diff --git a/container-selinux.tgz b/container-selinux.tgz
index 4ee15e8..5d20257 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 9a30bf1..d16ef44 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -5615,7 +5615,7 @@ index f6eb4851f..3628a384f 100644
+ allow $1 httpd_t:process { noatsecure };
')
diff --git a/apache.te b/apache.te
-index 6649962b6..1362c1bc9 100644
+index 6649962b6..f6ac61e03 100644
--- a/apache.te
+++ b/apache.te
@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
@@ -7836,7 +7836,7 @@ index 6649962b6..1362c1bc9 100644
- fs_exec_nfs_files(httpd_user_script_t)
+ read_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
+ read_lnk_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
-+ allow httpd_t httpd_sys_content_type:file map;
++ allow httpd_t httpd_user_content_type:file map;
')
tunable_policy(`httpd_read_user_content',`
@@ -9212,7 +9212,7 @@ index 9078c3d85..2f6b2503e 100644
+ allow $1 avahi_unit_file_t:service all_service_perms;
')
diff --git a/avahi.te b/avahi.te
-index b8355b32f..7137937b9 100644
+index b8355b32f..51ce1b60f 100644
--- a/avahi.te
+++ b/avahi.te
@@ -13,17 +13,21 @@ type avahi_initrc_exec_t;
@@ -9235,7 +9235,7 @@ index b8355b32f..7137937b9 100644
#
-allow avahi_t self:capability { dac_override setgid chown fowner kill net_admin net_raw setuid sys_chroot };
-+allow avahi_t self:capability { dac_read_search setgid chown fowner kill net_admin net_raw setuid sys_chroot };
++allow avahi_t self:capability { dac_read_search dac_override setgid chown fowner kill net_admin net_raw setuid sys_chroot };
dontaudit avahi_t self:capability sys_tty_config;
allow avahi_t self:process { setrlimit signal_perms getcap setcap };
allow avahi_t self:fifo_file rw_fifo_file_perms;
@@ -40061,10 +40061,10 @@ index 000000000..74206edcb
+
diff --git a/ipa.if b/ipa.if
new file mode 100644
-index 000000000..d611c53d4
+index 000000000..72a6b78ba
--- /dev/null
+++ b/ipa.if
-@@ -0,0 +1,309 @@
+@@ -0,0 +1,310 @@
+## Policy for IPA services.
+
+########################################
@@ -40351,6 +40351,7 @@ index 000000000..d611c53d4
+interface(`ipa_cert_filetrans_named_content',`
+ gen_require(`
+ type ipa_cert_t;
++ type cert_t;
+ ')
+
+ filetrans_pattern($1, cert_t, ipa_cert_t, file ,"ipasession.key")
@@ -40376,10 +40377,10 @@ index 000000000..d611c53d4
+')
diff --git a/ipa.te b/ipa.te
new file mode 100644
-index 000000000..49295fe45
+index 000000000..653c11fb3
--- /dev/null
+++ b/ipa.te
-@@ -0,0 +1,275 @@
+@@ -0,0 +1,276 @@
+policy_module(ipa, 1.0.0)
+
+########################################
@@ -40564,6 +40565,7 @@ index 000000000..49295fe45
+
+kernel_dgram_send(ipa_dnskey_t)
+kernel_read_system_state(ipa_dnskey_t)
++kernel_read_network_state(ipa_dnskey_t)
+
+auth_use_nsswitch(ipa_dnskey_t)
+
@@ -69403,7 +69405,7 @@ index 9b157305b..cb00f200a 100644
+ ')
')
diff --git a/openvswitch.te b/openvswitch.te
-index 44dbc99ab..d11c99a93 100644
+index 44dbc99ab..7bcb16c59 100644
--- a/openvswitch.te
+++ b/openvswitch.te
@@ -9,11 +9,8 @@ type openvswitch_t;
@@ -69469,7 +69471,7 @@ index 44dbc99ab..d11c99a93 100644
manage_lnk_files_pattern(openvswitch_t, openvswitch_log_t, openvswitch_log_t)
logging_log_filetrans(openvswitch_t, openvswitch_log_t, { dir file lnk_file })
-@@ -63,35 +67,63 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
+@@ -63,35 +67,71 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
manage_lnk_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
@@ -69542,6 +69544,14 @@ index 44dbc99ab..d11c99a93 100644
+optional_policy(`
+ plymouthd_exec_plymouth(openvswitch_t)
+')
++
++optional_policy(`
++ networkmanager_read_state(openvswitch_t)
++')
++
++optional_policy(`
++ seutil_domtrans_setfiles(openvswitch_t)
++')
diff --git a/openwsman.fc b/openwsman.fc
new file mode 100644
index 000000000..00d0643d9
@@ -84816,10 +84826,10 @@ index 70ab68b02..b985b6570 100644
+/var/run/neutron(/.*)? gen_context(system_u:object_r:neutron_var_run_t,s0)
+/var/run/quantum(/.*)? gen_context(system_u:object_r:neutron_var_run_t,s0)
diff --git a/quantum.if b/quantum.if
-index afc00688d..589a7fdde 100644
+index afc00688d..e974fad4b 100644
--- a/quantum.if
+++ b/quantum.if
-@@ -2,41 +2,295 @@
+@@ -2,41 +2,314 @@
########################################
##
@@ -84845,13 +84855,12 @@ index afc00688d..589a7fdde 100644
+########################################
+##
+## Allow read/write neutron pipes
- ##
- ##
- ##
- ## Domain allowed access.
- ##
- ##
--##
++##
++##
++##
++## Domain allowed access.
++##
++##
+#
+interface(`neutron_rw_inherited_pipes',`
+ gen_require(`
@@ -84864,13 +84873,13 @@ index afc00688d..589a7fdde 100644
+########################################
+##
+## Send sigchld to neutron.
-+##
-+##
+ ##
+ ##
##
--## Role allowed access.
-+## Domain allowed access.
-+##
-+##
+ ## Domain allowed access.
+ ##
+ ##
+-##
+#
+#
+interface(`neutron_sigchld',`
@@ -84886,7 +84895,8 @@ index afc00688d..589a7fdde 100644
+## Read neutron's log files.
+##
+##
-+##
+ ##
+-## Role allowed access.
+## Domain allowed access.
##
##
@@ -84998,11 +85008,7 @@ index afc00688d..589a7fdde 100644
+ gen_require(`
+ type neutron_var_lib_t;
+ ')
-
-- init_labeled_script_domtrans($1, quantum_initrc_exec_t)
-- domain_system_change_exemption($1)
-- role_transition $2 quantum_initrc_exec_t system_r;
-- allow $2 system_r;
++
+ files_search_var_lib($1)
+ manage_files_pattern($1, neutron_var_lib_t, neutron_var_lib_t)
+ manage_sock_files_pattern($1, neutron_var_lib_t, neutron_var_lib_t)
@@ -85022,7 +85028,11 @@ index afc00688d..589a7fdde 100644
+ gen_require(`
+ type neutron_var_lib_t;
+ ')
-+
+
+- init_labeled_script_domtrans($1, quantum_initrc_exec_t)
+- domain_system_change_exemption($1)
+- role_transition $2 quantum_initrc_exec_t system_r;
+- allow $2 system_r;
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, neutron_var_lib_t, neutron_var_lib_t)
+')
@@ -85091,6 +85101,25 @@ index afc00688d..589a7fdde 100644
+ ps_process_pattern($1, neutron_t)
+')
+
++#######################################
++##
++## Read neutron process state files.
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
++interface(`neutron_read_state',`
++ gen_require(`
++ type neutron_t;
++ ')
++
++ allow $1 neutron_t:dir search_dir_perms;
++ allow $1 neutron_t:file read_file_perms;
++ allow $1 neutron_t:lnk_file read_lnk_file_perms;
++')
+
+########################################
+##
@@ -115158,10 +115187,10 @@ index 3d11c6a3d..3590f3ef9 100644
optional_policy(`
diff --git a/virt.fc b/virt.fc
-index a4f20bcfc..58d0a33f2 100644
+index a4f20bcfc..95abdb144 100644
--- a/virt.fc
+++ b/virt.fc
-@@ -1,51 +1,111 @@
+@@ -1,51 +1,113 @@
-HOME_DIR/\.libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
-HOME_DIR/\.libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0)
-HOME_DIR/\.virtinst(/.*)? gen_context(system_u:object_r:virt_home_t,s0)
@@ -115218,6 +115247,7 @@ index a4f20bcfc..58d0a33f2 100644
+/usr/sbin/virtlockd -- gen_context(system_u:object_r:virtd_exec_t,s0)
+/usr/sbin/virtlogd -- gen_context(system_u:object_r:virtlogd_exec_t,s0)
+/usr/bin/virt-who -- gen_context(system_u:object_r:virtd_exec_t,s0)
++/usr/bin/qemu-pr-helper -- gen_context(system_u:object_r:virtd_exec_t,s0)
+/usr/bin/virsh -- gen_context(system_u:object_r:virsh_exec_t,s0)
+/usr/sbin/condor_vm-gahp -- gen_context(system_u:object_r:virtd_exec_t,s0)
+/usr/sbin/xl -- gen_context(system_u:object_r:virsh_exec_t,s0)
@@ -115251,6 +115281,7 @@ index a4f20bcfc..58d0a33f2 100644
+/var/run/libvirt/virtlogd-sock -s gen_context(system_u:object_r:virtlogd_var_run_t,s0)
+/var/run/libvirt-sandbox(/.*)? gen_context(system_u:object_r:virt_lxc_var_run_t,s0)
+/var/run/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
++/var/run/qemu-pr-helper\.sock -s gen_context(system_u:object_r:virt_var_run_t,s0)
-/var/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
+/var/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
@@ -117537,7 +117568,7 @@ index facdee8b3..2a619ba9e 100644
+ dgram_send_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
')
diff --git a/virt.te b/virt.te
-index f03dcf567..c7a95a908 100644
+index f03dcf567..3fde9b1cd 100644
--- a/virt.te
+++ b/virt.te
@@ -1,451 +1,424 @@
@@ -118150,10 +118181,10 @@ index f03dcf567..c7a95a908 100644
-manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t)
-manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
-manage_sock_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
+-
+-filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, dir, "qemu")
+allow svirt_t self:process ptrace;
--filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, dir, "qemu")
--
-stream_connect_pattern(svirt_t, svirt_home_t, svirt_home_t, virtd_t)
+# it was a part of auth_use_nsswitch
+allow svirt_t self:netlink_route_socket r_netlink_socket_perms;
@@ -118337,12 +118368,12 @@ index f03dcf567..c7a95a908 100644
-stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t)
-stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
+-
+-can_exec(virtd_t, virt_tmp_t)
+# libvirtd is permitted to talk to virtlogd
+stream_connect_pattern(virtd_t, virt_var_run_t, virtlogd_var_run_t, virtlogd_t)
+allow virtd_t virtlogd_t:fifo_file rw_inherited_fifo_file_perms;
--can_exec(virtd_t, virt_tmp_t)
--
-kernel_read_crypto_sysctls(virtd_t)
kernel_read_system_state(virtd_t)
kernel_read_network_state(virtd_t)
@@ -118442,13 +118473,13 @@ index f03dcf567..c7a95a908 100644
+sysnet_read_config(virtd_t)
-userdom_read_all_users_state(virtd_t)
--
--ifdef(`hide_broken_symptoms',`
-- dontaudit virtd_t self:capability { sys_module sys_ptrace };
--')
+systemd_dbus_chat_logind(virtd_t)
+systemd_write_inhibit_pipes(virtd_t)
+-ifdef(`hide_broken_symptoms',`
+- dontaudit virtd_t self:capability { sys_module sys_ptrace };
+-')
+-
-tunable_policy(`virt_use_fusefs',`
- fs_manage_fusefs_dirs(virtd_t)
- fs_manage_fusefs_files(virtd_t)
@@ -118502,7 +118533,7 @@ index f03dcf567..c7a95a908 100644
')
optional_policy(`
-@@ -691,99 +653,445 @@ optional_policy(`
+@@ -691,99 +653,449 @@ optional_policy(`
dnsmasq_kill(virtd_t)
dnsmasq_signull(virtd_t)
dnsmasq_create_pid_dirs(virtd_t)
@@ -118802,6 +118833,10 @@ index f03dcf567..c7a95a908 100644
+')
+
+optional_policy(`
++ openvswitch_stream_connect(svirt_t)
++')
++
++optional_policy(`
+ ptchown_domtrans(virt_domain)
+')
+
@@ -118999,7 +119034,7 @@ index f03dcf567..c7a95a908 100644
kernel_read_system_state(virsh_t)
kernel_read_network_state(virsh_t)
kernel_read_kernel_sysctls(virsh_t)
-@@ -794,25 +1102,18 @@ kernel_write_xen_state(virsh_t)
+@@ -794,25 +1106,18 @@ kernel_write_xen_state(virsh_t)
corecmd_exec_bin(virsh_t)
corecmd_exec_shell(virsh_t)
@@ -119026,7 +119061,7 @@ index f03dcf567..c7a95a908 100644
fs_getattr_all_fs(virsh_t)
fs_manage_xenfs_dirs(virsh_t)
-@@ -821,23 +1122,25 @@ fs_search_auto_mountpoints(virsh_t)
+@@ -821,23 +1126,25 @@ fs_search_auto_mountpoints(virsh_t)
storage_raw_read_fixed_disk(virsh_t)
@@ -119060,7 +119095,7 @@ index f03dcf567..c7a95a908 100644
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virsh_t)
-@@ -856,14 +1159,20 @@ optional_policy(`
+@@ -856,14 +1163,20 @@ optional_policy(`
')
optional_policy(`
@@ -119082,7 +119117,7 @@ index f03dcf567..c7a95a908 100644
xen_stream_connect(virsh_t)
xen_stream_connect_xenstore(virsh_t)
')
-@@ -888,49 +1197,66 @@ optional_policy(`
+@@ -888,49 +1201,66 @@ optional_policy(`
kernel_read_xen_state(virsh_ssh_t)
kernel_write_xen_state(virsh_ssh_t)
@@ -119167,7 +119202,7 @@ index f03dcf567..c7a95a908 100644
corecmd_exec_bin(virtd_lxc_t)
corecmd_exec_shell(virtd_lxc_t)
-@@ -942,17 +1268,16 @@ dev_read_urand(virtd_lxc_t)
+@@ -942,17 +1272,16 @@ dev_read_urand(virtd_lxc_t)
domain_use_interactive_fds(virtd_lxc_t)
@@ -119187,7 +119222,7 @@ index f03dcf567..c7a95a908 100644
fs_getattr_all_fs(virtd_lxc_t)
fs_manage_tmpfs_dirs(virtd_lxc_t)
fs_manage_tmpfs_chr_files(virtd_lxc_t)
-@@ -964,15 +1289,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
+@@ -964,15 +1293,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
fs_unmount_all_fs(virtd_lxc_t)
fs_relabelfrom_tmpfs(virtd_lxc_t)
@@ -119206,7 +119241,7 @@ index f03dcf567..c7a95a908 100644
term_use_generic_ptys(virtd_lxc_t)
term_use_ptmx(virtd_lxc_t)
-@@ -982,186 +1303,307 @@ auth_use_nsswitch(virtd_lxc_t)
+@@ -982,186 +1307,307 @@ auth_use_nsswitch(virtd_lxc_t)
logging_send_syslog_msg(virtd_lxc_t)
@@ -119643,7 +119678,7 @@ index f03dcf567..c7a95a908 100644
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
-@@ -1174,12 +1616,12 @@ dev_read_sysfs(virt_qmf_t)
+@@ -1174,12 +1620,12 @@ dev_read_sysfs(virt_qmf_t)
dev_read_rand(virt_qmf_t)
dev_read_urand(virt_qmf_t)
@@ -119658,7 +119693,7 @@ index f03dcf567..c7a95a908 100644
sysnet_read_config(virt_qmf_t)
optional_policy(`
-@@ -1192,7 +1634,7 @@ optional_policy(`
+@@ -1192,7 +1638,7 @@ optional_policy(`
########################################
#
@@ -119667,7 +119702,7 @@ index f03dcf567..c7a95a908 100644
#
allow virt_bridgehelper_t self:process { setcap getcap };
-@@ -1201,11 +1643,264 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
+@@ -1201,11 +1647,264 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
allow virt_bridgehelper_t self:tun_socket create_socket_perms;
allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms;
@@ -122822,6 +122857,16 @@ index 0928c5d6a..99a430031 100644
miscfiles_read_fonts(xfs_t)
userdom_dontaudit_use_unpriv_user_fds(xfs_t)
+diff --git a/xguest.if b/xguest.if
+index 4f1d07d71..5c819abe8 100644
+--- a/xguest.if
++++ b/xguest.if
+@@ -1,4 +1,4 @@
+-## Least privledge xwindows user role.
++## Least privileged xwindows user role.
+
+ ########################################
+ ##
diff --git a/xguest.te b/xguest.te
index a64aad347..12dc86b2f 100644
--- a/xguest.te
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 2a92476..9346077 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 296%{?dist}
+Release: 297%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -722,6 +722,16 @@ exit 0
%endif
%changelog
+* Fri Oct 20 2017 Lukas Vrabec - 3.13.1-297
+- Fix typo in virt file contexts file
+- allow ipa_dnskey_t to read /proc/net/unix file
+- Allow openvswitch to run setfiles in setfiles_t domain.
+- Allow openvswitch_t domain to read process data of neutron_t domains
+- Fix typo in ipa_cert_filetrans_named_content() interface
+- Fix typo bug in summary of xguest SELinux module
+- Allow virtual machine with svirt_t label to stream connect to openvswitch.
+- Label qemu-pr-helper script as virt_exec_t so this script won't run as unconfined_service_t
+
* Tue Oct 17 2017 Lukas Vrabec - 3.13.1-296
- Merge pull request #19 from RodrigoQuesadaDev/snapper-fix-1
- Allow httpd_t domain to mmap httpd_user_content_t files. BZ(1494852)