ -305,11 +386,25 @@ ifdef(`hide_broken_symptoms',`
  	dev_dontaudit_write_all_chr_files(abrt_helper_t)
  	dev_dontaudit_write_all_blk_files(abrt_helper_t)
  	fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
@@ -993,7 +1011,7 @@ index eb50f07..9bd797b 100644
  #
  
  allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms;
-@@ -327,10 +420,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
+@@ -327,10 +422,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
  
  dev_read_urand(abrt_retrace_coredump_t)
  
@@ -1007,7 +1025,7 @@ index eb50f07..9bd797b 100644
  optional_policy(`
  	rpm_exec(abrt_retrace_coredump_t)
  	rpm_dontaudit_manage_db(abrt_retrace_coredump_t)
-@@ -343,10 +438,11 @@ optional_policy(`
+@@ -343,10 +440,11 @@ optional_policy(`
  
  #######################################
  #
@@ -1021,7 +1039,7 @@ index eb50f07..9bd797b 100644
  allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
  
  domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
-@@ -365,38 +461,64 @@ corecmd_exec_shell(abrt_retrace_worker_t)
+@@ -365,38 +463,64 @@ corecmd_exec_shell(abrt_retrace_worker_t)
  
  dev_read_urand(abrt_retrace_worker_t)
  
@@ -1090,7 +1108,7 @@ index eb50f07..9bd797b 100644
  
  #######################################
  #
-@@ -404,25 +526,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +528,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
  #
  
  allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@@ -1153,7 +1171,7 @@ index eb50f07..9bd797b 100644
  ')
  
  #######################################
-@@ -430,10 +587,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +589,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
  # Global local policy
  #
  
@@ -28027,10 +28045,10 @@ index cf0e567..6c3ce35 100644
 +    apache_read_log(fail2ban_client_t)
 +')
 diff --git a/fcoe.te b/fcoe.te
-index ce358fb..65ade3f 100644
+index ce358fb..8cc3ca2 100644
 --- a/fcoe.te
 +++ b/fcoe.te
-@@ -20,25 +20,31 @@ files_pid_file(fcoemon_var_run_t)
+@@ -20,25 +20,32 @@ files_pid_file(fcoemon_var_run_t)
  # Local policy
  #
  
@@ -28040,6 +28058,7 @@ index ce358fb..65ade3f 100644
  allow fcoemon_t self:unix_stream_socket { accept listen };
  allow fcoemon_t self:netlink_socket create_socket_perms;
  allow fcoemon_t self:netlink_route_socket create_netlink_socket_perms;
++allow fcoemon_t self:netlink_scsitransport_socket create_socket_perms;
 +allow fcoemon_t self:packet_socket create_socket_perms;
 +allow fcoemon_t self:udp_socket create_socket_perms;
  
@@ -47972,13 +47991,15 @@ index 0000000..f59af1b
 +')
 diff --git a/mock.fc b/mock.fc
 new file mode 100644
-index 0000000..8d0e473
+index 0000000..394bc46
 --- /dev/null
 +++ b/mock.fc
-@@ -0,0 +1,5 @@
+@@ -0,0 +1,7 @@
 +
 +/usr/sbin/mock		--	gen_context(system_u:object_r:mock_exec_t,s0)
 +
++/usr/libexec/mock/mock  --  gen_context(system_u:object_r:mock_exec_t,s0)
++
 +/var/lib/mock(/.*)?		gen_context(system_u:object_r:mock_var_lib_t,s0)
 +/var/cache/mock(/.*)?		gen_context(system_u:object_r:mock_cache_t,s0)
 diff --git a/mock.if b/mock.if
@@ -57342,7 +57363,7 @@ index 86dc29d..7380935 100644
 +	logging_log_filetrans($1, NetworkManager_var_lib_t, file, "wpa_supplicant.log")
  ')
 diff --git a/networkmanager.te b/networkmanager.te
-index 55f2009..51cb268 100644
+index 55f2009..d63018d 100644
 --- a/networkmanager.te
 +++ b/networkmanager.te
 @@ -9,15 +9,18 @@ type NetworkManager_t;
@@ -57433,7 +57454,7 @@ index 55f2009..51cb268 100644
  manage_dirs_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t)
  manage_files_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t)
  filetrans_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_rw_t, { dir file })
-@@ -68,6 +102,7 @@ create_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_
+@@ -68,30 +102,29 @@ create_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_
  setattr_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
  logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
  
@@ -57441,7 +57462,14 @@ index 55f2009..51cb268 100644
  manage_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
  manage_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
  files_tmp_filetrans(NetworkManager_t, NetworkManager_tmp_t, { sock_file file })
-@@ -81,17 +116,15 @@ manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_
+ 
+ manage_dirs_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+ manage_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+-files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, dir)
++files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, { dir file })
+ 
+ manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
+ manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
  manage_sock_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
  files_pid_filetrans(NetworkManager_t, NetworkManager_var_run_t, { dir file sock_file })
  
@@ -66381,10 +66409,10 @@ index 0000000..80246e6
 +
 diff --git a/pcp.te b/pcp.te
 new file mode 100644
-index 0000000..b7242be
+index 0000000..08c51d3
 --- /dev/null
 +++ b/pcp.te
-@@ -0,0 +1,266 @@
+@@ -0,0 +1,268 @@
 +policy_module(pcp, 1.0.0)
 +
 +########################################
@@ -66647,6 +66675,8 @@ index 0000000..b7242be
 +
 +kernel_read_system_state(pcp_pmlogger_t)
 +
++corecmd_exec_bin(pcp_pmlogger_t)
++
 +corenet_tcp_bind_dey_sapi_port(pcp_pmlogger_t)
 +corenet_tcp_bind_commplex_link_port(pcp_pmlogger_t)
 +corenet_tcp_bind_generic_node(pcp_pmlogger_t)
@@ -90754,7 +90784,7 @@ index b8b66ff..a93346e 100644
 +/var/lib/samba/scripts(/.*)?		gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
 +')
 diff --git a/samba.if b/samba.if
-index 50d07fb..337a3e7 100644
+index 50d07fb..e9569d2 100644
 --- a/samba.if
 +++ b/samba.if
 @@ -1,8 +1,12 @@
@@ -91133,7 +91163,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -421,33 +537,34 @@ interface(`samba_manage_var_files',`
+@@ -421,33 +537,55 @@ interface(`samba_manage_var_files',`
  	')
  
  	files_search_var_lib($1)
@@ -91145,16 +91175,36 @@ index 50d07fb..337a3e7 100644
  ########################################
  ## <summary>
 -##	Execute smbcontrol in the smbcontrol domain.
-+##	Execute a domain transition to run smbcontrol.
++##	Allow the specified domain to
++##	read and write samba /var directories.
  ## </summary>
  ## <param name="domain">
--##	<summary>
-+## <summary>
- ##	Domain allowed to transition.
--##	</summary>
-+## </summary>
+ ##	<summary>
+-##	Domain allowed to transition.
++##	Domain allowed access.
+ ##	</summary>
  ## </param>
  #
++interface(`samba_manage_var_dirs',`
++	gen_require(`
++		type samba_var_t;
++	')
++
++	files_search_var_lib($1)
++	files_search_var_lib($1)
++	manage_dirs_pattern($1, samba_var_t, samba_var_t)
++')
++
++########################################
++## <summary>
++##	Execute a domain transition to run smbcontrol.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
  interface(`samba_domtrans_smbcontrol',`
  	gen_require(`
 -		type smbcontrol_t, smbcontrol_exec_t;
@@ -91176,7 +91226,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -462,16 +579,16 @@ interface(`samba_domtrans_smbcontrol',`
+@@ -462,16 +600,16 @@ interface(`samba_domtrans_smbcontrol',`
  #
  interface(`samba_run_smbcontrol',`
  	gen_require(`
@@ -91196,7 +91246,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -488,9 +605,27 @@ interface(`samba_domtrans_smbd',`
+@@ -488,9 +626,27 @@ interface(`samba_domtrans_smbd',`
  	domtrans_pattern($1, smbd_exec_t, smbd_t)
  ')
  
@@ -91225,7 +91275,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -505,10 +640,26 @@ interface(`samba_signal_smbd',`
+@@ -505,10 +661,26 @@ interface(`samba_signal_smbd',`
  	allow $1 smbd_t:process signal;
  ')
  
@@ -91254,7 +91304,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -526,7 +677,7 @@ interface(`samba_dontaudit_use_fds',`
+@@ -526,7 +698,7 @@ interface(`samba_dontaudit_use_fds',`
  
  ########################################
  ## <summary>
@@ -91263,7 +91313,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -544,7 +695,7 @@ interface(`samba_write_smbmount_tcp_sockets',`
+@@ -544,7 +716,7 @@ interface(`samba_write_smbmount_tcp_sockets',`
  
  ########################################
  ## <summary>
@@ -91272,7 +91322,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -560,49 +711,47 @@ interface(`samba_rw_smbmount_tcp_sockets',`
+@@ -560,49 +732,47 @@ interface(`samba_rw_smbmount_tcp_sockets',`
  	allow $1 smbmount_t:tcp_socket { read write };
  ')
  
@@ -91341,7 +91391,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -618,16 +767,16 @@ interface(`samba_getattr_winbind_exec',`
+@@ -618,16 +788,16 @@ interface(`samba_getattr_winbind_exec',`
  #
  interface(`samba_run_winbind_helper',`
  	gen_require(`
@@ -91361,7 +91411,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -637,17 +786,71 @@ interface(`samba_run_winbind_helper',`
+@@ -637,17 +807,71 @@ interface(`samba_run_winbind_helper',`
  #
  interface(`samba_read_winbind_pid',`
  	gen_require(`
@@ -91437,7 +91487,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -657,17 +860,61 @@ interface(`samba_read_winbind_pid',`
+@@ -657,17 +881,61 @@ interface(`samba_read_winbind_pid',`
  #
  interface(`samba_stream_connect_winbind',`
  	gen_require(`
@@ -91504,7 +91554,7 @@ index 50d07fb..337a3e7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -676,7 +923,7 @@ interface(`samba_stream_connect_winbind',`
+@@ -676,7 +944,7 @@ interface(`samba_stream_connect_winbind',`
  ## </param>
  ## <param name="role">
  ##	<summary>
@@ -91513,7 +91563,7 @@ index 50d07fb..337a3e7 100644
  ##	</summary>
  ## </param>
  ## <rolecap/>
-@@ -689,11 +936,30 @@ interface(`samba_admin',`
+@@ -689,11 +957,30 @@ interface(`samba_admin',`
  		type samba_etc_t, samba_share_t, samba_initrc_exec_t;
  		type swat_var_run_t, swat_tmp_t, winbind_log_t;
  		type winbind_var_run_t, winbind_tmp_t;
@@ -91521,8 +91571,10 @@ index 50d07fb..337a3e7 100644
 +		type smbd_keytab_t, samba_unit_file_t;
 +        type samba_unconfined_script_t;
 +        type samba_unconfined_script_exec_t;
-+	')
-+
+ 	')
+ 
+-	allow $1 { nmbd_t smbd_t }:process { ptrace signal_perms };
+-	ps_process_pattern($1, { nmbd_t smbd_t })
 +	allow $1 smbd_t:process signal_perms;
 +	ps_process_pattern($1, smbd_t)
 +
@@ -91530,10 +91582,8 @@ index 50d07fb..337a3e7 100644
 +		allow $1 smbd_t:process ptrace;
 +		allow $1 nmbd_t:process ptrace;
 +		allow $1 samba_unconfined_script_t:process ptrace;
- 	')
- 
--	allow $1 { nmbd_t smbd_t }:process { ptrace signal_perms };
--	ps_process_pattern($1, { nmbd_t smbd_t })
++	')
++
 +	allow $1 nmbd_t:process signal_perms;
 +	ps_process_pattern($1, nmbd_t)
 +
@@ -91547,7 +91597,7 @@ index 50d07fb..337a3e7 100644
  
  	init_labeled_script_domtrans($1, samba_initrc_exec_t)
  	domain_system_change_exemption($1)
-@@ -703,23 +969,34 @@ interface(`samba_admin',`
+@@ -703,23 +990,34 @@ interface(`samba_admin',`
  	files_list_etc($1)
  	admin_pattern($1, { samba_etc_t smbd_keytab_t })
  
@@ -91562,10 +91612,10 @@ index 50d07fb..337a3e7 100644
 -	files_list_spool($1)
 -	admin_pattern($1, smbd_spool_t)
 +	admin_pattern($1, samba_share_t)
-+
+ 
 +	admin_pattern($1, samba_var_t)
 +	files_list_var($1)
- 
++
 +	admin_pattern($1, smbd_var_run_t)
  	files_list_pids($1)
 -	admin_pattern($1, { winbind_var_run_t smbd_var_run_t swat_var_run_t nmbd_var_run_t })
@@ -99404,7 +99454,7 @@ index 1499b0b..6950cab 100644
 -	spamassassin_role($2, $1)
  ')
 diff --git a/spamassassin.te b/spamassassin.te
-index cc58e35..4b352a2 100644
+index cc58e35..2794505 100644
 --- a/spamassassin.te
 +++ b/spamassassin.te
 @@ -7,50 +7,23 @@ policy_module(spamassassin, 2.6.1)
@@ -99931,7 +99981,7 @@ index cc58e35..4b352a2 100644
  manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
  manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
  
-@@ -317,12 +434,13 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
+@@ -317,12 +434,14 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
  manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
  files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir })
  
@@ -99942,12 +99992,13 @@ index cc58e35..4b352a2 100644
  
  kernel_read_all_sysctls(spamd_t)
  kernel_read_system_state(spamd_t)
++kernel_read_network_state(spamd_t)
  
 -corenet_all_recvfrom_unlabeled(spamd_t)
  corenet_all_recvfrom_netlabel(spamd_t)
  corenet_tcp_sendrecv_generic_if(spamd_t)
  corenet_udp_sendrecv_generic_if(spamd_t)
-@@ -331,78 +449,59 @@ corenet_udp_sendrecv_generic_node(spamd_t)
+@@ -331,78 +450,59 @@ corenet_udp_sendrecv_generic_node(spamd_t)
  corenet_tcp_sendrecv_all_ports(spamd_t)
  corenet_udp_sendrecv_all_ports(spamd_t)
  corenet_tcp_bind_generic_node(spamd_t)
@@ -100051,7 +100102,7 @@ index cc58e35..4b352a2 100644
  ')
  
  optional_policy(`
-@@ -421,21 +520,13 @@ optional_policy(`
+@@ -421,21 +521,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -100075,7 +100126,7 @@ index cc58e35..4b352a2 100644
  ')
  
  optional_policy(`
-@@ -443,8 +534,8 @@ optional_policy(`
+@@ -443,8 +535,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -100085,7 +100136,7 @@ index cc58e35..4b352a2 100644
  ')
  
  optional_policy(`
-@@ -455,7 +546,17 @@ optional_policy(`
+@@ -455,7 +547,17 @@ optional_policy(`
  optional_policy(`
  	razor_domtrans(spamd_t)
  	razor_read_lib_files(spamd_t)
@@ -100104,7 +100155,7 @@ index cc58e35..4b352a2 100644
  ')
  
  optional_policy(`
-@@ -463,9 +564,9 @@ optional_policy(`
+@@ -463,9 +565,9 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -100115,7 +100166,7 @@ index cc58e35..4b352a2 100644
  ')
  
  optional_policy(`
-@@ -474,32 +575,32 @@ optional_policy(`
+@@ -474,32 +576,32 @@ optional_policy(`
  
  ########################################
  #
@@ -100158,7 +100209,7 @@ index cc58e35..4b352a2 100644
  
  corecmd_exec_bin(spamd_update_t)
  corecmd_exec_shell(spamd_update_t)
-@@ -508,25 +609,21 @@ dev_read_urand(spamd_update_t)
+@@ -508,25 +610,21 @@ dev_read_urand(spamd_update_t)
  
  domain_use_interactive_fds(spamd_update_t)
  
@@ -101390,7 +101441,7 @@ index a240455..04419ae 100644
 -	admin_pattern($1, sssd_log_t)
  ')
 diff --git a/sssd.te b/sssd.te
-index 2d8db1f..aafd7c8 100644
+index 2d8db1f..edad970 100644
 --- a/sssd.te
 +++ b/sssd.te
 @@ -28,17 +28,25 @@ logging_log_file(sssd_var_log_t)
@@ -101494,7 +101545,7 @@ index 2d8db1f..aafd7c8 100644
  
  init_read_utmp(sssd_t)
  
-@@ -112,18 +120,58 @@ logging_send_syslog_msg(sssd_t)
+@@ -112,18 +120,63 @@ logging_send_syslog_msg(sssd_t)
  logging_send_audit_msgs(sssd_t)
  
  miscfiles_read_generic_certs(sssd_t)
@@ -101533,9 +101584,14 @@ index 2d8db1f..aafd7c8 100644
 +')
 +
 +optional_policy(`
-+	systemd_login_read_pid_files(sssd_t)
++    samba_manage_var_dirs(sssd_t)
++    samba_manage_var_files(sssd_t)
  ')
 +
++optional_policy(`
++	systemd_login_read_pid_files(sssd_t)
++')
++
 +########################################
 +#
 +# sssd SELinux manager local policy
@@ -106707,10 +106763,10 @@ index 1ec5e99..5b6c80b 100644
 +	allow $1 usbmuxd_unit_file_t:service all_service_perms;
 +')
 diff --git a/usbmuxd.te b/usbmuxd.te
-index 34a8917..a6b9e84 100644
+index 34a8917..933baa4 100644
 --- a/usbmuxd.te
 +++ b/usbmuxd.te
-@@ -10,34 +10,54 @@ roleattribute system_r usbmuxd_roles;
+@@ -10,34 +10,58 @@ roleattribute system_r usbmuxd_roles;
  
  type usbmuxd_t;
  type usbmuxd_exec_t;
@@ -106767,6 +106823,10 @@ index 34a8917..a6b9e84 100644
 +seutil_dontaudit_read_file_contexts(usbmuxd_t)
 +
 +optional_policy(`
++    udev_read_pid_files(usbmuxd_t)
++')
++
++optional_policy(`
 +	virt_dontaudit_read_chr_dev(usbmuxd_t)
 +')
 diff --git a/userhelper.fc b/userhelper.fc
@@ -109970,7 +110030,7 @@ index facdee8..efe9356 100644
 +        ps_process_pattern(virtd_t, $1)
  ')
 diff --git a/virt.te b/virt.te
-index f03dcf5..d15b4d3 100644
+index f03dcf5..a463e77 100644
 --- a/virt.te
 +++ b/virt.te
 @@ -1,150 +1,241 @@
@@ -111535,89 +111595,7 @@ index f03dcf5..d15b4d3 100644
 +tunable_policy(`deny_ptrace',`',`
 +	allow svirt_sandbox_domain self:process ptrace;
 +')
- 
--allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot };
--allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid };
--allow svirt_lxc_domain self:fifo_file manage_file_perms;
--allow svirt_lxc_domain self:sem create_sem_perms;
--allow svirt_lxc_domain self:shm create_shm_perms;
--allow svirt_lxc_domain self:msgq create_msgq_perms;
--allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto };
--allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms };
--
--allow svirt_lxc_domain virtd_lxc_t:fd use;
--allow svirt_lxc_domain virtd_lxc_t:fifo_file rw_fifo_file_perms;
--allow svirt_lxc_domain virtd_lxc_t:process sigchld;
--
--allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms };
--
--allow svirt_lxc_domain virsh_t:fd use;
--allow svirt_lxc_domain virsh_t:fifo_file rw_fifo_file_perms;
--allow svirt_lxc_domain virsh_t:process sigchld;
--
--allow svirt_lxc_domain virtd_lxc_var_run_t:dir list_dir_perms;
--allow svirt_lxc_domain virtd_lxc_var_run_t:file read_file_perms;
--
--manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
--
--allow svirt_lxc_net_t svirt_lxc_file_t:dir mounton;
--allow svirt_lxc_net_t svirt_lxc_file_t:filesystem getattr;
--
--can_exec(svirt_lxc_domain, svirt_lxc_file_t)
--
--kernel_getattr_proc(svirt_lxc_domain)
--kernel_list_all_proc(svirt_lxc_domain)
--kernel_read_kernel_sysctls(svirt_lxc_domain)
--kernel_rw_net_sysctls(svirt_lxc_domain)
--kernel_read_system_state(svirt_lxc_domain)
--kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain)
--
--corecmd_exec_all_executables(svirt_lxc_domain)
--
--files_dontaudit_getattr_all_dirs(svirt_lxc_domain)
--files_dontaudit_getattr_all_files(svirt_lxc_domain)
--files_dontaudit_getattr_all_symlinks(svirt_lxc_domain)
--files_dontaudit_getattr_all_pipes(svirt_lxc_domain)
--files_dontaudit_getattr_all_sockets(svirt_lxc_domain)
--files_dontaudit_list_all_mountpoints(svirt_lxc_domain)
--files_dontaudit_write_etc_runtime_files(svirt_lxc_domain)
--# files_entrypoint_all_files(svirt_lxc_domain)
--files_list_var(svirt_lxc_domain)
--files_list_var_lib(svirt_lxc_domain)
--files_search_all(svirt_lxc_domain)
--files_read_config_files(svirt_lxc_domain)
--files_read_usr_files(svirt_lxc_domain)
--files_read_usr_symlinks(svirt_lxc_domain)
--
--fs_getattr_all_fs(svirt_lxc_domain)
--fs_list_inotifyfs(svirt_lxc_domain)
--
--# fs_rw_inherited_tmpfs_files(svirt_lxc_domain)
--# fs_rw_inherited_cifs_files(svirt_lxc_domain)
--# fs_rw_inherited_noxattr_fs_files(svirt_lxc_domain)
--
--auth_dontaudit_read_login_records(svirt_lxc_domain)
--auth_dontaudit_write_login_records(svirt_lxc_domain)
--auth_search_pam_console_data(svirt_lxc_domain)
--
--clock_read_adjtime(svirt_lxc_domain)
--
--init_read_utmp(svirt_lxc_domain)
--init_dontaudit_write_utmp(svirt_lxc_domain)
--
--libs_dontaudit_setattr_lib_files(svirt_lxc_domain)
--
--miscfiles_read_localization(svirt_lxc_domain)
--miscfiles_dontaudit_setattr_fonts_cache_dirs(svirt_lxc_domain)
--miscfiles_read_fonts(svirt_lxc_domain)
--
--mta_dontaudit_read_spool_symlinks(svirt_lxc_domain)
++
 +allow virtd_t svirt_sandbox_domain:unix_stream_socket { create_stream_socket_perms connectto };
 +allow virtd_t svirt_sandbox_domain:process { signal_perms getattr };
 +allow virtd_lxc_t svirt_sandbox_domain:process { getattr getsched setsched setrlimit transition signal_perms };
@@ -111702,27 +111680,107 @@ index f03dcf5..d15b4d3 100644
 +	apache_exec_modules(svirt_sandbox_domain)
 +	apache_read_sys_content(svirt_sandbox_domain)
 +')
- 
- optional_policy(`
--	udev_read_pid_files(svirt_lxc_domain)
++
++optional_policy(`
 +	gear_read_pid_files(svirt_sandbox_domain)
- ')
- 
- optional_policy(`
--	apache_exec_modules(svirt_lxc_domain)
--	apache_read_sys_content(svirt_lxc_domain)
++')
++
++optional_policy(`
 +	mta_dontaudit_read_spool_symlinks(svirt_sandbox_domain)
 +')
 +
 +optional_policy(`
 +	ssh_use_ptys(svirt_sandbox_domain)
 +')
-+
+ 
+-allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot };
+-allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid };
+-allow svirt_lxc_domain self:fifo_file manage_file_perms;
+-allow svirt_lxc_domain self:sem create_sem_perms;
+-allow svirt_lxc_domain self:shm create_shm_perms;
+-allow svirt_lxc_domain self:msgq create_msgq_perms;
+-allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto };
+-allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms };
+-
+-allow svirt_lxc_domain virtd_lxc_t:fd use;
+-allow svirt_lxc_domain virtd_lxc_t:fifo_file rw_fifo_file_perms;
+-allow svirt_lxc_domain virtd_lxc_t:process sigchld;
+-
+-allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms };
+-
+-allow svirt_lxc_domain virsh_t:fd use;
+-allow svirt_lxc_domain virsh_t:fifo_file rw_fifo_file_perms;
+-allow svirt_lxc_domain virsh_t:process sigchld;
+-
+-allow svirt_lxc_domain virtd_lxc_var_run_t:dir list_dir_perms;
+-allow svirt_lxc_domain virtd_lxc_var_run_t:file read_file_perms;
+-
+-manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
+-
+-allow svirt_lxc_net_t svirt_lxc_file_t:dir mounton;
+-allow svirt_lxc_net_t svirt_lxc_file_t:filesystem getattr;
+-
+-can_exec(svirt_lxc_domain, svirt_lxc_file_t)
+-
+-kernel_getattr_proc(svirt_lxc_domain)
+-kernel_list_all_proc(svirt_lxc_domain)
+-kernel_read_kernel_sysctls(svirt_lxc_domain)
+-kernel_rw_net_sysctls(svirt_lxc_domain)
+-kernel_read_system_state(svirt_lxc_domain)
+-kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain)
+-
+-corecmd_exec_all_executables(svirt_lxc_domain)
+-
+-files_dontaudit_getattr_all_dirs(svirt_lxc_domain)
+-files_dontaudit_getattr_all_files(svirt_lxc_domain)
+-files_dontaudit_getattr_all_symlinks(svirt_lxc_domain)
+-files_dontaudit_getattr_all_pipes(svirt_lxc_domain)
+-files_dontaudit_getattr_all_sockets(svirt_lxc_domain)
+-files_dontaudit_list_all_mountpoints(svirt_lxc_domain)
+-files_dontaudit_write_etc_runtime_files(svirt_lxc_domain)
+-# files_entrypoint_all_files(svirt_lxc_domain)
+-files_list_var(svirt_lxc_domain)
+-files_list_var_lib(svirt_lxc_domain)
+-files_search_all(svirt_lxc_domain)
+-files_read_config_files(svirt_lxc_domain)
+-files_read_usr_files(svirt_lxc_domain)
+-files_read_usr_symlinks(svirt_lxc_domain)
+-
+-fs_getattr_all_fs(svirt_lxc_domain)
+-fs_list_inotifyfs(svirt_lxc_domain)
+-
+-# fs_rw_inherited_tmpfs_files(svirt_lxc_domain)
+-# fs_rw_inherited_cifs_files(svirt_lxc_domain)
+-# fs_rw_inherited_noxattr_fs_files(svirt_lxc_domain)
+-
+-auth_dontaudit_read_login_records(svirt_lxc_domain)
+-auth_dontaudit_write_login_records(svirt_lxc_domain)
+-auth_search_pam_console_data(svirt_lxc_domain)
+-
+-clock_read_adjtime(svirt_lxc_domain)
+-
+-init_read_utmp(svirt_lxc_domain)
+-init_dontaudit_write_utmp(svirt_lxc_domain)
+-
+-libs_dontaudit_setattr_lib_files(svirt_lxc_domain)
+-
+-miscfiles_read_localization(svirt_lxc_domain)
+-miscfiles_dontaudit_setattr_fonts_cache_dirs(svirt_lxc_domain)
+-miscfiles_read_fonts(svirt_lxc_domain)
+-
+-mta_dontaudit_read_spool_symlinks(svirt_lxc_domain)
 +optional_policy(`
 +	udev_read_pid_files(svirt_sandbox_domain)
 +')
-+
-+optional_policy(`
+ 
+ optional_policy(`
+-	udev_read_pid_files(svirt_lxc_domain)
 +	userhelper_dontaudit_write_config(svirt_sandbox_domain)
 +')
 +
@@ -111738,9 +111796,11 @@ index f03dcf5..d15b4d3 100644
 +	fs_manage_cifs_dirs(svirt_sandbox_domain)
 +	fs_manage_cifs_named_sockets(svirt_sandbox_domain)
 +	fs_manage_cifs_symlinks(svirt_sandbox_domain)
-+')
-+
-+optional_policy(`
+ ')
+ 
+ optional_policy(`
+-	apache_exec_modules(svirt_lxc_domain)
+-	apache_read_sys_content(svirt_lxc_domain)
 +    #docker_read_share_files(svirt_sandbox_domain)
 +    #docker_lib_filetrans(svirt_sandbox_domain,svirt_sandbox_file_t, sock_file)
 +    #docker_use_ptys(svirt_sandbox_domain)
@@ -111903,13 +111963,13 @@ index f03dcf5..d15b4d3 100644
 +dev_read_urand(svirt_qemu_net_t)
 +
 +files_read_kernel_modules(svirt_qemu_net_t)
- 
--allow svirt_prot_exec_t self:process { execmem execstack };
++
 +fs_noxattr_type(svirt_sandbox_file_t)
 +fs_mount_cgroup(svirt_qemu_net_t)
 +fs_manage_cgroup_dirs(svirt_qemu_net_t)
 +fs_manage_cgroup_files(svirt_qemu_net_t)
-+
+ 
+-allow svirt_prot_exec_t self:process { execmem execstack };
 +term_pty(svirt_sandbox_file_t)
 +
 +auth_use_nsswitch(svirt_qemu_net_t)
@@ -111964,8 +112024,13 @@ index f03dcf5..d15b4d3 100644
  allow virt_bridgehelper_t self:process { setcap getcap };
  allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
  allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
-@@ -1207,5 +1535,242 @@ kernel_read_network_state(virt_bridgehelper_t)
+@@ -1205,7 +1533,247 @@ manage_files_pattern(virt_bridgehelper_t, svirt_home_t, svirt_home_t)
  
+ kernel_read_network_state(virt_bridgehelper_t)
+ 
++dev_read_urand(virt_bridgehelper_t)
++dev_read_rand(virt_bridgehelper_t)
++
  corenet_rw_tun_tap_dev(virt_bridgehelper_t)
  
 -userdom_search_user_home_dirs(virt_bridgehelper_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index b9d3761..1f240c6 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 152%{?dist}
+Release: 153%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -656,6 +656,24 @@ exit 0
 %endif
 
 %changelog
+* Tue Oct 13 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-153
+- Allow abrt_t to read sysctl_net_t files. BZ(#1194280)
+- Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
+- Add abrt_stub interface.
+- Add support for new mock location - /usr/libexec/mock/mock. BZ(#1270972)
+- Allow usbmuxd to access /run/udev/data/+usb:*. BZ(#1269633)
+- Allow qemu-bridge-helper to read /dev/random and /dev/urandom. BZ(#1267217)
+- Allow sssd_t to manage samba var files/dirs to SSSD's GPO support which is enabled against an Active Directory domain. BZ(#1225200).
+- Add samba_manage_var_dirs() interface.
+- Allow pcp_pmlogger to exec bin_t BZ(#1258698)
+- Allow spamd to read system network state. BZ(1260234)
+- Allow fcoemon to create netlink scsitransport sockets BZ(#1260882)
+- Allow networkmanager to create networkmanager_var_lib_t files. BZ(1270201)
+- Allow systemd-networkd to read XEN state for Xen hypervisor. BZ(#1269916)
+- Add fs_read_xenfs_files() interface.
+- Allow systemd_machined_t to send dbus msgs to all users and read/write /dev/ptmx to make 'machinectl shell' working correctly.
+- Allow systemd running as init_t to override the default context for key creation. BZ(#1267850)
+
 * Thu Oct 08 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-152
 - Allow pcp_pmlogger to read system state. BZ(1258699)
 - Allow cupsd to connect on socket. BZ(1258089)