diff --git a/container-selinux.tgz b/container-selinux.tgz
index 734bfcd..efca376 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 9b14adf..a9c04b3 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -49424,10 +49424,10 @@ index 0000000..86e3d01
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..caba12b
+index 0000000..0c415d2
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,978 @@
+@@ -0,0 +1,980 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -50303,6 +50303,8 @@ index 0000000..caba12b
+dev_write_kmsg(systemd_gpt_generator_t)
+dev_read_nvme(systemd_gpt_generator_t)
+
++fs_read_efivarfs_files(systemd_gpt_generator_t)
++
+fstools_exec(systemd_gpt_generator_t)
+
+storage_raw_read_fixed_disk(systemd_gpt_generator_t)
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index e10ed4d..bdb3e50 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -20522,7 +20522,7 @@ index b25b01d..06895f3 100644
')
+
diff --git a/ctdb.te b/ctdb.te
-index 001b502..9892b34 100644
+index 001b502..ac0508e 100644
--- a/ctdb.te
+++ b/ctdb.te
@@ -24,6 +24,9 @@ files_tmp_file(ctdbd_tmp_t)
@@ -20576,7 +20576,7 @@ index 001b502..9892b34 100644
kernel_read_network_state(ctdbd_t)
kernel_read_system_state(ctdbd_t)
kernel_rw_net_sysctls(ctdbd_t)
-@@ -72,10 +89,16 @@ corenet_all_recvfrom_netlabel(ctdbd_t)
+@@ -72,27 +89,38 @@ corenet_all_recvfrom_netlabel(ctdbd_t)
corenet_tcp_sendrecv_generic_if(ctdbd_t)
corenet_tcp_sendrecv_generic_node(ctdbd_t)
corenet_tcp_bind_generic_node(ctdbd_t)
@@ -20593,7 +20593,10 @@ index 001b502..9892b34 100644
corecmd_exec_bin(ctdbd_t)
corecmd_exec_shell(ctdbd_t)
-@@ -85,14 +108,18 @@ dev_read_urand(ctdbd_t)
++corecmd_getattr_all_executables(ctdbd_t)
+
+ dev_read_sysfs(ctdbd_t)
+ dev_read_urand(ctdbd_t)
domain_dontaudit_read_all_domains_state(ctdbd_t)
@@ -20614,10 +20617,12 @@ index 001b502..9892b34 100644
optional_policy(`
consoletype_exec(ctdbd_t)
')
-@@ -106,9 +133,20 @@ optional_policy(`
+@@ -106,9 +134,22 @@ optional_policy(`
')
optional_policy(`
++ rpc_domtrans_rpcd(ctdbd_t)
++ rpc_manage_nfs_state_data_dir(ctdbd_t)
+ rpc_read_nfs_state_data(ctdbd_t)
+')
+
@@ -32425,10 +32430,10 @@ index 0000000..764ae00
+
diff --git a/glusterd.te b/glusterd.te
new file mode 100644
-index 0000000..40c6ade
+index 0000000..03db2af
--- /dev/null
+++ b/glusterd.te
-@@ -0,0 +1,307 @@
+@@ -0,0 +1,308 @@
+policy_module(glusterd, 1.1.3)
+
+## <desc>
@@ -32563,6 +32568,7 @@ index 0000000..40c6ade
+
+corenet_tcp_connect_gluster_port(glusterd_t)
+corenet_tcp_bind_gluster_port(glusterd_t)
++corenet_udp_bind_gluster_port(glusterd_t)
+
+# replacement for rpc.mountd
+corenet_sendrecv_all_server_packets(glusterd_t)
@@ -109138,14 +109144,16 @@ index 97cd155..49321a5 100644
fs_search_auto_mountpoints(timidity_t)
diff --git a/tlp.fc b/tlp.fc
new file mode 100644
-index 0000000..8b8cf4a
+index 0000000..eef708d
--- /dev/null
+++ b/tlp.fc
-@@ -0,0 +1,5 @@
+@@ -0,0 +1,7 @@
+/usr/lib/systemd/system/((tlp-sleep.*)|(tlp.*)) -- gen_context(system_u:object_r:tlp_unit_file_t,s0)
+
+/usr/sbin/tlp -- gen_context(system_u:object_r:tlp_exec_t,s0)
+
++/var/lib/tlp(/.*)? gen_context(system_u:object_r:tlp_var_lib_t,s0)
++
+/var/run/tlp(/.*)? gen_context(system_u:object_r:tlp_var_run_t,s0)
diff --git a/tlp.if b/tlp.if
new file mode 100644
@@ -109339,10 +109347,10 @@ index 0000000..46f12a4
+')
diff --git a/tlp.te b/tlp.te
new file mode 100644
-index 0000000..98e708a
+index 0000000..0183c55
--- /dev/null
+++ b/tlp.te
-@@ -0,0 +1,55 @@
+@@ -0,0 +1,65 @@
+policy_module(tlp, 1.0.0)
+
+########################################
@@ -109357,6 +109365,9 @@ index 0000000..98e708a
+type tlp_var_run_t;
+files_pid_file(tlp_var_run_t)
+
++type tlp_var_lib_t;
++files_type(tlp_var_lib_t)
++
+type tlp_unit_file_t;
+systemd_unit_file(tlp_unit_file_t)
+
@@ -109368,12 +109379,18 @@ index 0000000..98e708a
+allow tlp_t self:unix_stream_socket create_stream_socket_perms;
+allow tlp_t self:udp_socket create_socket_perms;
+allow tlp_t self:unix_dgram_socket create_socket_perms;
++allow tlp_t self:netlink_generic_socket create_socket_perms;
+
+manage_dirs_pattern(tlp_t, tlp_var_run_t, tlp_var_run_t)
+manage_files_pattern(tlp_t, tlp_var_run_t, tlp_var_run_t)
+files_pid_filetrans(tlp_t, tlp_var_run_t, { dir file })
+
++manage_dirs_pattern(tlp_t, tlp_var_lib_t, tlp_var_lib_t)
++manage_files_pattern(tlp_t, tlp_var_lib_t, tlp_var_lib_t)
++files_var_lib_filetrans(tlp_t, tlp_var_lib_t, dir)
++
+kernel_read_system_state(tlp_t)
++kernel_read_network_state(tlp_t)
+kernel_read_fs_sysctls(tlp_t)
+kernel_rw_fs_sysctls(tlp_t)
+kernel_rw_kernel_sysctl(tlp_t)
@@ -109385,6 +109402,7 @@ index 0000000..98e708a
+
+dev_list_sysfs(tlp_t)
+dev_manage_sysfs(tlp_t)
++dev_rw_cpu_microcode(tlp_t)
+
+files_read_kernel_modules(tlp_t)
+
@@ -114622,7 +114640,7 @@ index facdee8..2cff369 100644
+ domtrans_pattern($1,container_file_t, $2)
')
diff --git a/virt.te b/virt.te
-index f03dcf5..9bde200 100644
+index f03dcf5..587e30f 100644
--- a/virt.te
+++ b/virt.te
@@ -1,451 +1,403 @@
@@ -115393,18 +115411,19 @@ index f03dcf5..9bde200 100644
-manage_dirs_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t)
-manage_files_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t)
-filetrans_pattern(virtd_t, virt_var_run_t, virtd_lxc_var_run_t, dir, "lxc")
+-
+-stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t)
+-stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
+manage_dirs_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
+manage_files_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
+filetrans_pattern(virtd_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc")
+allow virtd_t virt_lxc_var_run_t:file { relabelfrom relabelto };
+stream_connect_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t, virtd_lxc_t)
--stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t)
--stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
+-can_exec(virtd_t, virt_tmp_t)
+# libvirtd is permitted to talk to virtlogd
+stream_connect_pattern(virtd_t, virt_var_run_t, virtlogd_var_run_t, virtlogd_t)
-
--can_exec(virtd_t, virt_tmp_t)
++allow virtd_t virtlogd_t:fifo_file rw_inherited_fifo_file_perms;
-kernel_read_crypto_sysctls(virtd_t)
kernel_read_system_state(virtd_t)
@@ -115576,12 +115595,11 @@ index f03dcf5..9bde200 100644
')
optional_policy(`
-- iptables_domtrans(virtd_t)
+ firewalld_dbus_chat(virtd_t)
+')
+
+optional_policy(`
-+ iptables_domtrans(virtd_t)
+ iptables_domtrans(virtd_t)
iptables_initrc_domtrans(virtd_t)
+ iptables_systemctl(virtd_t)
+
@@ -115833,7 +115851,7 @@ index f03dcf5..9bde200 100644
+storage_raw_read_removable_device(virt_domain)
+
+sysnet_read_config(virt_domain)
-+
+
+term_use_all_inherited_terms(virt_domain)
+term_getattr_pty_fs(virt_domain)
+term_use_generic_ptys(virt_domain)
@@ -115846,7 +115864,7 @@ index f03dcf5..9bde200 100644
+optional_policy(`
+ alsa_read_rw_config(virt_domain)
+')
-
++
+optional_policy(`
+ nscd_dontaudit_write_sock_file(virt_domain)
+')
@@ -116206,7 +116224,7 @@ index f03dcf5..9bde200 100644
selinux_get_enforce_mode(virtd_lxc_t)
selinux_get_fs_mount(virtd_lxc_t)
selinux_validate_context(virtd_lxc_t)
-@@ -974,194 +1260,372 @@ selinux_compute_create_context(virtd_lxc_t)
+@@ -974,194 +1260,376 @@ selinux_compute_create_context(virtd_lxc_t)
selinux_compute_relabel_context(virtd_lxc_t)
selinux_compute_user_contexts(virtd_lxc_t)
@@ -116493,6 +116511,7 @@ index f03dcf5..9bde200 100644
+ fs_manage_nfs_symlinks(svirt_sandbox_domain)
+ fs_mount_nfs(svirt_sandbox_domain)
+ fs_unmount_nfs(svirt_sandbox_domain)
++ fs_exec_nfs_files(svirt_sandbox_domain)
+ kernel_rw_fs_sysctls(svirt_sandbox_domain)
+')
+
@@ -116501,6 +116520,7 @@ index f03dcf5..9bde200 100644
+ fs_manage_cifs_dirs(svirt_sandbox_domain)
+ fs_manage_cifs_named_sockets(svirt_sandbox_domain)
+ fs_manage_cifs_symlinks(svirt_sandbox_domain)
++ fs_exec_cifs_files(svirt_sandbox_domain)
+')
+
+tunable_policy(`virt_sandbox_use_fusefs',`
@@ -116509,6 +116529,7 @@ index f03dcf5..9bde200 100644
+ fs_manage_fusefs_symlinks(svirt_sandbox_domain)
+ fs_mount_fusefs(svirt_sandbox_domain)
+ fs_unmount_fusefs(svirt_sandbox_domain)
++ fs_exec_fusefs(svirt_sandbox_domain)
')
optional_policy(`
@@ -116536,6 +116557,7 @@ index f03dcf5..9bde200 100644
+dontaudit container_t self:capability2 block_suspend ;
+allow container_t self:process { execstack execmem };
+manage_chr_files_pattern(container_t, container_file_t, container_file_t)
++manage_blk_files_pattern(container_t, container_file_t, container_file_t)
+
+tunable_policy(`virt_sandbox_use_sys_admin',`
+ allow container_t self:capability sys_admin;
@@ -116723,7 +116745,7 @@ index f03dcf5..9bde200 100644
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
-@@ -1174,12 +1638,12 @@ dev_read_sysfs(virt_qmf_t)
+@@ -1174,12 +1642,12 @@ dev_read_sysfs(virt_qmf_t)
dev_read_rand(virt_qmf_t)
dev_read_urand(virt_qmf_t)
@@ -116738,7 +116760,7 @@ index f03dcf5..9bde200 100644
sysnet_read_config(virt_qmf_t)
optional_policy(`
-@@ -1192,7 +1656,7 @@ optional_policy(`
+@@ -1192,7 +1660,7 @@ optional_policy(`
########################################
#
@@ -116747,7 +116769,7 @@ index f03dcf5..9bde200 100644
#
allow virt_bridgehelper_t self:process { setcap getcap };
-@@ -1201,11 +1665,262 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
+@@ -1201,11 +1669,262 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
allow virt_bridgehelper_t self:tun_socket create_socket_perms;
allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms;
@@ -120367,7 +120389,7 @@ index dd63de0..38ce620 100644
- admin_pattern($1, zabbix_tmpfs_t)
')
diff --git a/zabbix.te b/zabbix.te
-index 7f496c6..fccb7b1 100644
+index 7f496c6..aab4f86 100644
--- a/zabbix.te
+++ b/zabbix.te
@@ -6,27 +6,32 @@ policy_module(zabbix, 1.6.0)
@@ -120545,7 +120567,7 @@ index 7f496c6..fccb7b1 100644
')
########################################
-@@ -132,18 +161,7 @@ optional_policy(`
+@@ -132,18 +161,9 @@ optional_policy(`
# Agent local policy
#
@@ -120556,7 +120578,8 @@ index 7f496c6..fccb7b1 100644
-allow zabbix_agent_t self:shm create_shm_perms;
-allow zabbix_agent_t self:tcp_socket { accept listen };
-allow zabbix_agent_t self:unix_stream_socket create_stream_socket_perms;
--
++allow zabbix_agent_t self:process { setrlimit };
+
-append_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t)
-create_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t)
-setattr_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t)
@@ -120565,7 +120588,7 @@ index 7f496c6..fccb7b1 100644
rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t)
fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file)
-@@ -151,16 +169,13 @@ fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file)
+@@ -151,16 +171,13 @@ fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file)
manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t)
files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file)
@@ -120585,7 +120608,7 @@ index 7f496c6..fccb7b1 100644
corenet_sendrecv_zabbix_agent_server_packets(zabbix_agent_t)
corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t)
-@@ -170,6 +185,30 @@ corenet_sendrecv_ssh_client_packets(zabbix_agent_t)
+@@ -170,6 +187,30 @@ corenet_sendrecv_ssh_client_packets(zabbix_agent_t)
corenet_tcp_connect_ssh_port(zabbix_agent_t)
corenet_tcp_sendrecv_ssh_port(zabbix_agent_t)
@@ -120616,7 +120639,7 @@ index 7f496c6..fccb7b1 100644
corenet_sendrecv_zabbix_client_packets(zabbix_agent_t)
corenet_tcp_connect_zabbix_port(zabbix_agent_t)
corenet_tcp_sendrecv_zabbix_port(zabbix_agent_t)
-@@ -177,21 +216,49 @@ corenet_tcp_sendrecv_zabbix_port(zabbix_agent_t)
+@@ -177,21 +218,49 @@ corenet_tcp_sendrecv_zabbix_port(zabbix_agent_t)
dev_getattr_all_blk_files(zabbix_agent_t)
dev_getattr_all_chr_files(zabbix_agent_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index add1429..569f257 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 231%{?dist}
+Release: 232%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -675,6 +675,17 @@ exit 0
%endif
%changelog
+* Fri Jan 06 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
+- Add tlp_var_lib_t label for /var/lib/tlp directory BZ(1409977)
+- Allow tlp_t domain to read proc_net_t BZ(1403487)
+- Merge pull request #179 from rhatdan/virt1
+- Allow tlp_t domain to read/write cpu microcode BZ(1403103)
+- Allow virt domain to use interited virtlogd domains fifo_file
+- Fixes for containers
+- Allow glusterd_t to bind on glusterd_port_t udp ports.
+- Update ctdbd_t policy to reflect all changes.
+- Allow ctdbd_t domain transition to rpcd_t
+
* Wed Dec 14 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-231
- Allow pptp_t to read /dev/random BZ(1404248)
- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t