diff --git a/.gitignore b/.gitignore
index 5b78d2a..02281dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -366,3 +366,4 @@ serefpolicy*
 /selinux-policy-6ed8a72.tar.gz
 /selinux-policy-contrib-5a0561d.tar.gz
 /selinux-policy-54c05f2.tar.gz
+/selinux-policy-088381c.tar.gz
diff --git a/selinux-policy.spec b/selinux-policy.spec
index c767785..0967f7d 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -1,6 +1,6 @@
 # github repo with selinux-policy base sources
 %global git0 https://github.com/fedora-selinux/selinux-policy
-%global commit0 54c05f2645a660c545ec406558b42687df2552a7
+%global commit0 088381c4e36d3b4d4b289ac27a2a2a97f953585e
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 # github repo with selinux-policy contrib sources
@@ -29,7 +29,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.14.4
-Release: 13%{?dist}
+Release: 14%{?dist}
 License: GPLv2+
 Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
 Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz
@@ -787,6 +787,9 @@ exit 0
 %endif
 
 %changelog
+* Fri Apr 26 2019 Lukas Vrabec <lvrabec@redhat.com> - 3.14.4-14
+- Allow transition from cockpit_session to unpriv user domains
+
 * Thu Apr 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 3.14.4-13
 - Introduce deny_bluetooth boolean
 - Allow greylist_milter_t to read network system state BZ(1702672)
diff --git a/sources b/sources
index aa2b52e..ca94ffb 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (selinux-policy-contrib-5a0561d.tar.gz) = 40ac186675b0c3633263165ecc409f9b36752d74e9c699a637f0a56e6a9162bf6be89b4a2a081e331accabaf82d2d36f260804a0743993a64d0425b3fd3dd0cd
-SHA512 (selinux-policy-54c05f2.tar.gz) = 1ff1a1e7931e107f8f53952428b8abd1b4ec4997463132ad2255afd08f6b6bc240722d07b0a132492ab4f33fac7af14725c440c6d6c959c8b8afe9ad194ee2d4
-SHA512 (container-selinux.tgz) = e17ae54aa1899b413b79f02d95e188a575111f88b723e2b38331da056260c342228fb47b8b85963e8312844e1b0e4f7fe22c3a6cc2c204126c6cdff952425842
+SHA512 (selinux-policy-088381c.tar.gz) = 831d10631a6f70ebe44b1ad9057326a58be6fd71e4261f58c4d8e8cb1dfa7905653c2bbfec7ee23feda749f2a5067b5c41d3331145e56d5d3bfe2cc309ee02e5
+SHA512 (container-selinux.tgz) = f3813f79fdddda9bba892035f0ed530a835c8db9f791bf83c6afb25868e0b575a88132f7021b20604f5144bfd40a00fb0076107c962a8857f319f86381db3ea2
 SHA512 (macro-expander) = b4f26e7ed6c32b3d7b3f1244e549a0e68cb387ab5276c4f4e832a9a6b74b08bea2234e8064549d47d1b272dbd22ef0f7c6b94cd307cc31ab872f9b68206021b2