diff --git a/.gitignore b/.gitignore
index c2c88c3..271aee1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
 SOURCES/container-selinux.tgz
-SOURCES/selinux-policy-55f4df9.tar.gz
-SOURCES/selinux-policy-contrib-73a88dc.tar.gz
+SOURCES/selinux-policy-8f56f63.tar.gz
+SOURCES/selinux-policy-contrib-e231b3e.tar.gz
diff --git a/.selinux-policy.metadata b/.selinux-policy.metadata
index c4abb92..8ba77ee 100644
--- a/.selinux-policy.metadata
+++ b/.selinux-policy.metadata
@@ -1,3 +1,3 @@
-526c41eed592a718650dde4345718e26fc32b581 SOURCES/container-selinux.tgz
-c10a1f894f9a2b1eb2159c2c753d97a5ff788887 SOURCES/selinux-policy-55f4df9.tar.gz
-77721918853ad9706dc2189c1787587ee6c3b72e SOURCES/selinux-policy-contrib-73a88dc.tar.gz
+1e65dcb828792d3eba6cf15383ab9da3132e8b8b SOURCES/container-selinux.tgz
+672cfe526149ad56c857a79856e769548d9ead8e SOURCES/selinux-policy-8f56f63.tar.gz
+f386b378f3a398fc17dfbaa3acfacbeaeaf5e0b4 SOURCES/selinux-policy-contrib-e231b3e.tar.gz
diff --git a/SOURCES/file_contexts.subs_dist b/SOURCES/file_contexts.subs_dist
index f64b231..0f127d9 100644
--- a/SOURCES/file_contexts.subs_dist
+++ b/SOURCES/file_contexts.subs_dist
@@ -17,3 +17,4 @@
 /var/roothome        /root
 /sbin                /usr/sbin
 /sysroot/tmp         /tmp
+/var/usrlocal        /usr/local
diff --git a/SOURCES/modules-targeted-contrib.conf b/SOURCES/modules-targeted-contrib.conf
index 7c6c66d..de87626 100644
--- a/SOURCES/modules-targeted-contrib.conf
+++ b/SOURCES/modules-targeted-contrib.conf
@@ -720,13 +720,6 @@ git = module
 # 
 glance = module
 
-# Layer: contrib
-# Module: glusterd
-#  
-#  policy for glusterd service
-#
-glusterd =  module
-
 # Layer: apps
 # Module: gnome
 #
@@ -2012,7 +2005,7 @@ timidity = off
 tmpreaper = module
 
 # Layer: contrib
-# Module: glusterd
+# Module: tomcat
 #  
 #  policy for tomcat service
 #
diff --git a/SPECS/selinux-policy.spec b/SPECS/selinux-policy.spec
index d403220..fae0cc8 100644
--- a/SPECS/selinux-policy.spec
+++ b/SPECS/selinux-policy.spec
@@ -1,11 +1,11 @@
 # github repo with selinux-policy base sources
 %global git0 https://github.com/fedora-selinux/selinux-policy
-%global commit0 55f4df96a3aff2ed1791e428385e1967856eed49
+%global commit0 8f56f631a921d043bc8176f7c64a38cd77b48f66
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 # github repo with selinux-policy contrib sources
 %global git1 https://github.com/fedora-selinux/selinux-policy-contrib
-%global commit1 73a88dc7435b803ba860e8938c9611dd62ef6d5c
+%global commit1 e231b3e6ede7acd60339cc7264bbdba1da6014d2
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
 %define distro redhat
@@ -29,7 +29,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.14.3
-Release: 67%{?dist}.2
+Release: 80%{?dist}
 License: GPLv2+
 Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
 Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz
@@ -715,13 +715,215 @@ exit 0
 %endif
 
 %changelog
-* Thu Sep 02 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-67.2
+* Thu Sep 16 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-80
+- Allow rhsmcertd_t dbus chat with anaconda install_t
+Resolves: rhbz#2002666
+
+* Fri Aug 27 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
+- Introduce xdm_manage_bootloader booelan
+Resolves: rhbz#1994096
+- Rename samba_exec() to samba_exec_net()
+Resolves: rhbz#1855215
+- Allow sssd to set samba setting
+Resolves: rhbz#1855215
+- Allow dirsrv read slapd tmpfs files
+Resolves: rhbz#1843238
+- Allow rhsmcertd to create cache file in /var/cache/cloud-what
+Resolves: rhbz#1994718
+
+* Wed Aug 25 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
+- Label /usr/bin/Xwayland with xserver_exec_t
+Resolves: rhbz#1984584
+- Label /usr/libexec/gdm-runtime-config with xdm_exec_t
+Resolves: rhbz#1984584
+- Allow D-bus communication between avahi and sosreport
+Resolves: rhbz#1916397
+- Allow lldpad send to kdumpctl over a unix dgram socket
+Resolves: rhbz#1979121
+- Revert "Allow lldpad send to kdump over a unix dgram socket"
+Resolves: rhbz#1979121
+- Allow chronyc respond to a user chronyd instance
+Resolves: rhbz#1993104
+- Allow ptp4l respond to pmc
+Resolves: rhbz#1993104
+- Allow lldpad send to unconfined_t over a unix dgram socket
+Resolves: rhbz#1993270
+
+* Thu Aug 12 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
+- Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
+Resolves: rhbz#1887739
+- Allow sysadm to read/write scsi files and manage shadow
+Resolves: rhbz#1956302
+- Allow rhsmcertd execute gpg
+Resolves: rhbz#1887572
+- Allow lldpad send to kdump over a unix dgram socket
+Resolves: rhbz#1979121
+- Remove glusterd SELinux module from distribution policy
+Resolves: rhbz#1816718
+
+* Tue Aug 10 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
+- Allow login_userdomain read and map /var/lib/systemd files
+Resolves: rhbz#1965251
+- Allow sysadm acces to kernel module resources
+Resolves: rhbz#1965251
+- Allow sysadm to read/write scsi files and manage shadow
+Resolves: rhbz#1965251
+- Allow sysadm access to files_unconfined and bind rpc ports
+Resolves: rhbz#1965251
+- Allow sysadm read and view kernel keyrings
+Resolves: rhbz#1965251
+- Allow bootloader to read tuned etc files
+Resolves: rhbz#1965251
+- Update the policy for systemd-journal-upload
+Resolves: rhbz#1913414
+- Allow journal mmap and read var lib files
+Resolves: rhbz#1965251
+- Allow tuned to read rhsmcertd config files
+Resolves: rhbz#1965251
+- Allow bootloader to read tuned etc files
+Resolves: rhbz#1965251
+- Confine rhsm service and rhsm-facts service as rhsmcertd_t
+Resolves: rhbz#1846081
+- Allow virtlogd_t read process state of user domains
+Resolves: rhbz#1797899
+- Allow cockpit_ws_t get attributes of fs_t filesystems
+Resolves: rhbz#1979182
+
+* Thu Jul 29 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
+- Add the unconfined_dgram_send() interface
+Resolves: rhbz#1978562
+- Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
+Resolves: rhbz#1936522
+- Add checkpoint_restore cap2 capability
+Resolves: rhbz#1973325
+- Allow fcoemon talk with unconfined user over unix domain datagram socket
+Resolves: rhbz#1978562
+- Allow hostapd bind UDP sockets to the dhcpd port
+Resolves: rhbz#1977676
+- Allow NetworkManager read and write z90crypt device
+Resolves: rhbz#1938203
+- Allow abrt_domain read and write z90crypt device
+Resolves: rhbz#1938203
+- Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
+Resolves: rhbz#1937111
+- Allow mdadm read iscsi pid files
+Resolves: rhbz#1924716
+
+* Fri Jul 16 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-74
+- Allow dyntransition from sshd_t to unconfined_t
+Resolves: rhbz#1947841
+
+* Wed Jul 14 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
+- Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
+Resolves: rhbz#1947841
+- Allow transition from xdm domain to unconfined_t domain.
+Resolves: rhbz#1947841
+- Allow nftables read NetworkManager unnamed pipes
+Resolves: rhbz#1967857
+- Create a policy for systemd-journal-upload
+Resolves: rhbz#1913414
+- Add dev_getattr_infiniband_dev() interface.
+Resolves: rhbz#1972522
+- Allow tcpdump and nmap get attributes of infiniband_device_t
+Resolves: rhbz#1972522
+- Allow fcoemon create sysfs files
+Resolves: rhbz#1978562
+- Allow nftables read NetworkManager unnamed pipes
+Resolves: rhbz#1967857
+- Allow radius map its library files
+Resolves: rhbz#1854650
+- Allow arpwatch get attributes of infiniband_device_t devices
+Resolves: rhbz#1936522
+
+* Tue Jun 29 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
+- Allow systemd-sleep get attributes of fixed disk device nodes
+Resolves: rhbz#1931460
+- Allow systemd-sleep create hardware state information files
+Resolves: rhbz#1968610
+- virtiofs supports Xattrs and SELinux
+Resolves: rhbz#1899703
+- Label 4460/tcp port as ntske_port_t
+Resolves: rhbz#1961207
+- Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
+Resolves: rhbz#1961207
+- Allow chronyd_t to accept and make NTS-KE connections
+Resolves: rhbz#1961207
+- Dontaudit NetworkManager write to initrc_tmp_t pipes
+Resolves: rhbz#1963162
+- Allow logrotate rotate container log files
+Resolves: rhbz#1892170
+- Allow rhsmd read process state of all domains and kernel threads
+Resolves: rhbz#1878020
+
+* Tue Jun 15 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-71
+- Allow nmap create and use rdma socket
+Resolves: rhbz#1844530
 - Label /.k5identity file allow read of this file to rpc.gssd
-Resolves: rhbz#1995594
-
-* Tue Jun 29 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-67.1
+Resolves: rhbz#1951093
 - Label /var/lib/kdump with kdump_var_lib_t
-Resolves: rhbz#1976260
+Resolves: rhbz#1965985
+- Label /run/libvirt/common with virt_common_var_run_t
+Resolves: rhbz#1966842
+
+* Wed Jun 09 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-70
+- Allow using opencryptoki for ipsec
+Resolves: rhbz#1894132
+- Remove all kernel_getattr_proc() interface calls
+Resolves: rhbz#1967125
+- Allow domain stat /proc filesystem
+Resolves: rhbz#1967125
+- Allow pkcs-slotd create and use netlink_kobject_uevent_socket
+Resolves: rhbz#1969725
+- Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
+Resolves: rhbz#1894132
+- Allow using opencryptoki for certmonger
+Resolves: rhbz#1894132
+- install_t: Allow NoNewPriv transition from systemd
+Resolves: rhbz#1955547
+- Remove all kernel_getattr_proc() interface calls
+Resolves: rhbz#1967125
+- Allow httpd_sys_script_t read, write, and map hugetlbfs files
+Resolves: rhbz#1966133
+
+* Wed Jun 02 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-69
+- Add /var/usrlocal equivalency rule
+Resolves: rhbz#1943381
+- Label '/var/usrlocal/(.*/)?sbin(/.*)?' as bin_t
+Resolves: rhbz#1943381
+- Label /dev/trng with random_device_t
+Resolves: rhbz#1934483
+- Allow systemd-sleep transition to sysstat_t
+Resolves: rhbz#1927551
+- Allow systemd-sleep transition to tlp_t
+Resolves: rhbz#1927551
+- Allow systemd-sleep transition to unconfined_service_t on bin_t executables
+Resolves: rhbz#1927551
+- Allow systemd-sleep execute generic programs
+Resolves: rhbz#1948070
+- Allow systemd-sleep execute shell
+Resolves: rhbz#1954358
+- Allow nsswitch_domain read init pid lnk_files
+Resolves: rhbz#1860924
+- Introduce logging_syslogd_list_non_security_dirs tunable
+Resolves: rhbz#1823669
+- Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
+Resolves: rhbz#1927551
+- Change param description in cron interfaces to userdomain_prefix
+Resolves: rhbz#1801249
+- Add missing declaration in rpm_named_filetrans()
+Resolves: rhbz#1801249
+
+* Thu May 20 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-68
+- Allow pluto IKEv2 / ESP over TCP
+Resolves: rhbz#1931848
+- Label SDC(scini) Dell Driver
+Resolves: rhbz#1936882
+- Add file context specification for /var/tmp/tmp-inst
+Resolves: rhbz#1919253
+- Allow virtlogd_t to create virt_var_lockd_t dir
+Resolves: rhbz#1941464
+- Allow cups-lpd read its private runtime socket files
+Resolves: rhbz#1919399
 
 * Mon Mar 15 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-67
 - Allow systemd the audit_control capability conditionally