diff --git a/container-selinux.tgz b/container-selinux.tgz
index af9d4ac..3861472 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index de2489e..ecefc64 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -3855,7 +3855,7 @@ index 759016583..1b9a61d18 100644
+ fs_mounton_fusefs(seunshare_domain)
')
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 33e0f8dad..1eb3faaa3 100644
+index 33e0f8dad..6fd767031 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -1,9 +1,10 @@
@@ -3912,19 +3912,23 @@ index 33e0f8dad..1eb3faaa3 100644
/etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -101,11 +118,8 @@ ifdef(`distro_redhat',`
+@@ -99,13 +116,12 @@ ifdef(`distro_redhat',`
- /etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0)
+ /etc/racoon/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
+-/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0)
++/etc/init\.d/vboxdrv.* gen_context(system_u:object_r:bin_t,s0)
-/etc/security/namespace.init -- gen_context(system_u:object_r:bin_t,s0)
--
++/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0)
+
/etc/sysconfig/crond -- gen_context(system_u:object_r:bin_t,s0)
/etc/sysconfig/init -- gen_context(system_u:object_r:bin_t,s0)
-/etc/sysconfig/libvirtd -- gen_context(system_u:object_r:bin_t,s0)
/etc/sysconfig/netconsole -- gen_context(system_u:object_r:bin_t,s0)
/etc/sysconfig/readonly-root -- gen_context(system_u:object_r:bin_t,s0)
-@@ -116,6 +130,9 @@ ifdef(`distro_redhat',`
+@@ -116,6 +132,9 @@ ifdef(`distro_redhat',`
/etc/vmware-tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -3934,7 +3938,7 @@ index 33e0f8dad..1eb3faaa3 100644
/etc/X11/xdm/GiveConsole -- gen_context(system_u:object_r:bin_t,s0)
/etc/X11/xdm/TakeConsole -- gen_context(system_u:object_r:bin_t,s0)
/etc/X11/xdm/Xsetup_0 -- gen_context(system_u:object_r:bin_t,s0)
-@@ -128,6 +145,8 @@ ifdef(`distro_debian',`
+@@ -128,6 +147,8 @@ ifdef(`distro_debian',`
/etc/mysql/debian-start -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -3943,7 +3947,7 @@ index 33e0f8dad..1eb3faaa3 100644
#
# /lib
#
-@@ -135,10 +154,12 @@ ifdef(`distro_debian',`
+@@ -135,10 +156,12 @@ ifdef(`distro_debian',`
/lib/nut/.* -- gen_context(system_u:object_r:bin_t,s0)
/lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0)
/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
@@ -3957,7 +3961,7 @@ index 33e0f8dad..1eb3faaa3 100644
ifdef(`distro_gentoo',`
/lib/dhcpcd/dhcpcd-run-hooks -- gen_context(system_u:object_r:bin_t,s0)
-@@ -149,10 +170,12 @@ ifdef(`distro_gentoo',`
+@@ -149,10 +172,12 @@ ifdef(`distro_gentoo',`
/lib/rcscripts/net\.modules\.d/helpers\.d/udhcpc-.* -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -3971,7 +3975,7 @@ index 33e0f8dad..1eb3faaa3 100644
/sbin/.* gen_context(system_u:object_r:bin_t,s0)
/sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
/sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
-@@ -168,6 +191,7 @@ ifdef(`distro_gentoo',`
+@@ -168,6 +193,7 @@ ifdef(`distro_gentoo',`
/opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/opt/google/talkplugin(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -3979,7 +3983,7 @@ index 33e0f8dad..1eb3faaa3 100644
/opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -179,34 +203,50 @@ ifdef(`distro_gentoo',`
+@@ -179,34 +205,50 @@ ifdef(`distro_gentoo',`
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -4039,7 +4043,7 @@ index 33e0f8dad..1eb3faaa3 100644
/usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -218,19 +258,32 @@ ifdef(`distro_gentoo',`
+@@ -218,19 +260,32 @@ ifdef(`distro_gentoo',`
/usr/lib/mailman/mail(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0)
/usr/lib/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
@@ -4079,7 +4083,7 @@ index 33e0f8dad..1eb3faaa3 100644
/usr/lib/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/xfce4/exo-1/exo-helper-1 -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/xfce4/panel/migrate -- gen_context(system_u:object_r:bin_t,s0)
-@@ -245,26 +298,41 @@ ifdef(`distro_gentoo',`
+@@ -245,26 +300,41 @@ ifdef(`distro_gentoo',`
/usr/lib/debug/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/debug/usr/bin(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/debug/usr/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
@@ -4126,7 +4130,7 @@ index 33e0f8dad..1eb3faaa3 100644
/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0)
-@@ -280,10 +348,14 @@ ifdef(`distro_gentoo',`
+@@ -280,10 +350,14 @@ ifdef(`distro_gentoo',`
/usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
@@ -4141,7 +4145,7 @@ index 33e0f8dad..1eb3faaa3 100644
/usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0)
-@@ -298,16 +370,22 @@ ifdef(`distro_gentoo',`
+@@ -298,16 +372,22 @@ ifdef(`distro_gentoo',`
/usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0)
@@ -4166,7 +4170,7 @@ index 33e0f8dad..1eb3faaa3 100644
ifdef(`distro_debian',`
/usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0)
-@@ -325,20 +403,27 @@ ifdef(`distro_redhat', `
+@@ -325,20 +405,27 @@ ifdef(`distro_redhat', `
/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0)
/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
@@ -4195,7 +4199,7 @@ index 33e0f8dad..1eb3faaa3 100644
/usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -346,6 +431,7 @@ ifdef(`distro_redhat', `
+@@ -346,6 +433,7 @@ ifdef(`distro_redhat', `
/usr/share/ssl/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/switchdesk/switchdesk-gui\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-date/system-config-date\.py -- gen_context(system_u:object_r:bin_t,s0)
@@ -4203,7 +4207,7 @@ index 33e0f8dad..1eb3faaa3 100644
/usr/share/system-config-selinux/polgen\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-selinux/system-config-selinux\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/system-config-display/system-config-display -- gen_context(system_u:object_r:bin_t,s0)
-@@ -387,17 +473,36 @@ ifdef(`distro_suse', `
+@@ -387,17 +475,36 @@ ifdef(`distro_suse', `
#
# /var
#
@@ -11422,7 +11426,7 @@ index 0b1a8715a..849b00191 100644
+dev_getattr_all(devices_unconfined_type)
+
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
-index 6a1e4d156..4b87be8e4 100644
+index 6a1e4d156..452a80549 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -76,33 +76,8 @@ interface(`domain_type',`
@@ -11670,7 +11674,7 @@ index 6a1e4d156..4b87be8e4 100644
## Unconfined access to domains.
## </summary>
## <param name="domain">
-@@ -1530,4 +1636,101 @@ interface(`domain_unconfined',`
+@@ -1530,4 +1636,102 @@ interface(`domain_unconfined',`
typeattribute $1 can_change_object_identity;
typeattribute $1 set_curr_context;
typeattribute $1 process_uncond_exempt;
@@ -11678,6 +11682,7 @@ index 6a1e4d156..4b87be8e4 100644
+ mcs_process_set_categories($1)
+
+ userdom_filetrans_home_content($1)
++ domain_named_filetrans($1)
+')
+
+########################################
@@ -12608,7 +12613,7 @@ index b876c48ad..2e591a538 100644
+
+/sysroot/ostree/deploy/.*-atomic/deploy(/.*)? gen_context(system_u:object_r:root_t,s0)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index f962f76ad..bb8b58852 100644
+index f962f76ad..74a6d0a54 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -19,6 +19,136 @@
@@ -13442,37 +13447,44 @@ index f962f76ad..bb8b58852 100644
## Do not audit attempts to set the attributes on all mount points.
## </summary>
## <param name="domain">
-@@ -1691,44 +2139,44 @@ interface(`files_dontaudit_list_all_mountpoints',`
+@@ -1691,6 +2139,24 @@ interface(`files_dontaudit_list_all_mountpoints',`
########################################
## <summary>
--## Do not audit attempts to write to mount points.
+## Write all mount points.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain to not audit.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`files_dontaudit_write_all_mountpoints',`
-- gen_require(`
-- attribute mountpoint;
-- ')
++## </summary>
++## </param>
++#
+interface(`files_write_all_mountpoints',`
+ gen_require(`
+ attribute mountpoint;
+ ')
-
-- dontaudit $1 mountpoint:dir write;
++
+ allow $1 mountpoint:dir write;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to write to mount points.
+ ## </summary>
+ ## <param name="domain">
+@@ -1703,104 +2169,233 @@ interface(`files_dontaudit_write_all_mountpoints',`
+ gen_require(`
+ attribute mountpoint;
+ ')
++ dontaudit $1 self:capability { dac_read_search };
+
+ dontaudit $1 mountpoint:dir write;
')
########################################
## <summary>
-## List the contents of the root directory.
-+## Do not audit attempts to write to mount points.
++## Do not audit attempts to unmount all mount points.
## </summary>
## <param name="domain">
## <summary>
@@ -13482,46 +13494,47 @@ index f962f76ad..bb8b58852 100644
## </param>
#
-interface(`files_list_root',`
-+interface(`files_dontaudit_write_all_mountpoints',`
++interface(`files_dontaudit_unmount_all_mountpoints',`
gen_require(`
- type root_t;
+ attribute mountpoint;
')
-+ dontaudit $1 self:capability { dac_read_search };
- allow $1 root_t:dir list_dir_perms;
- allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock };
-+ dontaudit $1 mountpoint:dir write;
++ dontaudit $1 mountpoint:filesystem unmount;
')
########################################
## <summary>
-## Do not audit attempts to write to / dirs.
-+## Do not audit attempts to unmount all mount points.
++## Read all mountpoint symbolic links.
## </summary>
## <param name="domain">
## <summary>
-@@ -1736,79 +2184,208 @@ interface(`files_list_root',`
+-## Domain to not audit.
++## Domain allowed access.
## </summary>
## </param>
#
-interface(`files_dontaudit_write_root_dirs',`
-+interface(`files_dontaudit_unmount_all_mountpoints',`
++interface(`files_read_all_mountpoint_symlinks',`
gen_require(`
- type root_t;
+ attribute mountpoint;
')
- dontaudit $1 root_t:dir write;
-+ dontaudit $1 mountpoint:filesystem unmount;
++ allow $1 mountpoint:lnk_file read_lnk_file_perms;
')
-###################
++
+########################################
## <summary>
-## Do not audit attempts to write
-## files in the root directory.
-+## Read all mountpoint symbolic links.
++## Make all mountpoint as entrypoint.
## </summary>
## <param name="domain">
## <summary>
@@ -13531,22 +13544,21 @@ index f962f76ad..bb8b58852 100644
## </param>
#
-interface(`files_dontaudit_rw_root_dir',`
-+interface(`files_read_all_mountpoint_symlinks',`
++interface(`files_entrypoint_all_mountpoint',`
gen_require(`
- type root_t;
+ attribute mountpoint;
')
- dontaudit $1 root_t:dir rw_dir_perms;
-+ allow $1 mountpoint:lnk_file read_lnk_file_perms;
++ allow $1 mountpoint:file entrypoint;
')
-+
########################################
## <summary>
-## Create an object in the root directory, with a private
-## type using a type transition.
-+## Make all mountpoint as entrypoint.
++## Remove all file type directories.
## </summary>
## <param name="domain">
## <summary>
@@ -13570,14 +13582,14 @@ index f962f76ad..bb8b58852 100644
-## </param>
#
-interface(`files_root_filetrans',`
-+interface(`files_entrypoint_all_mountpoint',`
++interface(`files_rmdir_all_dirs',`
gen_require(`
- type root_t;
-+ attribute mountpoint;
++ attribute file_type;
')
- filetrans_pattern($1, root_t, $2, $3, $4)
-+ allow $1 mountpoint:file entrypoint;
++ allow $1 file_type:dir rmdir;
')
########################################
@@ -13585,15 +13597,13 @@ index f962f76ad..bb8b58852 100644
-## Do not audit attempts to read files in
-## the root directory.
+## Write all file type directories.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain to not audit.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`files_dontaudit_read_root_files',`
++## </summary>
++## </param>
++#
+interface(`files_write_all_dirs',`
+ gen_require(`
+ attribute file_type;
@@ -13733,18 +13743,10 @@ index f962f76ad..bb8b58852 100644
+## <summary>
+## Do not audit attempts to read files in
+## the root directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`files_dontaudit_read_root_files',`
- gen_require(`
- type root_t;
- ')
-@@ -1892,25 +2469,25 @@ interface(`files_delete_root_dir_entry',`
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1892,25 +2487,25 @@ interface(`files_delete_root_dir_entry',`
########################################
## <summary>
@@ -13776,7 +13778,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1923,7 +2500,7 @@ interface(`files_relabel_rootfs',`
+@@ -1923,7 +2518,7 @@ interface(`files_relabel_rootfs',`
type root_t;
')
@@ -13785,7 +13787,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -1946,6 +2523,42 @@ interface(`files_unmount_rootfs',`
+@@ -1946,6 +2541,42 @@ interface(`files_unmount_rootfs',`
########################################
## <summary>
@@ -13828,7 +13830,7 @@ index f962f76ad..bb8b58852 100644
## Get attributes of the /boot directory.
## </summary>
## <param name="domain">
-@@ -2181,6 +2794,24 @@ interface(`files_relabelfrom_boot_files',`
+@@ -2181,6 +2812,24 @@ interface(`files_relabelfrom_boot_files',`
relabelfrom_files_pattern($1, boot_t, boot_t)
')
@@ -13853,7 +13855,7 @@ index f962f76ad..bb8b58852 100644
######################################
## <summary>
## Read symbolic links in the /boot directory.
-@@ -2557,6 +3188,24 @@ interface(`files_read_default_pipes',`
+@@ -2557,6 +3206,24 @@ interface(`files_read_default_pipes',`
########################################
## <summary>
@@ -13878,7 +13880,7 @@ index f962f76ad..bb8b58852 100644
## Search the contents of /etc directories.
## </summary>
## <param name="domain">
-@@ -2645,6 +3294,24 @@ interface(`files_rw_etc_dirs',`
+@@ -2645,6 +3312,24 @@ interface(`files_rw_etc_dirs',`
allow $1 etc_t:dir rw_dir_perms;
')
@@ -13903,7 +13905,7 @@ index f962f76ad..bb8b58852 100644
##########################################
## <summary>
## Manage generic directories in /etc
-@@ -2716,6 +3383,7 @@ interface(`files_read_etc_files',`
+@@ -2716,6 +3401,7 @@ interface(`files_read_etc_files',`
allow $1 etc_t:dir list_dir_perms;
read_files_pattern($1, etc_t, etc_t)
read_lnk_files_pattern($1, etc_t, etc_t)
@@ -13911,7 +13913,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -2724,7 +3392,7 @@ interface(`files_read_etc_files',`
+@@ -2724,7 +3410,7 @@ interface(`files_read_etc_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -13920,7 +13922,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## </param>
#
-@@ -2780,6 +3448,25 @@ interface(`files_manage_etc_files',`
+@@ -2780,6 +3466,25 @@ interface(`files_manage_etc_files',`
########################################
## <summary>
@@ -13946,7 +13948,7 @@ index f962f76ad..bb8b58852 100644
## Delete system configuration files in /etc.
## </summary>
## <param name="domain">
-@@ -2798,6 +3485,24 @@ interface(`files_delete_etc_files',`
+@@ -2798,6 +3503,24 @@ interface(`files_delete_etc_files',`
########################################
## <summary>
@@ -13971,7 +13973,7 @@ index f962f76ad..bb8b58852 100644
## Execute generic files in /etc.
## </summary>
## <param name="domain">
-@@ -2963,26 +3668,8 @@ interface(`files_delete_boot_flag',`
+@@ -2963,26 +3686,8 @@ interface(`files_delete_boot_flag',`
########################################
## <summary>
@@ -14000,7 +14002,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <desc>
## <p>
-@@ -3021,9 +3708,7 @@ interface(`files_read_etc_runtime_files',`
+@@ -3021,9 +3726,7 @@ interface(`files_read_etc_runtime_files',`
########################################
## <summary>
@@ -14011,7 +14013,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3031,18 +3716,17 @@ interface(`files_read_etc_runtime_files',`
+@@ -3031,18 +3734,17 @@ interface(`files_read_etc_runtime_files',`
## </summary>
## </param>
#
@@ -14033,7 +14035,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3060,6 +3744,26 @@ interface(`files_dontaudit_write_etc_runtime_files',`
+@@ -3060,6 +3762,26 @@ interface(`files_dontaudit_write_etc_runtime_files',`
########################################
## <summary>
@@ -14060,7 +14062,7 @@ index f962f76ad..bb8b58852 100644
## Read and write files in /etc that are dynamically
## created on boot, such as mtab.
## </summary>
-@@ -3077,6 +3781,7 @@ interface(`files_rw_etc_runtime_files',`
+@@ -3077,6 +3799,7 @@ interface(`files_rw_etc_runtime_files',`
allow $1 etc_t:dir list_dir_perms;
rw_files_pattern($1, etc_t, etc_runtime_t)
@@ -14068,7 +14070,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3098,6 +3803,7 @@ interface(`files_manage_etc_runtime_files',`
+@@ -3098,6 +3821,7 @@ interface(`files_manage_etc_runtime_files',`
')
manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t)
@@ -14076,7 +14078,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3142,10 +3848,48 @@ interface(`files_etc_filetrans_etc_runtime',`
+@@ -3142,10 +3866,48 @@ interface(`files_etc_filetrans_etc_runtime',`
#
interface(`files_getattr_isid_type_dirs',`
gen_require(`
@@ -14127,7 +14129,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3161,10 +3905,10 @@ interface(`files_getattr_isid_type_dirs',`
+@@ -3161,10 +3923,10 @@ interface(`files_getattr_isid_type_dirs',`
#
interface(`files_dontaudit_search_isid_type_dirs',`
gen_require(`
@@ -14140,7 +14142,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3180,10 +3924,10 @@ interface(`files_dontaudit_search_isid_type_dirs',`
+@@ -3180,10 +3942,10 @@ interface(`files_dontaudit_search_isid_type_dirs',`
#
interface(`files_list_isid_type_dirs',`
gen_require(`
@@ -14153,7 +14155,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3199,10 +3943,10 @@ interface(`files_list_isid_type_dirs',`
+@@ -3199,10 +3961,10 @@ interface(`files_list_isid_type_dirs',`
#
interface(`files_rw_isid_type_dirs',`
gen_require(`
@@ -14166,7 +14168,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3218,10 +3962,66 @@ interface(`files_rw_isid_type_dirs',`
+@@ -3218,10 +3980,66 @@ interface(`files_rw_isid_type_dirs',`
#
interface(`files_delete_isid_type_dirs',`
gen_require(`
@@ -14235,7 +14237,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3237,10 +4037,10 @@ interface(`files_delete_isid_type_dirs',`
+@@ -3237,10 +4055,10 @@ interface(`files_delete_isid_type_dirs',`
#
interface(`files_manage_isid_type_dirs',`
gen_require(`
@@ -14248,7 +14250,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3256,10 +4056,29 @@ interface(`files_manage_isid_type_dirs',`
+@@ -3256,10 +4074,29 @@ interface(`files_manage_isid_type_dirs',`
#
interface(`files_mounton_isid_type_dirs',`
gen_require(`
@@ -14280,7 +14282,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3275,10 +4094,10 @@ interface(`files_mounton_isid_type_dirs',`
+@@ -3275,10 +4112,10 @@ interface(`files_mounton_isid_type_dirs',`
#
interface(`files_read_isid_type_files',`
gen_require(`
@@ -14293,7 +14295,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3294,10 +4113,10 @@ interface(`files_read_isid_type_files',`
+@@ -3294,10 +4131,10 @@ interface(`files_read_isid_type_files',`
#
interface(`files_delete_isid_type_files',`
gen_require(`
@@ -14306,7 +14308,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3313,10 +4132,10 @@ interface(`files_delete_isid_type_files',`
+@@ -3313,10 +4150,10 @@ interface(`files_delete_isid_type_files',`
#
interface(`files_delete_isid_type_symlinks',`
gen_require(`
@@ -14319,7 +14321,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3332,10 +4151,10 @@ interface(`files_delete_isid_type_symlinks',`
+@@ -3332,10 +4169,10 @@ interface(`files_delete_isid_type_symlinks',`
#
interface(`files_delete_isid_type_fifo_files',`
gen_require(`
@@ -14332,7 +14334,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3351,10 +4170,10 @@ interface(`files_delete_isid_type_fifo_files',`
+@@ -3351,10 +4188,10 @@ interface(`files_delete_isid_type_fifo_files',`
#
interface(`files_delete_isid_type_sock_files',`
gen_require(`
@@ -14345,7 +14347,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3370,10 +4189,10 @@ interface(`files_delete_isid_type_sock_files',`
+@@ -3370,10 +4207,10 @@ interface(`files_delete_isid_type_sock_files',`
#
interface(`files_delete_isid_type_blk_files',`
gen_require(`
@@ -14358,7 +14360,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3389,10 +4208,10 @@ interface(`files_delete_isid_type_blk_files',`
+@@ -3389,10 +4226,10 @@ interface(`files_delete_isid_type_blk_files',`
#
interface(`files_dontaudit_write_isid_chr_files',`
gen_require(`
@@ -14371,7 +14373,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3408,10 +4227,10 @@ interface(`files_dontaudit_write_isid_chr_files',`
+@@ -3408,10 +4245,10 @@ interface(`files_dontaudit_write_isid_chr_files',`
#
interface(`files_delete_isid_type_chr_files',`
gen_require(`
@@ -14384,7 +14386,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3427,10 +4246,10 @@ interface(`files_delete_isid_type_chr_files',`
+@@ -3427,10 +4264,10 @@ interface(`files_delete_isid_type_chr_files',`
#
interface(`files_manage_isid_type_files',`
gen_require(`
@@ -14397,7 +14399,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3446,10 +4265,10 @@ interface(`files_manage_isid_type_files',`
+@@ -3446,10 +4283,10 @@ interface(`files_manage_isid_type_files',`
#
interface(`files_manage_isid_type_symlinks',`
gen_require(`
@@ -14410,7 +14412,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3465,10 +4284,29 @@ interface(`files_manage_isid_type_symlinks',`
+@@ -3465,10 +4302,29 @@ interface(`files_manage_isid_type_symlinks',`
#
interface(`files_rw_isid_type_blk_files',`
gen_require(`
@@ -14442,7 +14444,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3484,10 +4322,10 @@ interface(`files_rw_isid_type_blk_files',`
+@@ -3484,10 +4340,10 @@ interface(`files_rw_isid_type_blk_files',`
#
interface(`files_manage_isid_type_blk_files',`
gen_require(`
@@ -14455,7 +14457,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3503,10 +4341,29 @@ interface(`files_manage_isid_type_blk_files',`
+@@ -3503,10 +4359,29 @@ interface(`files_manage_isid_type_blk_files',`
#
interface(`files_manage_isid_type_chr_files',`
gen_require(`
@@ -14487,7 +14489,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3552,6 +4409,27 @@ interface(`files_dontaudit_getattr_home_dir',`
+@@ -3552,6 +4427,27 @@ interface(`files_dontaudit_getattr_home_dir',`
########################################
## <summary>
@@ -14515,7 +14517,7 @@ index f962f76ad..bb8b58852 100644
## Search home directories root (/home).
## </summary>
## <param name="domain">
-@@ -3814,20 +4692,38 @@ interface(`files_list_mnt',`
+@@ -3814,20 +4710,38 @@ interface(`files_list_mnt',`
######################################
## <summary>
@@ -14559,7 +14561,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -3921,6 +4817,45 @@ interface(`files_read_mnt_symlinks',`
+@@ -3921,6 +4835,45 @@ interface(`files_read_mnt_symlinks',`
read_lnk_files_pattern($1, mnt_t, mnt_t)
')
@@ -14605,7 +14607,7 @@ index f962f76ad..bb8b58852 100644
########################################
## <summary>
## Create, read, write, and delete symbolic links in /mnt.
-@@ -4012,6 +4947,7 @@ interface(`files_read_kernel_modules',`
+@@ -4012,6 +4965,7 @@ interface(`files_read_kernel_modules',`
allow $1 modules_object_t:dir list_dir_perms;
read_files_pattern($1, modules_object_t, modules_object_t)
read_lnk_files_pattern($1, modules_object_t, modules_object_t)
@@ -14613,7 +14615,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -4217,48 +5153,218 @@ interface(`files_read_world_readable_sockets',`
+@@ -4217,48 +5171,235 @@ interface(`files_read_world_readable_sockets',`
allow $1 readable_t:sock_file read_sock_file_perms;
')
@@ -14793,6 +14795,23 @@ index f962f76ad..bb8b58852 100644
+ files_filetrans_system_db_named_files($1)
+')
+
++######################################
++## <summary>
++## Map manageable system db files in /var/lib.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_map_system_db_files',`
++ gen_require(`
++ type system_db_t;
++ ')
++ allow $1 system_db_t:file map;
++')
++
+#####################################
+## <summary>
+## File name transition for system db files in /var/lib.
@@ -14858,7 +14877,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4266,6 +5372,45 @@ interface(`files_getattr_tmp_dirs',`
+@@ -4266,6 +5407,45 @@ interface(`files_getattr_tmp_dirs',`
## </summary>
## </param>
#
@@ -14904,7 +14923,7 @@ index f962f76ad..bb8b58852 100644
interface(`files_dontaudit_getattr_tmp_dirs',`
gen_require(`
type tmp_t;
-@@ -4289,6 +5434,8 @@ interface(`files_search_tmp',`
+@@ -4289,6 +5469,8 @@ interface(`files_search_tmp',`
type tmp_t;
')
@@ -14913,7 +14932,7 @@ index f962f76ad..bb8b58852 100644
allow $1 tmp_t:dir search_dir_perms;
')
-@@ -4325,6 +5472,7 @@ interface(`files_list_tmp',`
+@@ -4325,6 +5507,7 @@ interface(`files_list_tmp',`
type tmp_t;
')
@@ -14921,7 +14940,7 @@ index f962f76ad..bb8b58852 100644
allow $1 tmp_t:dir list_dir_perms;
')
-@@ -4334,7 +5482,7 @@ interface(`files_list_tmp',`
+@@ -4334,7 +5517,7 @@ interface(`files_list_tmp',`
## </summary>
## <param name="domain">
## <summary>
@@ -14930,7 +14949,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## </param>
#
-@@ -4346,6 +5494,25 @@ interface(`files_dontaudit_list_tmp',`
+@@ -4346,6 +5529,25 @@ interface(`files_dontaudit_list_tmp',`
dontaudit $1 tmp_t:dir list_dir_perms;
')
@@ -14956,7 +14975,7 @@ index f962f76ad..bb8b58852 100644
########################################
## <summary>
## Remove entries from the tmp directory.
-@@ -4361,6 +5528,7 @@ interface(`files_delete_tmp_dir_entry',`
+@@ -4361,6 +5563,7 @@ interface(`files_delete_tmp_dir_entry',`
type tmp_t;
')
@@ -14964,7 +14983,7 @@ index f962f76ad..bb8b58852 100644
allow $1 tmp_t:dir del_entry_dir_perms;
')
-@@ -4402,6 +5570,32 @@ interface(`files_manage_generic_tmp_dirs',`
+@@ -4402,6 +5605,32 @@ interface(`files_manage_generic_tmp_dirs',`
########################################
## <summary>
@@ -14997,7 +15016,7 @@ index f962f76ad..bb8b58852 100644
## Manage temporary files and directories in /tmp.
## </summary>
## <param name="domain">
-@@ -4456,6 +5650,42 @@ interface(`files_rw_generic_tmp_sockets',`
+@@ -4456,6 +5685,42 @@ interface(`files_rw_generic_tmp_sockets',`
########################################
## <summary>
@@ -15040,7 +15059,7 @@ index f962f76ad..bb8b58852 100644
## Set the attributes of all tmp directories.
## </summary>
## <param name="domain">
-@@ -4474,6 +5704,60 @@ interface(`files_setattr_all_tmp_dirs',`
+@@ -4474,6 +5739,60 @@ interface(`files_setattr_all_tmp_dirs',`
########################################
## <summary>
@@ -15101,7 +15120,7 @@ index f962f76ad..bb8b58852 100644
## List all tmp directories.
## </summary>
## <param name="domain">
-@@ -4519,7 +5803,7 @@ interface(`files_relabel_all_tmp_dirs',`
+@@ -4519,7 +5838,7 @@ interface(`files_relabel_all_tmp_dirs',`
## </summary>
## <param name="domain">
## <summary>
@@ -15110,7 +15129,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## </param>
#
-@@ -4579,7 +5863,7 @@ interface(`files_relabel_all_tmp_files',`
+@@ -4579,7 +5898,7 @@ interface(`files_relabel_all_tmp_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -15119,7 +15138,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## </param>
#
-@@ -4611,17 +5895,55 @@ interface(`files_read_all_tmp_files',`
+@@ -4611,20 +5930,58 @@ interface(`files_read_all_tmp_files',`
########################################
## <summary>
@@ -15131,10 +15150,15 @@ index f962f76ad..bb8b58852 100644
## <param name="domain">
## <summary>
-## Domain allowed access.
+-## </summary>
+-## </param>
+-## <param name="private type">
+-## <summary>
+-## The type of the object to be created.
+## Domain to not audit.
## </summary>
## </param>
--## <param name="private type">
+-## <param name="object">
+#
+interface(`files_dontaudit_tmp_file_leaks',`
+ gen_require(`
@@ -15150,8 +15174,7 @@ index f962f76ad..bb8b58852 100644
+## all leaked tmpfiles files.
+## </summary>
+## <param name="domain">
- ## <summary>
--## The type of the object to be created.
++## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
@@ -15177,10 +15200,13 @@ index f962f76ad..bb8b58852 100644
+## <param name="private type">
+## <summary>
+## The type of the object to be created.
++## </summary>
++## </param>
++## <param name="object">
+ ## <summary>
+ ## The object class of the object being created.
## </summary>
- ## </param>
- ## <param name="object">
-@@ -4664,6 +5986,16 @@ interface(`files_purge_tmp',`
+@@ -4664,6 +6021,16 @@ interface(`files_purge_tmp',`
delete_lnk_files_pattern($1, tmpfile, tmpfile)
delete_fifo_files_pattern($1, tmpfile, tmpfile)
delete_sock_files_pattern($1, tmpfile, tmpfile)
@@ -15197,7 +15223,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -4814,6 +6146,24 @@ interface(`files_delete_usr_files',`
+@@ -4814,6 +6181,24 @@ interface(`files_delete_usr_files',`
########################################
## <summary>
@@ -15222,7 +15248,7 @@ index f962f76ad..bb8b58852 100644
## Get the attributes of files in /usr.
## </summary>
## <param name="domain">
-@@ -5112,6 +6462,24 @@ interface(`files_create_kernel_symbol_table',`
+@@ -5112,6 +6497,24 @@ interface(`files_create_kernel_symbol_table',`
########################################
## <summary>
@@ -15247,7 +15273,7 @@ index f962f76ad..bb8b58852 100644
## Read system.map in the /boot directory.
## </summary>
## <param name="domain">
-@@ -5241,6 +6609,24 @@ interface(`files_list_var',`
+@@ -5241,6 +6644,24 @@ interface(`files_list_var',`
########################################
## <summary>
@@ -15272,7 +15298,7 @@ index f962f76ad..bb8b58852 100644
## Create, read, write, and delete directories
## in the /var directory.
## </summary>
-@@ -5328,7 +6714,7 @@ interface(`files_dontaudit_rw_var_files',`
+@@ -5328,7 +6749,7 @@ interface(`files_dontaudit_rw_var_files',`
type var_t;
')
@@ -15281,7 +15307,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -5419,6 +6805,24 @@ interface(`files_var_filetrans',`
+@@ -5419,6 +6840,24 @@ interface(`files_var_filetrans',`
filetrans_pattern($1, var_t, $2, $3, $4)
')
@@ -15306,7 +15332,7 @@ index f962f76ad..bb8b58852 100644
########################################
## <summary>
## Get the attributes of the /var/lib directory.
-@@ -5527,6 +6931,25 @@ interface(`files_rw_var_lib_dirs',`
+@@ -5527,6 +6966,25 @@ interface(`files_rw_var_lib_dirs',`
########################################
## <summary>
@@ -15332,7 +15358,7 @@ index f962f76ad..bb8b58852 100644
## Create objects in the /var/lib directory
## </summary>
## <param name="domain">
-@@ -5596,6 +7019,25 @@ interface(`files_read_var_lib_symlinks',`
+@@ -5596,6 +7054,25 @@ interface(`files_read_var_lib_symlinks',`
read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
')
@@ -15358,7 +15384,7 @@ index f962f76ad..bb8b58852 100644
# cjp: the next two interfaces really need to be fixed
# in some way. They really neeed their own types.
-@@ -5619,6 +7061,42 @@ interface(`files_manage_urandom_seed',`
+@@ -5619,6 +7096,42 @@ interface(`files_manage_urandom_seed',`
manage_files_pattern($1, var_lib_t, var_lib_t)
')
@@ -15401,7 +15427,7 @@ index f962f76ad..bb8b58852 100644
########################################
## <summary>
## Allow domain to manage mount tables
-@@ -5641,7 +7119,7 @@ interface(`files_manage_mounttab',`
+@@ -5641,7 +7154,7 @@ interface(`files_manage_mounttab',`
########################################
## <summary>
@@ -15410,7 +15436,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5649,12 +7127,13 @@ interface(`files_manage_mounttab',`
+@@ -5649,12 +7162,13 @@ interface(`files_manage_mounttab',`
## </summary>
## </param>
#
@@ -15426,7 +15452,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -5672,6 +7151,7 @@ interface(`files_search_locks',`
+@@ -5672,6 +7186,7 @@ interface(`files_search_locks',`
type var_t, var_lock_t;
')
@@ -15434,7 +15460,7 @@ index f962f76ad..bb8b58852 100644
allow $1 var_lock_t:lnk_file read_lnk_file_perms;
search_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5698,7 +7178,26 @@ interface(`files_dontaudit_search_locks',`
+@@ -5698,7 +7213,26 @@ interface(`files_dontaudit_search_locks',`
########################################
## <summary>
@@ -15462,7 +15488,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5706,13 +7205,12 @@ interface(`files_dontaudit_search_locks',`
+@@ -5706,13 +7240,12 @@ interface(`files_dontaudit_search_locks',`
## </summary>
## </param>
#
@@ -15479,7 +15505,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -5731,7 +7229,7 @@ interface(`files_rw_lock_dirs',`
+@@ -5731,7 +7264,7 @@ interface(`files_rw_lock_dirs',`
type var_t, var_lock_t;
')
@@ -15488,7 +15514,7 @@ index f962f76ad..bb8b58852 100644
rw_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5764,7 +7262,6 @@ interface(`files_create_lock_dirs',`
+@@ -5764,7 +7297,6 @@ interface(`files_create_lock_dirs',`
## Domain allowed access.
## </summary>
## </param>
@@ -15496,7 +15522,7 @@ index f962f76ad..bb8b58852 100644
#
interface(`files_relabel_all_lock_dirs',`
gen_require(`
-@@ -5779,7 +7276,7 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5779,7 +7311,7 @@ interface(`files_relabel_all_lock_dirs',`
########################################
## <summary>
@@ -15505,7 +15531,7 @@ index f962f76ad..bb8b58852 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5787,13 +7284,33 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5787,13 +7319,33 @@ interface(`files_relabel_all_lock_dirs',`
## </summary>
## </param>
#
@@ -15540,7 +15566,7 @@ index f962f76ad..bb8b58852 100644
allow $1 var_lock_t:dir list_dir_perms;
getattr_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5809,13 +7326,12 @@ interface(`files_getattr_generic_locks',`
+@@ -5809,13 +7361,12 @@ interface(`files_getattr_generic_locks',`
## </param>
#
interface(`files_delete_generic_locks',`
@@ -15558,7 +15584,7 @@ index f962f76ad..bb8b58852 100644
')
########################################
-@@ -5834,9 +7350,7 @@ interface(`files_manage_generic_locks',`
+@@ -5834,9 +7385,7 @@ interface(`files_manage_generic_locks',`
type var_t, var_lock_t;
')
@@ -15569,7 +15595,7 @@ index f962f76ad..bb8b58852 100644
manage_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5878,8 +7392,7 @@ interface(`files_read_all_locks',`
+@@ -5878,8 +7427,7 @@ interface(`files_read_all_locks',`
type var_t, var_lock_t;
')
@@ -15579,7 +15605,7 @@ index f962f76ad..bb8b58852 100644
allow $1 lockfile:dir list_dir_perms;
read_files_pattern($1, lockfile, lockfile)
read_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5901,8 +7414,7 @@ interface(`files_manage_all_locks',`
+@@ -5901,8 +7449,7 @@ interface(`files_manage_all_locks',`
type var_t, var_lock_t;
')
@@ -15589,7 +15615,7 @@ index f962f76ad..bb8b58852 100644
manage_dirs_pattern($1, lockfile, lockfile)
manage_files_pattern($1, lockfile, lockfile)
manage_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5939,8 +7451,7 @@ interface(`files_lock_filetrans',`
+@@ -5939,8 +7486,7 @@ interface(`files_lock_filetrans',`
type var_t, var_lock_t;
')
@@ -15599,7 +15625,7 @@ index f962f76ad..bb8b58852 100644
filetrans_pattern($1, var_lock_t, $2, $3, $4)
')
-@@ -5979,7 +7490,7 @@ interface(`files_setattr_pid_dirs',`
+@@ -5979,7 +7525,7 @@ interface(`files_setattr_pid_dirs',`
type var_run_t;
')
@@ -15608,7 +15634,7 @@ index f962f76ad..bb8b58852 100644
allow $1 var_run_t:dir setattr;
')
-@@ -5999,10 +7510,48 @@ interface(`files_search_pids',`
+@@ -5999,10 +7545,48 @@ interface(`files_search_pids',`
type var_t, var_run_t;
')
@@ -15657,69 +15683,101 @@ index f962f76ad..bb8b58852 100644
########################################
## <summary>
## Do not audit attempts to search
-@@ -6025,6 +7574,43 @@ interface(`files_dontaudit_search_pids',`
+@@ -6025,42 +7609,79 @@ interface(`files_dontaudit_search_pids',`
########################################
## <summary>
+-## List the contents of the runtime process
+-## ID directories (/var/run).
+## Do not audit attempts to search
+## the all /var/run directory.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_list_pids',`
++interface(`files_dontaudit_search_all_pids',`
+ gen_require(`
+- type var_t, var_run_t;
++ attribute pidfile;
+ ')
+
+- allow $1 var_run_t:lnk_file read_lnk_file_perms;
+- list_dirs_pattern($1, var_t, var_run_t)
++ dontaudit $1 pidfile:dir search_dir_perms;
+ ')
+
+ ########################################
+ ## <summary>
+-## Read generic process ID files.
++## Allow search the all /var/run directory.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_read_generic_pids',`
++interface(`files_search_all_pids',`
+ gen_require(`
+- type var_t, var_run_t;
++ attribute pidfile;
+ ')
+
+- allow $1 var_run_t:lnk_file read_lnk_file_perms;
+- list_dirs_pattern($1, var_t, var_run_t)
+- read_files_pattern($1, var_run_t, var_run_t)
++ allow $1 pidfile:dir search_dir_perms;
++')
++
++########################################
++## <summary>
++## List the contents of the runtime process
++## ID directories (/var/run).
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain to not audit.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`files_dontaudit_search_all_pids',`
++interface(`files_list_pids',`
+ gen_require(`
-+ attribute pidfile;
++ type var_t, var_run_t;
+ ')
+
-+ dontaudit $1 pidfile:dir search_dir_perms;
++ files_search_pids($1)
++ list_dirs_pattern($1, var_t, var_run_t)
+')
+
+########################################
+## <summary>
-+## Allow search the all /var/run directory.
++## Read generic process ID files.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain to not audit.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`files_search_all_pids',`
++interface(`files_read_generic_pids',`
+ gen_require(`
-+ attribute pidfile;
++ type var_t, var_run_t;
+ ')
+
-+ allow $1 pidfile:dir search_dir_perms;
-+')
-+
-+########################################
-+## <summary>
- ## List the contents of the runtime process
- ## ID directories (/var/run).
- ## </summary>
-@@ -6039,7 +7625,7 @@ interface(`files_list_pids',`
- type var_t, var_run_t;
- ')
-
-- allow $1 var_run_t:lnk_file read_lnk_file_perms;
+ files_search_pids($1)
- list_dirs_pattern($1, var_t, var_run_t)
++ list_dirs_pattern($1, var_t, var_run_t)
++ read_files_pattern($1, var_run_t, var_run_t)
')
-@@ -6058,7 +7644,7 @@ interface(`files_read_generic_pids',`
- type var_t, var_run_t;
- ')
-
-- allow $1 var_run_t:lnk_file read_lnk_file_perms;
-+ files_search_pids($1)
- list_dirs_pattern($1, var_t, var_run_t)
- read_files_pattern($1, var_run_t, var_run_t)
- ')
-@@ -6078,7 +7664,7 @@ interface(`files_write_generic_pid_pipes',`
+ ########################################
+@@ -6078,7 +7699,7 @@ interface(`files_write_generic_pid_pipes',`
type var_run_t;
')
@@ -15728,7 +15786,7 @@ index f962f76ad..bb8b58852 100644
allow $1 var_run_t:fifo_file write;
')
-@@ -6140,7 +7726,6 @@ interface(`files_pid_filetrans',`
+@@ -6140,7 +7761,6 @@ interface(`files_pid_filetrans',`
')
allow $1 var_t:dir search_dir_perms;
@@ -15736,7 +15794,7 @@ index f962f76ad..bb8b58852 100644
filetrans_pattern($1, var_run_t, $2, $3, $4)
')
-@@ -6169,6 +7754,24 @@ interface(`files_pid_filetrans_lock_dir',`
+@@ -6169,6 +7789,24 @@ interface(`files_pid_filetrans_lock_dir',`
########################################
## <summary>
@@ -15761,7 +15819,7 @@ index f962f76ad..bb8b58852 100644
## Read and write generic process ID files.
## </summary>
## <param name="domain">
-@@ -6182,7 +7785,7 @@ interface(`files_rw_generic_pids',`
+@@ -6182,7 +7820,7 @@ interface(`files_rw_generic_pids',`
type var_t, var_run_t;
')
@@ -15770,221 +15828,307 @@ index f962f76ad..bb8b58852 100644
list_dirs_pattern($1, var_t, var_run_t)
rw_files_pattern($1, var_run_t, var_run_t)
')
-@@ -6249,6 +7852,116 @@ interface(`files_dontaudit_ioctl_all_pids',`
+@@ -6249,55 +7887,43 @@ interface(`files_dontaudit_ioctl_all_pids',`
########################################
## <summary>
+-## Read all process ID files.
+## Relable all pid directories
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <rolecap/>
+ #
+-interface(`files_read_all_pids',`
+interface(`files_relabel_all_pid_dirs',`
-+ gen_require(`
-+ attribute pidfile;
-+ ')
-+
+ gen_require(`
+ attribute pidfile;
+- type var_t, var_run_t;
+ ')
+
+- allow $1 var_run_t:lnk_file read_lnk_file_perms;
+- list_dirs_pattern($1, var_t, pidfile)
+- read_files_pattern($1, pidfile, pidfile)
+ relabel_dirs_pattern($1, pidfile, pidfile)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Delete all process IDs.
+## Delete all pid sockets
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <rolecap/>
+ #
+-interface(`files_delete_all_pids',`
+interface(`files_delete_all_pid_sockets',`
-+ gen_require(`
-+ attribute pidfile;
-+ ')
-+
+ gen_require(`
+ attribute pidfile;
+- type var_t, var_run_t;
+ ')
+
+- allow $1 var_t:dir search_dir_perms;
+- allow $1 var_run_t:lnk_file read_lnk_file_perms;
+- allow $1 var_run_t:dir rmdir;
+- allow $1 var_run_t:lnk_file delete_lnk_file_perms;
+- delete_files_pattern($1, pidfile, pidfile)
+- delete_fifo_files_pattern($1, pidfile, pidfile)
+- delete_sock_files_pattern($1, pidfile, { pidfile var_run_t })
+ allow $1 pidfile:sock_file delete_sock_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Delete all process ID directories.
+## Create all pid sockets
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6305,42 +7931,35 @@ interface(`files_delete_all_pids',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_delete_all_pid_dirs',`
+interface(`files_create_all_pid_sockets',`
-+ gen_require(`
-+ attribute pidfile;
-+ ')
-+
+ gen_require(`
+ attribute pidfile;
+- type var_t, var_run_t;
+ ')
+
+- allow $1 var_t:dir search_dir_perms;
+- allow $1 var_run_t:lnk_file read_lnk_file_perms;
+- delete_dirs_pattern($1, pidfile, pidfile)
+ allow $1 pidfile:sock_file create_sock_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Create, read, write and delete all
+-## var_run (pid) content
+## Create all pid named pipes
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain alloed access.
+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_manage_all_pids',`
+interface(`files_create_all_pid_pipes',`
-+ gen_require(`
-+ attribute pidfile;
-+ ')
-+
+ gen_require(`
+ attribute pidfile;
+ ')
+
+- manage_dirs_pattern($1, pidfile, pidfile)
+- manage_files_pattern($1, pidfile, pidfile)
+- manage_lnk_files_pattern($1, pidfile, pidfile)
+ allow $1 pidfile:fifo_file create_fifo_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Mount filesystems on all polyinstantiation
+-## member directories.
+## Delete all pid named pipes
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6348,18 +7967,18 @@ interface(`files_manage_all_pids',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_mounton_all_poly_members',`
+interface(`files_delete_all_pid_pipes',`
-+ gen_require(`
+ gen_require(`
+- attribute polymember;
+ attribute pidfile;
-+ ')
-+
+ ')
+
+- allow $1 polymember:dir mounton;
+ allow $1 pidfile:fifo_file delete_fifo_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Search the contents of generic spool
+-## directories (/var/spool).
+## manage all pidfile directories
+## in the /var/run directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6367,37 +7986,40 @@ interface(`files_mounton_all_poly_members',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_search_spool',`
+interface(`files_manage_all_pid_dirs',`
-+ gen_require(`
+ gen_require(`
+- type var_t, var_spool_t;
+ attribute pidfile;
-+ ')
-+
+ ')
+
+- search_dirs_pattern($1, var_t, var_spool_t)
+ manage_dirs_pattern($1,pidfile,pidfile)
-+')
-+
+ ')
+
+
-+########################################
-+## <summary>
- ## Read all process ID files.
+ ########################################
+ ## <summary>
+-## Do not audit attempts to search generic
+-## spool directories.
++## Read all process ID files.
## </summary>
## <param name="domain">
-@@ -6261,12 +7974,105 @@ interface(`files_dontaudit_ioctl_all_pids',`
- interface(`files_read_all_pids',`
+ ## <summary>
+-## Domain to not audit.
++## Domain allowed access.
+ ## </summary>
+ ## </param>
++## <rolecap/>
+ #
+-interface(`files_dontaudit_search_spool',`
++interface(`files_read_all_pids',`
gen_require(`
- attribute pidfile;
-- type var_t, var_run_t;
+- type var_spool_t;
++ attribute pidfile;
+ type var_t;
')
-- allow $1 var_run_t:lnk_file read_lnk_file_perms;
- list_dirs_pattern($1, var_t, pidfile)
- read_files_pattern($1, pidfile, pidfile)
+- dontaudit $1 var_spool_t:dir search_dir_perms;
++ list_dirs_pattern($1, var_t, pidfile)
++ read_files_pattern($1, pidfile, pidfile)
+ read_lnk_files_pattern($1, pidfile, pidfile)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## List the contents of generic spool
+-## (/var/spool) directories.
+## Relable all pid files
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6405,18 +8027,17 @@ interface(`files_dontaudit_search_spool',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_list_spool',`
+interface(`files_relabel_all_pid_files',`
-+ gen_require(`
+ gen_require(`
+- type var_t, var_spool_t;
+ attribute pidfile;
-+ ')
-+
+ ')
+
+- list_dirs_pattern($1, var_t, var_spool_t)
+ relabel_files_pattern($1, pidfile, pidfile)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Create, read, write, and delete generic
+-## spool directories (/var/spool).
+## Execute generic programs in /var/run in the caller domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6424,18 +8045,18 @@ interface(`files_list_spool',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_manage_generic_spool_dirs',`
+interface(`files_exec_generic_pid_files',`
-+ gen_require(`
+ gen_require(`
+- type var_t, var_spool_t;
+ type var_run_t;
-+ ')
-+
+ ')
+
+- allow $1 var_t:dir search_dir_perms;
+- manage_dirs_pattern($1, var_spool_t, var_spool_t)
+ exec_files_pattern($1, var_run_t, var_run_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read generic spool files.
+## Write all sockets
+## in the /var/run directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6443,19 +8064,18 @@ interface(`files_manage_generic_spool_dirs',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_read_generic_spool',`
+interface(`files_write_all_pid_sockets',`
-+ gen_require(`
+ gen_require(`
+- type var_t, var_spool_t;
+ attribute pidfile;
-+ ')
-+
+ ')
+
+- list_dirs_pattern($1, var_t, var_spool_t)
+- read_files_pattern($1, var_spool_t, var_spool_t)
+ allow $1 pidfile:sock_file write_sock_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Create, read, write, and delete generic
+-## spool files.
+## manage all pidfiles
+## in the /var/run directory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6463,55 +8083,62 @@ interface(`files_read_generic_spool',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_manage_generic_spool',`
+interface(`files_manage_all_pids',`
-+ gen_require(`
+ gen_require(`
+- type var_t, var_spool_t;
+ attribute pidfile;
-+ ')
-+
+ ')
+
+- allow $1 var_t:dir search_dir_perms;
+- manage_files_pattern($1, var_spool_t, var_spool_t)
+ manage_files_pattern($1,pidfile,pidfile)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Create objects in the spool directory
+-## with a private type with a type transition.
+## Mount filesystems on all polyinstantiation
+## member directories.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-## <param name="file">
+-## <summary>
+-## Type to which the created node will be transitioned.
+-## </summary>
+-## </param>
+-## <param name="class">
+-## <summary>
+-## Object class(es) (single or set including {}) for which this
+-## the transition will occur.
+-## </summary>
+-## </param>
+-## <param name="name" optional="true">
+#
+interface(`files_mounton_all_poly_members',`
+ gen_require(`
@@ -15992,36 +16136,107 @@ index f962f76ad..bb8b58852 100644
+ ')
+
+ allow $1 polymember:dir mounton;
- ')
-
- ########################################
-@@ -6286,8 +8092,8 @@ interface(`files_delete_all_pids',`
- type var_t, var_run_t;
++')
++
++########################################
++## <summary>
++## Delete all process IDs.
++## </summary>
++## <param name="domain">
+ ## <summary>
+-## The name of the object being created.
++## Domain allowed access.
+ ## </summary>
+ ## </param>
++## <rolecap/>
+ #
+-interface(`files_spool_filetrans',`
++interface(`files_delete_all_pids',`
+ gen_require(`
+- type var_t, var_spool_t;
++ attribute pidfile;
++ type var_t, var_run_t;
')
+ files_search_pids($1)
allow $1 var_t:dir search_dir_perms;
-- allow $1 var_run_t:lnk_file read_lnk_file_perms;
- allow $1 var_run_t:dir rmdir;
- allow $1 var_run_t:lnk_file delete_lnk_file_perms;
- delete_files_pattern($1, pidfile, pidfile)
-@@ -6311,36 +8117,80 @@ interface(`files_delete_all_pid_dirs',`
- type var_t, var_run_t;
+- filetrans_pattern($1, var_spool_t, $2, $3, $4)
++ allow $1 var_run_t:dir rmdir;
++ allow $1 var_run_t:lnk_file delete_lnk_file_perms;
++ delete_files_pattern($1, pidfile, pidfile)
++ delete_fifo_files_pattern($1, pidfile, pidfile)
++ delete_sock_files_pattern($1, pidfile, { pidfile var_run_t })
+ ')
+
+ ########################################
+ ## <summary>
+-## Allow access to manage all polyinstantiated
+-## directories on the system.
++## Delete all process ID directories.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -6519,64 +8146,963 @@ interface(`files_spool_filetrans',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`files_polyinstantiate_all',`
++interface(`files_delete_all_pid_dirs',`
+ gen_require(`
+- attribute polydir, polymember, polyparent;
+- type poly_t;
++ attribute pidfile;
++ type var_t, var_run_t;
')
+- # Need to give access to /selinux/member
+- selinux_compute_member($1)
+-
+- # Need sys_admin capability for mounting
+- allow $1 self:capability { chown fsetid sys_admin fowner };
+-
+- # Need to give access to the directories to be polyinstantiated
+- allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
+-
+- # Need to give access to the polyinstantiated subdirectories
+- allow $1 polymember:dir search_dir_perms;
+-
+- # Need to give access to parent directories where original
+- # is remounted for polyinstantiation aware programs (like gdm)
+- allow $1 polyparent:dir { getattr mounton };
+-
+- # Need to give permission to create directories where applicable
+- allow $1 self:process setfscreate;
+- allow $1 polymember: dir { create setattr relabelto };
+- allow $1 polydir: dir { write add_name open };
+- allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto };
+-
+- # Default type for mountpoints
+- allow $1 poly_t:dir { create mounton };
+- fs_unmount_xattr_fs($1)
+-
+- fs_mount_tmpfs($1)
+- fs_unmount_tmpfs($1)
+-
+- ifdef(`distro_redhat',`
+- # namespace.init
+- files_search_tmp($1)
+- files_search_home($1)
+- corecmd_exec_bin($1)
+- seutil_domtrans_setfiles($1)
+- ')
+ files_search_pids($1)
- allow $1 var_t:dir search_dir_perms;
-- allow $1 var_run_t:lnk_file read_lnk_file_perms;
- delete_dirs_pattern($1, pidfile, pidfile)
++ allow $1 var_t:dir search_dir_perms;
++ delete_dirs_pattern($1, pidfile, pidfile)
')
########################################
## <summary>
--## Create, read, write and delete all
--## var_run (pid) content
+-## Unconfined access to files.
+## Make the specified type a file
+## used for spool files.
-+## </summary>
+ ## </summary>
+-## <param name="domain">
+## <desc>
+## <p>
+## Make the specified type usable for spool files.
@@ -16049,18 +16264,22 @@ index f962f76ad..bb8b58852 100644
+## </p>
+## </desc>
+## <param name="file_type">
-+## <summary>
+ ## <summary>
+-## Domain allowed access.
+## Type of the file to be used as a
+## spool file.
-+## </summary>
-+## </param>
+ ## </summary>
+ ## </param>
+## <infoflow type="none"/>
-+#
+ #
+-interface(`files_unconfined',`
+interface(`files_spool_file',`
-+ gen_require(`
+ gen_require(`
+- attribute files_unconfined_type;
+ attribute spoolfile;
-+ ')
-+
+ ')
+
+- typeattribute $1 files_unconfined_type;
+ files_type($1)
+ typeattribute $1 spoolfile;
+')
@@ -16068,47 +16287,36 @@ index f962f76ad..bb8b58852 100644
+########################################
+## <summary>
+## Create all spool sockets
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain alloed access.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`files_manage_all_pids',`
++## </summary>
++## </param>
++#
+interface(`files_create_all_spool_sockets',`
- gen_require(`
-- attribute pidfile;
++ gen_require(`
+ attribute spoolfile;
- ')
-
-- manage_dirs_pattern($1, pidfile, pidfile)
-- manage_files_pattern($1, pidfile, pidfile)
-- manage_lnk_files_pattern($1, pidfile, pidfile)
++ ')
++
+ allow $1 spoolfile:sock_file create_sock_file_perms;
- ')
-
- ########################################
- ## <summary>
--## Mount filesystems on all polyinstantiation
--## member directories.
++')
++
++########################################
++## <summary>
+## Delete all spool sockets
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -6348,12 +8198,33 @@ interface(`files_manage_all_pids',`
- ## </summary>
- ## </param>
- #
--interface(`files_mounton_all_poly_members',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`files_delete_all_spool_sockets',`
- gen_require(`
-- attribute polymember;
++ gen_require(`
+ attribute spoolfile;
- ')
-
-- allow $1 polymember:dir mounton;
++ ')
++
+ allow $1 spoolfile:sock_file delete_sock_file_perms;
+')
+
@@ -16131,13 +16339,232 @@ index f962f76ad..bb8b58852 100644
+ ')
+
+ relabel_dirs_pattern($1, spoolfile, spoolfile)
- ')
-
- ########################################
-@@ -6580,3 +8451,623 @@ interface(`files_unconfined',`
-
- typeattribute $1 files_unconfined_type;
- ')
++')
++
++########################################
++## <summary>
++## Search the contents of generic spool
++## directories (/var/spool).
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_search_spool',`
++ gen_require(`
++ type var_t, var_spool_t;
++ ')
++
++ search_dirs_pattern($1, var_t, var_spool_t)
++')
++
++########################################
++## <summary>
++## Do not audit attempts to search generic
++## spool directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`files_dontaudit_search_spool',`
++ gen_require(`
++ type var_spool_t;
++ ')
++
++ dontaudit $1 var_spool_t:dir search_dir_perms;
++')
++
++########################################
++## <summary>
++## List the contents of generic spool
++## (/var/spool) directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_list_spool',`
++ gen_require(`
++ type var_t, var_spool_t;
++ ')
++
++ list_dirs_pattern($1, var_t, var_spool_t)
++')
++
++########################################
++## <summary>
++## Create, read, write, and delete generic
++## spool directories (/var/spool).
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_manage_generic_spool_dirs',`
++ gen_require(`
++ type var_t, var_spool_t;
++ ')
++
++ allow $1 var_t:dir search_dir_perms;
++ manage_dirs_pattern($1, var_spool_t, var_spool_t)
++')
++
++########################################
++## <summary>
++## Read generic spool files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_read_generic_spool',`
++ gen_require(`
++ type var_t, var_spool_t;
++ ')
++
++ list_dirs_pattern($1, var_t, var_spool_t)
++ read_files_pattern($1, var_spool_t, var_spool_t)
++')
++
++########################################
++## <summary>
++## Create, read, write, and delete generic
++## spool files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_manage_generic_spool',`
++ gen_require(`
++ type var_t, var_spool_t;
++ ')
++
++ allow $1 var_t:dir search_dir_perms;
++ manage_files_pattern($1, var_spool_t, var_spool_t)
++')
++
++########################################
++## <summary>
++## Create objects in the spool directory
++## with a private type with a type transition.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="file">
++## <summary>
++## Type to which the created node will be transitioned.
++## </summary>
++## </param>
++## <param name="class">
++## <summary>
++## Object class(es) (single or set including {}) for which this
++## the transition will occur.
++## </summary>
++## </param>
++## <param name="name" optional="true">
++## <summary>
++## The name of the object being created.
++## </summary>
++## </param>
++#
++interface(`files_spool_filetrans',`
++ gen_require(`
++ type var_t, var_spool_t;
++ ')
++
++ allow $1 var_t:dir search_dir_perms;
++ filetrans_pattern($1, var_spool_t, $2, $3, $4)
++')
++
++########################################
++## <summary>
++## Allow access to manage all polyinstantiated
++## directories on the system.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_polyinstantiate_all',`
++ gen_require(`
++ attribute polydir, polymember, polyparent;
++ type poly_t;
++ ')
++
++ # Need to give access to /selinux/member
++ selinux_compute_member($1)
++
++ # Need sys_admin capability for mounting
++ allow $1 self:capability { chown fsetid sys_admin fowner };
++
++ # Need to give access to the directories to be polyinstantiated
++ allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
++
++ # Need to give access to the polyinstantiated subdirectories
++ allow $1 polymember:dir search_dir_perms;
++
++ # Need to give access to parent directories where original
++ # is remounted for polyinstantiation aware programs (like gdm)
++ allow $1 polyparent:dir { getattr mounton };
++
++ # Need to give permission to create directories where applicable
++ allow $1 self:process setfscreate;
++ allow $1 polymember: dir { create setattr relabelto };
++ allow $1 polydir: dir { write add_name open };
++ allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto };
++
++ # Default type for mountpoints
++ allow $1 poly_t:dir { create mounton };
++ fs_unmount_xattr_fs($1)
++
++ fs_mount_tmpfs($1)
++ fs_unmount_tmpfs($1)
++
++ ifdef(`distro_redhat',`
++ # namespace.init
++ files_search_tmp($1)
++ files_search_home($1)
++ corecmd_exec_bin($1)
++ seutil_domtrans_setfiles($1)
++ ')
++')
++
++########################################
++## <summary>
++## Unconfined access to files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_unconfined',`
++ gen_require(`
++ attribute files_unconfined_type;
++ ')
++
++ typeattribute $1 files_unconfined_type;
++')
+
+########################################
+## <summary>
@@ -16757,7 +17184,7 @@ index f962f76ad..bb8b58852 100644
+ ')
+
+ allow $1 modules_object_t:dir mounton;
-+')
+ ')
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 1a03abdd7..3221f8018 100644
--- a/policy/modules/kernel/files.te
@@ -22775,7 +23202,7 @@ index e100d886b..355a67b18 100644
+')
+
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index 8dbab4c5e..2d283007a 100644
+index 8dbab4c5e..4818adb52 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -25,6 +25,9 @@ attribute kern_unconfined;
@@ -22866,8 +23293,11 @@ index 8dbab4c5e..2d283007a 100644
# /proc/sys/net directory and files
type sysctl_net_t, sysctl_type;
genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
-@@ -153,6 +176,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
+@@ -151,8 +174,13 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
+
+ # /proc/sys/vm directory and files
type sysctl_vm_t, sysctl_type;
++fs_associate(sysctl_vm_t)
genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
+# /proc/sys/vm/overcommit_memory
@@ -22877,7 +23307,7 @@ index 8dbab4c5e..2d283007a 100644
# /proc/sys/dev directory and files
type sysctl_dev_t, sysctl_type;
genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
-@@ -165,6 +192,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
+@@ -165,6 +193,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
type unlabeled_t;
fs_associate(unlabeled_t)
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -22892,7 +23322,7 @@ index 8dbab4c5e..2d283007a 100644
# These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
-@@ -189,6 +224,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
+@@ -189,6 +225,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
# kernel local policy
#
@@ -22900,7 +23330,7 @@ index 8dbab4c5e..2d283007a 100644
allow kernel_t self:capability ~sys_module;
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow kernel_t self:shm create_shm_perms;
-@@ -233,7 +269,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
+@@ -233,7 +270,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
corenet_in_generic_if(unlabeled_t)
corenet_in_generic_node(unlabeled_t)
@@ -22908,7 +23338,7 @@ index 8dbab4c5e..2d283007a 100644
corenet_all_recvfrom_netlabel(kernel_t)
# Kernel-generated traffic e.g., ICMP replies:
corenet_raw_sendrecv_all_if(kernel_t)
-@@ -244,17 +279,26 @@ corenet_tcp_sendrecv_all_if(kernel_t)
+@@ -244,17 +280,26 @@ corenet_tcp_sendrecv_all_if(kernel_t)
corenet_tcp_sendrecv_all_nodes(kernel_t)
corenet_raw_send_generic_node(kernel_t)
corenet_send_all_packets(kernel_t)
@@ -22939,7 +23369,7 @@ index 8dbab4c5e..2d283007a 100644
# Mount root file system. Used when loading a policy
# from initrd, then mounting the root filesystem
-@@ -263,7 +307,8 @@ fs_unmount_all_fs(kernel_t)
+@@ -263,7 +308,8 @@ fs_unmount_all_fs(kernel_t)
selinux_load_policy(kernel_t)
@@ -22949,7 +23379,7 @@ index 8dbab4c5e..2d283007a 100644
corecmd_exec_shell(kernel_t)
corecmd_list_bin(kernel_t)
-@@ -277,13 +322,23 @@ files_list_root(kernel_t)
+@@ -277,13 +323,23 @@ files_list_root(kernel_t)
files_list_etc(kernel_t)
files_list_home(kernel_t)
files_read_usr_files(kernel_t)
@@ -22973,7 +23403,7 @@ index 8dbab4c5e..2d283007a 100644
ifdef(`distro_redhat',`
# Bugzilla 222337
-@@ -291,11 +346,29 @@ ifdef(`distro_redhat',`
+@@ -291,11 +347,29 @@ ifdef(`distro_redhat',`
')
optional_policy(`
@@ -23003,7 +23433,7 @@ index 8dbab4c5e..2d283007a 100644
')
optional_policy(`
-@@ -305,6 +378,19 @@ optional_policy(`
+@@ -305,6 +379,19 @@ optional_policy(`
optional_policy(`
logging_send_syslog_msg(kernel_t)
@@ -23023,7 +23453,7 @@ index 8dbab4c5e..2d283007a 100644
')
optional_policy(`
-@@ -312,6 +398,11 @@ optional_policy(`
+@@ -312,6 +399,11 @@ optional_policy(`
')
optional_policy(`
@@ -23035,7 +23465,7 @@ index 8dbab4c5e..2d283007a 100644
# nfs kernel server needs kernel UDP access. It is less risky and painful
# to just give it everything.
allow kernel_t self:tcp_socket create_stream_socket_perms;
-@@ -332,9 +423,6 @@ optional_policy(`
+@@ -332,9 +424,6 @@ optional_policy(`
sysnet_read_config(kernel_t)
@@ -23045,7 +23475,7 @@ index 8dbab4c5e..2d283007a 100644
rpc_udp_rw_nfs_sockets(kernel_t)
tunable_policy(`nfs_export_all_ro',`
-@@ -343,9 +431,7 @@ optional_policy(`
+@@ -343,9 +432,7 @@ optional_policy(`
fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t)
@@ -23056,7 +23486,7 @@ index 8dbab4c5e..2d283007a 100644
')
tunable_policy(`nfs_export_all_rw',`
-@@ -354,7 +440,7 @@ optional_policy(`
+@@ -354,7 +441,7 @@ optional_policy(`
fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t)
@@ -23065,7 +23495,7 @@ index 8dbab4c5e..2d283007a 100644
')
')
-@@ -364,9 +450,22 @@ optional_policy(`
+@@ -364,9 +451,22 @@ optional_policy(`
')
optional_policy(`
@@ -23088,7 +23518,7 @@ index 8dbab4c5e..2d283007a 100644
########################################
#
# Unlabeled process local policy
-@@ -388,6 +487,8 @@ optional_policy(`
+@@ -388,6 +488,8 @@ optional_policy(`
if( ! secure_mode_insmod ) {
allow can_load_kernmodule self:capability sys_module;
@@ -23097,7 +23527,7 @@ index 8dbab4c5e..2d283007a 100644
# load_module() calls stop_machine() which
# calls sched_setscheduler()
allow can_load_kernmodule self:capability sys_nice;
-@@ -399,14 +500,38 @@ if( ! secure_mode_insmod ) {
+@@ -399,14 +501,38 @@ if( ! secure_mode_insmod ) {
# Rules for unconfined acccess to this module
#
@@ -32046,7 +32476,7 @@ index 6bf0ecc2d..75b2f31f9 100644
+')
+
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 8b403774f..0bdea37e9 100644
+index 8b403774f..f17b76dec 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -26,28 +26,66 @@ gen_require(`
@@ -32405,7 +32835,7 @@ index 8b403774f..0bdea37e9 100644
ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t)
ssh_dontaudit_rw_tcp_sockets(xauth_t)
-@@ -300,64 +420,108 @@ optional_policy(`
+@@ -300,64 +420,110 @@ optional_policy(`
# XDM Local policy
#
@@ -32438,11 +32868,13 @@ index 8b403774f..0bdea37e9 100644
+
+allow xdm_t xauth_home_t:file manage_file_perms;
+
++allow xdm_t xserver_unconfined_type:process { signull };
+
+-allow xdm_t xconsole_device_t:fifo_file { getattr setattr };
+allow xdm_t xconsole_device_t:fifo_file { getattr_fifo_file_perms setattr_fifo_file_perms };
+manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
+manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
-
--allow xdm_t xconsole_device_t:fifo_file { getattr setattr };
++
+manage_dirs_pattern(xdm_t, xdm_home_t, xdm_home_t)
+manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t)
+xserver_filetrans_home_content(xdm_t)
@@ -32499,12 +32931,12 @@ index 8b403774f..0bdea37e9 100644
manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
++exec_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+manage_lnk_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
-files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file })
+manage_sock_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file sock_file })
-+allow xdm_t xdm_var_run_t:file map;
-allow xdm_t xserver_t:process signal;
+allow xdm_t xserver_t:process { signal signull };
@@ -32527,7 +32959,7 @@ index 8b403774f..0bdea37e9 100644
# connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
-@@ -366,20 +530,31 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
+@@ -366,20 +532,32 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@@ -32552,6 +32984,7 @@ index 8b403774f..0bdea37e9 100644
+kernel_request_load_module(xdm_t)
+kernel_stream_connect(xdm_t)
+kernel_view_key(xdm_t)
++kernel_read_usermodehelper_state(xdm_t)
corecmd_exec_shell(xdm_t)
corecmd_exec_bin(xdm_t)
@@ -32561,7 +32994,7 @@ index 8b403774f..0bdea37e9 100644
corenet_all_recvfrom_netlabel(xdm_t)
corenet_tcp_sendrecv_generic_if(xdm_t)
corenet_udp_sendrecv_generic_if(xdm_t)
-@@ -389,38 +564,51 @@ corenet_tcp_sendrecv_all_ports(xdm_t)
+@@ -389,38 +567,51 @@ corenet_tcp_sendrecv_all_ports(xdm_t)
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
@@ -32617,7 +33050,7 @@ index 8b403774f..0bdea37e9 100644
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -431,9 +619,30 @@ files_list_mnt(xdm_t)
+@@ -431,9 +622,30 @@ files_list_mnt(xdm_t)
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
@@ -32648,7 +33081,7 @@ index 8b403774f..0bdea37e9 100644
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,28 +651,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
+@@ -442,28 +654,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -32704,7 +33137,7 @@ index 8b403774f..0bdea37e9 100644
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -472,24 +703,171 @@ userdom_read_user_home_content_files(xdm_t)
+@@ -472,24 +706,171 @@ userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -32882,7 +33315,7 @@ index 8b403774f..0bdea37e9 100644
tunable_policy(`xdm_sysadm_login',`
userdom_xsession_spec_domtrans_all_users(xdm_t)
# FIXME:
-@@ -502,12 +880,31 @@ tunable_policy(`xdm_sysadm_login',`
+@@ -502,12 +883,31 @@ tunable_policy(`xdm_sysadm_login',`
# allow xserver_t xdm_tmpfs_t:file rw_file_perms;
')
@@ -32914,7 +33347,7 @@ index 8b403774f..0bdea37e9 100644
')
optional_policy(`
-@@ -518,8 +915,36 @@ optional_policy(`
+@@ -518,8 +918,36 @@ optional_policy(`
dbus_system_bus_client(xdm_t)
dbus_connect_system_bus(xdm_t)
@@ -32933,7 +33366,8 @@ index 8b403774f..0bdea37e9 100644
+ cpufreqselector_dbus_chat(xdm_t)
+ ')
+
-+ optional_policy(`
+ optional_policy(`
+- accountsd_dbus_chat(xdm_t)
+ devicekit_dbus_chat_disk(xdm_t)
+ devicekit_dbus_chat_power(xdm_t)
+ ')
@@ -32942,8 +33376,7 @@ index 8b403774f..0bdea37e9 100644
+ hal_dbus_chat(xdm_t)
+ ')
+
- optional_policy(`
-- accountsd_dbus_chat(xdm_t)
++ optional_policy(`
+ gnomeclock_dbus_chat(xdm_t)
+ ')
+
@@ -32952,7 +33385,7 @@ index 8b403774f..0bdea37e9 100644
')
')
-@@ -530,6 +955,20 @@ optional_policy(`
+@@ -530,6 +958,20 @@ optional_policy(`
')
optional_policy(`
@@ -32973,7 +33406,7 @@ index 8b403774f..0bdea37e9 100644
hostname_exec(xdm_t)
')
-@@ -547,28 +986,78 @@ optional_policy(`
+@@ -547,28 +989,78 @@ optional_policy(`
')
optional_policy(`
@@ -33061,7 +33494,7 @@ index 8b403774f..0bdea37e9 100644
')
optional_policy(`
-@@ -580,6 +1069,14 @@ optional_policy(`
+@@ -580,6 +1072,14 @@ optional_policy(`
')
optional_policy(`
@@ -33076,7 +33509,7 @@ index 8b403774f..0bdea37e9 100644
xfs_stream_connect(xdm_t)
')
-@@ -594,7 +1091,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+@@ -594,7 +1094,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@@ -33085,7 +33518,7 @@ index 8b403774f..0bdea37e9 100644
# setuid/setgid for the wrapper program to change UID
# sys_rawio is for iopl access - should not be needed for frame-buffer
-@@ -604,8 +1101,11 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -604,8 +1104,11 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -33098,7 +33531,7 @@ index 8b403774f..0bdea37e9 100644
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
-@@ -618,8 +1118,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -618,8 +1121,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -33114,7 +33547,7 @@ index 8b403774f..0bdea37e9 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -627,36 +1134,53 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+@@ -627,36 +1137,53 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
@@ -33172,7 +33605,7 @@ index 8b403774f..0bdea37e9 100644
corenet_all_recvfrom_netlabel(xserver_t)
corenet_tcp_sendrecv_generic_if(xserver_t)
corenet_udp_sendrecv_generic_if(xserver_t)
-@@ -677,23 +1201,29 @@ dev_rw_apm_bios(xserver_t)
+@@ -677,23 +1204,29 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -33205,7 +33638,7 @@ index 8b403774f..0bdea37e9 100644
# brought on by rhgb
files_search_mnt(xserver_t)
-@@ -705,6 +1235,14 @@ fs_search_nfs(xserver_t)
+@@ -705,6 +1238,14 @@ fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -33220,7 +33653,7 @@ index 8b403774f..0bdea37e9 100644
mls_xwin_read_to_clearance(xserver_t)
selinux_validate_context(xserver_t)
-@@ -718,28 +1256,25 @@ init_getpgid(xserver_t)
+@@ -718,28 +1259,25 @@ init_getpgid(xserver_t)
term_setattr_unallocated_ttys(xserver_t)
term_use_unallocated_ttys(xserver_t)
@@ -33253,7 +33686,7 @@ index 8b403774f..0bdea37e9 100644
ifndef(`distro_redhat',`
allow xserver_t self:process { execmem execheap execstack };
-@@ -785,17 +1320,54 @@ optional_policy(`
+@@ -785,17 +1323,54 @@ optional_policy(`
')
optional_policy(`
@@ -33310,7 +33743,7 @@ index 8b403774f..0bdea37e9 100644
')
optional_policy(`
-@@ -803,6 +1375,10 @@ optional_policy(`
+@@ -803,6 +1378,10 @@ optional_policy(`
')
optional_policy(`
@@ -33321,7 +33754,7 @@ index 8b403774f..0bdea37e9 100644
xfs_stream_connect(xserver_t)
')
-@@ -818,18 +1394,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -818,18 +1397,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!!
@@ -33346,7 +33779,7 @@ index 8b403774f..0bdea37e9 100644
can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server
-@@ -842,26 +1417,21 @@ init_use_fds(xserver_t)
+@@ -842,26 +1420,21 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -33381,7 +33814,7 @@ index 8b403774f..0bdea37e9 100644
')
optional_policy(`
-@@ -912,7 +1482,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -912,7 +1485,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -33390,7 +33823,7 @@ index 8b403774f..0bdea37e9 100644
# operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
-@@ -966,11 +1536,31 @@ allow x_domain self:x_resource { read write };
+@@ -966,11 +1539,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr };
@@ -33422,7 +33855,7 @@ index 8b403774f..0bdea37e9 100644
tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals
-@@ -992,18 +1582,148 @@ tunable_policy(`! xserver_object_manager',`
+@@ -992,18 +1585,148 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *;
')
@@ -34801,7 +35234,7 @@ index 3efd5b669..a8cb6df3d 100644
+ allow $1 login_pgm:key manage_key_perms;
+')
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
-index 09b791dcc..78d158ca9 100644
+index 09b791dcc..498375fcf 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -5,6 +5,19 @@ policy_module(authlogin, 2.5.1)
@@ -34894,16 +35327,17 @@ index 09b791dcc..78d158ca9 100644
dontaudit chkpwd_t self:capability sys_tty_config;
allow chkpwd_t self:process { getattr signal };
-@@ -109,6 +131,8 @@ dev_read_urand(chkpwd_t)
+@@ -109,6 +131,9 @@ dev_read_urand(chkpwd_t)
files_read_etc_files(chkpwd_t)
# for nscd
files_dontaudit_search_var(chkpwd_t)
+files_read_usr_symlinks(chkpwd_t)
+files_list_tmp(chkpwd_t)
++files_map_system_db_files(chkpwd_t)
fs_dontaudit_getattr_xattr_fs(chkpwd_t)
-@@ -122,12 +146,11 @@ auth_use_nsswitch(chkpwd_t)
+@@ -122,12 +147,11 @@ auth_use_nsswitch(chkpwd_t)
logging_send_audit_msgs(chkpwd_t)
logging_send_syslog_msg(chkpwd_t)
@@ -34917,7 +35351,18 @@ index 09b791dcc..78d158ca9 100644
ifdef(`distro_ubuntu',`
optional_policy(`
-@@ -153,53 +176,52 @@ optional_policy(`
+@@ -141,6 +165,10 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ dbus_system_bus_client(chkpwd_t)
++')
++
++optional_policy(`
+ kerberos_use(chkpwd_t)
+ ')
+
+@@ -153,53 +181,52 @@ optional_policy(`
# PAM local policy
#
@@ -34999,7 +35444,7 @@ index 09b791dcc..78d158ca9 100644
')
########################################
-@@ -289,7 +311,6 @@ init_use_script_ptys(pam_console_t)
+@@ -289,7 +316,6 @@ init_use_script_ptys(pam_console_t)
logging_send_syslog_msg(pam_console_t)
@@ -35007,7 +35452,7 @@ index 09b791dcc..78d158ca9 100644
miscfiles_read_generic_certs(pam_console_t)
seutil_read_file_contexts(pam_console_t)
-@@ -330,7 +351,7 @@ optional_policy(`
+@@ -330,7 +356,7 @@ optional_policy(`
# updpwd local policy
#
@@ -35016,7 +35461,7 @@ index 09b791dcc..78d158ca9 100644
allow updpwd_t self:process setfscreate;
allow updpwd_t self:fifo_file rw_fifo_file_perms;
allow updpwd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -341,6 +362,11 @@ kernel_read_system_state(updpwd_t)
+@@ -341,6 +367,11 @@ kernel_read_system_state(updpwd_t)
dev_read_urand(updpwd_t)
files_manage_etc_files(updpwd_t)
@@ -35028,7 +35473,7 @@ index 09b791dcc..78d158ca9 100644
term_dontaudit_use_console(updpwd_t)
term_dontaudit_use_unallocated_ttys(updpwd_t)
-@@ -350,9 +376,7 @@ auth_use_nsswitch(updpwd_t)
+@@ -350,9 +381,7 @@ auth_use_nsswitch(updpwd_t)
logging_send_syslog_msg(updpwd_t)
@@ -35039,7 +35484,7 @@ index 09b791dcc..78d158ca9 100644
ifdef(`distro_ubuntu',`
optional_policy(`
-@@ -380,13 +404,15 @@ term_dontaudit_use_all_ttys(utempter_t)
+@@ -380,13 +409,15 @@ term_dontaudit_use_all_ttys(utempter_t)
term_dontaudit_use_all_ptys(utempter_t)
term_dontaudit_use_ptmx(utempter_t)
@@ -35056,7 +35501,7 @@ index 09b791dcc..78d158ca9 100644
# Allow utemper to write to /tmp/.xses-*
userdom_write_user_tmp_files(utempter_t)
-@@ -397,19 +423,29 @@ ifdef(`distro_ubuntu',`
+@@ -397,19 +428,29 @@ ifdef(`distro_ubuntu',`
')
optional_policy(`
@@ -35090,7 +35535,7 @@ index 09b791dcc..78d158ca9 100644
files_list_var_lib(nsswitch_domain)
# read /etc/nsswitch.conf
-@@ -417,15 +453,42 @@ files_read_etc_files(nsswitch_domain)
+@@ -417,15 +458,42 @@ files_read_etc_files(nsswitch_domain)
sysnet_dns_name_resolve(nsswitch_domain)
@@ -35135,7 +35580,7 @@ index 09b791dcc..78d158ca9 100644
ldap_stream_connect(nsswitch_domain)
')
')
-@@ -438,6 +501,7 @@ optional_policy(`
+@@ -438,6 +506,7 @@ optional_policy(`
likewise_stream_connect_lsassd(nsswitch_domain)
')
@@ -35143,7 +35588,7 @@ index 09b791dcc..78d158ca9 100644
optional_policy(`
kerberos_use(nsswitch_domain)
')
-@@ -456,10 +520,163 @@ optional_policy(`
+@@ -456,10 +525,163 @@ optional_policy(`
optional_policy(`
sssd_stream_connect(nsswitch_domain)
@@ -36088,7 +36533,7 @@ index bc0ffc84e..37b8ea5ec 100644
')
+/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index 79a45f62e..b25993d41 100644
+index 79a45f62e..0244681f0 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -1,5 +1,21 @@
@@ -36319,10 +36764,13 @@ index 79a45f62e..b25993d41 100644
########################################
## <summary>
## Mark the file type as a daemon run dir, allowing initrc_t
-@@ -460,6 +512,25 @@ interface(`init_domtrans',`
- domtrans_pattern($1, init_exec_t, init_t)
- ')
+@@ -458,6 +510,26 @@ interface(`init_domtrans',`
+ ')
+ domtrans_pattern($1, init_exec_t, init_t)
++ allow $1 init_exec_t:file map;
++')
++
+
+########################################
+## <summary>
@@ -36340,12 +36788,10 @@ index 79a45f62e..b25993d41 100644
+ ')
+
+ allow $1 init_exec_t:file entrypoint;
-+')
-+
+ ')
+
########################################
- ## <summary>
- ## Execute the init program in the caller domain.
-@@ -469,7 +540,6 @@ interface(`init_domtrans',`
+@@ -469,7 +541,6 @@ interface(`init_domtrans',`
## Domain allowed access.
## </summary>
## </param>
@@ -36353,7 +36799,7 @@ index 79a45f62e..b25993d41 100644
#
interface(`init_exec',`
gen_require(`
-@@ -478,6 +548,48 @@ interface(`init_exec',`
+@@ -478,6 +549,48 @@ interface(`init_exec',`
corecmd_search_bin($1)
can_exec($1, init_exec_t)
@@ -36402,7 +36848,7 @@ index 79a45f62e..b25993d41 100644
')
########################################
-@@ -566,6 +678,58 @@ interface(`init_sigchld',`
+@@ -566,6 +679,58 @@ interface(`init_sigchld',`
########################################
## <summary>
@@ -36461,7 +36907,7 @@ index 79a45f62e..b25993d41 100644
## Connect to init with a unix socket.
## </summary>
## <param name="domain">
-@@ -576,12 +740,87 @@ interface(`init_sigchld',`
+@@ -576,12 +741,87 @@ interface(`init_sigchld',`
#
interface(`init_stream_connect',`
gen_require(`
@@ -36549,7 +36995,7 @@ index 79a45f62e..b25993d41 100644
########################################
## <summary>
## Inherit and use file descriptors from init.
-@@ -743,22 +982,24 @@ interface(`init_write_initctl',`
+@@ -743,22 +983,24 @@ interface(`init_write_initctl',`
interface(`init_telinit',`
gen_require(`
type initctl_t;
@@ -36583,7 +37029,7 @@ index 79a45f62e..b25993d41 100644
')
########################################
-@@ -787,7 +1028,7 @@ interface(`init_rw_initctl',`
+@@ -787,7 +1029,7 @@ interface(`init_rw_initctl',`
## </summary>
## <param name="domain">
## <summary>
@@ -36592,7 +37038,7 @@ index 79a45f62e..b25993d41 100644
## </summary>
## </param>
#
-@@ -830,11 +1071,12 @@ interface(`init_script_file_entry_type',`
+@@ -830,11 +1072,12 @@ interface(`init_script_file_entry_type',`
#
interface(`init_spec_domtrans_script',`
gen_require(`
@@ -36607,7 +37053,7 @@ index 79a45f62e..b25993d41 100644
ifdef(`distro_gentoo',`
gen_require(`
-@@ -845,11 +1087,11 @@ interface(`init_spec_domtrans_script',`
+@@ -845,11 +1088,11 @@ interface(`init_spec_domtrans_script',`
')
ifdef(`enable_mcs',`
@@ -36621,7 +37067,7 @@ index 79a45f62e..b25993d41 100644
')
')
-@@ -865,23 +1107,45 @@ interface(`init_spec_domtrans_script',`
+@@ -865,23 +1108,45 @@ interface(`init_spec_domtrans_script',`
#
interface(`init_domtrans_script',`
gen_require(`
@@ -36671,7 +37117,7 @@ index 79a45f62e..b25993d41 100644
## Execute a init script in a specified domain.
## </summary>
## <desc>
-@@ -933,9 +1197,14 @@ interface(`init_script_file_domtrans',`
+@@ -933,9 +1198,14 @@ interface(`init_script_file_domtrans',`
interface(`init_labeled_script_domtrans',`
gen_require(`
type initrc_t;
@@ -36686,7 +37132,7 @@ index 79a45f62e..b25993d41 100644
files_search_etc($1)
')
-@@ -992,7 +1261,7 @@ interface(`init_run_daemon',`
+@@ -992,7 +1262,7 @@ interface(`init_run_daemon',`
########################################
## <summary>
@@ -36695,7 +37141,7 @@ index 79a45f62e..b25993d41 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1000,38 +1269,37 @@ interface(`init_run_daemon',`
+@@ -1000,38 +1270,37 @@ interface(`init_run_daemon',`
## </summary>
## </param>
#
@@ -36743,7 +37189,7 @@ index 79a45f62e..b25993d41 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1039,17 +1307,19 @@ interface(`init_ptrace',`
+@@ -1039,17 +1308,19 @@ interface(`init_ptrace',`
## </summary>
## </param>
#
@@ -36767,7 +37213,7 @@ index 79a45f62e..b25993d41 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1057,18 +1327,17 @@ interface(`init_write_script_pipes',`
+@@ -1057,18 +1328,17 @@ interface(`init_write_script_pipes',`
## </summary>
## </param>
#
@@ -36790,7 +37236,7 @@ index 79a45f62e..b25993d41 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1076,18 +1345,94 @@ interface(`init_getattr_script_files',`
+@@ -1076,18 +1346,94 @@ interface(`init_getattr_script_files',`
## </summary>
## </param>
#
@@ -36890,7 +37336,7 @@ index 79a45f62e..b25993d41 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1125,6 +1470,63 @@ interface(`init_getattr_all_script_files',`
+@@ -1125,6 +1471,63 @@ interface(`init_getattr_all_script_files',`
########################################
## <summary>
@@ -36954,7 +37400,7 @@ index 79a45f62e..b25993d41 100644
## Read all init script files.
## </summary>
## <param name="domain">
-@@ -1144,6 +1546,24 @@ interface(`init_read_all_script_files',`
+@@ -1144,6 +1547,24 @@ interface(`init_read_all_script_files',`
#######################################
## <summary>
@@ -36979,7 +37425,7 @@ index 79a45f62e..b25993d41 100644
## Dontaudit read all init script files.
## </summary>
## <param name="domain">
-@@ -1195,12 +1615,7 @@ interface(`init_read_script_state',`
+@@ -1195,12 +1616,7 @@ interface(`init_read_script_state',`
')
kernel_search_proc($1)
@@ -36993,7 +37439,7 @@ index 79a45f62e..b25993d41 100644
')
########################################
-@@ -1314,6 +1729,24 @@ interface(`init_signal_script',`
+@@ -1314,6 +1730,24 @@ interface(`init_signal_script',`
########################################
## <summary>
@@ -37018,7 +37464,7 @@ index 79a45f62e..b25993d41 100644
## Send null signals to init scripts.
## </summary>
## <param name="domain">
-@@ -1440,6 +1873,27 @@ interface(`init_dbus_send_script',`
+@@ -1440,6 +1874,27 @@ interface(`init_dbus_send_script',`
########################################
## <summary>
## Send and receive messages from
@@ -37046,7 +37492,7 @@ index 79a45f62e..b25993d41 100644
## init scripts over dbus.
## </summary>
## <param name="domain">
-@@ -1547,6 +2001,25 @@ interface(`init_getattr_script_status_files',`
+@@ -1547,6 +2002,25 @@ interface(`init_getattr_script_status_files',`
########################################
## <summary>
@@ -37072,7 +37518,7 @@ index 79a45f62e..b25993d41 100644
## Do not audit attempts to read init script
## status files.
## </summary>
-@@ -1605,6 +2078,42 @@ interface(`init_rw_script_tmp_files',`
+@@ -1605,6 +2079,42 @@ interface(`init_rw_script_tmp_files',`
########################################
## <summary>
@@ -37115,7 +37561,7 @@ index 79a45f62e..b25993d41 100644
## Create files in a init script
## temporary data directory.
## </summary>
-@@ -1677,6 +2186,43 @@ interface(`init_read_utmp',`
+@@ -1677,6 +2187,43 @@ interface(`init_read_utmp',`
########################################
## <summary>
@@ -37159,7 +37605,7 @@ index 79a45f62e..b25993d41 100644
## Do not audit attempts to write utmp.
## </summary>
## <param name="domain">
-@@ -1765,7 +2311,7 @@ interface(`init_dontaudit_rw_utmp',`
+@@ -1765,7 +2312,7 @@ interface(`init_dontaudit_rw_utmp',`
type initrc_var_run_t;
')
@@ -37168,7 +37614,7 @@ index 79a45f62e..b25993d41 100644
')
########################################
-@@ -1806,30 +2352,157 @@ interface(`init_pid_filetrans_utmp',`
+@@ -1806,30 +2353,157 @@ interface(`init_pid_filetrans_utmp',`
files_pid_filetrans($1, initrc_var_run_t, file, "utmp")
')
@@ -37339,7 +37785,7 @@ index 79a45f62e..b25993d41 100644
## Domain allowed access.
## </summary>
## </param>
-@@ -1840,3 +2513,584 @@ interface(`init_udp_recvfrom_all_daemons',`
+@@ -1840,3 +2514,584 @@ interface(`init_udp_recvfrom_all_daemons',`
')
corenet_udp_recvfrom_labeled($1, daemon)
')
@@ -37925,7 +38371,7 @@ index 79a45f62e..b25993d41 100644
+')
+
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda2480..cc1720cf2 100644
+index 17eda2480..09d9144cb 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -11,10 +11,31 @@ gen_require(`
@@ -38248,7 +38694,7 @@ index 17eda2480..cc1720cf2 100644
ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap };
-@@ -186,29 +348,294 @@ ifdef(`distro_gentoo',`
+@@ -186,29 +348,295 @@ ifdef(`distro_gentoo',`
')
ifdef(`distro_redhat',`
@@ -38413,6 +38859,7 @@ index 17eda2480..cc1720cf2 100644
+files_relabel_var_dirs(init_t)
+files_relabel_var_lib_dirs(init_t)
+files_read_kernel_modules(init_t)
++files_map_kernel_modules(init_t)
+files_dontaudit_mounton_isid(init_t)
+fs_getattr_all_fs(init_t)
+fs_manage_cgroup_dirs(init_t)
@@ -38552,7 +38999,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -216,7 +643,35 @@ optional_policy(`
+@@ -216,7 +644,35 @@ optional_policy(`
')
optional_policy(`
@@ -38589,7 +39036,7 @@ index 17eda2480..cc1720cf2 100644
')
########################################
-@@ -225,9 +680,9 @@ optional_policy(`
+@@ -225,9 +681,9 @@ optional_policy(`
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -38601,7 +39048,7 @@ index 17eda2480..cc1720cf2 100644
allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms;
-@@ -258,12 +713,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
+@@ -258,12 +714,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -38618,7 +39065,7 @@ index 17eda2480..cc1720cf2 100644
manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
-@@ -279,23 +738,36 @@ kernel_change_ring_buffer_level(initrc_t)
+@@ -279,23 +739,36 @@ kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t)
@@ -38661,7 +39108,7 @@ index 17eda2480..cc1720cf2 100644
corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t)
-@@ -303,9 +775,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
+@@ -303,9 +776,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
dev_read_rand(initrc_t)
dev_read_urand(initrc_t)
@@ -38673,7 +39120,7 @@ index 17eda2480..cc1720cf2 100644
dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t)
-@@ -313,8 +787,10 @@ dev_write_framebuffer(initrc_t)
+@@ -313,8 +788,10 @@ dev_write_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t)
dev_read_sound_mixer(initrc_t)
dev_write_sound_mixer(initrc_t)
@@ -38684,7 +39131,7 @@ index 17eda2480..cc1720cf2 100644
dev_delete_lvm_control_dev(initrc_t)
dev_manage_generic_symlinks(initrc_t)
dev_manage_generic_files(initrc_t)
-@@ -322,8 +798,7 @@ dev_manage_generic_files(initrc_t)
+@@ -322,8 +799,7 @@ dev_manage_generic_files(initrc_t)
dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t)
@@ -38694,7 +39141,7 @@ index 17eda2480..cc1720cf2 100644
domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t)
-@@ -332,7 +807,6 @@ domain_sigstop_all_domains(initrc_t)
+@@ -332,7 +808,6 @@ domain_sigstop_all_domains(initrc_t)
domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t)
@@ -38702,7 +39149,7 @@ index 17eda2480..cc1720cf2 100644
domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown:
-@@ -340,6 +814,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
+@@ -340,6 +815,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
domain_dontaudit_getattr_all_pipes(initrc_t)
@@ -38710,7 +39157,7 @@ index 17eda2480..cc1720cf2 100644
files_getattr_all_dirs(initrc_t)
files_getattr_all_files(initrc_t)
-@@ -347,14 +822,15 @@ files_getattr_all_symlinks(initrc_t)
+@@ -347,14 +823,15 @@ files_getattr_all_symlinks(initrc_t)
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@@ -38728,7 +39175,7 @@ index 17eda2480..cc1720cf2 100644
files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t)
files_manage_generic_spool(initrc_t)
-@@ -364,8 +840,12 @@ files_list_isid_type_dirs(initrc_t)
+@@ -364,8 +841,12 @@ files_list_isid_type_dirs(initrc_t)
files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@@ -38742,7 +39189,7 @@ index 17eda2480..cc1720cf2 100644
fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs
-@@ -375,10 +855,11 @@ fs_mount_all_fs(initrc_t)
+@@ -375,10 +856,11 @@ fs_mount_all_fs(initrc_t)
fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t)
@@ -38756,7 +39203,7 @@ index 17eda2480..cc1720cf2 100644
mcs_process_set_categories(initrc_t)
mls_file_read_all_levels(initrc_t)
-@@ -387,8 +868,10 @@ mls_process_read_up(initrc_t)
+@@ -387,8 +869,10 @@ mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t)
@@ -38767,7 +39214,7 @@ index 17eda2480..cc1720cf2 100644
storage_getattr_fixed_disk_dev(initrc_t)
storage_setattr_fixed_disk_dev(initrc_t)
-@@ -398,6 +881,7 @@ term_use_all_terms(initrc_t)
+@@ -398,6 +882,7 @@ term_use_all_terms(initrc_t)
term_reset_tty_labels(initrc_t)
auth_rw_login_records(initrc_t)
@@ -38775,7 +39222,7 @@ index 17eda2480..cc1720cf2 100644
auth_setattr_login_records(initrc_t)
auth_rw_lastlog(initrc_t)
auth_read_pam_pid(initrc_t)
-@@ -416,20 +900,18 @@ logging_read_all_logs(initrc_t)
+@@ -416,20 +901,18 @@ logging_read_all_logs(initrc_t)
logging_append_all_logs(initrc_t)
logging_read_audit_config(initrc_t)
@@ -38799,7 +39246,7 @@ index 17eda2480..cc1720cf2 100644
ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t)
-@@ -451,7 +933,6 @@ ifdef(`distro_gentoo',`
+@@ -451,7 +934,6 @@ ifdef(`distro_gentoo',`
allow initrc_t self:process setfscreate;
dev_create_null_dev(initrc_t)
dev_create_zero_dev(initrc_t)
@@ -38807,7 +39254,7 @@ index 17eda2480..cc1720cf2 100644
term_create_console_dev(initrc_t)
# unfortunately /sbin/rc does stupid tricks
-@@ -486,6 +967,10 @@ ifdef(`distro_gentoo',`
+@@ -486,6 +968,10 @@ ifdef(`distro_gentoo',`
sysnet_setattr_config(initrc_t)
optional_policy(`
@@ -38818,7 +39265,7 @@ index 17eda2480..cc1720cf2 100644
alsa_read_lib(initrc_t)
')
-@@ -506,7 +991,7 @@ ifdef(`distro_redhat',`
+@@ -506,7 +992,7 @@ ifdef(`distro_redhat',`
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -38827,7 +39274,7 @@ index 17eda2480..cc1720cf2 100644
files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd
-@@ -521,6 +1006,7 @@ ifdef(`distro_redhat',`
+@@ -521,6 +1007,7 @@ ifdef(`distro_redhat',`
files_create_boot_dirs(initrc_t)
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
@@ -38835,7 +39282,7 @@ index 17eda2480..cc1720cf2 100644
# wants to read /.fonts directory
files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t)
-@@ -541,6 +1027,7 @@ ifdef(`distro_redhat',`
+@@ -541,6 +1028,7 @@ ifdef(`distro_redhat',`
miscfiles_rw_localization(initrc_t)
miscfiles_setattr_localization(initrc_t)
miscfiles_relabel_localization(initrc_t)
@@ -38843,7 +39290,7 @@ index 17eda2480..cc1720cf2 100644
miscfiles_read_fonts(initrc_t)
miscfiles_read_hwdata(initrc_t)
-@@ -550,8 +1037,44 @@ ifdef(`distro_redhat',`
+@@ -550,8 +1038,44 @@ ifdef(`distro_redhat',`
')
optional_policy(`
@@ -38888,7 +39335,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -559,14 +1082,31 @@ ifdef(`distro_redhat',`
+@@ -559,14 +1083,31 @@ ifdef(`distro_redhat',`
rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t)
')
@@ -38920,7 +39367,7 @@ index 17eda2480..cc1720cf2 100644
')
')
-@@ -577,6 +1117,39 @@ ifdef(`distro_suse',`
+@@ -577,6 +1118,39 @@ ifdef(`distro_suse',`
')
')
@@ -38960,7 +39407,7 @@ index 17eda2480..cc1720cf2 100644
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -589,6 +1162,8 @@ optional_policy(`
+@@ -589,6 +1163,8 @@ optional_policy(`
optional_policy(`
apache_read_config(initrc_t)
apache_list_modules(initrc_t)
@@ -38969,7 +39416,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -610,6 +1185,7 @@ optional_policy(`
+@@ -610,6 +1186,7 @@ optional_policy(`
optional_policy(`
cgroup_stream_connect_cgred(initrc_t)
@@ -38977,7 +39424,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -626,6 +1202,17 @@ optional_policy(`
+@@ -626,6 +1203,17 @@ optional_policy(`
')
optional_policy(`
@@ -38995,7 +39442,7 @@ index 17eda2480..cc1720cf2 100644
dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t)
-@@ -642,9 +1229,13 @@ optional_policy(`
+@@ -642,9 +1230,13 @@ optional_policy(`
dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t)
@@ -39009,7 +39456,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -657,15 +1248,11 @@ optional_policy(`
+@@ -657,15 +1249,11 @@ optional_policy(`
')
optional_policy(`
@@ -39027,7 +39474,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -686,6 +1273,15 @@ optional_policy(`
+@@ -686,6 +1274,15 @@ optional_policy(`
')
optional_policy(`
@@ -39043,7 +39490,7 @@ index 17eda2480..cc1720cf2 100644
inn_exec_config(initrc_t)
')
-@@ -726,6 +1322,7 @@ optional_policy(`
+@@ -726,6 +1323,7 @@ optional_policy(`
lpd_list_spool(initrc_t)
lpd_read_config(initrc_t)
@@ -39051,7 +39498,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -743,7 +1340,13 @@ optional_policy(`
+@@ -743,7 +1341,13 @@ optional_policy(`
')
optional_policy(`
@@ -39066,7 +39513,7 @@ index 17eda2480..cc1720cf2 100644
mta_dontaudit_read_spool_symlinks(initrc_t)
')
-@@ -766,6 +1369,10 @@ optional_policy(`
+@@ -766,6 +1370,10 @@ optional_policy(`
')
optional_policy(`
@@ -39077,7 +39524,7 @@ index 17eda2480..cc1720cf2 100644
postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t)
')
-@@ -775,10 +1382,20 @@ optional_policy(`
+@@ -775,10 +1383,20 @@ optional_policy(`
')
optional_policy(`
@@ -39098,7 +39545,7 @@ index 17eda2480..cc1720cf2 100644
quota_manage_flags(initrc_t)
')
-@@ -787,6 +1404,10 @@ optional_policy(`
+@@ -787,6 +1405,10 @@ optional_policy(`
')
optional_policy(`
@@ -39109,7 +39556,7 @@ index 17eda2480..cc1720cf2 100644
fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t)
-@@ -808,8 +1429,6 @@ optional_policy(`
+@@ -808,8 +1430,6 @@ optional_policy(`
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -39118,7 +39565,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -818,6 +1437,10 @@ optional_policy(`
+@@ -818,6 +1438,10 @@ optional_policy(`
')
optional_policy(`
@@ -39129,7 +39576,7 @@ index 17eda2480..cc1720cf2 100644
# shorewall-init script run /var/lib/shorewall/firewall
shorewall_lib_domtrans(initrc_t)
')
-@@ -827,10 +1450,12 @@ optional_policy(`
+@@ -827,10 +1451,12 @@ optional_policy(`
squid_manage_logs(initrc_t)
')
@@ -39142,7 +39589,7 @@ index 17eda2480..cc1720cf2 100644
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -857,21 +1482,62 @@ optional_policy(`
+@@ -857,21 +1483,62 @@ optional_policy(`
')
optional_policy(`
@@ -39206,7 +39653,7 @@ index 17eda2480..cc1720cf2 100644
')
optional_policy(`
-@@ -887,6 +1553,10 @@ optional_policy(`
+@@ -887,6 +1554,10 @@ optional_policy(`
')
optional_policy(`
@@ -39217,7 +39664,7 @@ index 17eda2480..cc1720cf2 100644
# Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t)
-@@ -897,3 +1567,218 @@ optional_policy(`
+@@ -897,3 +1568,218 @@ optional_policy(`
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -40226,10 +40673,10 @@ index c42fbc329..bf211dbee 100644
+ files_pid_filetrans($1, iptables_var_run_t, file, "xtables.lock")
+')
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
-index be8ed1e6c..697c2cf05 100644
+index be8ed1e6c..5a5a54d66 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
-@@ -16,44 +16,61 @@ role iptables_roles types iptables_t;
+@@ -16,44 +16,62 @@ role iptables_roles types iptables_t;
type iptables_initrc_exec_t;
init_script_file(iptables_initrc_exec_t)
@@ -40258,6 +40705,7 @@ index be8ed1e6c..697c2cf05 100644
-allow iptables_t self:capability { dac_read_search dac_override net_admin net_raw };
+allow iptables_t self:capability { dac_read_search net_admin net_raw };
++allow iptables_t self:cap_userns { dac_read_search net_admin net_raw };
dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:fifo_file rw_fifo_file_perms;
allow iptables_t self:process { sigchld sigkill sigstop signull signal };
@@ -40298,7 +40746,7 @@ index be8ed1e6c..697c2cf05 100644
kernel_use_fds(iptables_t)
# needed by ipvsadm
-@@ -64,19 +81,24 @@ corenet_relabelto_all_packets(iptables_t)
+@@ -64,19 +82,24 @@ corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t)
dev_read_sysfs(iptables_t)
@@ -40325,7 +40773,7 @@ index be8ed1e6c..697c2cf05 100644
auth_use_nsswitch(iptables_t)
-@@ -85,15 +107,14 @@ init_use_script_ptys(iptables_t)
+@@ -85,15 +108,14 @@ init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
init_rw_script_stream_sockets(iptables_t)
@@ -40343,7 +40791,7 @@ index be8ed1e6c..697c2cf05 100644
userdom_use_all_users_fds(iptables_t)
ifdef(`hide_broken_symptoms',`
-@@ -101,7 +122,14 @@ ifdef(`hide_broken_symptoms',`
+@@ -101,7 +123,14 @@ ifdef(`hide_broken_symptoms',`
')
optional_policy(`
@@ -40358,7 +40806,7 @@ index be8ed1e6c..697c2cf05 100644
')
optional_policy(`
-@@ -110,7 +138,16 @@ optional_policy(`
+@@ -110,7 +139,16 @@ optional_policy(`
')
optional_policy(`
@@ -40375,7 +40823,7 @@ index be8ed1e6c..697c2cf05 100644
')
optional_policy(`
-@@ -119,11 +156,25 @@ optional_policy(`
+@@ -119,11 +157,25 @@ optional_policy(`
')
optional_policy(`
@@ -40401,7 +40849,7 @@ index be8ed1e6c..697c2cf05 100644
')
optional_policy(`
-@@ -132,12 +183,13 @@ optional_policy(`
+@@ -132,12 +184,13 @@ optional_policy(`
optional_policy(`
seutil_sigchld_newrole(iptables_t)
@@ -47802,7 +48250,7 @@ index 2cea692c0..853ddefe4 100644
+ files_pid_filetrans($1, net_conf_t, dir, "cloud-init")
+')
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index a392fc4bc..a61ba7d4e 100644
+index a392fc4bc..4870f76fd 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4)
@@ -47930,7 +48378,7 @@ index a392fc4bc..a61ba7d4e 100644
fs_getattr_all_fs(dhcpc_t)
fs_search_auto_mountpoints(dhcpc_t)
-@@ -137,11 +158,17 @@ term_dontaudit_use_all_ptys(dhcpc_t)
+@@ -137,16 +158,23 @@ term_dontaudit_use_all_ptys(dhcpc_t)
term_dontaudit_use_unallocated_ttys(dhcpc_t)
term_dontaudit_use_generic_ptys(dhcpc_t)
@@ -47949,7 +48397,13 @@ index a392fc4bc..a61ba7d4e 100644
modutils_run_insmod(dhcpc_t, dhcpc_roles)
-@@ -161,7 +188,21 @@ ifdef(`distro_ubuntu',`
+ sysnet_run_ifconfig(dhcpc_t, dhcpc_roles)
+
++userdom_stream_connect(dhcpc_t)
+ userdom_use_user_terminals(dhcpc_t)
+ userdom_dontaudit_search_user_home_dirs(dhcpc_t)
+
+@@ -161,7 +189,21 @@ ifdef(`distro_ubuntu',`
')
optional_policy(`
@@ -47972,7 +48426,7 @@ index a392fc4bc..a61ba7d4e 100644
')
optional_policy(`
-@@ -179,10 +220,6 @@ optional_policy(`
+@@ -179,10 +221,6 @@ optional_policy(`
')
optional_policy(`
@@ -47983,7 +48437,7 @@ index a392fc4bc..a61ba7d4e 100644
hotplug_getattr_config_dirs(dhcpc_t)
hotplug_search_config(dhcpc_t)
-@@ -195,23 +232,31 @@ optional_policy(`
+@@ -195,23 +233,31 @@ optional_policy(`
optional_policy(`
netutils_run_ping(dhcpc_t, dhcpc_roles)
netutils_run(dhcpc_t, dhcpc_roles)
@@ -48018,7 +48472,7 @@ index a392fc4bc..a61ba7d4e 100644
')
optional_policy(`
-@@ -221,7 +266,16 @@ optional_policy(`
+@@ -221,7 +267,16 @@ optional_policy(`
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
@@ -48036,7 +48490,7 @@ index a392fc4bc..a61ba7d4e 100644
')
optional_policy(`
-@@ -233,6 +287,10 @@ optional_policy(`
+@@ -233,6 +288,10 @@ optional_policy(`
')
optional_policy(`
@@ -48047,7 +48501,7 @@ index a392fc4bc..a61ba7d4e 100644
vmware_append_log(dhcpc_t)
')
-@@ -264,32 +322,73 @@ allow ifconfig_t self:msgq create_msgq_perms;
+@@ -264,32 +323,73 @@ allow ifconfig_t self:msgq create_msgq_perms;
allow ifconfig_t self:msg { send receive };
# Create UDP sockets, necessary when called from dhcpc
allow ifconfig_t self:udp_socket create_socket_perms;
@@ -48121,7 +48575,7 @@ index a392fc4bc..a61ba7d4e 100644
selinux_dontaudit_getattr_fs(ifconfig_t)
-@@ -299,33 +398,51 @@ term_dontaudit_use_all_ptys(ifconfig_t)
+@@ -299,33 +399,51 @@ term_dontaudit_use_all_ptys(ifconfig_t)
term_dontaudit_use_ptmx(ifconfig_t)
term_dontaudit_use_generic_ptys(ifconfig_t)
@@ -48179,7 +48633,7 @@ index a392fc4bc..a61ba7d4e 100644
optional_policy(`
dev_dontaudit_rw_cardmgr(ifconfig_t)
')
-@@ -336,7 +453,11 @@ ifdef(`hide_broken_symptoms',`
+@@ -336,7 +454,11 @@ ifdef(`hide_broken_symptoms',`
')
optional_policy(`
@@ -48192,7 +48646,7 @@ index a392fc4bc..a61ba7d4e 100644
')
optional_policy(`
-@@ -350,7 +471,16 @@ optional_policy(`
+@@ -350,7 +472,16 @@ optional_policy(`
')
optional_policy(`
@@ -48210,7 +48664,7 @@ index a392fc4bc..a61ba7d4e 100644
')
optional_policy(`
-@@ -371,3 +501,17 @@ optional_policy(`
+@@ -371,3 +502,17 @@ optional_policy(`
xen_append_log(ifconfig_t)
xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
')
@@ -57836,7 +58290,7 @@ index 9dc60c6c0..562afbe9a 100644
+ ')
')
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
-index f4ac38dc7..1589d6065 100644
+index f4ac38dc7..e4733e828 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -7,48 +7,43 @@ policy_module(userdomain, 4.9.1)
@@ -57986,7 +58440,7 @@ index f4ac38dc7..1589d6065 100644
+')
+
+allow userdomain userdomain:process signull;
-+allow userdomain userdomain:fifo_file rw_inherited_fifo_file_perms;
++allow userdomain userdomain:fifo_file { map rw_inherited_fifo_file_perms };
+dontaudit unpriv_userdomain self:rawip_socket create_socket_perms;
+
+# Nautilus causes this avc
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index c4b2449..b4a2b26 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -1813,7 +1813,7 @@ index 01cbb67df..94a4a2406 100644
files_list_etc($1)
diff --git a/aide.te b/aide.te
-index 03831e6e5..d97de5ad7 100644
+index 03831e6e5..93a15b5de 100644
--- a/aide.te
+++ b/aide.te
@@ -10,6 +10,7 @@ attribute_role aide_roles;
@@ -1824,7 +1824,7 @@ index 03831e6e5..d97de5ad7 100644
role aide_roles types aide_t;
type aide_log_t;
-@@ -23,22 +24,34 @@ files_type(aide_db_t)
+@@ -23,23 +24,39 @@ files_type(aide_db_t)
# Local policy
#
@@ -1864,6 +1864,11 @@ index 03831e6e5..d97de5ad7 100644
optional_policy(`
seutil_use_newrole_fds(aide_t)
+ ')
++
++optional_policy(`
++ sssd_stream_connect(aide_t)
++')
diff --git a/aisexec.if b/aisexec.if
index a2997fa57..861cebdf9 100644
--- a/aisexec.if
@@ -5626,7 +5631,7 @@ index f6eb4851f..3628a384f 100644
+ allow $1 httpd_t:process { noatsecure };
')
diff --git a/apache.te b/apache.te
-index 6649962b6..3db9df9f9 100644
+index 6649962b6..0a7b49bbb 100644
--- a/apache.te
+++ b/apache.te
@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
@@ -6337,7 +6342,15 @@ index 6649962b6..3db9df9f9 100644
allow httpd_t httpd_sys_script_t:unix_stream_socket connectto;
-@@ -438,6 +558,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi
+@@ -428,6 +548,7 @@ manage_sock_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
+ manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
+ files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file sock_file })
+ userdom_user_tmp_filetrans(httpd_t, httpd_tmp_t, dir)
++allow httpd_t httpd_tmp_t:file map;
+
+ manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
+ manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t)
+@@ -438,6 +559,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi
manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
@@ -6345,7 +6358,7 @@ index 6649962b6..3db9df9f9 100644
files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file })
setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
-@@ -450,140 +571,179 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
+@@ -450,140 +572,179 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
@@ -6589,7 +6602,7 @@ index 6649962b6..3db9df9f9 100644
')
tunable_policy(`httpd_enable_cgi && httpd_use_nfs',`
-@@ -594,28 +754,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
+@@ -594,28 +755,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
fs_cifs_domtrans(httpd_t, httpd_sys_script_t)
')
@@ -6649,7 +6662,7 @@ index 6649962b6..3db9df9f9 100644
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -624,68 +806,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+@@ -624,68 +807,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
fs_read_nfs_symlinks(httpd_t)
')
@@ -6752,7 +6765,7 @@ index 6649962b6..3db9df9f9 100644
')
tunable_policy(`httpd_setrlimit',`
-@@ -695,49 +865,48 @@ tunable_policy(`httpd_setrlimit',`
+@@ -695,49 +866,48 @@ tunable_policy(`httpd_setrlimit',`
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
@@ -6833,7 +6846,7 @@ index 6649962b6..3db9df9f9 100644
')
optional_policy(`
-@@ -749,24 +918,32 @@ optional_policy(`
+@@ -749,24 +919,32 @@ optional_policy(`
')
optional_policy(`
@@ -6872,7 +6885,7 @@ index 6649962b6..3db9df9f9 100644
')
optional_policy(`
-@@ -775,6 +952,10 @@ optional_policy(`
+@@ -775,6 +953,10 @@ optional_policy(`
tunable_policy(`httpd_dbus_avahi',`
avahi_dbus_chat(httpd_t)
')
@@ -6883,7 +6896,7 @@ index 6649962b6..3db9df9f9 100644
')
optional_policy(`
-@@ -786,35 +967,62 @@ optional_policy(`
+@@ -786,35 +968,62 @@ optional_policy(`
')
optional_policy(`
@@ -6959,7 +6972,7 @@ index 6649962b6..3db9df9f9 100644
tunable_policy(`httpd_manage_ipa',`
memcached_manage_pid_files(httpd_t)
-@@ -822,8 +1030,31 @@ optional_policy(`
+@@ -822,8 +1031,31 @@ optional_policy(`
')
optional_policy(`
@@ -6991,7 +7004,7 @@ index 6649962b6..3db9df9f9 100644
tunable_policy(`httpd_can_network_connect_db',`
mysql_tcp_connect(httpd_t)
-@@ -832,6 +1063,8 @@ optional_policy(`
+@@ -832,6 +1064,8 @@ optional_policy(`
optional_policy(`
nagios_read_config(httpd_t)
@@ -7000,7 +7013,7 @@ index 6649962b6..3db9df9f9 100644
')
optional_policy(`
-@@ -842,20 +1075,48 @@ optional_policy(`
+@@ -842,20 +1076,48 @@ optional_policy(`
')
optional_policy(`
@@ -7055,7 +7068,7 @@ index 6649962b6..3db9df9f9 100644
')
optional_policy(`
-@@ -863,16 +1124,31 @@ optional_policy(`
+@@ -863,16 +1125,31 @@ optional_policy(`
')
optional_policy(`
@@ -7089,7 +7102,7 @@ index 6649962b6..3db9df9f9 100644
')
optional_policy(`
-@@ -883,65 +1159,189 @@ optional_policy(`
+@@ -883,65 +1160,189 @@ optional_policy(`
yam_read_content(httpd_t)
')
@@ -7301,7 +7314,7 @@ index 6649962b6..3db9df9f9 100644
files_dontaudit_search_pids(httpd_suexec_t)
files_search_home(httpd_suexec_t)
-@@ -950,123 +1350,75 @@ auth_use_nsswitch(httpd_suexec_t)
+@@ -950,123 +1351,75 @@ auth_use_nsswitch(httpd_suexec_t)
logging_search_logs(httpd_suexec_t)
logging_send_syslog_msg(httpd_suexec_t)
@@ -7455,7 +7468,7 @@ index 6649962b6..3db9df9f9 100644
mysql_read_config(httpd_suexec_t)
tunable_policy(`httpd_can_network_connect_db',`
-@@ -1083,172 +1435,107 @@ optional_policy(`
+@@ -1083,172 +1436,107 @@ optional_policy(`
')
')
@@ -7693,7 +7706,7 @@ index 6649962b6..3db9df9f9 100644
')
tunable_policy(`httpd_read_user_content',`
-@@ -1256,64 +1543,74 @@ tunable_policy(`httpd_read_user_content',`
+@@ -1256,64 +1544,74 @@ tunable_policy(`httpd_read_user_content',`
')
tunable_policy(`httpd_use_cifs',`
@@ -7791,7 +7804,7 @@ index 6649962b6..3db9df9f9 100644
########################################
#
-@@ -1321,8 +1618,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
+@@ -1321,8 +1619,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
#
optional_policy(`
@@ -7808,7 +7821,7 @@ index 6649962b6..3db9df9f9 100644
')
########################################
-@@ -1330,49 +1634,43 @@ optional_policy(`
+@@ -1330,49 +1635,43 @@ optional_policy(`
# User content local policy
#
@@ -7877,7 +7890,7 @@ index 6649962b6..3db9df9f9 100644
kernel_read_system_state(httpd_passwd_t)
corecmd_exec_bin(httpd_passwd_t)
-@@ -1382,38 +1680,109 @@ dev_read_urand(httpd_passwd_t)
+@@ -1382,38 +1681,109 @@ dev_read_urand(httpd_passwd_t)
domain_use_interactive_fds(httpd_passwd_t)
@@ -21731,7 +21744,7 @@ index 3023be7f6..5afde8039 100644
+ files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
')
diff --git a/cups.te b/cups.te
-index c91813ccb..774431956 100644
+index c91813ccb..0ea3e3d6a 100644
--- a/cups.te
+++ b/cups.te
@@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -22008,7 +22021,7 @@ index c91813ccb..774431956 100644
selinux_compute_access_vector(cupsd_t)
selinux_validate_context(cupsd_t)
-@@ -244,22 +289,30 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,23 +289,31 @@ auth_dontaudit_read_pam_pid(cupsd_t)
auth_rw_faillog(cupsd_t)
auth_use_nsswitch(cupsd_t)
@@ -22033,17 +22046,18 @@ index c91813ccb..774431956 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
+userdom_dontaudit_search_user_home_dirs(cupsd_t)
- userdom_dontaudit_search_user_home_content(cupsd_t)
-+userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
+userdom_dontaudit_search_user_home_content(cupsd_t)
-+
++userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
+ userdom_dontaudit_search_user_home_content(cupsd_t)
+
+tunable_policy(`cups_execmem',`
+ allow cupsd_t self:process { execmem execstack };
+')
+
-
++
optional_policy(`
apm_domtrans_client(cupsd_t)
+ ')
@@ -272,6 +325,8 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(cupsd_t)
@@ -22187,7 +22201,7 @@ index c91813ccb..774431956 100644
fs_search_auto_mountpoints(cupsd_config_t)
domain_use_interactive_fds(cupsd_config_t)
-@@ -417,11 +476,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,17 +476,16 @@ auth_use_nsswitch(cupsd_config_t)
logging_send_syslog_msg(cupsd_config_t)
@@ -22199,7 +22213,17 @@ index c91813ccb..774431956 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t)
-@@ -449,9 +503,12 @@ optional_policy(`
+ userdom_read_user_tmp_symlinks(cupsd_config_t)
+ userdom_rw_user_tmp_files(cupsd_config_t)
+
++tunable_policy(`cups_execmem',`
++ allow cupsd_config_t self:process { execmem execstack };
++')
++
+ optional_policy(`
+ term_use_generic_ptys(cupsd_config_t)
+ ')
+@@ -449,9 +507,12 @@ optional_policy(`
')
optional_policy(`
@@ -22213,7 +22237,7 @@ index c91813ccb..774431956 100644
')
optional_policy(`
-@@ -467,6 +524,10 @@ optional_policy(`
+@@ -467,6 +528,10 @@ optional_policy(`
')
optional_policy(`
@@ -22224,7 +22248,7 @@ index c91813ccb..774431956 100644
rpm_read_db(cupsd_config_t)
')
-@@ -487,10 +548,6 @@ optional_policy(`
+@@ -487,10 +552,6 @@ optional_policy(`
# Lpd local policy
#
@@ -22235,7 +22259,7 @@ index c91813ccb..774431956 100644
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +565,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +569,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
kernel_read_kernel_sysctls(cupsd_lpd_t)
kernel_read_system_state(cupsd_lpd_t)
@@ -22253,7 +22277,7 @@ index c91813ccb..774431956 100644
corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +594,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +598,6 @@ auth_use_nsswitch(cupsd_lpd_t)
logging_send_syslog_msg(cupsd_lpd_t)
@@ -22263,7 +22287,7 @@ index c91813ccb..774431956 100644
optional_policy(`
inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
')
-@@ -549,9 +603,9 @@ optional_policy(`
+@@ -549,9 +607,9 @@ optional_policy(`
# Pdf local policy
#
@@ -22275,7 +22299,7 @@ index c91813ccb..774431956 100644
append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +620,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +624,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
kernel_read_system_state(cups_pdf_t)
@@ -22304,13 +22328,11 @@ index c91813ccb..774431956 100644
- fs_manage_cifs_dirs(cups_pdf_t)
- fs_manage_cifs_files(cups_pdf_t)
-')
-+userdom_home_manager(cups_pdf_t)
-
- optional_policy(`
+-
+-optional_policy(`
- lpd_manage_spool(cups_pdf_t)
-+ gnome_read_config(cups_pdf_t)
- ')
-
+-')
+-
-########################################
-#
-# HPLIP local policy
@@ -22412,11 +22434,13 @@ index c91813ccb..774431956 100644
- lpd_read_config(hplip_t)
- lpd_manage_spool(hplip_t)
-')
--
--optional_policy(`
++userdom_home_manager(cups_pdf_t)
+
+ optional_policy(`
- seutil_sigchld_newrole(hplip_t)
--')
--
++ gnome_read_config(cups_pdf_t)
+ ')
+
-optional_policy(`
- snmp_read_snmp_var_lib_files(hplip_t)
-')
@@ -22427,7 +22451,7 @@ index c91813ccb..774431956 100644
########################################
#
-@@ -735,7 +664,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +668,6 @@ kernel_read_kernel_sysctls(ptal_t)
kernel_list_proc(ptal_t)
kernel_read_proc_symlinks(ptal_t)
@@ -22435,7 +22459,7 @@ index c91813ccb..774431956 100644
corenet_all_recvfrom_netlabel(ptal_t)
corenet_tcp_sendrecv_generic_if(ptal_t)
corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +673,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +677,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
corenet_tcp_bind_ptal_port(ptal_t)
corenet_tcp_sendrecv_ptal_port(ptal_t)
@@ -22449,7 +22473,7 @@ index c91813ccb..774431956 100644
files_read_etc_runtime_files(ptal_t)
fs_getattr_all_fs(ptal_t)
-@@ -759,8 +685,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +689,6 @@ fs_search_auto_mountpoints(ptal_t)
logging_send_syslog_msg(ptal_t)
@@ -22458,7 +22482,7 @@ index c91813ccb..774431956 100644
sysnet_read_config(ptal_t)
userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +697,4 @@ optional_policy(`
+@@ -773,3 +701,4 @@ optional_policy(`
optional_policy(`
udev_read_db(ptal_t)
')
@@ -25467,7 +25491,7 @@ index c697edbcd..954c090bd 100644
+ allow $1 dhcpd_unit_file_t:service all_service_perms;
')
diff --git a/dhcp.te b/dhcp.te
-index 98a24b989..9ded26309 100644
+index 98a24b989..c9162e646 100644
--- a/dhcp.te
+++ b/dhcp.te
@@ -20,6 +20,9 @@ init_daemon_domain(dhcpd_t, dhcpd_exec_t)
@@ -25485,7 +25509,7 @@ index 98a24b989..9ded26309 100644
#
-allow dhcpd_t self:capability { chown dac_override sys_chroot net_raw setgid setuid sys_resource };
-+allow dhcpd_t self:capability { chown dac_read_search fowner sys_chroot net_raw kill setgid setuid setpcap sys_resource };
++allow dhcpd_t self:capability { chown dac_read_search dac_override fowner sys_chroot net_raw kill setgid setuid setpcap sys_resource };
dontaudit dhcpd_t self:capability { net_admin sys_tty_config };
allow dhcpd_t self:process { getcap setcap signal_perms };
allow dhcpd_t self:fifo_file rw_fifo_file_perms;
@@ -32113,10 +32137,10 @@ index 000000000..d9ba5fa27
+')
diff --git a/ganesha.te b/ganesha.te
new file mode 100644
-index 000000000..0fdeecfd6
+index 000000000..f25a3f34d
--- /dev/null
+++ b/ganesha.te
-@@ -0,0 +1,110 @@
+@@ -0,0 +1,111 @@
+policy_module(ganesha, 1.0.0)
+
+########################################
@@ -32153,6 +32177,7 @@ index 000000000..0fdeecfd6
+#
+dontaudit ganesha_t self:capability net_admin;
+
++allow ganesha_t self:capability { dac_read_search dac_override };
+allow ganesha_t self:capability2 block_suspend;
+allow ganesha_t self:process { setcap setrlimit };
+allow ganesha_t self:fifo_file rw_fifo_file_perms;
@@ -44078,7 +44103,7 @@ index 4fe75fd63..3504a9bf7 100644
+/var/tmp/ldap_487 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
+/var/tmp/ldap_55 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
diff --git a/kerberos.if b/kerberos.if
-index f6c00d8e6..79ea4d8d2 100644
+index f6c00d8e6..1233a5ba2 100644
--- a/kerberos.if
+++ b/kerberos.if
@@ -1,27 +1,29 @@
@@ -44217,7 +44242,16 @@ index f6c00d8e6..79ea4d8d2 100644
pcscd_stream_connect($1)
')
')
-@@ -119,7 +119,7 @@ interface(`kerberos_use',`
+@@ -115,11 +115,16 @@ interface(`kerberos_use',`
+ optional_policy(`
+ sssd_read_public_files($1)
+ ')
++
++ # Allow to use kerberos KCM daemon (sssd-kcm)
++ optional_policy(`
++ sssd_run_stream_connect($1)
++ ')
+ ')
########################################
## <summary>
@@ -44226,7 +44260,7 @@ index f6c00d8e6..79ea4d8d2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -135,15 +135,13 @@ interface(`kerberos_read_config',`
+@@ -135,15 +140,13 @@ interface(`kerberos_read_config',`
files_search_etc($1)
allow $1 krb5_conf_t:file read_file_perms;
@@ -44244,7 +44278,7 @@ index f6c00d8e6..79ea4d8d2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -156,13 +154,12 @@ interface(`kerberos_dontaudit_write_config',`
+@@ -156,13 +159,12 @@ interface(`kerberos_dontaudit_write_config',`
type krb5_conf_t;
')
@@ -44260,7 +44294,7 @@ index f6c00d8e6..79ea4d8d2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -182,27 +179,27 @@ interface(`kerberos_rw_config',`
+@@ -182,27 +184,27 @@ interface(`kerberos_rw_config',`
########################################
## <summary>
@@ -44295,7 +44329,7 @@ index f6c00d8e6..79ea4d8d2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -210,220 +207,252 @@ interface(`kerberos_manage_krb5_home_files',`
+@@ -210,220 +212,252 @@ interface(`kerberos_manage_krb5_home_files',`
## </summary>
## </param>
#
@@ -44638,7 +44672,7 @@ index f6c00d8e6..79ea4d8d2 100644
## </summary>
## </param>
## <param name="name" optional="true">
-@@ -432,17 +461,18 @@ interface(`kerberos_manage_host_rcache',`
+@@ -432,17 +466,18 @@ interface(`kerberos_manage_host_rcache',`
## </summary>
## </param>
#
@@ -44661,7 +44695,7 @@ index f6c00d8e6..79ea4d8d2 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -450,82 +480,109 @@ interface(`kerberos_tmp_filetrans_host_rcache',`
+@@ -450,82 +485,109 @@ interface(`kerberos_tmp_filetrans_host_rcache',`
## </summary>
## </param>
#
@@ -46992,7 +47026,7 @@ index 3602712d0..af83a5b6b 100644
+ allow $1 slapd_unit_file_t:service all_service_perms;
')
diff --git a/ldap.te b/ldap.te
-index 4c2b1110e..4baf7a041 100644
+index 4c2b1110e..a9444566a 100644
--- a/ldap.te
+++ b/ldap.te
@@ -21,6 +21,9 @@ files_config_file(slapd_etc_t)
@@ -47037,7 +47071,17 @@ index 4c2b1110e..4baf7a041 100644
logging_log_filetrans(slapd_t, slapd_log_t, { file dir })
manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
-@@ -93,7 +96,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file })
+@@ -80,7 +83,8 @@ manage_lnk_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
+
+ manage_dirs_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t)
+ manage_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t)
+-files_tmp_filetrans(slapd_t, slapd_tmp_t, { file dir })
++manage_lnk_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t)
++files_tmp_filetrans(slapd_t, slapd_tmp_t, { file lnk_file dir })
+
+ manage_files_pattern(slapd_t, slapd_tmpfs_t, slapd_tmpfs_t)
+ fs_tmpfs_filetrans(slapd_t, slapd_tmpfs_t, file)
+@@ -93,7 +97,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file })
kernel_read_system_state(slapd_t)
kernel_read_kernel_sysctls(slapd_t)
@@ -47045,7 +47089,7 @@ index 4c2b1110e..4baf7a041 100644
corenet_all_recvfrom_netlabel(slapd_t)
corenet_tcp_sendrecv_generic_if(slapd_t)
corenet_tcp_sendrecv_generic_node(slapd_t)
-@@ -115,25 +117,26 @@ fs_getattr_all_fs(slapd_t)
+@@ -115,25 +118,26 @@ fs_getattr_all_fs(slapd_t)
fs_search_auto_mountpoints(slapd_t)
files_read_etc_runtime_files(slapd_t)
@@ -47735,7 +47779,7 @@ index dff21a7c4..b6981c846 100644
init_labeled_script_domtrans($1, lircd_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/lircd.te b/lircd.te
-index 483c87bb6..5c41c7557 100644
+index 483c87bb6..1bfb75c34 100644
--- a/lircd.te
+++ b/lircd.te
@@ -13,7 +13,7 @@ type lircd_initrc_exec_t;
@@ -47760,15 +47804,16 @@ index 483c87bb6..5c41c7557 100644
read_files_pattern(lircd_t, lircd_etc_t, lircd_etc_t)
-@@ -39,6 +40,7 @@ dev_filetrans(lircd_t, lircd_var_run_t, sock_file)
+@@ -39,6 +40,8 @@ dev_filetrans(lircd_t, lircd_var_run_t, sock_file)
kernel_request_load_module(lircd_t)
++corecmd_exec_shell(lircd_t)
+
corenet_all_recvfrom_unlabeled(lircd_t)
corenet_all_recvfrom_netlabel(lircd_t)
corenet_tcp_sendrecv_generic_if(lircd_t)
-@@ -56,7 +58,7 @@ dev_read_mouse(lircd_t)
+@@ -56,7 +59,7 @@ dev_read_mouse(lircd_t)
dev_filetrans_lirc(lircd_t)
dev_rw_lirc(lircd_t)
dev_rw_input_dev(lircd_t)
@@ -47777,7 +47822,7 @@ index 483c87bb6..5c41c7557 100644
files_read_config_files(lircd_t)
files_list_var(lircd_t)
-@@ -64,9 +66,11 @@ files_manage_generic_locks(lircd_t)
+@@ -64,9 +67,11 @@ files_manage_generic_locks(lircd_t)
files_read_all_locks(lircd_t)
term_use_ptmx(lircd_t)
@@ -56955,7 +57000,7 @@ index ed81cac5a..cd52baf59 100644
+ mta_filetrans_admin_home_content($1)
+')
diff --git a/mta.te b/mta.te
-index ff1d68c6a..28ff27c22 100644
+index ff1d68c6a..ee540eafd 100644
--- a/mta.te
+++ b/mta.te
@@ -14,8 +14,6 @@ attribute mailserver_sender;
@@ -57103,14 +57148,14 @@ index ff1d68c6a..28ff27c22 100644
init_use_script_ptys(system_mail_t)
+init_dontaudit_rw_stream_socket(system_mail_t)
-+
+
+-userdom_use_user_terminals(system_mail_t)
+userdom_use_inherited_user_terminals(system_mail_t)
+userdom_dontaudit_list_user_home_dirs(system_mail_t)
+userdom_dontaudit_list_admin_dir(system_mail_t)
+userdom_dontaudit_list_user_tmp(system_mail_t)
+userdom_dontaudit_read_inherited_admin_home_files(system_mail_t)
-
--userdom_use_user_terminals(system_mail_t)
++
+manage_dirs_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t)
+manage_files_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t)
+
@@ -57177,13 +57222,17 @@ index ff1d68c6a..28ff27c22 100644
courier_stream_connect_authdaemon(system_mail_t)
')
-@@ -244,9 +270,10 @@ optional_policy(`
+@@ -244,9 +270,14 @@ optional_policy(`
')
optional_policy(`
- fail2ban_dontaudit_rw_stream_sockets(system_mail_t)
- fail2ban_append_log(system_mail_t)
- fail2ban_rw_inherited_tmp_files(system_mail_t)
++ dbus_system_bus_client(system_mail_t)
++')
++
++optional_policy(`
+ fail2ban_append_log(user_mail_domain)
+ fail2ban_dontaudit_leaks(user_mail_domain)
+ fail2ban_rw_inherited_tmp_files(mta_user_agent)
@@ -57191,7 +57240,7 @@ index ff1d68c6a..28ff27c22 100644
')
optional_policy(`
-@@ -258,10 +285,17 @@ optional_policy(`
+@@ -258,10 +289,17 @@ optional_policy(`
')
optional_policy(`
@@ -57209,7 +57258,7 @@ index ff1d68c6a..28ff27c22 100644
nagios_read_tmp_files(system_mail_t)
')
-@@ -272,6 +306,19 @@ optional_policy(`
+@@ -272,6 +310,19 @@ optional_policy(`
manage_fifo_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
manage_sock_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file })
@@ -57229,7 +57278,7 @@ index ff1d68c6a..28ff27c22 100644
')
optional_policy(`
-@@ -279,6 +326,10 @@ optional_policy(`
+@@ -279,6 +330,10 @@ optional_policy(`
')
optional_policy(`
@@ -57240,7 +57289,7 @@ index ff1d68c6a..28ff27c22 100644
userdom_dontaudit_use_user_ptys(system_mail_t)
optional_policy(`
-@@ -287,42 +338,36 @@ optional_policy(`
+@@ -287,42 +342,36 @@ optional_policy(`
')
optional_policy(`
@@ -57293,7 +57342,7 @@ index ff1d68c6a..28ff27c22 100644
allow mailserver_delivery mail_spool_t:dir list_dir_perms;
create_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
-@@ -331,44 +376,48 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
+@@ -331,44 +380,48 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
create_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
read_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t)
@@ -57363,7 +57412,7 @@ index ff1d68c6a..28ff27c22 100644
')
optional_policy(`
-@@ -381,24 +430,49 @@ optional_policy(`
+@@ -381,24 +434,49 @@ optional_policy(`
########################################
#
@@ -63626,7 +63675,7 @@ index a9c60ff87..ad4f14ad6 100644
+ refpolicywarn(`$0($*) has been deprecated.')
')
diff --git a/nsd.te b/nsd.te
-index 47bb1d204..56874943b 100644
+index 47bb1d204..bd2b122ae 100644
--- a/nsd.te
+++ b/nsd.te
@@ -9,9 +9,7 @@ type nsd_t;
@@ -63640,7 +63689,7 @@ index 47bb1d204..56874943b 100644
type nsd_conf_t;
files_type(nsd_conf_t)
-@@ -20,41 +18,50 @@ domain_type(nsd_crond_t)
+@@ -20,40 +18,51 @@ domain_type(nsd_crond_t)
domain_entry_file(nsd_crond_t, nsd_exec_t)
role system_r types nsd_crond_t;
@@ -63695,15 +63744,16 @@ index 47bb1d204..56874943b 100644
manage_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t)
manage_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t)
files_var_lib_filetrans(nsd_t, nsd_zone_t, dir)
-
++allow nsd_t nsd_zone_t:file { map } ;
++
+manage_dirs_pattern(nsd_t, nsd_tmp_t, nsd_tmp_t)
+manage_files_pattern(nsd_t, nsd_tmp_t, nsd_tmp_t)
+files_tmp_filetrans(nsd_t, nsd_tmp_t, { file dir })
-+
++allow nsd_t nsd_tmp_t:file { map } ;
+
can_exec(nsd_t, nsd_exec_t)
- kernel_read_system_state(nsd_t)
-@@ -62,7 +69,6 @@ kernel_read_kernel_sysctls(nsd_t)
+@@ -62,7 +71,6 @@ kernel_read_kernel_sysctls(nsd_t)
corecmd_exec_bin(nsd_t)
@@ -63711,7 +63761,7 @@ index 47bb1d204..56874943b 100644
corenet_all_recvfrom_netlabel(nsd_t)
corenet_tcp_sendrecv_generic_if(nsd_t)
corenet_udp_sendrecv_generic_if(nsd_t)
-@@ -72,16 +78,20 @@ corenet_tcp_sendrecv_all_ports(nsd_t)
+@@ -72,16 +80,20 @@ corenet_tcp_sendrecv_all_ports(nsd_t)
corenet_udp_sendrecv_all_ports(nsd_t)
corenet_tcp_bind_generic_node(nsd_t)
corenet_udp_bind_generic_node(nsd_t)
@@ -63734,7 +63784,7 @@ index 47bb1d204..56874943b 100644
fs_getattr_all_fs(nsd_t)
fs_search_auto_mountpoints(nsd_t)
-@@ -90,8 +100,6 @@ auth_use_nsswitch(nsd_t)
+@@ -90,8 +102,6 @@ auth_use_nsswitch(nsd_t)
logging_send_syslog_msg(nsd_t)
@@ -63743,7 +63793,7 @@ index 47bb1d204..56874943b 100644
userdom_dontaudit_use_unpriv_user_fds(nsd_t)
userdom_dontaudit_search_user_home_dirs(nsd_t)
-@@ -105,23 +113,24 @@ optional_policy(`
+@@ -105,23 +115,24 @@ optional_policy(`
########################################
#
@@ -63777,7 +63827,7 @@ index 47bb1d204..56874943b 100644
manage_files_pattern(nsd_crond_t, nsd_zone_t, nsd_zone_t)
filetrans_pattern(nsd_crond_t, nsd_conf_t, nsd_zone_t, file)
-@@ -133,29 +142,33 @@ kernel_read_system_state(nsd_crond_t)
+@@ -133,29 +144,33 @@ kernel_read_system_state(nsd_crond_t)
corecmd_exec_bin(nsd_crond_t)
corecmd_exec_shell(nsd_crond_t)
@@ -71346,10 +71396,10 @@ index 000000000..abb250dba
+')
diff --git a/pcp.te b/pcp.te
new file mode 100644
-index 000000000..140ec0d3a
+index 000000000..89e89b240
--- /dev/null
+++ b/pcp.te
-@@ -0,0 +1,313 @@
+@@ -0,0 +1,315 @@
+policy_module(pcp, 1.0.0)
+
+########################################
@@ -71656,6 +71706,8 @@ index 000000000..140ec0d3a
+init_read_utmp(pcp_pmlogger_t)
+init_status(pcp_pmlogger_t)
+
++logging_send_syslog_msg(pcp_pmlogger_t)
++
+systemd_exec_systemctl(pcp_pmlogger_t)
+systemd_getattr_unit_files(pcp_pmlogger_t)
+
@@ -88679,7 +88731,7 @@ index 16c8ecbe3..4e021eca7 100644
+ ')
')
diff --git a/redis.te b/redis.te
-index 25cd4175f..84c02e325 100644
+index 25cd4175f..cf565276c 100644
--- a/redis.te
+++ b/redis.te
@@ -12,6 +12,9 @@ init_daemon_domain(redis_t, redis_exec_t)
@@ -88692,17 +88744,20 @@ index 25cd4175f..84c02e325 100644
type redis_log_t;
logging_log_file(redis_log_t)
-@@ -21,6 +24,9 @@ files_type(redis_var_lib_t)
+@@ -21,6 +24,12 @@ files_type(redis_var_lib_t)
type redis_var_run_t;
files_pid_file(redis_var_run_t)
++type redis_tmp_t;
++files_tmp_file(redis_tmp_t)
++
+type redis_unit_file_t;
+systemd_unit_file(redis_unit_file_t)
+
########################################
#
# Local policy
-@@ -31,6 +37,8 @@ allow redis_t self:fifo_file rw_fifo_file_perms;
+@@ -31,6 +40,8 @@ allow redis_t self:fifo_file rw_fifo_file_perms;
allow redis_t self:unix_stream_socket create_stream_socket_perms;
allow redis_t self:tcp_socket create_stream_socket_perms;
@@ -88711,11 +88766,16 @@ index 25cd4175f..84c02e325 100644
manage_dirs_pattern(redis_t, redis_log_t, redis_log_t)
manage_files_pattern(redis_t, redis_log_t, redis_log_t)
manage_lnk_files_pattern(redis_t, redis_log_t, redis_log_t)
-@@ -42,24 +50,27 @@ manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t)
+@@ -42,24 +53,32 @@ manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t)
manage_dirs_pattern(redis_t, redis_var_run_t, redis_var_run_t)
manage_files_pattern(redis_t, redis_var_run_t, redis_var_run_t)
manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t)
+manage_sock_files_pattern(redis_t, redis_var_run_t, redis_var_run_t)
++
++
++manage_dirs_pattern(redis_t, redis_tmp_t, redis_tmp_t)
++manage_files_pattern(redis_t, redis_tmp_t, redis_tmp_t)
++files_tmp_filetrans(redis_t, redis_tmp_t, { dir file })
kernel_read_system_state(redis_t)
+kernel_read_net_sysctls(redis_t)
@@ -89543,7 +89603,7 @@ index 47de2d681..6baf5cdae 100644
+/var/log/pacemaker\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0)
+/var/log/pcsd(/.*)? gen_context(system_u:object_r:cluster_var_log_t,s0)
diff --git a/rhcs.if b/rhcs.if
-index c8bdea28d..beb2872e3 100644
+index c8bdea28d..96da15f8a 100644
--- a/rhcs.if
+++ b/rhcs.if
@@ -1,19 +1,19 @@
@@ -89872,8 +89932,10 @@ index c8bdea28d..beb2872e3 100644
+ manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t)
+')
+
-+########################################
-+## <summary>
+ ########################################
+ ## <summary>
+-## Read and write all cluster domains
+-## shared memory.
+## Read and write to group shared memory.
+## </summary>
+## <param name="domain">
@@ -89893,10 +89955,8 @@ index c8bdea28d..beb2872e3 100644
+ manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t)
+')
+
- ########################################
- ## <summary>
--## Read and write all cluster domains
--## shared memory.
++########################################
++## <summary>
+## Read and write to group shared memory.
## </summary>
## <param name="domain">
@@ -89994,7 +90054,7 @@ index c8bdea28d..beb2872e3 100644
')
######################################
-@@ -446,52 +577,404 @@ interface(`rhcs_domtrans_qdiskd',`
+@@ -446,52 +577,423 @@ interface(`rhcs_domtrans_qdiskd',`
########################################
## <summary>
@@ -90032,10 +90092,16 @@ index c8bdea28d..beb2872e3 100644
#
-interface(`rhcs_admin',`
+interface(`rhcs_read_cluster_lib_files',`
-+ gen_require(`
+ gen_require(`
+- attribute cluster_domain, cluster_pid, cluster_tmpfs;
+- attribute cluster_log;
+- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t;
+- type fenced_tmp_t, qdiskd_var_lib_t;
+ type cluster_var_lib_t;
-+ ')
-+
+ ')
+
+- allow $1 cluster_domain:process { ptrace signal_perms };
+- ps_process_pattern($1, cluster_domain)
+ files_search_var_lib($1)
+ read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t)
+')
@@ -90054,11 +90120,17 @@ index c8bdea28d..beb2872e3 100644
+ gen_require(`
+ type cluster_var_lib_t;
+ ')
-+
+
+- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t })
+- domain_system_change_exemption($1)
+- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r;
+- allow $2 system_r;
+ files_search_var_lib($1)
+ manage_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t)
+')
-+
+
+- files_search_pids($1)
+- admin_pattern($1, cluster_pid)
+####################################
+## <summary>
+## Allow domain to relabel cluster lib files
@@ -90078,7 +90150,9 @@ index c8bdea28d..beb2872e3 100644
+ relabelto_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t)
+ relabelfrom_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t)
+')
-+
+
+- files_search_locks($1)
+- admin_pattern($1, fenced_lock_t)
+######################################
+## <summary>
+## Execute a domain transition to run cluster administrative domain.
@@ -90093,11 +90167,15 @@ index c8bdea28d..beb2872e3 100644
+ gen_require(`
+ type cluster_t, cluster_exec_t;
+ ')
-+
+
+- files_search_tmp($1)
+- admin_pattern($1, fenced_tmp_t)
+ corecmd_search_bin($1)
+ domtrans_pattern($1, cluster_exec_t, cluster_t)
+')
-+
+
+- files_search_var_lib($1)
+- admin_pattern($1, qdiskd_var_lib_t)
+#######################################
+## <summary>
+## Execute cluster init scripts in
@@ -90113,7 +90191,9 @@ index c8bdea28d..beb2872e3 100644
+ gen_require(`
+ type cluster_initrc_exec_t;
+ ')
-+
+
+- fs_search_tmpfs($1)
+- admin_pattern($1, cluster_tmpfs)
+ init_labeled_script_domtrans($1, cluster_initrc_exec_t)
+')
+
@@ -90324,31 +90404,17 @@ index c8bdea28d..beb2872e3 100644
+## </param>
+#
+interface(`rhcs_dbus_chat_cluster',`
- gen_require(`
-- attribute cluster_domain, cluster_pid, cluster_tmpfs;
-- attribute cluster_log;
-- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t;
-- type fenced_tmp_t, qdiskd_var_lib_t;
++ gen_require(`
+ type cluster_t;
+ class dbus send_msg;
- ')
-
-- allow $1 cluster_domain:process { ptrace signal_perms };
-- ps_process_pattern($1, cluster_domain)
++ ')
++
+ allow $1 cluster_t:dbus send_msg;
+ allow cluster_t $1:dbus send_msg;
+')
-
-- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t })
-- domain_system_change_exemption($1)
-- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r;
-- allow $2 system_r;
-
-- files_search_pids($1)
-- admin_pattern($1, cluster_pid)
-
-- files_search_locks($1)
-- admin_pattern($1, fenced_lock_t)
++
++
++
+#####################################
+## <summary>
+## All of the rules required to administrate
@@ -90372,20 +90438,14 @@ index c8bdea28d..beb2872e3 100644
+ type cluster_tmpfs_t, cluster_var_log_t, cluster_var_run_t;
+ type cluster_unit_file_t;
+ ')
-
-- files_search_tmp($1)
-- admin_pattern($1, fenced_tmp_t)
++
+ allow $1 cluster_t:process signal_perms;
+ ps_process_pattern($1, cluster_t)
-
-- files_search_var_lib($1)
-- admin_pattern($1, qdiskd_var_lib_t)
++
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 cluster_t:process ptrace;
+ ')
-
-- fs_search_tmpfs($1)
-- admin_pattern($1, cluster_tmpfs)
++
+ init_labeled_script_domtrans($1, cluster_initrc_exec_t)
+ domain_system_change_exemption($1)
+ role_transition $2 cluster_initrc_exec_t system_r;
@@ -90421,14 +90481,33 @@ index c8bdea28d..beb2872e3 100644
+ gen_require(`
+ type haproxy_unit_file_t;
+ ')
++
++ systemd_exec_systemctl($1)
++ allow $1 haproxy_unit_file_t:service {status start};
++')
++
++########################################
++## <summary>
++## Create log files with a named file
++## type transition.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`rhcs_named_filetrans_log_dir',`
++ gen_require(`
++ type var_log_t;
++ ')
- logging_search_logs($1)
- admin_pattern($1, cluster_log)
-+ systemd_exec_systemctl($1)
-+ allow $1 haproxy_unit_file_t:service {status start};
++ logging_log_named_filetrans($1, var_log_t, dir, "bundles")
')
diff --git a/rhcs.te b/rhcs.te
-index 6cf79c449..7b0fd415b 100644
+index 6cf79c449..5c0bfd05d 100644
--- a/rhcs.te
+++ b/rhcs.te
@@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false)
@@ -90467,7 +90546,7 @@ index 6cf79c449..7b0fd415b 100644
attribute cluster_domain;
attribute cluster_log;
attribute cluster_pid;
-@@ -44,34 +73,291 @@ type foghorn_initrc_exec_t;
+@@ -44,34 +73,295 @@ type foghorn_initrc_exec_t;
init_script_file(foghorn_initrc_exec_t)
rhcs_domain_template(gfs_controld)
@@ -90722,6 +90801,10 @@ index 6cf79c449..7b0fd415b 100644
+')
+
+optional_policy(`
++ rhcs_named_filetrans_log_dir(cluster_t)
++')
++
++optional_policy(`
+ rpc_systemctl_nfsd(cluster_t)
+ rpc_systemctl_rpcd(cluster_t)
+
@@ -90763,7 +90846,7 @@ index 6cf79c449..7b0fd415b 100644
')
#####################################
-@@ -79,13 +365,14 @@ optional_policy(`
+@@ -79,13 +369,14 @@ optional_policy(`
# dlm_controld local policy
#
@@ -90780,7 +90863,7 @@ index 6cf79c449..7b0fd415b 100644
kernel_rw_net_sysctls(dlm_controld_t)
corecmd_exec_bin(dlm_controld_t)
-@@ -98,16 +385,30 @@ fs_manage_configfs_dirs(dlm_controld_t)
+@@ -98,16 +389,30 @@ fs_manage_configfs_dirs(dlm_controld_t)
init_rw_script_tmp_files(dlm_controld_t)
@@ -90814,7 +90897,7 @@ index 6cf79c449..7b0fd415b 100644
manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t)
files_lock_filetrans(fenced_t, fenced_lock_t, file)
-@@ -118,9 +419,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir })
+@@ -118,9 +423,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir })
stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t)
@@ -90826,7 +90909,7 @@ index 6cf79c449..7b0fd415b 100644
corecmd_exec_bin(fenced_t)
corecmd_exec_shell(fenced_t)
-@@ -140,6 +440,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
+@@ -140,6 +444,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
corenet_sendrecv_zented_server_packets(fenced_t)
corenet_tcp_bind_zented_port(fenced_t)
@@ -90835,7 +90918,7 @@ index 6cf79c449..7b0fd415b 100644
corenet_tcp_sendrecv_zented_port(fenced_t)
corenet_sendrecv_http_client_packets(fenced_t)
-@@ -148,9 +450,8 @@ corenet_tcp_sendrecv_http_port(fenced_t)
+@@ -148,9 +454,8 @@ corenet_tcp_sendrecv_http_port(fenced_t)
dev_read_sysfs(fenced_t)
dev_read_urand(fenced_t)
@@ -90847,7 +90930,7 @@ index 6cf79c449..7b0fd415b 100644
storage_raw_read_fixed_disk(fenced_t)
storage_raw_write_fixed_disk(fenced_t)
-@@ -160,7 +461,7 @@ term_getattr_pty_fs(fenced_t)
+@@ -160,7 +465,7 @@ term_getattr_pty_fs(fenced_t)
term_use_generic_ptys(fenced_t)
term_use_ptmx(fenced_t)
@@ -90856,7 +90939,7 @@ index 6cf79c449..7b0fd415b 100644
tunable_policy(`fenced_can_network_connect',`
corenet_sendrecv_all_client_packets(fenced_t)
-@@ -182,7 +483,8 @@ optional_policy(`
+@@ -182,7 +487,8 @@ optional_policy(`
')
optional_policy(`
@@ -90866,7 +90949,7 @@ index 6cf79c449..7b0fd415b 100644
')
optional_policy(`
-@@ -190,12 +492,17 @@ optional_policy(`
+@@ -190,12 +496,17 @@ optional_policy(`
')
optional_policy(`
@@ -90885,7 +90968,7 @@ index 6cf79c449..7b0fd415b 100644
')
optional_policy(`
-@@ -203,6 +510,21 @@ optional_policy(`
+@@ -203,6 +514,21 @@ optional_policy(`
snmp_manage_var_lib_dirs(fenced_t)
')
@@ -90907,7 +90990,7 @@ index 6cf79c449..7b0fd415b 100644
#######################################
#
# foghorn local policy
-@@ -221,16 +543,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
+@@ -221,16 +547,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
corenet_tcp_connect_agentx_port(foghorn_t)
corenet_tcp_sendrecv_agentx_port(foghorn_t)
@@ -90932,7 +91015,7 @@ index 6cf79c449..7b0fd415b 100644
snmp_stream_connect(foghorn_t)
')
-@@ -247,16 +575,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_
+@@ -247,16 +579,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_
stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t)
stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t)
@@ -90954,7 +91037,7 @@ index 6cf79c449..7b0fd415b 100644
optional_policy(`
lvm_exec(gfs_controld_t)
dev_rw_lvm_control(gfs_controld_t)
-@@ -275,10 +607,59 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
+@@ -275,10 +611,59 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
dev_list_sysfs(groupd_t)
@@ -91016,7 +91099,7 @@ index 6cf79c449..7b0fd415b 100644
######################################
#
# qdiskd local policy
-@@ -292,7 +673,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t)
+@@ -292,7 +677,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t)
manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t)
files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file })
@@ -91024,7 +91107,7 @@ index 6cf79c449..7b0fd415b 100644
kernel_read_software_raid_state(qdiskd_t)
kernel_getattr_core_if(qdiskd_t)
-@@ -321,6 +701,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
+@@ -321,6 +705,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
auth_use_nsswitch(qdiskd_t)
@@ -96921,7 +97004,7 @@ index b8b66ff4d..a93346efe 100644
+/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0)
+')
diff --git a/samba.if b/samba.if
-index 50d07fb2e..a34db489c 100644
+index 50d07fb2e..e1474fde7 100644
--- a/samba.if
+++ b/samba.if
@@ -1,8 +1,12 @@
@@ -97282,13 +97365,14 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -400,14 +515,15 @@ interface(`samba_rw_var_files',`
+@@ -400,14 +515,16 @@ interface(`samba_rw_var_files',`
type samba_var_t;
')
+ files_search_var($1)
files_search_var_lib($1)
rw_files_pattern($1, samba_var_t, samba_var_t)
++ allow $1 samba_var_t:file { map};
')
########################################
@@ -97300,7 +97384,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -421,33 +537,55 @@ interface(`samba_manage_var_files',`
+@@ -421,33 +538,55 @@ interface(`samba_manage_var_files',`
')
files_search_var_lib($1)
@@ -97363,7 +97447,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -462,16 +600,16 @@ interface(`samba_domtrans_smbcontrol',`
+@@ -462,16 +601,16 @@ interface(`samba_domtrans_smbcontrol',`
#
interface(`samba_run_smbcontrol',`
gen_require(`
@@ -97383,7 +97467,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -488,9 +626,27 @@ interface(`samba_domtrans_smbd',`
+@@ -488,9 +627,27 @@ interface(`samba_domtrans_smbd',`
domtrans_pattern($1, smbd_exec_t, smbd_t)
')
@@ -97412,7 +97496,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -505,10 +661,26 @@ interface(`samba_signal_smbd',`
+@@ -505,10 +662,26 @@ interface(`samba_signal_smbd',`
allow $1 smbd_t:process signal;
')
@@ -97441,7 +97525,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -526,7 +698,7 @@ interface(`samba_dontaudit_use_fds',`
+@@ -526,7 +699,7 @@ interface(`samba_dontaudit_use_fds',`
########################################
## <summary>
@@ -97450,7 +97534,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -544,7 +716,7 @@ interface(`samba_write_smbmount_tcp_sockets',`
+@@ -544,7 +717,7 @@ interface(`samba_write_smbmount_tcp_sockets',`
########################################
## <summary>
@@ -97459,7 +97543,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -560,49 +732,47 @@ interface(`samba_rw_smbmount_tcp_sockets',`
+@@ -560,49 +733,47 @@ interface(`samba_rw_smbmount_tcp_sockets',`
allow $1 smbmount_t:tcp_socket { read write };
')
@@ -97528,7 +97612,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -618,16 +788,16 @@ interface(`samba_getattr_winbind_exec',`
+@@ -618,16 +789,16 @@ interface(`samba_getattr_winbind_exec',`
#
interface(`samba_run_winbind_helper',`
gen_require(`
@@ -97548,7 +97632,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -637,17 +807,71 @@ interface(`samba_run_winbind_helper',`
+@@ -637,17 +808,71 @@ interface(`samba_run_winbind_helper',`
#
interface(`samba_read_winbind_pid',`
gen_require(`
@@ -97624,7 +97708,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -657,17 +881,61 @@ interface(`samba_read_winbind_pid',`
+@@ -657,17 +882,61 @@ interface(`samba_read_winbind_pid',`
#
interface(`samba_stream_connect_winbind',`
gen_require(`
@@ -97649,12 +97733,10 @@ index 50d07fb2e..a34db489c 100644
+ files_search_tmp($1)
+ stream_connect_pattern($1, winbind_tmp_t, winbind_tmp_t, winbind_t)
+ ')
- ')
-
- ########################################
- ## <summary>
--## All of the rules required to
--## administrate an samba environment.
++')
++
++########################################
++## <summary>
+## Create a set of derived types for apache
+## web content.
+## </summary>
@@ -97682,16 +97764,18 @@ index 50d07fb2e..a34db489c 100644
+
+ domtrans_pattern(smbd_t, samba_$1_script_exec_t, samba_$1_script_t)
+ allow smbd_t samba_$1_script_exec_t:file ioctl;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## All of the rules required to
+-## administrate an samba environment.
+## All of the rules required to administrate
+## an samba environment
## </summary>
## <param name="domain">
## <summary>
-@@ -676,7 +944,7 @@ interface(`samba_stream_connect_winbind',`
+@@ -676,7 +945,7 @@ interface(`samba_stream_connect_winbind',`
## </param>
## <param name="role">
## <summary>
@@ -97700,7 +97784,7 @@ index 50d07fb2e..a34db489c 100644
## </summary>
## </param>
## <rolecap/>
-@@ -689,11 +957,30 @@ interface(`samba_admin',`
+@@ -689,11 +958,30 @@ interface(`samba_admin',`
type samba_etc_t, samba_share_t, samba_initrc_exec_t;
type swat_var_run_t, swat_tmp_t, winbind_log_t;
type winbind_var_run_t, winbind_tmp_t;
@@ -97734,7 +97818,7 @@ index 50d07fb2e..a34db489c 100644
init_labeled_script_domtrans($1, samba_initrc_exec_t)
domain_system_change_exemption($1)
-@@ -703,23 +990,34 @@ interface(`samba_admin',`
+@@ -703,23 +991,34 @@ interface(`samba_admin',`
files_list_etc($1)
admin_pattern($1, { samba_etc_t smbd_keytab_t })
@@ -97781,7 +97865,7 @@ index 50d07fb2e..a34db489c 100644
+ allow $1 samba_unit_file_t:service all_service_perms;
')
diff --git a/samba.te b/samba.te
-index 2b7c441e7..7443a9ded 100644
+index 2b7c441e7..0f95635dd 100644
--- a/samba.te
+++ b/samba.te
@@ -6,99 +6,86 @@ policy_module(samba, 1.16.3)
@@ -98021,12 +98105,13 @@ index 2b7c441e7..7443a9ded 100644
allow samba_net_t samba_etc_t:file read_file_perms;
-@@ -208,19 +206,25 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir })
+@@ -208,19 +206,26 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir })
manage_dirs_pattern(samba_net_t, samba_var_t, samba_var_t)
manage_files_pattern(samba_net_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t)
+manage_sock_files_pattern(samba_net_t, samba_var_t, samba_var_t)
files_var_filetrans(samba_net_t, samba_var_t, dir, "samba")
++allow samba_net_t samba_var_t:file { map } ;
+kernel_read_proc_symlinks(samba_net_t)
kernel_read_system_state(samba_net_t)
@@ -98051,7 +98136,7 @@ index 2b7c441e7..7443a9ded 100644
dev_read_urand(samba_net_t)
-@@ -233,15 +237,22 @@ auth_manage_cache(samba_net_t)
+@@ -233,15 +238,22 @@ auth_manage_cache(samba_net_t)
logging_send_syslog_msg(samba_net_t)
@@ -98078,7 +98163,7 @@ index 2b7c441e7..7443a9ded 100644
')
optional_policy(`
-@@ -249,46 +260,59 @@ optional_policy(`
+@@ -249,46 +261,59 @@ optional_policy(`
')
optional_policy(`
@@ -98151,7 +98236,7 @@ index 2b7c441e7..7443a9ded 100644
manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t)
allow smbd_t samba_share_t:filesystem { getattr quotaget };
-@@ -297,66 +321,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t)
+@@ -297,66 +322,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t)
manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t)
files_var_filetrans(smbd_t, samba_var_t, dir, "samba")
@@ -98250,7 +98335,7 @@ index 2b7c441e7..7443a9ded 100644
fs_getattr_all_fs(smbd_t)
fs_getattr_all_dirs(smbd_t)
-@@ -366,44 +398,53 @@ fs_getattr_rpc_dirs(smbd_t)
+@@ -366,44 +399,53 @@ fs_getattr_rpc_dirs(smbd_t)
fs_list_inotifyfs(smbd_t)
fs_get_all_fs_quotas(smbd_t)
@@ -98316,7 +98401,7 @@ index 2b7c441e7..7443a9ded 100644
')
tunable_policy(`samba_domain_controller',`
-@@ -419,20 +460,16 @@ tunable_policy(`samba_domain_controller',`
+@@ -419,20 +461,16 @@ tunable_policy(`samba_domain_controller',`
')
tunable_policy(`samba_enable_home_dirs',`
@@ -98343,7 +98428,7 @@ index 2b7c441e7..7443a9ded 100644
tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t)
-@@ -441,6 +478,7 @@ tunable_policy(`samba_share_nfs',`
+@@ -441,6 +479,7 @@ tunable_policy(`samba_share_nfs',`
fs_manage_nfs_named_sockets(smbd_t)
')
@@ -98351,7 +98436,7 @@ index 2b7c441e7..7443a9ded 100644
tunable_policy(`samba_share_fusefs',`
fs_manage_fusefs_dirs(smbd_t)
fs_manage_fusefs_files(smbd_t)
-@@ -448,15 +486,10 @@ tunable_policy(`samba_share_fusefs',`
+@@ -448,15 +487,10 @@ tunable_policy(`samba_share_fusefs',`
fs_search_fusefs(smbd_t)
')
@@ -98371,7 +98456,7 @@ index 2b7c441e7..7443a9ded 100644
')
optional_policy(`
-@@ -466,6 +499,7 @@ optional_policy(`
+@@ -466,6 +500,7 @@ optional_policy(`
optional_policy(`
ctdbd_stream_connect(smbd_t)
ctdbd_manage_lib_files(smbd_t)
@@ -98379,7 +98464,7 @@ index 2b7c441e7..7443a9ded 100644
')
optional_policy(`
-@@ -474,11 +508,31 @@ optional_policy(`
+@@ -474,11 +509,31 @@ optional_policy(`
')
optional_policy(`
@@ -98411,7 +98496,7 @@ index 2b7c441e7..7443a9ded 100644
lpd_exec_lpr(smbd_t)
')
-@@ -488,6 +542,10 @@ optional_policy(`
+@@ -488,6 +543,10 @@ optional_policy(`
')
optional_policy(`
@@ -98422,7 +98507,7 @@ index 2b7c441e7..7443a9ded 100644
rpc_search_nfs_state_data(smbd_t)
')
-@@ -499,12 +557,53 @@ optional_policy(`
+@@ -499,12 +558,53 @@ optional_policy(`
udev_read_db(smbd_t)
')
@@ -98477,7 +98562,7 @@ index 2b7c441e7..7443a9ded 100644
allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow nmbd_t self:fd use;
allow nmbd_t self:fifo_file rw_fifo_file_perms;
-@@ -512,9 +611,11 @@ allow nmbd_t self:msg { send receive };
+@@ -512,9 +612,11 @@ allow nmbd_t self:msg { send receive };
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -98492,7 +98577,7 @@ index 2b7c441e7..7443a9ded 100644
manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t)
manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
-@@ -526,20 +627,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
+@@ -526,20 +628,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
@@ -98518,7 +98603,7 @@ index 2b7c441e7..7443a9ded 100644
kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t)
-@@ -547,53 +645,44 @@ kernel_read_kernel_sysctls(nmbd_t)
+@@ -547,53 +646,44 @@ kernel_read_kernel_sysctls(nmbd_t)
kernel_read_network_state(nmbd_t)
kernel_read_software_raid_state(nmbd_t)
kernel_read_system_state(nmbd_t)
@@ -98587,7 +98672,7 @@ index 2b7c441e7..7443a9ded 100644
')
optional_policy(`
-@@ -606,18 +695,29 @@ optional_policy(`
+@@ -606,18 +696,29 @@ optional_policy(`
########################################
#
@@ -98623,7 +98708,7 @@ index 2b7c441e7..7443a9ded 100644
samba_read_config(smbcontrol_t)
samba_search_var(smbcontrol_t)
-@@ -627,39 +727,38 @@ domain_use_interactive_fds(smbcontrol_t)
+@@ -627,39 +728,38 @@ domain_use_interactive_fds(smbcontrol_t)
dev_read_urand(smbcontrol_t)
@@ -98675,7 +98760,7 @@ index 2b7c441e7..7443a9ded 100644
allow smbmount_t samba_secrets_t:file manage_file_perms;
-@@ -668,26 +767,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
+@@ -668,26 +768,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
files_var_filetrans(smbmount_t, samba_var_t, dir, "samba")
@@ -98711,7 +98796,7 @@ index 2b7c441e7..7443a9ded 100644
fs_getattr_cifs(smbmount_t)
fs_mount_cifs(smbmount_t)
-@@ -699,58 +794,77 @@ fs_read_cifs_files(smbmount_t)
+@@ -699,58 +795,77 @@ fs_read_cifs_files(smbmount_t)
storage_raw_read_fixed_disk(smbmount_t)
storage_raw_write_fixed_disk(smbmount_t)
@@ -98804,7 +98889,7 @@ index 2b7c441e7..7443a9ded 100644
manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
-@@ -759,17 +873,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
+@@ -759,17 +874,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
files_pid_filetrans(swat_t, swat_var_run_t, file)
@@ -98828,7 +98913,7 @@ index 2b7c441e7..7443a9ded 100644
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -777,36 +887,25 @@ kernel_read_network_state(swat_t)
+@@ -777,36 +888,25 @@ kernel_read_network_state(swat_t)
corecmd_search_bin(swat_t)
@@ -98871,7 +98956,7 @@ index 2b7c441e7..7443a9ded 100644
auth_domtrans_chk_passwd(swat_t)
auth_use_nsswitch(swat_t)
-@@ -818,10 +917,11 @@ logging_send_syslog_msg(swat_t)
+@@ -818,10 +918,11 @@ logging_send_syslog_msg(swat_t)
logging_send_audit_msgs(swat_t)
logging_search_logs(swat_t)
@@ -98885,7 +98970,7 @@ index 2b7c441e7..7443a9ded 100644
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
-@@ -840,17 +940,20 @@ optional_policy(`
+@@ -840,17 +941,20 @@ optional_policy(`
# Winbind local policy
#
@@ -98912,7 +98997,7 @@ index 2b7c441e7..7443a9ded 100644
allow winbind_t samba_etc_t:dir list_dir_perms;
read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
-@@ -860,9 +963,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
+@@ -860,9 +964,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
@@ -98923,7 +99008,7 @@ index 2b7c441e7..7443a9ded 100644
manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
-@@ -870,41 +971,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t)
+@@ -870,41 +972,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t)
manage_sock_files_pattern(winbind_t, samba_var_t, samba_var_t)
files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
@@ -98982,7 +99067,7 @@ index 2b7c441e7..7443a9ded 100644
corenet_tcp_connect_smbd_port(winbind_t)
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
-@@ -912,38 +1018,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
+@@ -912,38 +1019,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
dev_read_sysfs(winbind_t)
dev_read_urand(winbind_t)
@@ -99041,7 +99126,7 @@ index 2b7c441e7..7443a9ded 100644
')
optional_policy(`
-@@ -959,31 +1079,36 @@ optional_policy(`
+@@ -959,31 +1080,36 @@ optional_policy(`
# Winbind helper local policy
#
@@ -99085,7 +99170,7 @@ index 2b7c441e7..7443a9ded 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -997,25 +1122,38 @@ optional_policy(`
+@@ -997,25 +1123,38 @@ optional_policy(`
########################################
#
@@ -104736,10 +104821,10 @@ index 000000000..88490d5c6
+
diff --git a/snapper.te b/snapper.te
new file mode 100644
-index 000000000..11b39923c
+index 000000000..6631a6500
--- /dev/null
+++ b/snapper.te
-@@ -0,0 +1,83 @@
+@@ -0,0 +1,85 @@
+policy_module(snapper, 1.0.0)
+
+########################################
@@ -104782,6 +104867,7 @@ index 000000000..11b39923c
+manage_dirs_pattern(snapperd_t, snapperd_data_t, snapperd_data_t)
+manage_lnk_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t)
+allow snapperd_t snapperd_data_t:dir mounton;
++allow snapperd_t snapperd_data_t:file relabelfrom;
+snapper_filetrans_named_content(snapperd_t)
+
+domain_read_all_domains_state(snapperd_t)
@@ -104795,6 +104881,7 @@ index 000000000..11b39923c
+files_relabelfrom_isid_type(snapperd_t)
+files_read_all_files(snapperd_t)
+files_list_all(snapperd_t)
++files_rmdir_all_dirs(snapperd_t)
+
+fs_getattr_all_fs(snapperd_t)
+
@@ -107180,7 +107267,7 @@ index 5e1f0534c..e7820bce3 100644
domain_system_change_exemption($1)
role_transition $2 squid_initrc_exec_t system_r;
diff --git a/squid.te b/squid.te
-index 03472ed9b..deade60a1 100644
+index 03472ed9b..87af88795 100644
--- a/squid.te
+++ b/squid.te
@@ -29,7 +29,7 @@ type squid_cache_t;
@@ -107232,13 +107319,14 @@ index 03472ed9b..deade60a1 100644
allow squid_t squid_conf_t:dir list_dir_perms;
allow squid_t squid_conf_t:file read_file_perms;
-@@ -78,15 +86,18 @@ manage_files_pattern(squid_t, squid_log_t, squid_log_t)
+@@ -78,15 +86,19 @@ manage_files_pattern(squid_t, squid_log_t, squid_log_t)
manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t)
logging_log_filetrans(squid_t, squid_log_t, { file dir })
+manage_files_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t)
+manage_dirs_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t)
+fs_tmpfs_filetrans(squid_t, squid_tmpfs_t, { dir file })
++allow squid_t squid_tmpfs_t:file map;
+
manage_dirs_pattern(squid_t, squid_tmp_t, squid_tmp_t)
manage_files_pattern(squid_t, squid_tmp_t, squid_tmp_t)
@@ -107255,7 +107343,7 @@ index 03472ed9b..deade60a1 100644
can_exec(squid_t, squid_exec_t)
-@@ -94,7 +105,6 @@ kernel_read_kernel_sysctls(squid_t)
+@@ -94,7 +106,6 @@ kernel_read_kernel_sysctls(squid_t)
kernel_read_system_state(squid_t)
kernel_read_network_state(squid_t)
@@ -107263,7 +107351,7 @@ index 03472ed9b..deade60a1 100644
corenet_all_recvfrom_netlabel(squid_t)
corenet_tcp_sendrecv_generic_if(squid_t)
corenet_udp_sendrecv_generic_if(squid_t)
-@@ -132,6 +142,7 @@ corenet_tcp_sendrecv_gopher_port(squid_t)
+@@ -132,6 +143,7 @@ corenet_tcp_sendrecv_gopher_port(squid_t)
corenet_udp_sendrecv_gopher_port(squid_t)
corenet_sendrecv_squid_server_packets(squid_t)
@@ -107271,7 +107359,7 @@ index 03472ed9b..deade60a1 100644
corenet_tcp_bind_squid_port(squid_t)
corenet_udp_bind_squid_port(squid_t)
corenet_tcp_sendrecv_squid_port(squid_t)
-@@ -154,7 +165,6 @@ dev_read_urand(squid_t)
+@@ -154,7 +166,6 @@ dev_read_urand(squid_t)
domain_use_interactive_fds(squid_t)
files_read_etc_runtime_files(squid_t)
@@ -107279,7 +107367,7 @@ index 03472ed9b..deade60a1 100644
files_search_spool(squid_t)
files_dontaudit_getattr_tmp_dirs(squid_t)
files_getattr_home_dir(squid_t)
-@@ -176,7 +186,6 @@ libs_exec_lib_files(squid_t)
+@@ -176,7 +187,6 @@ libs_exec_lib_files(squid_t)
logging_send_syslog_msg(squid_t)
miscfiles_read_generic_certs(squid_t)
@@ -107287,7 +107375,7 @@ index 03472ed9b..deade60a1 100644
userdom_use_unpriv_users_fds(squid_t)
userdom_dontaudit_search_user_home_dirs(squid_t)
-@@ -197,28 +206,31 @@ tunable_policy(`squid_use_tproxy',`
+@@ -197,28 +207,31 @@ tunable_policy(`squid_use_tproxy',`
optional_policy(`
apache_content_template(squid)
@@ -107333,7 +107421,7 @@ index 03472ed9b..deade60a1 100644
')
optional_policy(`
-@@ -236,3 +248,24 @@ optional_policy(`
+@@ -236,3 +249,24 @@ optional_policy(`
optional_policy(`
udev_read_db(squid_t)
')
@@ -111773,10 +111861,10 @@ index 000000000..115bf6c42
+/usr/lib/tumbler-?[^/]*/tumblerd -- gen_context(system_u:object_r:thumb_exec_t,s0)
diff --git a/thumb.if b/thumb.if
new file mode 100644
-index 000000000..9524b50aa
+index 000000000..d371f62f6
--- /dev/null
+++ b/thumb.if
-@@ -0,0 +1,134 @@
+@@ -0,0 +1,153 @@
+
+## <summary>policy for thumb</summary>
+
@@ -111800,6 +111888,24 @@ index 000000000..9524b50aa
+ dontaudit thumb_t $1:unix_stream_socket { getattr read write };
+')
+
++########################################
++## <summary>
++## NNP Transition to thumb.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`thumb_nnp_domtrans',`
++ gen_require(`
++ type thumb_t;
++ ')
++
++ allow $1 thumb_t:process2 { nnp_transition nosuid_transition };
++
++')
+
+########################################
+## <summary>
@@ -111823,6 +111929,7 @@ index 000000000..9524b50aa
+ ')
+
+ thumb_domtrans($1)
++ thumb_nnp_domtrans($1)
+ role $2 types thumb_t;
+
+ allow $1 thumb_t:process signal_perms;
@@ -111913,10 +112020,10 @@ index 000000000..9524b50aa
+')
diff --git a/thumb.te b/thumb.te
new file mode 100644
-index 000000000..d6affa561
+index 000000000..a34bf9b9f
--- /dev/null
+++ b/thumb.te
-@@ -0,0 +1,173 @@
+@@ -0,0 +1,174 @@
+policy_module(thumb, 1.0.0)
+
+########################################
@@ -112066,6 +112173,7 @@ index 000000000..d6affa561
+ gnome_manage_gstreamer_home_dirs(thumb_t)
+ gnome_exec_gstreamer_home_files(thumb_t)
+ gnome_create_generic_cache_dir(thumb_t)
++ gnome_setattr_cache_home_dir(thumb_t)
+ gnome_cache_filetrans(thumb_t, thumb_home_t, dir, "thumbnails")
+ gnome_cache_filetrans(thumb_t, thumb_home_t, file)
+')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 232fd61..413882a 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 302%{?dist}
+Release: 303%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -717,6 +717,43 @@ exit 0
%endif
%changelog
+* Thu Nov 16 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-303
+- Allow pcp_pmlogger to send logs to journal BZ(1512367)
+- Merge pull request #40 from lslebodn/kcm_kerberos
+- Allow services to use kerberos KCM BZ(1512128)
+- Allow system_mail_t domain to be system_dbus_client BZ(1512476)
+- Allow aide domain to stream connect to sssd_t BZ(1512500)
+- Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809)
+- Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269)
+- Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584)
+- Allow samba_net_t domain to mmap samba_var_t files BZ(1512227)
+- Allow lircd_t domain to execute shell BZ(1512787)
+- Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814)
+- Allow redis to creating tmp files with own label BZ(1513518)
+- Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502)
+- Allow httpd_t to mmap httpd_tmp_t files BZ(1502303)
+- Add map permission to samba_rw_var_files interface. BZ(1513908)
+- Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
+- Add dac_read_search and dac_override capabilities to ganesha
+- Allow ldap_t domain to manage also slapd_tmp_t lnk files
+- Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584)
+- Add dac_override capability to dhcpd_t doamin BZ(1510030)
+- Allow snapperd_t to remove old snaps BZ(1510862)
+- Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704)
+- Allow xdm_t send signull to all xserver unconfined types BZ(1499390)
+- Allow fs associate for sysctl_vm_t BZ(1447301)
+- Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479)
+- Allow xdm_t domain to read usermodehelper_t state BZ(1412609)
+- Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948)
+- Allow systemd to mmap kernel modules BZ(1513399)
+- Allow userdomains to mmap fifo_files BZ(1512242)
+- Merge pull request #205 from rhatdan/labels
+- Add map permission to init_domtrans() interface BZ(1513832)
+- Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883)
+- Unconfined domains, need to create content with the correct labels
+- Container runtimes are running iptables within a different user namespace
+- Add interface files_rmdir_all_dirs()
+
* Mon Nov 06 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-302
- Allow jabber domains to connect to postgresql ports
- Dontaudit slapd_t to block suspend system