diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 89f5679..c3f3910 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -10876,7 +10876,7 @@ index b876c48..03f9342 100644
+/nsr(/.*)? gen_context(system_u:object_r:var_t,s0)
+/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index f962f76..a226015 100644
+index f962f76..7c3c35b 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -19,6 +19,136 @@
@@ -12776,7 +12776,19 @@ index f962f76..a226015 100644
')
########################################
-@@ -4217,6 +5039,175 @@ interface(`files_read_world_readable_sockets',`
+@@ -4012,6 +4834,11 @@ interface(`files_read_kernel_modules',`
+ allow $1 modules_object_t:dir list_dir_perms;
+ read_files_pattern($1, modules_object_t, modules_object_t)
+ read_lnk_files_pattern($1, modules_object_t, modules_object_t)
++
++ # allow to read module deps because of labeling changed to modules_dep_t
++ optional_policy(`
++ modutils_read_module_deps($1)
++ ')
+ ')
+
+ ########################################
+@@ -4217,6 +5044,175 @@ interface(`files_read_world_readable_sockets',`
allow $1 readable_t:sock_file read_sock_file_perms;
')
@@ -12952,7 +12964,7 @@ index f962f76..a226015 100644
########################################
## <summary>
## Allow the specified type to associate
-@@ -4239,6 +5230,26 @@ interface(`files_associate_tmp',`
+@@ -4239,6 +5235,26 @@ interface(`files_associate_tmp',`
########################################
## <summary>
@@ -12979,7 +12991,7 @@ index f962f76..a226015 100644
## Get the attributes of the tmp directory (/tmp).
## </summary>
## <param name="domain">
-@@ -4252,17 +5263,37 @@ interface(`files_getattr_tmp_dirs',`
+@@ -4252,17 +5268,37 @@ interface(`files_getattr_tmp_dirs',`
type tmp_t;
')
@@ -13018,7 +13030,7 @@ index f962f76..a226015 100644
## </summary>
## </param>
#
-@@ -4289,6 +5320,8 @@ interface(`files_search_tmp',`
+@@ -4289,6 +5325,8 @@ interface(`files_search_tmp',`
type tmp_t;
')
@@ -13027,7 +13039,7 @@ index f962f76..a226015 100644
allow $1 tmp_t:dir search_dir_perms;
')
-@@ -4325,6 +5358,7 @@ interface(`files_list_tmp',`
+@@ -4325,6 +5363,7 @@ interface(`files_list_tmp',`
type tmp_t;
')
@@ -13035,7 +13047,7 @@ index f962f76..a226015 100644
allow $1 tmp_t:dir list_dir_perms;
')
-@@ -4334,7 +5368,7 @@ interface(`files_list_tmp',`
+@@ -4334,7 +5373,7 @@ interface(`files_list_tmp',`
## </summary>
## <param name="domain">
## <summary>
@@ -13044,7 +13056,7 @@ index f962f76..a226015 100644
## </summary>
## </param>
#
-@@ -4346,21 +5380,41 @@ interface(`files_dontaudit_list_tmp',`
+@@ -4346,21 +5385,41 @@ interface(`files_dontaudit_list_tmp',`
dontaudit $1 tmp_t:dir list_dir_perms;
')
@@ -13092,7 +13104,7 @@ index f962f76..a226015 100644
allow $1 tmp_t:dir del_entry_dir_perms;
')
-@@ -4402,6 +5456,32 @@ interface(`files_manage_generic_tmp_dirs',`
+@@ -4402,6 +5461,32 @@ interface(`files_manage_generic_tmp_dirs',`
########################################
## <summary>
@@ -13125,7 +13137,7 @@ index f962f76..a226015 100644
## Manage temporary files and directories in /tmp.
## </summary>
## <param name="domain">
-@@ -4456,6 +5536,42 @@ interface(`files_rw_generic_tmp_sockets',`
+@@ -4456,6 +5541,42 @@ interface(`files_rw_generic_tmp_sockets',`
########################################
## <summary>
@@ -13168,7 +13180,7 @@ index f962f76..a226015 100644
## Set the attributes of all tmp directories.
## </summary>
## <param name="domain">
-@@ -4474,6 +5590,60 @@ interface(`files_setattr_all_tmp_dirs',`
+@@ -4474,6 +5595,60 @@ interface(`files_setattr_all_tmp_dirs',`
########################################
## <summary>
@@ -13229,7 +13241,7 @@ index f962f76..a226015 100644
## List all tmp directories.
## </summary>
## <param name="domain">
-@@ -4519,7 +5689,7 @@ interface(`files_relabel_all_tmp_dirs',`
+@@ -4519,7 +5694,7 @@ interface(`files_relabel_all_tmp_dirs',`
## </summary>
## <param name="domain">
## <summary>
@@ -13238,7 +13250,7 @@ index f962f76..a226015 100644
## </summary>
## </param>
#
-@@ -4579,7 +5749,7 @@ interface(`files_relabel_all_tmp_files',`
+@@ -4579,7 +5754,7 @@ interface(`files_relabel_all_tmp_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -13247,7 +13259,7 @@ index f962f76..a226015 100644
## </summary>
## </param>
#
-@@ -4611,6 +5781,44 @@ interface(`files_read_all_tmp_files',`
+@@ -4611,6 +5786,44 @@ interface(`files_read_all_tmp_files',`
########################################
## <summary>
@@ -13292,7 +13304,7 @@ index f962f76..a226015 100644
## Create an object in the tmp directories, with a private
## type using a type transition.
## </summary>
-@@ -4664,6 +5872,16 @@ interface(`files_purge_tmp',`
+@@ -4664,6 +5877,16 @@ interface(`files_purge_tmp',`
delete_lnk_files_pattern($1, tmpfile, tmpfile)
delete_fifo_files_pattern($1, tmpfile, tmpfile)
delete_sock_files_pattern($1, tmpfile, tmpfile)
@@ -13309,7 +13321,7 @@ index f962f76..a226015 100644
')
########################################
-@@ -5112,6 +6330,24 @@ interface(`files_create_kernel_symbol_table',`
+@@ -5112,6 +6335,24 @@ interface(`files_create_kernel_symbol_table',`
########################################
## <summary>
@@ -13334,7 +13346,7 @@ index f962f76..a226015 100644
## Read system.map in the /boot directory.
## </summary>
## <param name="domain">
-@@ -5241,6 +6477,24 @@ interface(`files_list_var',`
+@@ -5241,6 +6482,24 @@ interface(`files_list_var',`
########################################
## <summary>
@@ -13359,7 +13371,7 @@ index f962f76..a226015 100644
## Create, read, write, and delete directories
## in the /var directory.
## </summary>
-@@ -5328,7 +6582,7 @@ interface(`files_dontaudit_rw_var_files',`
+@@ -5328,7 +6587,7 @@ interface(`files_dontaudit_rw_var_files',`
type var_t;
')
@@ -13368,7 +13380,7 @@ index f962f76..a226015 100644
')
########################################
-@@ -5527,6 +6781,25 @@ interface(`files_rw_var_lib_dirs',`
+@@ -5527,6 +6786,25 @@ interface(`files_rw_var_lib_dirs',`
########################################
## <summary>
@@ -13394,7 +13406,7 @@ index f962f76..a226015 100644
## Create objects in the /var/lib directory
## </summary>
## <param name="domain">
-@@ -5596,6 +6869,25 @@ interface(`files_read_var_lib_symlinks',`
+@@ -5596,6 +6874,25 @@ interface(`files_read_var_lib_symlinks',`
read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
')
@@ -13420,7 +13432,7 @@ index f962f76..a226015 100644
# cjp: the next two interfaces really need to be fixed
# in some way. They really neeed their own types.
-@@ -5641,7 +6933,7 @@ interface(`files_manage_mounttab',`
+@@ -5641,7 +6938,7 @@ interface(`files_manage_mounttab',`
########################################
## <summary>
@@ -13429,7 +13441,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5649,12 +6941,13 @@ interface(`files_manage_mounttab',`
+@@ -5649,12 +6946,13 @@ interface(`files_manage_mounttab',`
## </summary>
## </param>
#
@@ -13445,7 +13457,7 @@ index f962f76..a226015 100644
')
########################################
-@@ -5672,6 +6965,7 @@ interface(`files_search_locks',`
+@@ -5672,6 +6970,7 @@ interface(`files_search_locks',`
type var_t, var_lock_t;
')
@@ -13453,7 +13465,7 @@ index f962f76..a226015 100644
allow $1 var_lock_t:lnk_file read_lnk_file_perms;
search_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5698,7 +6992,26 @@ interface(`files_dontaudit_search_locks',`
+@@ -5698,7 +6997,26 @@ interface(`files_dontaudit_search_locks',`
########################################
## <summary>
@@ -13481,7 +13493,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5706,13 +7019,12 @@ interface(`files_dontaudit_search_locks',`
+@@ -5706,13 +7024,12 @@ interface(`files_dontaudit_search_locks',`
## </summary>
## </param>
#
@@ -13498,7 +13510,7 @@ index f962f76..a226015 100644
')
########################################
-@@ -5731,7 +7043,7 @@ interface(`files_rw_lock_dirs',`
+@@ -5731,7 +7048,7 @@ interface(`files_rw_lock_dirs',`
type var_t, var_lock_t;
')
@@ -13507,7 +13519,7 @@ index f962f76..a226015 100644
rw_dirs_pattern($1, var_t, var_lock_t)
')
-@@ -5764,7 +7076,6 @@ interface(`files_create_lock_dirs',`
+@@ -5764,7 +7081,6 @@ interface(`files_create_lock_dirs',`
## Domain allowed access.
## </summary>
## </param>
@@ -13515,7 +13527,7 @@ index f962f76..a226015 100644
#
interface(`files_relabel_all_lock_dirs',`
gen_require(`
-@@ -5779,7 +7090,7 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5779,7 +7095,7 @@ interface(`files_relabel_all_lock_dirs',`
########################################
## <summary>
@@ -13524,7 +13536,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -5787,13 +7098,33 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5787,13 +7103,33 @@ interface(`files_relabel_all_lock_dirs',`
## </summary>
## </param>
#
@@ -13559,7 +13571,7 @@ index f962f76..a226015 100644
allow $1 var_lock_t:dir list_dir_perms;
getattr_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5809,13 +7140,12 @@ interface(`files_getattr_generic_locks',`
+@@ -5809,13 +7145,12 @@ interface(`files_getattr_generic_locks',`
## </param>
#
interface(`files_delete_generic_locks',`
@@ -13577,7 +13589,7 @@ index f962f76..a226015 100644
')
########################################
-@@ -5834,9 +7164,7 @@ interface(`files_manage_generic_locks',`
+@@ -5834,9 +7169,7 @@ interface(`files_manage_generic_locks',`
type var_t, var_lock_t;
')
@@ -13588,7 +13600,7 @@ index f962f76..a226015 100644
manage_files_pattern($1, var_lock_t, var_lock_t)
')
-@@ -5878,8 +7206,7 @@ interface(`files_read_all_locks',`
+@@ -5878,8 +7211,7 @@ interface(`files_read_all_locks',`
type var_t, var_lock_t;
')
@@ -13598,7 +13610,7 @@ index f962f76..a226015 100644
allow $1 lockfile:dir list_dir_perms;
read_files_pattern($1, lockfile, lockfile)
read_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5901,8 +7228,7 @@ interface(`files_manage_all_locks',`
+@@ -5901,8 +7233,7 @@ interface(`files_manage_all_locks',`
type var_t, var_lock_t;
')
@@ -13608,7 +13620,7 @@ index f962f76..a226015 100644
manage_dirs_pattern($1, lockfile, lockfile)
manage_files_pattern($1, lockfile, lockfile)
manage_lnk_files_pattern($1, lockfile, lockfile)
-@@ -5939,8 +7265,7 @@ interface(`files_lock_filetrans',`
+@@ -5939,8 +7270,7 @@ interface(`files_lock_filetrans',`
type var_t, var_lock_t;
')
@@ -13618,7 +13630,7 @@ index f962f76..a226015 100644
filetrans_pattern($1, var_lock_t, $2, $3, $4)
')
-@@ -5979,7 +7304,7 @@ interface(`files_setattr_pid_dirs',`
+@@ -5979,7 +7309,7 @@ interface(`files_setattr_pid_dirs',`
type var_run_t;
')
@@ -13627,7 +13639,7 @@ index f962f76..a226015 100644
allow $1 var_run_t:dir setattr;
')
-@@ -5999,10 +7324,48 @@ interface(`files_search_pids',`
+@@ -5999,10 +7329,48 @@ interface(`files_search_pids',`
type var_t, var_run_t;
')
@@ -13676,7 +13688,7 @@ index f962f76..a226015 100644
########################################
## <summary>
## Do not audit attempts to search
-@@ -6025,6 +7388,43 @@ interface(`files_dontaudit_search_pids',`
+@@ -6025,6 +7393,43 @@ interface(`files_dontaudit_search_pids',`
########################################
## <summary>
@@ -13720,7 +13732,7 @@ index f962f76..a226015 100644
## List the contents of the runtime process
## ID directories (/var/run).
## </summary>
-@@ -6039,7 +7439,7 @@ interface(`files_list_pids',`
+@@ -6039,7 +7444,7 @@ interface(`files_list_pids',`
type var_t, var_run_t;
')
@@ -13729,7 +13741,7 @@ index f962f76..a226015 100644
list_dirs_pattern($1, var_t, var_run_t)
')
-@@ -6058,7 +7458,7 @@ interface(`files_read_generic_pids',`
+@@ -6058,7 +7463,7 @@ interface(`files_read_generic_pids',`
type var_t, var_run_t;
')
@@ -13738,7 +13750,7 @@ index f962f76..a226015 100644
list_dirs_pattern($1, var_t, var_run_t)
read_files_pattern($1, var_run_t, var_run_t)
')
-@@ -6078,7 +7478,7 @@ interface(`files_write_generic_pid_pipes',`
+@@ -6078,7 +7483,7 @@ interface(`files_write_generic_pid_pipes',`
type var_run_t;
')
@@ -13747,7 +13759,7 @@ index f962f76..a226015 100644
allow $1 var_run_t:fifo_file write;
')
-@@ -6140,7 +7540,6 @@ interface(`files_pid_filetrans',`
+@@ -6140,7 +7545,6 @@ interface(`files_pid_filetrans',`
')
allow $1 var_t:dir search_dir_perms;
@@ -13755,7 +13767,7 @@ index f962f76..a226015 100644
filetrans_pattern($1, var_run_t, $2, $3, $4)
')
-@@ -6169,6 +7568,24 @@ interface(`files_pid_filetrans_lock_dir',`
+@@ -6169,6 +7573,24 @@ interface(`files_pid_filetrans_lock_dir',`
########################################
## <summary>
@@ -13780,7 +13792,7 @@ index f962f76..a226015 100644
## Read and write generic process ID files.
## </summary>
## <param name="domain">
-@@ -6182,7 +7599,7 @@ interface(`files_rw_generic_pids',`
+@@ -6182,7 +7604,7 @@ interface(`files_rw_generic_pids',`
type var_t, var_run_t;
')
@@ -13789,7 +13801,7 @@ index f962f76..a226015 100644
list_dirs_pattern($1, var_t, var_run_t)
rw_files_pattern($1, var_run_t, var_run_t)
')
-@@ -6249,55 +7666,43 @@ interface(`files_dontaudit_ioctl_all_pids',`
+@@ -6249,55 +7671,43 @@ interface(`files_dontaudit_ioctl_all_pids',`
########################################
## <summary>
@@ -13852,7 +13864,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6305,42 +7710,35 @@ interface(`files_delete_all_pids',`
+@@ -6305,42 +7715,35 @@ interface(`files_delete_all_pids',`
## </summary>
## </param>
#
@@ -13902,7 +13914,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6348,18 +7746,18 @@ interface(`files_manage_all_pids',`
+@@ -6348,18 +7751,18 @@ interface(`files_manage_all_pids',`
## </summary>
## </param>
#
@@ -13926,7 +13938,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6367,37 +7765,40 @@ interface(`files_mounton_all_poly_members',`
+@@ -6367,37 +7770,40 @@ interface(`files_mounton_all_poly_members',`
## </summary>
## </param>
#
@@ -13978,7 +13990,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6405,18 +7806,17 @@ interface(`files_dontaudit_search_spool',`
+@@ -6405,18 +7811,17 @@ interface(`files_dontaudit_search_spool',`
## </summary>
## </param>
#
@@ -14001,7 +14013,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6424,18 +7824,18 @@ interface(`files_list_spool',`
+@@ -6424,18 +7829,18 @@ interface(`files_list_spool',`
## </summary>
## </param>
#
@@ -14025,7 +14037,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6443,19 +7843,18 @@ interface(`files_manage_generic_spool_dirs',`
+@@ -6443,19 +7848,18 @@ interface(`files_manage_generic_spool_dirs',`
## </summary>
## </param>
#
@@ -14050,7 +14062,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6463,109 +7862,62 @@ interface(`files_read_generic_spool',`
+@@ -6463,109 +7867,62 @@ interface(`files_read_generic_spool',`
## </summary>
## </param>
#
@@ -14181,7 +14193,7 @@ index f962f76..a226015 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -6573,10 +7925,944 @@ interface(`files_polyinstantiate_all',`
+@@ -6573,10 +7930,944 @@ interface(`files_polyinstantiate_all',`
## </summary>
## </param>
#
@@ -15374,7 +15386,7 @@ index d7c11a0..6b3331d 100644
/var/run/shm/.* <<none>>
-')
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
-index 8416beb..f1378d6 100644
+index 8416beb..b66e93a 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -631,6 +631,27 @@ interface(`fs_getattr_cgroup',`
@@ -15822,7 +15834,7 @@ index 8416beb..f1378d6 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1878,135 +2085,151 @@ interface(`fs_search_fusefs',`
+@@ -1878,117 +2085,190 @@ interface(`fs_search_fusefs',`
## </summary>
## </param>
#
@@ -15992,93 +16004,83 @@ index 8416beb..f1378d6 100644
-## read, write, and delete files
-## on a FUSEFS filesystem.
+## Unmount a FUSE filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain to not audit.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`fs_dontaudit_manage_fusefs_files',`
++## </summary>
++## </param>
++#
+interface(`fs_unmount_fusefs',`
- gen_require(`
- type fusefs_t;
- ')
-
-- dontaudit $1 fusefs_t:file manage_file_perms;
++ gen_require(`
++ type fusefs_t;
++ ')
++
+ allow $1 fusefs_t:filesystem unmount;
- ')
-
- ########################################
- ## <summary>
--## Read symbolic links on a FUSEFS filesystem.
++')
++
++########################################
++## <summary>
+## Mounton a FUSEFS filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -2014,145 +2237,194 @@ interface(`fs_dontaudit_manage_fusefs_files',`
- ## </summary>
- ## </param>
- #
--interface(`fs_read_fusefs_symlinks',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`fs_mounton_fusefs',`
- gen_require(`
- type fusefs_t;
- ')
-
-- allow $1 fusefs_t:dir list_dir_perms;
-- read_lnk_files_pattern($1, fusefs_t, fusefs_t)
++ gen_require(`
++ type fusefs_t;
++ ')
++
+ allow $1 fusefs_t:dir mounton;
- ')
-
- ########################################
- ## <summary>
--## Get the attributes of an hugetlbfs
--## filesystem.
++')
++
++########################################
++## <summary>
+## Search directories
+## on a FUSEFS filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
-+## <rolecap/>
- #
--interface(`fs_getattr_hugetlbfs',`
-+interface(`fs_search_fusefs',`
- gen_require(`
-- type hugetlbfs_t;
-+ type fusefs_t;
- ')
-
-- allow $1 hugetlbfs_t:filesystem getattr;
-+ allow $1 fusefs_t:dir search_dir_perms;
- ')
-
- ########################################
- ## <summary>
--## List hugetlbfs.
-+## Do not audit attempts to list the contents
-+## of directories on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain to not audit.
++## Domain allowed access.
+## </summary>
+## </param>
++## <rolecap/>
+#
-+interface(`fs_dontaudit_list_fusefs',`
++interface(`fs_search_fusefs',`
+ gen_require(`
+ type fusefs_t;
+ ')
+
-+ dontaudit $1 fusefs_t:dir list_dir_perms;
++ allow $1 fusefs_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
++## Do not audit attempts to list the contents
++## of directories on a FUSEFS filesystem.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1996,91 +2276,173 @@ interface(`fs_manage_fusefs_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`fs_dontaudit_manage_fusefs_files',`
++interface(`fs_dontaudit_list_fusefs',`
+ gen_require(`
+ type fusefs_t;
+ ')
+
+- dontaudit $1 fusefs_t:file manage_file_perms;
++ dontaudit $1 fusefs_t:dir list_dir_perms;
+ ')
+
+ ########################################
+ ## <summary>
+-## Read symbolic links on a FUSEFS filesystem.
+## Create, read, write, and delete directories
+## on a FUSEFS filesystem.
## </summary>
@@ -16089,20 +16091,21 @@ index 8416beb..f1378d6 100644
## </param>
+## <rolecap/>
#
--interface(`fs_list_hugetlbfs',`
+-interface(`fs_read_fusefs_symlinks',`
+interface(`fs_manage_fusefs_dirs',`
gen_require(`
-- type hugetlbfs_t;
-+ type fusefs_t;
+ type fusefs_t;
')
-- allow $1 hugetlbfs_t:dir list_dir_perms;
+- allow $1 fusefs_t:dir list_dir_perms;
+- read_lnk_files_pattern($1, fusefs_t, fusefs_t)
+ allow $1 fusefs_t:dir manage_dir_perms;
')
########################################
## <summary>
--## Manage hugetlbfs dirs.
+-## Get the attributes of an hugetlbfs
+-## filesystem.
+## Do not audit attempts to create, read,
+## write, and delete directories
+## on a FUSEFS filesystem.
@@ -16132,20 +16135,20 @@ index 8416beb..f1378d6 100644
## </param>
+## <rolecap/>
#
--interface(`fs_manage_hugetlbfs_dirs',`
+-interface(`fs_getattr_hugetlbfs',`
+interface(`fs_read_fusefs_files',`
gen_require(`
- type hugetlbfs_t;
+ type fusefs_t;
')
-- manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t)
+- allow $1 hugetlbfs_t:filesystem getattr;
+ read_files_pattern($1, fusefs_t, fusefs_t)
')
########################################
## <summary>
--## Read and write hugetlbfs files.
+-## List hugetlbfs.
+## Execute files on a FUSEFS filesystem.
## </summary>
## <param name="domain">
@@ -16155,69 +16158,58 @@ index 8416beb..f1378d6 100644
## </param>
+## <rolecap/>
#
--interface(`fs_rw_hugetlbfs_files',`
+-interface(`fs_list_hugetlbfs',`
+interface(`fs_exec_fusefs_files',`
gen_require(`
- type hugetlbfs_t;
+ type fusefs_t;
')
-- rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
+- allow $1 hugetlbfs_t:dir list_dir_perms;
+ exec_files_pattern($1, fusefs_t, fusefs_t)
')
########################################
## <summary>
--## Allow the type to associate to hugetlbfs filesystems.
+-## Manage hugetlbfs dirs.
+## Make general progams in FUSEFS an entrypoint for
+## the specified domain.
- ## </summary>
--## <param name="type">
++## </summary>
+## <param name="domain">
- ## <summary>
--## The type of the object to be associated.
++## <summary>
+## The domain for which fusefs_t is an entrypoint.
- ## </summary>
- ## </param>
- #
--interface(`fs_associate_hugetlbfs',`
++## </summary>
++## </param>
++#
+interface(`fs_fusefs_entry_type',`
- gen_require(`
-- type hugetlbfs_t;
++ gen_require(`
+ type fusefs_t;
- ')
-
-- allow $1 hugetlbfs_t:filesystem associate;
++ ')
++
+ domain_entry_file($1, fusefs_t)
- ')
-
- ########################################
- ## <summary>
--## Search inotifyfs filesystem.
++')
++
++########################################
++## <summary>
+## Make general progams in FUSEFS an entrypoint for
+## the specified domain.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain allowed access.
++## </summary>
++## <param name="domain">
++## <summary>
+## The domain for which fusefs_t is an entrypoint.
- ## </summary>
- ## </param>
- #
--interface(`fs_search_inotifyfs',`
++## </summary>
++## </param>
++#
+interface(`fs_fusefs_entrypoint',`
- gen_require(`
-- type inotifyfs_t;
++ gen_require(`
+ type fusefs_t;
- ')
-
-- allow $1 inotifyfs_t:dir search_dir_perms;
++ ')
++
+ allow $1 fusefs_t:file entrypoint;
- ')
-
- ########################################
- ## <summary>
--## List inotifyfs filesystem.
++')
++
++########################################
++## <summary>
+## Create, read, write, and delete files
+## on a FUSEFS filesystem.
## </summary>
@@ -16228,85 +16220,87 @@ index 8416beb..f1378d6 100644
## </param>
+## <rolecap/>
#
--interface(`fs_list_inotifyfs',`
+-interface(`fs_manage_hugetlbfs_dirs',`
+interface(`fs_manage_fusefs_files',`
gen_require(`
-- type inotifyfs_t;
+- type hugetlbfs_t;
+ type fusefs_t;
')
-- allow $1 inotifyfs_t:dir list_dir_perms;
+- manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t)
+ manage_files_pattern($1, fusefs_t, fusefs_t)
')
########################################
## <summary>
--## Dontaudit List inotifyfs filesystem.
+-## Read and write hugetlbfs files.
+## Do not audit attempts to create,
+## read, write, and delete files
+## on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`fs_dontaudit_manage_fusefs_files',`
++ gen_require(`
++ type fusefs_t;
++ ')
++
++ dontaudit $1 fusefs_t:file manage_file_perms;
++')
++
++########################################
++## <summary>
++## Read symbolic links on a FUSEFS filesystem.
## </summary>
## <param name="domain">
## <summary>
-@@ -2160,53 +2432,626 @@ interface(`fs_list_inotifyfs',`
+@@ -2088,53 +2450,100 @@ interface(`fs_manage_hugetlbfs_dirs',`
## </summary>
## </param>
#
--interface(`fs_dontaudit_list_inotifyfs',`
-+interface(`fs_dontaudit_manage_fusefs_files',`
+-interface(`fs_rw_hugetlbfs_files',`
++interface(`fs_read_fusefs_symlinks',`
gen_require(`
-- type inotifyfs_t;
+- type hugetlbfs_t;
+ type fusefs_t;
')
-- dontaudit $1 inotifyfs_t:dir list_dir_perms;
-+ dontaudit $1 fusefs_t:file manage_file_perms;
+- rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
++ allow $1 fusefs_t:dir list_dir_perms;
++ read_lnk_files_pattern($1, fusefs_t, fusefs_t)
')
########################################
## <summary>
--## Create an object in a hugetlbfs filesystem, with a private
--## type using a type transition.
-+## Read symbolic links on a FUSEFS filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
--## <param name="private type">
-+#
-+interface(`fs_read_fusefs_symlinks',`
-+ gen_require(`
-+ type fusefs_t;
-+ ')
-+
-+ allow $1 fusefs_t:dir list_dir_perms;
-+ read_lnk_files_pattern($1, fusefs_t, fusefs_t)
-+')
-+
-+########################################
-+## <summary>
+-## Allow the type to associate to hugetlbfs filesystems.
+## Manage symbolic links on a FUSEFS filesystem.
-+## </summary>
+ ## </summary>
+-## <param name="type">
+## <param name="domain">
## <summary>
--## The type of the object to be created.
+-## The type of the object to be associated.
+## Domain allowed access.
## </summary>
## </param>
--## <param name="object">
-+#
+ #
+-interface(`fs_associate_hugetlbfs',`
+interface(`fs_manage_fusefs_symlinks',`
-+ gen_require(`
+ gen_require(`
+- type hugetlbfs_t;
+ type fusefs_t;
-+ ')
-+
+ ')
+
+- allow $1 hugetlbfs_t:filesystem associate;
+ manage_lnk_files_pattern($1, fusefs_t, fusefs_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Search inotifyfs filesystem.
+## Execute a file on a FUSE filesystem
+## in the specified domain.
+## </summary>
@@ -16330,15 +16324,12 @@ index 8416beb..f1378d6 100644
+## </p>
+## </desc>
+## <param name="domain">
- ## <summary>
--## The object class of the object being created.
++## <summary>
+## Domain allowed to transition.
- ## </summary>
- ## </param>
--## <param name="name" optional="true">
++## </summary>
++## </param>
+## <param name="target_domain">
- ## <summary>
--## The name of the object being created.
++## <summary>
+## The type of the new process.
+## </summary>
+## </param>
@@ -16355,61 +16346,75 @@ index 8416beb..f1378d6 100644
+########################################
+## <summary>
+## Get the attributes of a FUSEFS filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+## <rolecap/>
-+#
+ #
+-interface(`fs_search_inotifyfs',`
+interface(`fs_getattr_fusefs',`
-+ gen_require(`
+ gen_require(`
+- type inotifyfs_t;
+ type fusefs_t;
-+ ')
-+
+ ')
+
+- allow $1 inotifyfs_t:dir search_dir_perms;
+ allow $1 fusefs_t:filesystem getattr;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## List inotifyfs filesystem.
+## Get the attributes of an hugetlbfs
+## filesystem.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -2142,71 +2551,527 @@ interface(`fs_search_inotifyfs',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`fs_list_inotifyfs',`
+interface(`fs_getattr_hugetlbfs',`
-+ gen_require(`
+ gen_require(`
+- type inotifyfs_t;
+ type hugetlbfs_t;
-+ ')
-+
+ ')
+
+- allow $1 inotifyfs_t:dir list_dir_perms;
+ allow $1 hugetlbfs_t:filesystem getattr;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Dontaudit List inotifyfs filesystem.
+## List hugetlbfs.
-+## </summary>
-+## <param name="domain">
-+## <summary>
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain to not audit.
+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`fs_dontaudit_list_inotifyfs',`
+interface(`fs_list_hugetlbfs',`
-+ gen_require(`
+ gen_require(`
+- type inotifyfs_t;
+ type hugetlbfs_t;
-+ ')
-+
+ ')
+
+- dontaudit $1 inotifyfs_t:dir list_dir_perms;
+ allow $1 hugetlbfs_t:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Create an object in a hugetlbfs filesystem, with a private
+-## type using a type transition.
+## Manage hugetlbfs dirs.
+## </summary>
+## <param name="domain">
@@ -16867,19 +16872,55 @@ index 8416beb..f1378d6 100644
+## <param name="domain">
+## <summary>
+## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fs_delete_kdbus_dirs', `
++ gen_require(`
++ type kdbusfs_t;
++ ')
++
++ delete_dirs_pattern($1, kdbusfs_t, kdbusfs_t)
++ fs_search_tmpfs($1)
++ dev_search_sysfs($1)
++')
++
++########################################
++## <summary>
++## Manage kdbusfs directories.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
## </summary>
## </param>
+-## <param name="private type">
+-## <summary>
+-## The type of the object to be created.
+-## </summary>
+-## </param>
+-## <param name="object">
+-## <summary>
+-## The object class of the object being created.
+-## </summary>
+-## </param>
+-## <param name="name" optional="true">
+-## <summary>
+-## The name of the object being created.
+-## </summary>
+-## </param>
#
-interface(`fs_hugetlbfs_filetrans',`
-+interface(`fs_delete_kdbus_dirs', `
++interface(`fs_manage_kdbus_dirs',`
gen_require(`
- type hugetlbfs_t;
+- ')
+ type kdbusfs_t;
- ')
- allow $2 hugetlbfs_t:filesystem associate;
- filetrans_pattern($1, hugetlbfs_t, $2, $3, $4)
-+ delete_dirs_pattern($1, kdbusfs_t, kdbusfs_t)
++ ')
++ manage_dirs_pattern($1, kdbusfs_t, kdbusfs_t)
+ fs_search_tmpfs($1)
+ dev_search_sysfs($1)
')
@@ -16888,24 +16929,25 @@ index 8416beb..f1378d6 100644
## <summary>
-## Mount an iso9660 filesystem, which
-## is usually used on CDs.
-+## Manage kdbusfs directories.
++## Read kdbusfs files.
## </summary>
## <param name="domain">
## <summary>
-@@ -2214,19 +3059,19 @@ interface(`fs_hugetlbfs_filetrans',`
+@@ -2214,19 +3079,21 @@ interface(`fs_hugetlbfs_filetrans',`
## </summary>
## </param>
#
-interface(`fs_mount_iso9660_fs',`
-+interface(`fs_manage_kdbus_dirs',`
++interface(`fs_read_kdbus_files',`
gen_require(`
- type iso9660_t;
-- ')
-+ type kdbusfs_t;
++ type cgroup_t;
++
+ ')
- allow $1 iso9660_t:filesystem mount;
-+ ')
-+ manage_dirs_pattern($1, kdbusfs_t, kdbusfs_t)
++ read_files_pattern($1, kdbusfs_t, kdbusfs_t)
++ read_lnk_files_pattern($1, kdbusfs_t, kdbusfs_t)
+ fs_search_tmpfs($1)
+ dev_search_sysfs($1)
')
@@ -16915,25 +16957,23 @@ index 8416beb..f1378d6 100644
-## Remount an iso9660 filesystem, which
-## is usually used on CDs. This allows
-## some mount options to be changed.
-+## Read kdbusfs files.
++## Write kdbusfs files.
## </summary>
## <param name="domain">
## <summary>
-@@ -2234,18 +3079,21 @@ interface(`fs_mount_iso9660_fs',`
+@@ -2234,18 +3101,19 @@ interface(`fs_mount_iso9660_fs',`
## </summary>
## </param>
#
-interface(`fs_remount_iso9660_fs',`
-+interface(`fs_read_kdbus_files',`
++interface(`fs_write_kdbus_files', `
gen_require(`
- type iso9660_t;
-+ type cgroup_t;
-+
++ type kdbusfs_t;
')
- allow $1 iso9660_t:filesystem remount;
-+ read_files_pattern($1, kdbusfs_t, kdbusfs_t)
-+ read_lnk_files_pattern($1, kdbusfs_t, kdbusfs_t)
++ write_files_pattern($1, kdbusfs_t, kdbusfs_t)
+ fs_search_tmpfs($1)
+ dev_search_sysfs($1)
')
@@ -16942,23 +16982,25 @@ index 8416beb..f1378d6 100644
## <summary>
-## Unmount an iso9660 filesystem, which
-## is usually used on CDs.
-+## Write kdbusfs files.
++## Read and write kdbusfs files.
## </summary>
## <param name="domain">
## <summary>
-@@ -2253,38 +3101,61 @@ interface(`fs_remount_iso9660_fs',`
+@@ -2253,38 +3121,41 @@ interface(`fs_remount_iso9660_fs',`
## </summary>
## </param>
#
-interface(`fs_unmount_iso9660_fs',`
-+interface(`fs_write_kdbus_files', `
++interface(`fs_rw_kdbus_files',`
gen_require(`
- type iso9660_t;
+ type kdbusfs_t;
++
')
- allow $1 iso9660_t:filesystem unmount;
-+ write_files_pattern($1, kdbusfs_t, kdbusfs_t)
++ read_lnk_files_pattern($1, kdbusfs_t, kdbusfs_t)
++ rw_files_pattern($1, kdbusfs_t, kdbusfs_t)
+ fs_search_tmpfs($1)
+ dev_search_sysfs($1)
')
@@ -16967,54 +17009,33 @@ index 8416beb..f1378d6 100644
## <summary>
-## Get the attributes of an iso9660
-## filesystem, which is usually used on CDs.
-+## Read and write kdbusfs files.
++## Do not audit attempts to open,
++## get attributes, read and write
++## cgroup files.
## </summary>
## <param name="domain">
## <summary>
- ## Domain allowed access.
+-## Domain allowed access.
++## Domain to not audit.
## </summary>
## </param>
-## <rolecap/>
#
-interface(`fs_getattr_iso9660_fs',`
-+interface(`fs_rw_kdbus_files',`
++interface(`fs_dontaudit_rw_kdbus_files',`
gen_require(`
- type iso9660_t;
+ type kdbusfs_t;
-+
')
- allow $1 iso9660_t:filesystem getattr;
-+ read_lnk_files_pattern($1, kdbusfs_t, kdbusfs_t)
-+ rw_files_pattern($1, kdbusfs_t, kdbusfs_t)
-+ fs_search_tmpfs($1)
-+ dev_search_sysfs($1)
++ dontaudit $1 kdbusfs_t:file rw_file_perms;
')
########################################
## <summary>
-## Read files on an iso9660 filesystem, which
-## is usually used on CDs.
-+## Do not audit attempts to open,
-+## get attributes, read and write
-+## cgroup files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_dontaudit_rw_kdbus_files',`
-+ gen_require(`
-+ type kdbusfs_t;
-+ ')
-+
-+ dontaudit $1 kdbusfs_t:file rw_file_perms;
-+')
-+
-+########################################
-+## <summary>
+## Manage kdbusfs files.
## </summary>
## <param name="domain">
@@ -17416,79 +17437,47 @@ index 8416beb..f1378d6 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3743,25 +4807,61 @@ interface(`fs_getattr_rpc_pipefs',`
-
- #########################################
- ## <summary>
--## Read and write RPC pipe filesystem named pipes.
-+## Read and write RPC pipe filesystem named pipes.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`fs_rw_rpc_named_pipes',`
+@@ -3769,17 +4833,53 @@ interface(`fs_rw_rpc_named_pipes',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`fs_mount_tmpfs',`
++interface(`fs_mount_tmpfs',`
+ gen_require(`
-+ type rpc_pipefs_t;
++ type tmpfs_t;
+ ')
+
-+ allow $1 rpc_pipefs_t:fifo_file rw_fifo_file_perms;
++ allow $1 tmpfs_t:filesystem mount;
+')
+
+########################################
+## <summary>
-+## Mount a tmpfs filesystem.
++## Dontaudit remount a tmpfs filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain allowed access.
++## Domain to not audit.
+## </summary>
+## </param>
+#
-+interface(`fs_mount_tmpfs',`
++interface(`fs_dontaudit_remount_tmpfs',`
+ gen_require(`
+ type tmpfs_t;
+ ')
+
-+ allow $1 tmpfs_t:filesystem mount;
++ dontaudit $1 tmpfs_t:filesystem remount;
+')
+
+########################################
+## <summary>
-+## Dontaudit remount a tmpfs filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain allowed access.
-+## Domain to not audit.
- ## </summary>
- ## </param>
- #
--interface(`fs_rw_rpc_named_pipes',`
-+interface(`fs_dontaudit_remount_tmpfs',`
- gen_require(`
-- type rpc_pipefs_t;
-+ type tmpfs_t;
- ')
-
-- allow $1 rpc_pipefs_t:fifo_file rw_fifo_file_perms;
-+ dontaudit $1 tmpfs_t:filesystem remount;
- ')
-
- ########################################
- ## <summary>
--## Mount a tmpfs filesystem.
+## Remount a tmpfs filesystem.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -3769,17 +4869,17 @@ interface(`fs_rw_rpc_named_pipes',`
- ## </summary>
- ## </param>
- #
--interface(`fs_mount_tmpfs',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`fs_remount_tmpfs',`
gen_require(`
type tmpfs_t;
@@ -17934,7 +17923,7 @@ index 8416beb..f1378d6 100644
## Search all directories with a filesystem type.
## </summary>
## <param name="domain">
-@@ -4912,3 +6218,43 @@ interface(`fs_unconfined',`
+@@ -4912,3 +6218,63 @@ interface(`fs_unconfined',`
typeattribute $1 filesystem_unconfined_type;
')
@@ -17978,6 +17967,26 @@ index 8416beb..f1378d6 100644
+ fs_tmpfs_filetrans($1, cgroup_t, lnk_file, "cpu")
+ fs_tmpfs_filetrans($1, cgroup_t, lnk_file, "cpuacct")
+')
++
++#######################################
++## <summary>
++## Read files in efivarfs
++## - contains Linux Kernel configuration options for UEFI systems
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`fs_read_efivarfs_files',`
++ gen_require(`
++ type efivarfs_t;
++ ')
++
++ read_files_pattern($1, efivarfs_t, efivarfs_t)
++')
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index e7d1738..3e3ed4e 100644
--- a/policy/modules/kernel/filesystem.te
@@ -28263,7 +28272,7 @@ index 6bf0ecc..b036584 100644
+')
+
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 8b40377..8c77595 100644
+index 8b40377..69be4cf 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -26,28 +26,66 @@ gen_require(`
@@ -28611,13 +28620,13 @@ index 8b40377..8c77595 100644
+ifdef(`hide_broken_symptoms',`
+ term_dontaudit_use_unallocated_ttys(xauth_t)
+ dev_dontaudit_rw_dri(xauth_t)
- ')
-
- optional_policy(`
-+ nx_var_lib_filetrans(xauth_t, xauth_home_t, file)
+')
+
+optional_policy(`
++ nx_var_lib_filetrans(xauth_t, xauth_home_t, file)
+ ')
+
+ optional_policy(`
+ ssh_use_ptys(xauth_t)
ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t)
@@ -29107,17 +29116,18 @@ index 8b40377..8c77595 100644
')
optional_policy(`
-@@ -517,9 +891,34 @@ optional_policy(`
- optional_policy(`
+@@ -518,8 +892,36 @@ optional_policy(`
dbus_system_bus_client(xdm_t)
dbus_connect_system_bus(xdm_t)
-+
+
++ dbus_session_bus_client(xdm_t)
++ dbus_connect_session_bus(xdm_t)
++
+ optional_policy(`
+ accountsd_dbus_chat(xdm_t)
+ ')
-
- optional_policy(`
-- accountsd_dbus_chat(xdm_t)
++
++ optional_policy(`
+ bluetooth_dbus_chat(xdm_t)
+ ')
+
@@ -29125,7 +29135,8 @@ index 8b40377..8c77595 100644
+ cpufreqselector_dbus_chat(xdm_t)
+ ')
+
-+ optional_policy(`
+ optional_policy(`
+- accountsd_dbus_chat(xdm_t)
+ devicekit_dbus_chat_disk(xdm_t)
+ devicekit_dbus_chat_power(xdm_t)
+ ')
@@ -29143,7 +29154,7 @@ index 8b40377..8c77595 100644
')
')
-@@ -530,6 +929,20 @@ optional_policy(`
+@@ -530,6 +932,20 @@ optional_policy(`
')
optional_policy(`
@@ -29164,7 +29175,7 @@ index 8b40377..8c77595 100644
hostname_exec(xdm_t)
')
-@@ -547,28 +960,78 @@ optional_policy(`
+@@ -547,28 +963,78 @@ optional_policy(`
')
optional_policy(`
@@ -29252,7 +29263,7 @@ index 8b40377..8c77595 100644
')
optional_policy(`
-@@ -580,6 +1043,14 @@ optional_policy(`
+@@ -580,6 +1046,14 @@ optional_policy(`
')
optional_policy(`
@@ -29267,7 +29278,7 @@ index 8b40377..8c77595 100644
xfs_stream_connect(xdm_t)
')
-@@ -594,7 +1065,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+@@ -594,7 +1068,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@@ -29276,7 +29287,7 @@ index 8b40377..8c77595 100644
# setuid/setgid for the wrapper program to change UID
# sys_rawio is for iopl access - should not be needed for frame-buffer
-@@ -604,8 +1075,11 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -604,8 +1078,11 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -29289,7 +29300,7 @@ index 8b40377..8c77595 100644
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
-@@ -618,8 +1092,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -618,8 +1095,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -29305,7 +29316,7 @@ index 8b40377..8c77595 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -627,6 +1108,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+@@ -627,6 +1111,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
@@ -29316,7 +29327,7 @@ index 8b40377..8c77595 100644
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -638,25 +1123,32 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+@@ -638,25 +1126,32 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -29353,7 +29364,7 @@ index 8b40377..8c77595 100644
corenet_all_recvfrom_netlabel(xserver_t)
corenet_tcp_sendrecv_generic_if(xserver_t)
corenet_udp_sendrecv_generic_if(xserver_t)
-@@ -677,23 +1169,28 @@ dev_rw_apm_bios(xserver_t)
+@@ -677,23 +1172,28 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -29385,7 +29396,7 @@ index 8b40377..8c77595 100644
# brought on by rhgb
files_search_mnt(xserver_t)
-@@ -705,6 +1202,14 @@ fs_search_nfs(xserver_t)
+@@ -705,6 +1205,14 @@ fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -29400,7 +29411,7 @@ index 8b40377..8c77595 100644
mls_xwin_read_to_clearance(xserver_t)
selinux_validate_context(xserver_t)
-@@ -718,20 +1223,18 @@ init_getpgid(xserver_t)
+@@ -718,20 +1226,18 @@ init_getpgid(xserver_t)
term_setattr_unallocated_ttys(xserver_t)
term_use_unallocated_ttys(xserver_t)
@@ -29424,7 +29435,7 @@ index 8b40377..8c77595 100644
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -739,8 +1242,6 @@ userdom_setattr_user_ttys(xserver_t)
+@@ -739,8 +1245,6 @@ userdom_setattr_user_ttys(xserver_t)
userdom_read_user_tmp_files(xserver_t)
userdom_rw_user_tmpfs_files(xserver_t)
@@ -29433,7 +29444,7 @@ index 8b40377..8c77595 100644
ifndef(`distro_redhat',`
allow xserver_t self:process { execmem execheap execstack };
domain_mmap_low_uncond(xserver_t)
-@@ -785,17 +1286,54 @@ optional_policy(`
+@@ -785,17 +1289,54 @@ optional_policy(`
')
optional_policy(`
@@ -29490,7 +29501,7 @@ index 8b40377..8c77595 100644
')
optional_policy(`
-@@ -803,6 +1341,10 @@ optional_policy(`
+@@ -803,6 +1344,10 @@ optional_policy(`
')
optional_policy(`
@@ -29501,7 +29512,7 @@ index 8b40377..8c77595 100644
xfs_stream_connect(xserver_t)
')
-@@ -818,18 +1360,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -818,18 +1363,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!!
@@ -29526,7 +29537,7 @@ index 8b40377..8c77595 100644
can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server
-@@ -842,26 +1383,21 @@ init_use_fds(xserver_t)
+@@ -842,26 +1386,21 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -29561,7 +29572,7 @@ index 8b40377..8c77595 100644
')
optional_policy(`
-@@ -912,7 +1448,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -912,7 +1451,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -29570,7 +29581,7 @@ index 8b40377..8c77595 100644
# operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
-@@ -966,11 +1502,31 @@ allow x_domain self:x_resource { read write };
+@@ -966,11 +1505,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr };
@@ -29602,7 +29613,7 @@ index 8b40377..8c77595 100644
tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals
-@@ -992,18 +1548,148 @@ tunable_policy(`! xserver_object_manager',`
+@@ -992,18 +1551,148 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *;
')
@@ -39089,7 +39100,7 @@ index 9933677..0b9c20a 100644
+
+/var/run/tmpfiles.d/kmod.conf -- gen_context(system_u:object_r:insmod_var_run_t,s0)
diff --git a/policy/modules/system/modutils.if b/policy/modules/system/modutils.if
-index 7449974..23bbbf2 100644
+index 7449974..f32a37c 100644
--- a/policy/modules/system/modutils.if
+++ b/policy/modules/system/modutils.if
@@ -12,7 +12,7 @@
@@ -39217,7 +39228,7 @@ index 7449974..23bbbf2 100644
')
########################################
-@@ -333,3 +414,25 @@ interface(`modutils_exec_update_mods',`
+@@ -333,3 +414,43 @@ interface(`modutils_exec_update_mods',`
corecmd_search_bin($1)
can_exec($1, update_modules_exec_t)
')
@@ -39240,8 +39251,26 @@ index 7449974..23bbbf2 100644
+
+ files_etc_filetrans($1, modules_conf_t, file, "modprobe.conf")
+ files_etc_filetrans($1, modules_conf_t, file, "modules.conf")
++
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.alias")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.alias.bin")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.block")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.builtin")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.builtin.bin")
+ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.dep")
+ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.dep.bin")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.devname")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.drm")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.modesetting")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.networking")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.order")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.softdep")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols")
++ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols.bin")
++')
++
++
++
+')
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 7a363b8..3f02a36 100644
@@ -43134,10 +43163,10 @@ index a392fc4..30cf590 100644
+')
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
new file mode 100644
-index 0000000..a03b5ee
+index 0000000..66b8608
--- /dev/null
+++ b/policy/modules/system/systemd.fc
-@@ -0,0 +1,51 @@
+@@ -0,0 +1,55 @@
+HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_home_t,s0)
+/root/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_home_t,s0)
+
@@ -43157,6 +43186,7 @@ index 0000000..a03b5ee
+
+/usr/lib/dracut/modules.d/.*\.service gen_context(system_u:object_r:systemd_unit_file_t,s0)
+/usr/lib/systemd/system(/.*)? gen_context(system_u:object_r:systemd_unit_file_t,s0)
++/usr/lib/systemd/system/systemd-machined\.service -- gen_context(system_u:object_r:systemd_machined_unit_file_t,s0)
+/usr/lib/systemd/system/systemd-networkd\.service gen_context(system_u:object_r:systemd_networkd_unit_file_t,s0)
+/usr/lib/systemd/system/systemd-vconsole-setup\.service gen_context(system_u:object_r:systemd_vconsole_unit_file_t,s0)
+/usr/lib/systemd/system/systemd-time.*\.service -- gen_context(system_u:object_r:systemd_timedated_unit_file_t,s0)
@@ -43168,6 +43198,7 @@ index 0000000..a03b5ee
+/usr/lib/systemd/system/.*shutdown.* -- gen_context(system_u:object_r:power_unit_file_t,s0)
+/usr/lib/systemd/system/.*suspend.* -- gen_context(system_u:object_r:power_unit_file_t,s0)
+/usr/lib/systemd/systemd-hostnamed -- gen_context(system_u:object_r:systemd_hostnamed_exec_t,s0)
++/usr/lib/systemd/systemd-machined -- gen_context(system_u:object_r:systemd_machined_exec_t,s0)
+/usr/lib/systemd/systemd-sysctl -- gen_context(system_u:object_r:systemd_sysctl_exec_t,s0)
+/usr/lib/systemd/systemd-timedated -- gen_context(system_u:object_r:systemd_timedated_exec_t,s0)
+/usr/lib/systemd/systemd-logind -- gen_context(system_u:object_r:systemd_logind_exec_t,s0)
@@ -43176,6 +43207,7 @@ index 0000000..a03b5ee
+/usr/lib/systemd/systemd-networkd -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
+/usr/lib/systemd/systemd-tmpfiles -- gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0)
+
++/var/lib/machines(/.*)? gen_context(system_u:object_r:systemd_machined_var_lib_t,s0)
+/var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,mls_systemhigh)
+/var/lib/random-seed gen_context(system_u:object_r:random_seed_t,mls_systemhigh)
+/usr/var/lib/random-seed gen_context(system_u:object_r:random_seed_t,mls_systemhigh)
@@ -43187,14 +43219,15 @@ index 0000000..a03b5ee
+/var/run/systemd/inhibit(/.*)? gen_context(system_u:object_r:systemd_logind_inhibit_var_run_t,s0)
+/var/run/systemd/ask-password-block(/.*)? gen_context(system_u:object_r:systemd_passwd_var_run_t,s0)
+/var/run/systemd/ask-password(/.*)? gen_context(system_u:object_r:systemd_passwd_var_run_t,s0)
-+/var/run/systemd/netif(/.*)? gen_context(system_u:object_r:systemd_networkd_var_run_t,s0)
++/var/run/systemd/machines(/.*)? gen_context(system_u:object_r:systemd_machined_var_run_t,s0)
++/var/run/systemd/netif(/.*)? gen_context(system_u:object_r:systemd_networkd_var_run_t,s0)
+/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
-index 0000000..cde0261
+index 0000000..4f142e9
--- /dev/null
+++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1497 @@
+@@ -0,0 +1,1615 @@
+## <summary>SELinux policy for systemd components</summary>
+
+######################################
@@ -44692,12 +44725,130 @@ index 0000000..cde0261
+
+ dontaudit $1 systemd_domain:dbus send_msg;
+')
++
++######################################
++## <summary>
++## Read systemd-machined PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_machined_read_pid_files',`
++ gen_require(`
++ type systemd_machined_var_run_t;
++ ')
++
++ files_search_pids($1)
++ list_dirs_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
++ read_files_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
++')
++
++######################################
++## <summary>
++## Manage systemd-machined PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_machined_manage_pid_files',`
++ gen_require(`
++ type systemd_machined_var_run_t;
++ ')
++
++ files_search_pids($1)
++ manage_dirs_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
++ manage_files_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
++')
++
++######################################
++## <summary>
++## List systemd-machined PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_machined_list_pid_dirs',`
++ gen_require(`
++ type systemd_machined_var_run_t;
++ ')
++
++ files_search_pids($1)
++ list_dirs_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
++')
++
++
++
++########################################
++## <summary>
++## Search systemd-machined lib directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_machined_search_lib',`
++ gen_require(`
++ type systemd_machined_var_lib_t;
++ ')
++
++ allow $1 systemd_machined_var_lib_t:dir search_dir_perms;
++ files_search_var_lib($1)
++')
++
++########################################
++## <summary>
++## Read systemd-machined lib files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_machined_read_lib_files',`
++ gen_require(`
++ type systemd_machined_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ read_files_pattern($1, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
++')
++
++########################################
++## <summary>
++## Manage systemd-machined lib files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`systemd_machined_manage_lib_files',`
++ gen_require(`
++ type systemd_machined_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
++')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..8209291
+index 0000000..0920911
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,725 @@
+@@ -0,0 +1,775 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -44785,6 +44936,20 @@ index 0000000..8209291
+
+systemd_domain_template(systemd_sysctl)
+
++#domain for systemd-machined
++systemd_domain_template(systemd_machined)
++
++type systemd_machined_unit_file_t;
++systemd_unit_file(systemd_machined_unit_file_t)
++
++# /run/systemd/machines
++type systemd_machined_var_run_t;
++files_pid_file(systemd_machined_var_run_t)
++
++# /var/lib/machines
++type systemd_machined_var_lib_t;
++files_type(systemd_machined_var_lib_t)
++
+#######################################
+#
+# Systemd_logind local policy
@@ -44806,6 +44971,9 @@ index 0000000..8209291
+fs_mount_tmpfs(systemd_logind_t)
+fs_unmount_tmpfs(systemd_logind_t)
+fs_list_tmpfs(systemd_logind_t)
++
++fs_read_efivarfs_files(systemd_logind_t)
++
+fs_manage_fusefs_dirs(systemd_logind_t)
+fs_manage_fusefs_files(systemd_logind_t)
+
@@ -44939,6 +45107,39 @@ index 0000000..8209291
+ xserver_search_xdm_tmp_dirs(systemd_logind_t)
+')
+
++########################################
++#
++# systemd_machined local policy
++#
++
++allow systemd_machined_t self:capability sys_ptrace;
++allow systemd_machined_t systemd_unit_file_t:service { status start };
++allow systemd_machined_t self:unix_dgram_socket create_socket_perms;
++
++manage_dirs_pattern(systemd_machined_t, systemd_machined_var_run_t, systemd_machined_var_run_t)
++manage_files_pattern(systemd_machined_t, systemd_machined_var_run_t, systemd_machined_var_run_t)
++manage_lnk_files_pattern(systemd_machined_t, systemd_machined_var_run_t, systemd_machined_var_run_t)
++init_pid_filetrans(systemd_machined_t, systemd_machined_var_run_t, dir, "machines")
++
++manage_dirs_pattern(systemd_machined_t, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
++manage_files_pattern(systemd_machined_t, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
++manage_lnk_files_pattern(systemd_machined_t, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
++init_var_lib_filetrans(systemd_machined_t, systemd_machined_var_lib_t, dir, "machines")
++
++kernel_dgram_send(systemd_machined_t)
++
++init_dbus_chat(systemd_machined_t)
++init_status(systemd_machined_t)
++
++optional_policy(`
++ dbus_connect_system_bus(systemd_machined_t)
++ dbus_system_bus_client(systemd_machined_t)
++')
++
++optional_policy(`
++ virt_dbus_chat(systemd_machined_t)
++')
++
+#######################################
+#
+# systemd-networkd local policy
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 599054e..45300a0 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -7985,7 +7985,7 @@ index 1a7a97e..2c7252a 100644
domain_system_change_exemption($1)
role_transition $2 apmd_initrc_exec_t system_r;
diff --git a/apm.te b/apm.te
-index 7fd431b..e9c4c5a 100644
+index 7fd431b..41f2a57 100644
--- a/apm.te
+++ b/apm.te
@@ -35,12 +35,15 @@ files_type(apmd_var_lib_t)
@@ -8014,7 +8014,7 @@ index 7fd431b..e9c4c5a 100644
domain_use_interactive_fds(apm_t)
-@@ -59,8 +62,8 @@ logging_send_syslog_msg(apm_t)
+@@ -59,11 +62,12 @@ logging_send_syslog_msg(apm_t)
# Server local policy
#
@@ -8025,7 +8025,11 @@ index 7fd431b..e9c4c5a 100644
allow apmd_t self:process { signal_perms getsession };
allow apmd_t self:fifo_file rw_fifo_file_perms;
allow apmd_t self:netlink_socket create_socket_perms;
-@@ -90,6 +93,7 @@ kernel_read_kernel_sysctls(apmd_t)
++allow apmd_t self:netlink_generic_socket create_socket_perms;
+ allow apmd_t self:unix_stream_socket { accept listen };
+
+ allow apmd_t apmd_lock_t:file manage_file_perms;
+@@ -90,6 +94,7 @@ kernel_read_kernel_sysctls(apmd_t)
kernel_rw_all_sysctls(apmd_t)
kernel_read_system_state(apmd_t)
kernel_write_proc_files(apmd_t)
@@ -8033,7 +8037,7 @@ index 7fd431b..e9c4c5a 100644
dev_read_input(apmd_t)
dev_read_mouse(apmd_t)
-@@ -114,8 +118,7 @@ fs_dontaudit_getattr_all_files(apmd_t)
+@@ -114,8 +119,7 @@ fs_dontaudit_getattr_all_files(apmd_t)
fs_dontaudit_getattr_all_symlinks(apmd_t)
fs_dontaudit_getattr_all_pipes(apmd_t)
fs_dontaudit_getattr_all_sockets(apmd_t)
@@ -8043,7 +8047,7 @@ index 7fd431b..e9c4c5a 100644
corecmd_exec_all_executables(apmd_t)
-@@ -129,6 +132,8 @@ domain_dontaudit_list_all_domains_state(apmd_t)
+@@ -129,6 +133,8 @@ domain_dontaudit_list_all_domains_state(apmd_t)
auth_use_nsswitch(apmd_t)
init_domtrans_script(apmd_t)
@@ -8052,7 +8056,7 @@ index 7fd431b..e9c4c5a 100644
libs_exec_ld_so(apmd_t)
libs_exec_lib_files(apmd_t)
-@@ -136,17 +141,16 @@ libs_exec_lib_files(apmd_t)
+@@ -136,17 +142,16 @@ libs_exec_lib_files(apmd_t)
logging_send_audit_msgs(apmd_t)
logging_send_syslog_msg(apmd_t)
@@ -8072,7 +8076,7 @@ index 7fd431b..e9c4c5a 100644
optional_policy(`
automount_domtrans(apmd_t)
-@@ -206,11 +210,15 @@ optional_policy(`
+@@ -206,11 +211,15 @@ optional_policy(`
')
optional_policy(`
@@ -68616,10 +68620,10 @@ index 0000000..1fa6db2
+')
diff --git a/pkcs11proxyd.te b/pkcs11proxyd.te
new file mode 100644
-index 0000000..6b49e41
+index 0000000..a2cb118
--- /dev/null
+++ b/pkcs11proxyd.te
-@@ -0,0 +1,41 @@
+@@ -0,0 +1,42 @@
+policy_module(pkcs11proxyd, 1.0.0)
+
+########################################
@@ -68644,6 +68648,7 @@ index 0000000..6b49e41
+#
+# pkcs11proxyd local policy
+#
++
+allow pkcs11proxyd_t self:capability { kill setuid setgid };
+allow pkcs11proxyd_t self:process { getpgid setpgid };
+
@@ -68655,10 +68660,10 @@ index 0000000..6b49e41
+manage_sock_files_pattern(pkcs11proxyd_t, pkcs11proxyd_var_run_t, pkcs11proxyd_var_run_t)
+files_pid_filetrans(pkcs11proxyd_t, pkcs11proxyd_var_run_t, { sock_file })
+
-+auth_use_nsswitch(pkcs11proxyd_t)
-+
+dev_read_urand(pkcs11proxyd_t)
+
++auth_use_nsswitch(pkcs11proxyd_t)
++
+logging_send_syslog_msg(pkcs11proxyd_t)
+
diff --git a/pki.fc b/pki.fc
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 673e3de..669d7e2 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 149%{?dist}
+Release: 150%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -656,6 +656,20 @@ exit 0
%endif
%changelog
+* Fri Oct 02 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-150
+- Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
+- Clean up pkcs11proxyd policy.
+- We need to require sandbox_web_type attribute in sandbox_x_domain_template().
+- Revert "depmod is a symlink to insmod so it runs as insmod_t. It causes that dep kernel modules files are not created with the correct labeling modules_dep_t. This fix adds filenamtrans rules for insmod_t."
+- depmod is a symlink to insmod so it runs as insmod_t. It causes that dep kernel modules files are not created with the correct labeling modules_dep_t. This fix adds filenamtrans rules for insmod_t.
+- Update files_read_kernel_modules() to contain modutils_read_module_deps() calling because module deps labeling has been updated and it allows to avoid regressions.
+- Update modules_filetrans_named_content() interface to cover more modules.* files.
+- New policy for systemd-machined. #1255305
+- In Rawhide/F24, we added pam_selinux.so support for systemd-users to have user sessions running under correct SELinux labeling. It also supports another new feature with systemd+dbus and we have sessions dbuses running with the correct labeling - unconfined_dbus_t for example.
+- Allow systemd-logind read access to efivarfs - Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables). #1244973, #1267207 (partial solution)
+- Merge pull request #42 from vmojzis/rawhide-base
+- Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
+
* Tue Sep 29 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-149
- Add few rules related to new policy for pkcs11proxyd
- Added new policy for pkcs11proxyd daemon