diff --git a/docker-selinux.tgz b/docker-selinux.tgz
index 659c3a5..077d9bb 100644
Binary files a/docker-selinux.tgz and b/docker-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 9cc9fe8..526532f 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -2171,7 +2171,7 @@ index 688abc2..3d89250 100644
/usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
diff --git a/policy/modules/admin/su.if b/policy/modules/admin/su.if
-index 03ec5ca..a777e72 100644
+index 03ec5ca..48ab7f8 100644
--- a/policy/modules/admin/su.if
+++ b/policy/modules/admin/su.if
@@ -58,6 +58,7 @@ template(`su_restricted_domain_template', `
@@ -2221,7 +2221,7 @@ index 03ec5ca..a777e72 100644
allow $1_su_t $3:key search;
# Transition from the user domain to this domain.
-@@ -194,125 +182,12 @@ template(`su_role_template',`
+@@ -194,125 +182,16 @@ template(`su_role_template',`
allow $3 $1_su_t:process sigchld;
kernel_read_system_state($1_su_t)
@@ -2233,7 +2233,7 @@ index 03ec5ca..a777e72 100644
- dev_read_urand($1_su_t)
-
- fs_search_auto_mountpoints($1_su_t)
-
+-
- # needed for pam_rootok
- selinux_compute_access_vector($1_su_t)
-
@@ -2243,9 +2243,11 @@ index 03ec5ca..a777e72 100644
- auth_rw_faillog($1_su_t)
-
- corecmd_search_bin($1_su_t)
--
++ kernel_dontaudit_getattr_core_if($1_su_t)
+
- domain_use_interactive_fds($1_su_t)
--
++ auth_use_pam($1_su_t)
+
- files_read_etc_files($1_su_t)
- files_read_etc_runtime_files($1_su_t)
- files_search_var_lib($1_su_t)
@@ -2254,12 +2256,12 @@ index 03ec5ca..a777e72 100644
- init_dontaudit_use_fds($1_su_t)
- # Write to utmp.
- init_rw_utmp($1_su_t)
-+ auth_use_pam($1_su_t)
++ init_dontaudit_getattr_initctl($1_su_t)
mls_file_write_all_levels($1_su_t)
logging_send_syslog_msg($1_su_t)
--
+
- miscfiles_read_localization($1_su_t)
-
- userdom_use_user_terminals($1_su_t)
@@ -5822,7 +5824,7 @@ index 8e0f9cd..b9f45b9 100644
define(`create_packet_interfaces',``
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
-index b191055..72bc5d0 100644
+index b191055..6c3e760 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -5,6 +5,7 @@ policy_module(corenetwork, 1.19.2)
@@ -6063,7 +6065,7 @@ index b191055..72bc5d0 100644
network_port(msnp, tcp,1863,s0, udp,1863,s0)
network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0)
network_port(ms_streaming, tcp,1755,s0, udp,1755,s0)
-@@ -186,101 +241,129 @@ network_port(munin, tcp,4949,s0, udp,4949,s0)
+@@ -186,101 +241,130 @@ network_port(munin, tcp,4949,s0, udp,4949,s0)
network_port(mxi, tcp,8005,s0, udp,8005,s0)
network_port(mysqld, tcp,1186,s0, tcp,3306,s0, tcp,63132-63164,s0)
network_port(mysqlmanagerd, tcp,2273,s0)
@@ -6114,6 +6116,7 @@ index b191055..72bc5d0 100644
network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0)
+network_port(preupgrade, tcp, 8099, s0)
network_port(printer, tcp,515,s0)
++network_port(prosody, tcp,5280-5281,s0)
network_port(ptal, tcp,5703,s0)
-network_port(pulseaudio, tcp,4713,s0)
+network_port(pulseaudio, tcp,4713,s0, udp,4713,s0)
@@ -6212,7 +6215,7 @@ index b191055..72bc5d0 100644
network_port(xserver, tcp,6000-6020,s0)
network_port(zarafa, tcp,236,s0, tcp,237,s0)
network_port(zabbix, tcp,10051,s0)
-@@ -288,19 +371,23 @@ network_port(zabbix_agent, tcp,10050,s0)
+@@ -288,19 +372,23 @@ network_port(zabbix_agent, tcp,10050,s0)
network_port(zookeeper_client, tcp,2181,s0)
network_port(zookeeper_election, tcp,3888,s0)
network_port(zookeeper_leader, tcp,2888,s0)
@@ -6239,7 +6242,7 @@ index b191055..72bc5d0 100644
########################################
#
-@@ -333,6 +420,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
+@@ -333,6 +421,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
build_option(`enable_mls',`
network_interface(lo, lo, s0 - mls_systemhigh)
@@ -6248,7 +6251,7 @@ index b191055..72bc5d0 100644
',`
typealias netif_t alias { lo_netif_t netif_lo_t };
')
-@@ -345,9 +434,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
+@@ -345,9 +435,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
allow corenet_unconfined_type node_type:node *;
allow corenet_unconfined_type netif_type:netif *;
allow corenet_unconfined_type packet_type:packet *;
@@ -6304,7 +6307,7 @@ index 3f6e168..340e49f 100644
')
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
-index b31c054..012cc6f 100644
+index b31c054..ed25075 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -15,15 +15,18 @@
@@ -6328,16 +6331,24 @@ index b31c054..012cc6f 100644
/dev/efirtc -c gen_context(system_u:object_r:clock_device_t,s0)
/dev/elographics/e2201 -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/em8300.* -c gen_context(system_u:object_r:v4l_device_t,s0)
-@@ -44,6 +47,8 @@
+@@ -44,6 +47,16 @@
/dev/hwrng -c gen_context(system_u:object_r:random_device_t,s0)
/dev/i915 -c gen_context(system_u:object_r:dri_device_t,s0)
/dev/inportbm -c gen_context(system_u:object_r:mouse_device_t,s0)
+/dev/infiniband/.* -c gen_context(system_u:object_r:infiniband_device_t,mls_systemhigh)
++/dev/infiniband/issm0 -c gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
++/dev/infiniband/issm1 -c gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
++/dev/infiniband/umad0 -c gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
++/dev/infiniband/umad1 -c gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
+/dev/infiniband/.* -b gen_context(system_u:object_r:infiniband_device_t,mls_systemhigh)
++/dev/infiniband/issm0 -b gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
++/dev/infiniband/issm1 -b gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
++/dev/infiniband/umad0 -b gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
++/dev/infiniband/umad1 -b gen_context(system_u:object_r:infiniband_mgmt_device_t,mls_systemhigh)
/dev/ipmi[0-9]+ -c gen_context(system_u:object_r:ipmi_device_t,s0)
/dev/ipmi/[0-9]+ -c gen_context(system_u:object_r:ipmi_device_t,s0)
/dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0)
-@@ -61,8 +66,10 @@
+@@ -61,8 +74,10 @@
/dev/loop-control -c gen_context(system_u:object_r:loop_control_device_t,s0)
/dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/mcelog -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
@@ -6349,7 +6360,7 @@ index b31c054..012cc6f 100644
/dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/mga_vid.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0)
-@@ -72,7 +79,9 @@
+@@ -72,7 +87,9 @@
/dev/mixer.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/modem -c gen_context(system_u:object_r:modem_device_t,s0)
@@ -6359,7 +6370,7 @@ index b31c054..012cc6f 100644
/dev/msr.* -c gen_context(system_u:object_r:cpu_device_t,s0)
/dev/net/vhost -c gen_context(system_u:object_r:vhost_device_t,s0)
/dev/network_latency -c gen_context(system_u:object_r:netcontrol_device_t,s0)
-@@ -80,6 +89,8 @@
+@@ -80,6 +97,8 @@
/dev/noz.* -c gen_context(system_u:object_r:modem_device_t,s0)
/dev/null -c gen_context(system_u:object_r:null_device_t,s0)
/dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
@@ -6368,7 +6379,7 @@ index b31c054..012cc6f 100644
/dev/nvram -c gen_context(system_u:object_r:nvram_device_t,mls_systemhigh)
/dev/oldmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
-@@ -90,6 +101,7 @@
+@@ -90,6 +109,7 @@
/dev/pmu -c gen_context(system_u:object_r:power_device_t,s0)
/dev/port -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
/dev/pps.* -c gen_context(system_u:object_r:clock_device_t,s0)
@@ -6376,7 +6387,7 @@ index b31c054..012cc6f 100644
/dev/(misc/)?psaux -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0)
-@@ -106,6 +118,7 @@
+@@ -106,6 +126,7 @@
/dev/snapshot -c gen_context(system_u:object_r:apm_bios_t,s0)
/dev/sndstat -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0)
@@ -6384,7 +6395,7 @@ index b31c054..012cc6f 100644
/dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/tpm[0-9]* -c gen_context(system_u:object_r:tpm_device_t,s0)
/dev/uinput -c gen_context(system_u:object_r:event_device_t,s0)
-@@ -118,6 +131,12 @@
+@@ -118,6 +139,12 @@
ifdef(`distro_suse', `
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
')
@@ -6397,7 +6408,7 @@ index b31c054..012cc6f 100644
/dev/vhost-net -c gen_context(system_u:object_r:vhost_device_t,s0)
/dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
-@@ -129,12 +148,14 @@ ifdef(`distro_suse', `
+@@ -129,12 +156,14 @@ ifdef(`distro_suse', `
/dev/vttuner -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/vtx.* -c gen_context(system_u:object_r:v4l_device_t,s0)
/dev/watchdog.* -c gen_context(system_u:object_r:watchdog_device_t,s0)
@@ -6412,7 +6423,7 @@ index b31c054..012cc6f 100644
/dev/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0)
-@@ -172,15 +193,21 @@ ifdef(`distro_suse', `
+@@ -172,15 +201,21 @@ ifdef(`distro_suse', `
/dev/touchscreen/ucb1x00 -c gen_context(system_u:object_r:mouse_device_t,s0)
/dev/touchscreen/mk712 -c gen_context(system_u:object_r:mouse_device_t,s0)
@@ -6434,7 +6445,7 @@ index b31c054..012cc6f 100644
ifdef(`distro_debian',`
# this is a static /dev dir "backup mount"
-@@ -198,12 +225,27 @@ ifdef(`distro_debian',`
+@@ -198,12 +233,27 @@ ifdef(`distro_debian',`
/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
@@ -6465,7 +6476,7 @@ index b31c054..012cc6f 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..5cd2702 100644
+index 76f285e..0aef35e 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -6966,7 +6977,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2043,7 +2285,99 @@ interface(`dev_getattr_framebuffer_dev',`
+@@ -2043,7 +2285,137 @@ interface(`dev_getattr_framebuffer_dev',`
## </summary>
## </param>
#
@@ -7037,6 +7048,44 @@ index 76f285e..5cd2702 100644
+
+########################################
+## <summary>
++## Read infiniband mgmt devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_read_infiniband_mgmt_dev',`
++ gen_require(`
++ type device_t, infiniband_mgmt_device_t;
++ ')
++
++ read_chr_files_pattern($1, device_t, infiniband_mgmt_device_t)
++ read_blk_files_pattern($1, device_t, infiniband_mgmt_device_t)
++')
++
++########################################
++## <summary>
++## Read and write ipmi devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_infiniband_mgmt_dev',`
++ gen_require(`
++ type device_t, infiniband_mgmt_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, infiniband_mgmt_device_t)
++ rw_blk_files_pattern($1, device_t, infiniband_mgmt_device_t)
++')
++
++########################################
++## <summary>
+## Get the attributes of the framebuffer device node.
+## </summary>
+## <param name="domain">
@@ -7067,7 +7116,7 @@ index 76f285e..5cd2702 100644
gen_require(`
type device_t, framebuf_device_t;
')
-@@ -2402,7 +2736,97 @@ interface(`dev_filetrans_lirc',`
+@@ -2402,7 +2774,97 @@ interface(`dev_filetrans_lirc',`
########################################
## <summary>
@@ -7166,7 +7215,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2532,6 +2956,24 @@ interface(`dev_read_raw_memory',`
+@@ -2532,6 +2994,24 @@ interface(`dev_read_raw_memory',`
########################################
## <summary>
@@ -7191,7 +7240,7 @@ index 76f285e..5cd2702 100644
## Do not audit attempts to read raw memory devices
## (e.g. /dev/mem).
## </summary>
-@@ -2573,6 +3015,24 @@ interface(`dev_write_raw_memory',`
+@@ -2573,6 +3053,24 @@ interface(`dev_write_raw_memory',`
########################################
## <summary>
@@ -7216,7 +7265,7 @@ index 76f285e..5cd2702 100644
## Read and execute raw memory devices (e.g. /dev/mem).
## </summary>
## <param name="domain">
-@@ -2725,7 +3185,7 @@ interface(`dev_write_misc',`
+@@ -2725,7 +3223,7 @@ interface(`dev_write_misc',`
## </summary>
## <param name="domain">
## <summary>
@@ -7225,178 +7274,245 @@ index 76f285e..5cd2702 100644
## </summary>
## </param>
#
-@@ -2811,6 +3271,78 @@ interface(`dev_rw_modem',`
+@@ -2811,7 +3309,7 @@ interface(`dev_rw_modem',`
########################################
## <summary>
+-## Get the attributes of the mouse devices.
+## Get the attributes of the monitor devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -2819,17 +3317,17 @@ interface(`dev_rw_modem',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_getattr_mouse_dev',`
+interface(`dev_getattr_monitor_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, mouse_device_t;
+ type device_t, monitor_device_t;
-+ ')
-+
+ ')
+
+- getattr_chr_files_pattern($1, device_t, mouse_device_t)
+ getattr_chr_files_pattern($1, device_t, monitor_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Set the attributes of the mouse devices.
+## Set the attributes of the monitor devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -2837,17 +3335,17 @@ interface(`dev_getattr_mouse_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_setattr_mouse_dev',`
+interface(`dev_setattr_monitor_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, mouse_device_t;
+ type device_t, monitor_device_t;
-+ ')
-+
+ ')
+
+- setattr_chr_files_pattern($1, device_t, mouse_device_t)
+ setattr_chr_files_pattern($1, device_t, monitor_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read the mouse devices.
+## Read the monitor devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -2855,17 +3353,17 @@ interface(`dev_setattr_mouse_dev',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_read_mouse',`
+interface(`dev_read_monitor_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, mouse_device_t;
+ type device_t, monitor_device_t;
-+ ')
-+
+ ')
+
+- read_chr_files_pattern($1, device_t, mouse_device_t)
+ read_chr_files_pattern($1, device_t, monitor_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Read and write to mouse devices.
+## Read and write to monitor devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -2873,18 +3371,17 @@ interface(`dev_read_mouse',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_rw_mouse',`
+interface(`dev_rw_monitor_dev',`
-+ gen_require(`
+ gen_require(`
+- type device_t, mouse_device_t;
+ type device_t, monitor_device_t;
-+ ')
-+
+ ')
+
+- rw_chr_files_pattern($1, device_t, mouse_device_t)
+ rw_chr_files_pattern($1, device_t, monitor_device_t)
-+')
-+
-+########################################
-+## <summary>
- ## Get the attributes of the mouse devices.
- ## </summary>
- ## <param name="domain">
-@@ -2903,20 +3435,20 @@ interface(`dev_getattr_mtrr_dev',`
+ ')
########################################
## <summary>
--## Read the memory type range
-+## Write the memory type range
- ## registers (MTRR). (Deprecated)
+-## Get the attributes of the memory type range
+-## registers (MTRR) device.
++## Get the attributes of the mouse devices.
## </summary>
- ## <desc>
- ## <p>
--## Read the memory type range
-+## Write the memory type range
- ## registers (MTRR). This interface has
- ## been deprecated, dev_rw_mtrr() should be
- ## used instead.
- ## </p>
- ## <p>
- ## The MTRR device ioctls can be used for
--## reading and writing; thus, read access to the
--## device cannot be separated from write access.
-+## reading and writing; thus, write access to the
-+## device cannot be separated from read access.
- ## </p>
- ## </desc>
## <param name="domain">
-@@ -2925,43 +3457,34 @@ interface(`dev_getattr_mtrr_dev',`
+ ## <summary>
+@@ -2892,47 +3389,91 @@ interface(`dev_rw_mouse',`
## </summary>
## </param>
#
--interface(`dev_read_mtrr',`
-+interface(`dev_write_mtrr',`
- refpolicywarn(`$0($*) has been replaced with dev_rw_mtrr().')
- dev_rw_mtrr($1)
+-interface(`dev_getattr_mtrr_dev',`
++interface(`dev_getattr_mouse_dev',`
+ gen_require(`
+- type device_t, mtrr_device_t;
++ type device_t, mouse_device_t;
+ ')
+
+- getattr_files_pattern($1, device_t, mtrr_device_t)
+- getattr_chr_files_pattern($1, device_t, mtrr_device_t)
++ getattr_chr_files_pattern($1, device_t, mouse_device_t)
')
########################################
## <summary>
--## Write the memory type range
+-## Read the memory type range
-## registers (MTRR). (Deprecated)
-+## Do not audit attempts to write the memory type
-+## range registers (MTRR).
++## Set the attributes of the mouse devices.
## </summary>
-## <desc>
-## <p>
--## Write the memory type range
+-## Read the memory type range
-## registers (MTRR). This interface has
-## been deprecated, dev_rw_mtrr() should be
-## used instead.
-## </p>
-## <p>
-## The MTRR device ioctls can be used for
--## reading and writing; thus, write access to the
--## device cannot be separated from read access.
+-## reading and writing; thus, read access to the
+-## device cannot be separated from write access.
-## </p>
-## </desc>
## <param name="domain">
## <summary>
--## Domain allowed access.
-+## Domain to not audit.
+ ## Domain allowed access.
## </summary>
## </param>
#
--interface(`dev_write_mtrr',`
+-interface(`dev_read_mtrr',`
- refpolicywarn(`$0($*) has been replaced with dev_rw_mtrr().')
- dev_rw_mtrr($1)
-+interface(`dev_dontaudit_write_mtrr',`
++interface(`dev_setattr_mouse_dev',`
+ gen_require(`
-+ type mtrr_device_t;
++ type device_t, mouse_device_t;
+ ')
+
-+ dontaudit $1 mtrr_device_t:file write_file_perms;
-+ dontaudit $1 mtrr_device_t:chr_file write_chr_file_perms;
++ setattr_chr_files_pattern($1, device_t, mouse_device_t)
')
########################################
## <summary>
--## Do not audit attempts to write the memory type
-+## Do not audit attempts to read the memory type
- ## range registers (MTRR).
+-## Write the memory type range
++## Read the mouse devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_read_mouse',`
++ gen_require(`
++ type device_t, mouse_device_t;
++ ')
++
++ read_chr_files_pattern($1, device_t, mouse_device_t)
++')
++
++########################################
++## <summary>
++## Read and write to mouse devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_mouse',`
++ gen_require(`
++ type device_t, mouse_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, mouse_device_t)
++')
++
++########################################
++## <summary>
++## Get the attributes of the memory type range
++## registers (MTRR) device.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_getattr_mtrr_dev',`
++ gen_require(`
++ type device_t, mtrr_device_t;
++ ')
++
++ getattr_files_pattern($1, device_t, mtrr_device_t)
++ getattr_chr_files_pattern($1, device_t, mtrr_device_t)
++')
++
++########################################
++## <summary>
++## Write the memory type range
+ ## registers (MTRR). (Deprecated)
## </summary>
- ## <param name="domain">
-@@ -2970,13 +3493,32 @@ interface(`dev_write_mtrr',`
- ## </summary>
- ## </param>
- #
--interface(`dev_dontaudit_write_mtrr',`
-+interface(`dev_dontaudit_read_mtrr',`
- gen_require(`
+ ## <desc>
+@@ -2975,8 +3516,47 @@ interface(`dev_dontaudit_write_mtrr',`
type mtrr_device_t;
')
- dontaudit $1 mtrr_device_t:file write;
- dontaudit $1 mtrr_device_t:chr_file write;
++ dontaudit $1 mtrr_device_t:file write_file_perms;
++ dontaudit $1 mtrr_device_t:chr_file write_chr_file_perms;
++')
++
++########################################
++## <summary>
++## Do not audit attempts to read the memory type
++## range registers (MTRR).
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`dev_dontaudit_read_mtrr',`
++ gen_require(`
++ type mtrr_device_t;
++ ')
++
+ dontaudit $1 mtrr_device_t:file { open read };
+ dontaudit $1 mtrr_device_t:chr_file { open read };
+')
@@ -7421,7 +7537,7 @@ index 76f285e..5cd2702 100644
')
########################################
-@@ -3144,6 +3686,61 @@ interface(`dev_create_null_dev',`
+@@ -3144,6 +3724,61 @@ interface(`dev_create_null_dev',`
########################################
## <summary>
@@ -7483,7 +7599,7 @@ index 76f285e..5cd2702 100644
## Do not audit attempts to get the attributes
## of the BIOS non-volatile RAM device.
## </summary>
-@@ -3163,6 +3760,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',`
+@@ -3163,6 +3798,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',`
########################################
## <summary>
@@ -7508,7 +7624,7 @@ index 76f285e..5cd2702 100644
## Read and write BIOS non-volatile RAM.
## </summary>
## <param name="domain">
-@@ -3254,7 +3869,25 @@ interface(`dev_rw_printer',`
+@@ -3254,7 +3907,25 @@ interface(`dev_rw_printer',`
########################################
## <summary>
@@ -7535,7 +7651,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3262,12 +3895,13 @@ interface(`dev_rw_printer',`
+@@ -3262,12 +3933,13 @@ interface(`dev_rw_printer',`
## </summary>
## </param>
#
@@ -7552,7 +7668,7 @@ index 76f285e..5cd2702 100644
')
########################################
-@@ -3399,7 +4033,7 @@ interface(`dev_dontaudit_read_rand',`
+@@ -3399,7 +4071,7 @@ interface(`dev_dontaudit_read_rand',`
########################################
## <summary>
@@ -7561,7 +7677,7 @@ index 76f285e..5cd2702 100644
## number generator devices (e.g., /dev/random)
## </summary>
## <param name="domain">
-@@ -3413,7 +4047,7 @@ interface(`dev_dontaudit_append_rand',`
+@@ -3413,7 +4085,7 @@ interface(`dev_dontaudit_append_rand',`
type random_device_t;
')
@@ -7570,7 +7686,7 @@ index 76f285e..5cd2702 100644
')
########################################
-@@ -3855,7 +4489,7 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3855,7 +4527,7 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
@@ -7579,7 +7695,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3863,91 +4497,89 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3863,91 +4535,89 @@ interface(`dev_getattr_sysfs_dirs',`
## </summary>
## </param>
#
@@ -7690,7 +7806,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3955,68 +4587,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
+@@ -3955,68 +4625,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
## </summary>
## </param>
#
@@ -7769,7 +7885,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4024,114 +4641,97 @@ interface(`dev_rw_sysfs',`
+@@ -4024,53 +4679,279 @@ interface(`dev_rw_sysfs',`
## </summary>
## </param>
#
@@ -7829,114 +7945,93 @@ index 76f285e..5cd2702 100644
- read_chr_files_pattern($1, device_t, urandom_device_t)
+ allow $1 sysfs_t:dir write;
- ')
-
- ########################################
- ## <summary>
--## Do not audit attempts to read from pseudo
--## random devices (e.g., /dev/urandom)
++')
++
++########################################
++## <summary>
+## Access check for a sysfs directories.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain to not audit.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`dev_dontaudit_read_urand',`
++## </summary>
++## </param>
++#
+interface(`dev_access_check_sysfs',`
- gen_require(`
-- type urandom_device_t;
++ gen_require(`
+ type sysfs_t;
- ')
-
-- dontaudit $1 urandom_device_t:chr_file { getattr read };
++ ')
++
+ allow $1 sysfs_t:dir audit_access;
- ')
-
- ########################################
- ## <summary>
--## Write to the pseudo random device (e.g., /dev/urandom). This
--## sets the random number generator seed.
++')
++
++########################################
++## <summary>
+## Do not audit attempts to write in a sysfs directory.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain allowed access.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain to not audit.
- ## </summary>
- ## </param>
- #
--interface(`dev_write_urand',`
++## </summary>
++## </param>
++#
+interface(`dev_dontaudit_write_sysfs_dirs',`
- gen_require(`
-- type device_t, urandom_device_t;
++ gen_require(`
+ type sysfs_t;
- ')
-
-- write_chr_files_pattern($1, device_t, urandom_device_t)
++ ')
++
+ dontaudit $1 sysfs_t:dir write;
- ')
-
- ########################################
- ## <summary>
--## Getattr generic the USB devices.
++')
++
++########################################
++## <summary>
+## Read cpu online hardware state information.
- ## </summary>
++## </summary>
+## <desc>
+## <p>
+## Allow the specified domain to read /sys/devices/system/cpu/online file.
+## </p>
+## </desc>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`dev_getattr_generic_usb_dev',`
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`dev_read_cpu_online',`
- gen_require(`
-- type usb_device_t;
++ gen_require(`
+ type cpu_online_t;
- ')
-
-- getattr_chr_files_pattern($1, device_t, usb_device_t)
++ ')
++
+ dev_search_sysfs($1)
+ read_files_pattern($1, cpu_online_t, cpu_online_t)
- ')
-
- ########################################
- ## <summary>
--## Setattr generic the USB devices.
++')
++
++########################################
++## <summary>
+## Relabel cpu online hardware state information.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -4139,35 +4739,50 @@ interface(`dev_getattr_generic_usb_dev',`
- ## </summary>
- ## </param>
- #
--interface(`dev_setattr_generic_usb_dev',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`dev_relabel_cpu_online',`
- gen_require(`
-- type usb_device_t;
++ gen_require(`
+ type cpu_online_t;
+ type sysfs_t;
- ')
-
-- setattr_chr_files_pattern($1, device_t, usb_device_t)
++ ')
++
+ dev_search_sysfs($1)
+ allow $1 cpu_online_t:file relabel_file_perms;
- ')
-
++')
+
- ########################################
- ## <summary>
--## Read generic the USB devices.
++
++########################################
++## <summary>
+## Read hardware state information.
- ## </summary>
++## </summary>
+## <desc>
+## <p>
+## Allow the specified domain to read the contents of
@@ -7945,39 +8040,34 @@ index 76f285e..5cd2702 100644
+## hardware installed on the system.
+## </p>
+## </desc>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
+## <infoflow type="read" weight="10"/>
- #
--interface(`dev_read_generic_usb_dev',`
++#
+interface(`dev_read_sysfs',`
- gen_require(`
-- type usb_device_t;
++ gen_require(`
+ type sysfs_t;
- ')
-
-- read_chr_files_pattern($1, device_t, usb_device_t)
++ ')
++
+ read_files_pattern($1, sysfs_t, sysfs_t)
+ read_lnk_files_pattern($1, sysfs_t, sysfs_t)
+
+ list_dirs_pattern($1, sysfs_t, sysfs_t)
- ')
-
- ########################################
- ## <summary>
--## Read and write generic the USB devices.
++')
++
++########################################
++## <summary>
+## Allow caller to modify hardware state information.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -4175,7 +4790,254 @@ interface(`dev_read_generic_usb_dev',`
- ## </summary>
- ## </param>
- #
--interface(`dev_rw_generic_usb_dev',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+interface(`dev_rw_sysfs',`
+ gen_require(`
+ type sysfs_t;
@@ -8102,48 +8192,13 @@ index 76f285e..5cd2702 100644
+ ')
+
+ read_chr_files_pattern($1, device_t, urandom_device_t)
-+')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to read from pseudo
-+## random devices (e.g., /dev/urandom)
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_dontaudit_read_urand',`
-+ gen_require(`
-+ type urandom_device_t;
-+ ')
-+
-+ dontaudit $1 urandom_device_t:chr_file { getattr read };
-+')
-+
-+########################################
-+## <summary>
-+## Write to the pseudo random device (e.g., /dev/urandom). This
-+## sets the random number generator seed.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_write_urand',`
-+ gen_require(`
-+ type device_t, urandom_device_t;
-+ ')
-+
-+ write_chr_files_pattern($1, device_t, urandom_device_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+@@ -4113,6 +4994,25 @@ interface(`dev_write_urand',`
+
+ ########################################
+ ## <summary>
+## Do not audit attempts to write to pseudo
+## random devices (e.g., /dev/urandom)
+## </summary>
@@ -8163,73 +8218,19 @@ index 76f285e..5cd2702 100644
+
+########################################
+## <summary>
-+## Getattr generic the USB devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_getattr_generic_usb_dev',`
-+ gen_require(`
-+ type usb_device_t,device_t;
-+ ')
-+
-+ getattr_chr_files_pattern($1, device_t, usb_device_t)
-+')
-+
-+########################################
-+## <summary>
-+## Setattr generic the USB devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_setattr_generic_usb_dev',`
-+ gen_require(`
-+ type usb_device_t;
-+ ')
-+
-+ setattr_chr_files_pattern($1, device_t, usb_device_t)
-+')
-+
-+########################################
-+## <summary>
-+## Read generic the USB devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_read_generic_usb_dev',`
-+ gen_require(`
-+ type usb_device_t;
-+ ')
-+
-+ read_chr_files_pattern($1, device_t, usb_device_t)
-+')
-+
-+########################################
-+## <summary>
-+## Read and write generic the USB devices.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_rw_generic_usb_dev',`
+ ## Getattr generic the USB devices.
+ ## </summary>
+ ## <param name="domain">
+@@ -4123,7 +5023,7 @@ interface(`dev_write_urand',`
+ #
+ interface(`dev_getattr_generic_usb_dev',`
gen_require(`
- type device_t, usb_device_t;
+- type usb_device_t;
++ type usb_device_t,device_t;
')
-@@ -4330,28 +5192,180 @@ interface(`dev_search_usbfs',`
+
+ getattr_chr_files_pattern($1, device_t, usb_device_t)
+@@ -4330,28 +5230,180 @@ interface(`dev_search_usbfs',`
########################################
## <summary>
@@ -8419,7 +8420,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4359,19 +5373,17 @@ interface(`dev_list_usbfs',`
+@@ -4359,19 +5411,17 @@ interface(`dev_list_usbfs',`
## </summary>
## </param>
#
@@ -8443,7 +8444,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4379,19 +5391,17 @@ interface(`dev_setattr_usbfs_files',`
+@@ -4379,19 +5429,17 @@ interface(`dev_setattr_usbfs_files',`
## </summary>
## </param>
#
@@ -8467,7 +8468,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4399,37 +5409,36 @@ interface(`dev_read_usbfs',`
+@@ -4399,37 +5447,36 @@ interface(`dev_read_usbfs',`
## </summary>
## </param>
#
@@ -8516,7 +8517,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4437,18 +5446,18 @@ interface(`dev_getattr_video_dev',`
+@@ -4437,18 +5484,18 @@ interface(`dev_getattr_video_dev',`
## </summary>
## </param>
#
@@ -8540,7 +8541,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4456,17 +5465,17 @@ interface(`dev_rw_userio_dev',`
+@@ -4456,17 +5503,17 @@ interface(`dev_rw_userio_dev',`
## </summary>
## </param>
#
@@ -8562,7 +8563,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4474,36 +5483,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
+@@ -4474,36 +5521,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
## </summary>
## </param>
#
@@ -8608,7 +8609,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4511,17 +5519,17 @@ interface(`dev_dontaudit_setattr_video_dev',`
+@@ -4511,17 +5557,17 @@ interface(`dev_dontaudit_setattr_video_dev',`
## </summary>
## </param>
#
@@ -8630,7 +8631,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4529,17 +5537,17 @@ interface(`dev_read_video_dev',`
+@@ -4529,17 +5575,17 @@ interface(`dev_read_video_dev',`
## </summary>
## </param>
#
@@ -8652,7 +8653,7 @@ index 76f285e..5cd2702 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4547,12 +5555,12 @@ interface(`dev_write_video_dev',`
+@@ -4547,12 +5593,12 @@ interface(`dev_write_video_dev',`
## </summary>
## </param>
#
@@ -8667,7 +8668,7 @@ index 76f285e..5cd2702 100644
')
########################################
-@@ -4630,6 +5638,24 @@ interface(`dev_write_watchdog',`
+@@ -4630,6 +5676,24 @@ interface(`dev_write_watchdog',`
########################################
## <summary>
@@ -8692,7 +8693,7 @@ index 76f285e..5cd2702 100644
## Read and write the the wireless device.
## </summary>
## <param name="domain">
-@@ -4762,6 +5788,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4762,6 +5826,44 @@ interface(`dev_rw_xserver_misc',`
########################################
## <summary>
@@ -8737,7 +8738,7 @@ index 76f285e..5cd2702 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
-@@ -4851,3 +5915,1020 @@ interface(`dev_unconfined',`
+@@ -4851,3 +5953,1020 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -9759,7 +9760,7 @@ index 76f285e..5cd2702 100644
+ filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
+')
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
-index 0b1a871..4cef59b 100644
+index 0b1a871..9f3512c 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -15,11 +15,12 @@ attribute devices_unconfined_type;
@@ -9796,7 +9797,7 @@ index 0b1a871..4cef59b 100644
# for the IBM zSeries z90crypt hardware ssl accelorator
type crypt_device_t;
dev_node(crypt_device_t)
-@@ -88,12 +89,27 @@ type framebuf_device_t;
+@@ -88,12 +89,33 @@ type framebuf_device_t;
dev_node(framebuf_device_t)
#
@@ -9821,10 +9822,16 @@ index 0b1a871..4cef59b 100644
+dev_node(infiniband_device_t)
+
+#
++# Type for /dev/infiniband mgmt devices
++#
++type infiniband_mgmt_device_t;
++dev_node(infiniband_mgmt_device_t)
++
++#
# Type for /dev/kmsg
#
type kmsg_device_t;
-@@ -111,6 +127,7 @@ dev_node(ksm_device_t)
+@@ -111,6 +133,7 @@ dev_node(ksm_device_t)
#
type kvm_device_t;
dev_node(kvm_device_t)
@@ -9832,7 +9839,7 @@ index 0b1a871..4cef59b 100644
#
# Type for /dev/lirc
-@@ -118,6 +135,9 @@ dev_node(kvm_device_t)
+@@ -118,6 +141,9 @@ dev_node(kvm_device_t)
type lirc_device_t;
dev_node(lirc_device_t)
@@ -9842,7 +9849,7 @@ index 0b1a871..4cef59b 100644
type loop_control_device_t;
dev_node(loop_control_device_t)
-@@ -150,12 +170,24 @@ type modem_device_t;
+@@ -150,12 +176,24 @@ type modem_device_t;
dev_node(modem_device_t)
#
@@ -9867,7 +9874,7 @@ index 0b1a871..4cef59b 100644
# Type for /dev/cpu/mtrr and /proc/mtrr
#
type mtrr_device_t;
-@@ -183,6 +215,12 @@ type nvram_device_t;
+@@ -183,6 +221,12 @@ type nvram_device_t;
dev_node(nvram_device_t)
#
@@ -9880,7 +9887,7 @@ index 0b1a871..4cef59b 100644
# Type for /dev/pmu
#
type power_device_t;
-@@ -227,6 +265,10 @@ files_mountpoint(sysfs_t)
+@@ -227,6 +271,10 @@ files_mountpoint(sysfs_t)
fs_type(sysfs_t)
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
@@ -9891,7 +9898,7 @@ index 0b1a871..4cef59b 100644
#
# Type for /dev/tpm
#
-@@ -266,6 +308,15 @@ dev_node(usbmon_device_t)
+@@ -266,6 +314,15 @@ dev_node(usbmon_device_t)
type userio_device_t;
dev_node(userio_device_t)
@@ -9907,7 +9914,7 @@ index 0b1a871..4cef59b 100644
type v4l_device_t;
dev_node(v4l_device_t)
-@@ -274,6 +325,7 @@ dev_node(v4l_device_t)
+@@ -274,6 +331,7 @@ dev_node(v4l_device_t)
#
type vhost_device_t;
dev_node(vhost_device_t)
@@ -9915,7 +9922,7 @@ index 0b1a871..4cef59b 100644
# Type for vmware devices.
type vmware_device_t;
-@@ -319,5 +371,8 @@ files_associate_tmp(device_node)
+@@ -319,5 +377,8 @@ files_associate_tmp(device_node)
#
allow devices_unconfined_type self:capability sys_rawio;
@@ -25960,10 +25967,10 @@ index 0000000..d9efb90
+#/usr/sbin/xrdp-sesman -- gen_context(system_u:object_r:unconfined_exec_t,s0)
diff --git a/policy/modules/roles/unconfineduser.if b/policy/modules/roles/unconfineduser.if
new file mode 100644
-index 0000000..03faeac
+index 0000000..15b42ae
--- /dev/null
+++ b/policy/modules/roles/unconfineduser.if
-@@ -0,0 +1,708 @@
+@@ -0,0 +1,727 @@
+## <summary>Unconfined user role</summary>
+
+########################################
@@ -26462,6 +26469,25 @@ index 0000000..03faeac
+
+########################################
+## <summary>
++## Create communication channel with unconfined domain over dbus.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`unconfined_dbus_acquire_svc',`
++ gen_require(`
++ type unconfined_t;
++ class dbus acquire_svc;
++ ')
++
++ allow $1 unconfined_t:dbus acquire_svc;
++')
++
++########################################
++## <summary>
+## Send and receive messages from
+## unconfined_t over dbus.
+## </summary>
@@ -41474,10 +41500,10 @@ index 6b91740..7c98978 100644
+/var/run/clvmd\.pid -- gen_context(system_u:object_r:clvmd_var_run_t,s0)
/var/run/dmevent.* gen_context(system_u:object_r:lvm_var_run_t,s0)
diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if
-index 58bc27f..8f7b119 100644
+index 58bc27f..9e86fce 100644
--- a/policy/modules/system/lvm.if
+++ b/policy/modules/system/lvm.if
-@@ -1,5 +1,22 @@
+@@ -1,5 +1,41 @@
## <summary>Policy for logical volume management programs.</summary>
+
@@ -41497,10 +41523,29 @@ index 58bc27f..8f7b119 100644
+ ')
+')
+
++########################################
++## <summary>
++## Get the attribute of lvm entrypoint files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`lvm_getattr_exec_files',`
++ gen_require(`
++ type lvm_exec_t;
++ ')
++
++ files_list_etc($1)
++ allow $1 lvm_exec_t:file getattr;
++')
++
########################################
## <summary>
## Execute lvm programs in the lvm domain.
-@@ -86,6 +103,50 @@ interface(`lvm_read_config',`
+@@ -86,6 +122,50 @@ interface(`lvm_read_config',`
########################################
## <summary>
@@ -41551,7 +41596,7 @@ index 58bc27f..8f7b119 100644
## Manage LVM configuration files.
## </summary>
## <param name="domain">
-@@ -105,6 +166,25 @@ interface(`lvm_manage_config',`
+@@ -105,6 +185,25 @@ interface(`lvm_manage_config',`
manage_files_pattern($1, lvm_etc_t, lvm_etc_t)
')
@@ -41577,7 +41622,7 @@ index 58bc27f..8f7b119 100644
######################################
## <summary>
## Execute a domain transition to run clvmd.
-@@ -123,3 +203,175 @@ interface(`lvm_domtrans_clvmd',`
+@@ -123,3 +222,175 @@ interface(`lvm_domtrans_clvmd',`
corecmd_search_bin($1)
domtrans_pattern($1, clvmd_exec_t, clvmd_t)
')
@@ -48364,10 +48409,10 @@ index 0000000..ebd6cc8
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..7717a2b
+index 0000000..f26d95b
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,932 @@
+@@ -0,0 +1,939 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -48769,6 +48814,10 @@ index 0000000..7717a2b
+ udev_read_db(systemd_networkd_t)
+')
+
++optional_policy(`
++ unconfined_dbus_acquire_svc(systemd_networkd_t)
++')
++
+#######################################
+#
+# Local policy
@@ -49205,6 +49254,7 @@ index 0000000..7717a2b
+# systemd_hwdb domain
+#
+manage_files_pattern(systemd_hwdb_t, systemd_hwdb_etc_t, systemd_hwdb_etc_t)
++allow systemd_hwdb_t systemd_hwdb_etc_t:file {relabelfrom relabelto};
+files_etc_filetrans(systemd_hwdb_t, systemd_hwdb_etc_t, file)
+
+
@@ -49245,6 +49295,7 @@ index 0000000..7717a2b
+read_files_pattern(systemd_resolved_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t)
+
+kernel_dgram_send(systemd_resolved_t)
++kernel_read_net_sysctls(systemd_resolved_t)
+
+auth_read_passwd(systemd_resolved_t)
+
@@ -49259,6 +49310,7 @@ index 0000000..7717a2b
+
+optional_policy(`
+ dbus_system_bus_client(systemd_resolved_t)
++ dbus_acquire_svc_system_dbusd(systemd_resolved_t)
+')
+
+########################################
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 0f5e589..e90b273 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -11112,10 +11112,12 @@ index c5a9113..1919abd 100644
xen_dontaudit_rw_unix_stream_sockets(brctl_t)
diff --git a/brltty.fc b/brltty.fc
new file mode 100644
-index 0000000..0cfe342
+index 0000000..05e3528
--- /dev/null
+++ b/brltty.fc
-@@ -0,0 +1,8 @@
+@@ -0,0 +1,10 @@
++/tmp/brltty\.log.* -- gen_context(system_u:object_r:brltty_log_t,s0)
++
+/usr/lib/systemd/system/brltty.* -- gen_context(system_u:object_r:brltty_unit_file_t,s0)
+
+/usr/bin/brltty -- gen_context(system_u:object_r:brltty_exec_t,s0)
@@ -11212,10 +11214,10 @@ index 0000000..968c957
+')
diff --git a/brltty.te b/brltty.te
new file mode 100644
-index 0000000..eabda1e
+index 0000000..988aa6c
--- /dev/null
+++ b/brltty.te
-@@ -0,0 +1,62 @@
+@@ -0,0 +1,70 @@
+policy_module(brltty, 1.0.0)
+
+########################################
@@ -11233,6 +11235,9 @@ index 0000000..eabda1e
+type brltty_var_run_t;
+files_pid_file(brltty_var_run_t)
+
++type brltty_log_t;
++logging_log_file(brltty_log_t)
++
+type brltty_unit_file_t;
+systemd_unit_file(brltty_unit_file_t)
+
@@ -11247,6 +11252,11 @@ index 0000000..eabda1e
+allow brltty_t self:unix_stream_socket create_stream_socket_perms;
+allow brltty_t self:tcp_socket listen;
+
++manage_files_pattern(brltty_t, brltty_log_t, brltty_log_t)
++manage_sock_files_pattern(brltty_t, brltty_log_t, brltty_log_t)
++manage_lnk_files_pattern(brltty_t, brltty_log_t, brltty_log_t)
++file_tmp_filetrans(brltty_t, brltty_log_t, { file dir })
++
+manage_dirs_pattern(brltty_t, brltty_var_lib_t, brltty_var_lib_t)
+manage_files_pattern(brltty_t, brltty_var_lib_t, brltty_var_lib_t)
+manage_sock_files_pattern(brltty_t,brltty_var_lib_t, brltty_var_lib_t)
@@ -21987,7 +21997,7 @@ index dda905b..5587295 100644
/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
+')
diff --git a/dbus.if b/dbus.if
-index 62d22cb..f8ab4af 100644
+index 62d22cb..d2ff291 100644
--- a/dbus.if
+++ b/dbus.if
@@ -1,4 +1,4 @@
@@ -22135,9 +22145,9 @@ index 62d22cb..f8ab4af 100644
- files_search_var_lib($1)
read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
+ files_search_var_lib($1)
-+
-+ dev_read_urand($1)
++ dev_read_urand($1)
++
+ # For connecting to the bus
files_search_pids($1)
stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
@@ -22650,7 +22660,7 @@ index 62d22cb..f8ab4af 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -498,98 +496,100 @@ interface(`dbus_connect_system_bus',`
+@@ -498,98 +496,121 @@ interface(`dbus_connect_system_bus',`
## </summary>
## </param>
#
@@ -22751,54 +22761,47 @@ index 62d22cb..f8ab4af 100644
- ps_process_pattern(system_dbusd_t, $1)
-
- userdom_read_all_users_state($1)
--
-- ifdef(`hide_broken_symptoms', `
-- dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
-- ')
+ allow $1 session_bus_type:dbus send_msg;
+ allow session_bus_type $1:dbus send_msg;
- ')
++')
- ########################################
- ## <summary>
--## Use and inherit DBUS system bus
--## file descriptors.
+- ifdef(`hide_broken_symptoms', `
+- dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
++########################################
++## <summary>
+## Do not audit attempts to send dbus
+## messages to session bus types.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain allowed access.
++## </summary>
++## <param name="domain">
++## <summary>
+## Domain to not audit.
- ## </summary>
- ## </param>
- #
--interface(`dbus_use_system_bus_fds',`
++## </summary>
++## </param>
++#
+interface(`dbus_dontaudit_chat_session_bus',`
- gen_require(`
-- type system_dbusd_t;
++ gen_require(`
+ attribute session_bus_type;
+ class dbus send_msg;
')
-
-- allow $1 system_dbusd_t:fd use;
++
+ dontaudit $1 session_bus_type:dbus send_msg;
')
########################################
## <summary>
--## Do not audit attempts to read and
--## write DBUS system bus TCP sockets.
+-## Use and inherit DBUS system bus
+-## file descriptors.
+## Do not audit attempts to send dbus
+## messages to system bus types.
## </summary>
## <param name="domain">
## <summary>
-@@ -597,28 +597,50 @@ interface(`dbus_use_system_bus_fds',`
+-## Domain allowed access.
++## Domain to not audit.
## </summary>
## </param>
#
--interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',`
+-interface(`dbus_use_system_bus_fds',`
+interface(`dbus_dontaudit_chat_system_bus',`
gen_require(`
- type system_dbusd_t;
@@ -22806,33 +22809,33 @@ index 62d22cb..f8ab4af 100644
+ class dbus send_msg;
')
-- dontaudit $1 system_dbusd_t:tcp_socket { read write };
+- allow $1 system_dbusd_t:fd use;
+ dontaudit $1 system_bus_type:dbus send_msg;
+ dontaudit system_bus_type $1:dbus send_msg;
')
########################################
## <summary>
--## Unconfined access to DBUS.
+-## Do not audit attempts to read and
+-## write DBUS system bus TCP sockets.
+## Allow attempts to send dbus
+## messages to system bus types.
## </summary>
## <param name="domain">
## <summary>
--## Domain allowed access.
-+## Domain to not audit.
+@@ -597,28 +618,50 @@ interface(`dbus_use_system_bus_fds',`
## </summary>
## </param>
#
--interface(`dbus_unconfined',`
+-interface(`dbus_dontaudit_system_bus_rw_tcp_sockets',`
+interface(`dbus_chat_system_bus',`
gen_require(`
-- attribute dbusd_unconfined;
+- type system_dbusd_t;
+ attribute system_bus_type;
+ class dbus send_msg;
')
-- typeattribute $1 dbusd_unconfined;
+- dontaudit $1 system_dbusd_t:tcp_socket { read write };
+ allow $1 system_bus_type:dbus send_msg;
+ allow system_bus_type $1:dbus send_msg;
+')
@@ -22853,6 +22856,32 @@ index 62d22cb..f8ab4af 100644
+ ')
+ files_var_filetrans($1, system_dbusd_var_lib_t, dir, "ibus")
')
+
+ ########################################
+ ## <summary>
+-## Unconfined access to DBUS.
++## Allow attempts to send dbus
++## messages to system dbusd type.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`dbus_unconfined',`
++interface(`dbus_acquire_svc_system_dbusd',`
+ gen_require(`
+- attribute dbusd_unconfined;
++ type system_dbusd_t;
++ class dbus acquire_svc;
+ ')
+
+- typeattribute $1 dbusd_unconfined;
++ allow $1 system_dbusd_t:dbus acquire_svc;
++
+ ')
diff --git a/dbus.te b/dbus.te
index c9998c8..44c6283 100644
--- a/dbus.te
@@ -28312,7 +28341,7 @@ index 50d0084..94e1936 100644
fail2ban_run_client($1, $2)
diff --git a/fail2ban.te b/fail2ban.te
-index cf0e567..7945ad9 100644
+index cf0e567..7bebd26 100644
--- a/fail2ban.te
+++ b/fail2ban.te
@@ -37,7 +37,7 @@ role fail2ban_client_roles types fail2ban_client_t;
@@ -28393,7 +28422,13 @@ index cf0e567..7945ad9 100644
shorewall_domtrans(fail2ban_t)
')
-@@ -131,22 +146,32 @@ allow fail2ban_client_t self:unix_stream_socket { create connect write read };
+@@ -126,27 +141,37 @@ optional_policy(`
+ # Client Local policy
+ #
+
+-allow fail2ban_client_t self:capability dac_read_search;
++allow fail2ban_client_t self:capability { dac_read_search dac_override };
+ allow fail2ban_client_t self:unix_stream_socket { create connect write read };
domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
@@ -28789,7 +28824,7 @@ index c62c567..a74f123 100644
+ allow $1 firewalld_unit_file_t:service all_service_perms;
')
diff --git a/firewalld.te b/firewalld.te
-index 98072a3..18a2ef2 100644
+index 98072a3..50e7985 100644
--- a/firewalld.te
+++ b/firewalld.te
@@ -21,9 +21,15 @@ logging_log_file(firewalld_var_log_t)
@@ -28833,7 +28868,7 @@ index 98072a3..18a2ef2 100644
kernel_read_network_state(firewalld_t)
kernel_read_system_state(firewalld_t)
-@@ -63,20 +77,20 @@ dev_search_sysfs(firewalld_t)
+@@ -63,20 +77,21 @@ dev_search_sysfs(firewalld_t)
domain_use_interactive_fds(firewalld_t)
@@ -28858,10 +28893,11 @@ index 98072a3..18a2ef2 100644
-sysnet_read_config(firewalld_t)
+sysnet_dns_name_resolve(firewalld_t)
+sysnet_manage_config_dirs(firewalld_t)
++sysnet_create_config(firewalld_t)
optional_policy(`
dbus_system_domain(firewalld_t, firewalld_exec_t)
-@@ -95,6 +109,10 @@ optional_policy(`
+@@ -95,6 +110,10 @@ optional_policy(`
')
optional_policy(`
@@ -37415,10 +37451,10 @@ index 6517fad..f183748 100644
+ allow $1 hypervkvp_unit_file_t:service all_service_perms;
')
diff --git a/hypervkvp.te b/hypervkvp.te
-index 4eb7041..fc5435f 100644
+index 4eb7041..b7b9201 100644
--- a/hypervkvp.te
+++ b/hypervkvp.te
-@@ -5,24 +5,146 @@ policy_module(hypervkvp, 1.0.0)
+@@ -5,24 +5,148 @@ policy_module(hypervkvp, 1.0.0)
# Declarations
#
@@ -37451,11 +37487,12 @@ index 4eb7041..fc5435f 100644
+
+type hypervvssd_unit_file_t;
+systemd_unit_file(hypervvssd_unit_file_t)
-+
-+########################################
-+#
+
+ ########################################
+ #
+-# Local policy
+# hyperv domain local policy
-+#
+ #
+
+allow hyperv_domain self:capability net_admin;
+allow hyperv_domain self:netlink_socket create_socket_perms;
@@ -37467,10 +37504,9 @@ index 4eb7041..fc5435f 100644
+corecmd_exec_bin(hyperv_domain)
+
+dev_read_sysfs(hyperv_domain)
-
- ########################################
++
++########################################
#
--# Local policy
+# hypervkvp local policy
+#
+
@@ -37505,6 +37541,8 @@ index 4eb7041..fc5435f 100644
+
+files_dontaudit_search_home(hypervkvp_t)
+
++fs_getattr_all_fs(hypervkvp_t)
++
+auth_use_nsswitch(hypervkvp_t)
+
+logging_send_syslog_msg(hypervkvp_t)
@@ -37557,14 +37595,14 @@ index 4eb7041..fc5435f 100644
+')
+
+########################################
- #
++#
+# hypervvssd local policy
- #
++#
++
++allow hypervvssd_t self:capability sys_admin;
-allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
-allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
-+allow hypervvssd_t self:capability sys_admin;
-+
+dev_rw_hypervvssd(hypervvssd_t)
-logging_send_syslog_msg(hypervkvpd_t)
@@ -37734,7 +37772,7 @@ index fbb54e7..05c3777 100644
########################################
diff --git a/inetd.te b/inetd.te
-index c6450df..a28aa13 100644
+index c6450df..6304b00 100644
--- a/inetd.te
+++ b/inetd.te
@@ -37,9 +37,9 @@ ifdef(`enable_mcs',`
@@ -37824,7 +37862,7 @@ index c6450df..a28aa13 100644
dev_read_urand(inetd_child_t)
fs_getattr_xattr_fs(inetd_child_t)
-@@ -230,7 +243,11 @@ auth_use_nsswitch(inetd_child_t)
+@@ -230,7 +243,15 @@ auth_use_nsswitch(inetd_child_t)
logging_send_syslog_msg(inetd_child_t)
@@ -37834,6 +37872,10 @@ index c6450df..a28aa13 100644
+optional_policy(`
+ kerberos_use(inetd_child_t)
+')
++
++optional_policy(`
++ systemd_dbus_chat_logind(inetd_child_t)
++')
optional_policy(`
unconfined_domain(inetd_child_t)
@@ -42617,7 +42659,7 @@ index f6c00d8..e3cb4f1 100644
+ kerberos_tmp_filetrans_host_rcache($1, "ldap_55")
')
diff --git a/kerberos.te b/kerberos.te
-index 8833d59..1d0599a 100644
+index 8833d59..a6356be 100644
--- a/kerberos.te
+++ b/kerberos.te
@@ -6,11 +6,11 @@ policy_module(kerberos, 1.12.0)
@@ -42886,7 +42928,7 @@ index 8833d59..1d0599a 100644
selinux_validate_context(krb5kdc_t)
-+auth_read_passwd(krb5kdc_t)
++auth_use_nsswitch(krb5kdc_t)
+
logging_send_syslog_msg(krb5kdc_t)
@@ -46822,10 +46864,10 @@ index 0000000..bdd17ca
+/var/run/lttng(/.*)? gen_context(system_u:object_r:lttng_sessiond_var_run_t,s0)
diff --git a/lttng-tools.if b/lttng-tools.if
new file mode 100644
-index 0000000..6b0da33
+index 0000000..e86897d
--- /dev/null
+++ b/lttng-tools.if
-@@ -0,0 +1,98 @@
+@@ -0,0 +1,117 @@
+
+## <summary>LTTng 2.x central tracing registry session daemon.</summary>
+
@@ -46924,6 +46966,25 @@ index 0000000..6b0da33
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
++
++########################################
++## <summary>
++## Read and write lttng-tools shared memory.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`lttng_read_shm',`
++ gen_require(`
++ type lttng_sessiond_tmpfs_t;
++ ')
++
++ read_files_pattern($1, lttng_sessiond_tmpfs_t, lttng_sessiond_tmpfs_t)
++ fs_search_tmpfs($1)
++')
diff --git a/lttng-tools.te b/lttng-tools.te
new file mode 100644
index 0000000..0b9ade5
@@ -49737,10 +49798,10 @@ index 0000000..f5b98e6
+')
diff --git a/mock.te b/mock.te
new file mode 100644
-index 0000000..86766b0
+index 0000000..66c45cb
--- /dev/null
+++ b/mock.te
-@@ -0,0 +1,278 @@
+@@ -0,0 +1,284 @@
+policy_module(mock,1.0.0)
+
+## <desc>
@@ -49887,7 +49948,13 @@ index 0000000..86766b0
+logging_send_audit_msgs(mock_t)
+logging_send_syslog_msg(mock_t)
+
++lvm_manage_lock(mock_t)
++lvm_read_config(mock_t)
++lvm_read_metadata(mock_t)
++lvm_getattr_exec_files(mock_t)
++
+userdom_use_user_ptys(mock_t)
++userdom_use_user_ttys(mock_t)
+
+files_search_home(mock_t)
+
@@ -60333,7 +60400,7 @@ index ba64485..429bd79 100644
+
+/usr/lib/systemd/system/nscd\.service -- gen_context(system_u:object_r:nscd_unit_file_t,s0)
diff --git a/nscd.if b/nscd.if
-index 8f2ab09..cd5d344 100644
+index 8f2ab09..a298198 100644
--- a/nscd.if
+++ b/nscd.if
@@ -1,8 +1,8 @@
@@ -60519,16 +60586,34 @@ index 8f2ab09..cd5d344 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -193,7 +214,7 @@ interface(`nscd_dontaudit_search_pid',`
+@@ -193,7 +214,25 @@ interface(`nscd_dontaudit_search_pid',`
########################################
## <summary>
-## Read nscd pid files.
++## Do not audit attempts to read the NSCD pid directory.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`nscd_dontaudit_read_pid',`
++ gen_require(`
++ type nscd_var_run_t;
++ ')
++
++ dontaudit $1 nscd_var_run_t:file read_file_perms;
++')
++
++########################################
++## <summary>
+## Read NSCD pid file.
## </summary>
## <param name="domain">
## <summary>
-@@ -212,7 +233,7 @@ interface(`nscd_read_pid',`
+@@ -212,7 +251,7 @@ interface(`nscd_read_pid',`
########################################
## <summary>
@@ -60537,7 +60622,7 @@ index 8f2ab09..cd5d344 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -244,20 +265,20 @@ interface(`nscd_unconfined',`
+@@ -244,20 +283,20 @@ interface(`nscd_unconfined',`
## Role allowed access.
## </summary>
## </param>
@@ -60562,7 +60647,7 @@ index 8f2ab09..cd5d344 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -275,8 +296,32 @@ interface(`nscd_initrc_domtrans',`
+@@ -275,8 +314,32 @@ interface(`nscd_initrc_domtrans',`
########################################
## <summary>
@@ -60597,7 +60682,7 @@ index 8f2ab09..cd5d344 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -285,7 +330,7 @@ interface(`nscd_initrc_domtrans',`
+@@ -285,7 +348,7 @@ interface(`nscd_initrc_domtrans',`
## </param>
## <param name="role">
## <summary>
@@ -60606,7 +60691,7 @@ index 8f2ab09..cd5d344 100644
## </summary>
## </param>
## <rolecap/>
-@@ -294,10 +339,14 @@ interface(`nscd_admin',`
+@@ -294,10 +357,14 @@ interface(`nscd_admin',`
gen_require(`
type nscd_t, nscd_log_t, nscd_var_run_t;
type nscd_initrc_exec_t;
@@ -60622,7 +60707,7 @@ index 8f2ab09..cd5d344 100644
init_labeled_script_domtrans($1, nscd_initrc_exec_t)
domain_system_change_exemption($1)
-@@ -310,5 +359,7 @@ interface(`nscd_admin',`
+@@ -310,5 +377,7 @@ interface(`nscd_admin',`
files_list_pids($1)
admin_pattern($1, nscd_var_run_t)
@@ -60945,7 +61030,7 @@ index a9c60ff..ad4f14a 100644
+ refpolicywarn(`$0($*) has been deprecated.')
')
diff --git a/nsd.te b/nsd.te
-index 47bb1d2..5cc2b26 100644
+index 47bb1d2..45ea5b7 100644
--- a/nsd.te
+++ b/nsd.te
@@ -9,9 +9,7 @@ type nsd_t;
@@ -60994,13 +61079,14 @@ index 47bb1d2..5cc2b26 100644
allow nsd_t self:fifo_file rw_fifo_file_perms;
-allow nsd_t self:tcp_socket { accept listen };
- allow nsd_t nsd_conf_t:dir list_dir_perms;
+-allow nsd_t nsd_conf_t:dir list_dir_perms;
-allow nsd_t nsd_conf_t:file read_file_perms;
-allow nsd_t nsd_conf_t:lnk_file read_lnk_file_perms;
-
-allow nsd_t nsd_db_t:file manage_file_perms;
-filetrans_pattern(nsd_t, nsd_zone_t, nsd_db_t, file)
-+read_files_pattern(nsd_t, nsd_conf_t, nsd_conf_t)
++manage_dirs_pattern(nsd_t, nsd_conf_t, nsd_conf_t)
++manage_files_pattern(nsd_t, nsd_conf_t, nsd_conf_t)
+read_lnk_files_pattern(nsd_t, nsd_conf_t, nsd_conf_t)
manage_files_pattern(nsd_t, nsd_var_run_t, nsd_var_run_t)
@@ -66201,10 +66287,10 @@ index 0000000..45de664
+')
diff --git a/opensm.te b/opensm.te
new file mode 100644
-index 0000000..de03e94
+index 0000000..87c86ed
--- /dev/null
+++ b/opensm.te
-@@ -0,0 +1,45 @@
+@@ -0,0 +1,46 @@
+policy_module(opensm, 1.0.0)
+
+########################################
@@ -66248,6 +66334,7 @@ index 0000000..de03e94
+
+dev_read_sysfs(opensm_t)
+dev_rw_infiniband_dev(opensm_t)
++dev_rw_infiniband_mgmt_dev(opensm_t)
+
+logging_send_syslog_msg(opensm_t)
diff --git a/openvpn.fc b/openvpn.fc
@@ -66359,7 +66446,7 @@ index 6837e9a..8d6e33b 100644
domain_system_change_exemption($1)
role_transition $2 openvpn_initrc_exec_t system_r;
diff --git a/openvpn.te b/openvpn.te
-index 63957a3..a6cf637 100644
+index 63957a3..91dead6 100644
--- a/openvpn.te
+++ b/openvpn.te
@@ -6,6 +6,13 @@ policy_module(openvpn, 1.12.2)
@@ -66413,7 +66500,7 @@ index 63957a3..a6cf637 100644
allow openvpn_t openvpn_etc_t:dir list_dir_perms;
allow openvpn_t openvpn_etc_t:file read_file_perms;
allow openvpn_t openvpn_etc_t:lnk_file read_lnk_file_perms;
-@@ -73,13 +85,17 @@ filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)
+@@ -73,18 +85,23 @@ filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)
allow openvpn_t openvpn_status_t:file manage_file_perms;
logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
@@ -66434,7 +66521,14 @@ index 63957a3..a6cf637 100644
logging_log_filetrans(openvpn_t, openvpn_var_log_t, file)
manage_dirs_pattern(openvpn_t, openvpn_var_run_t, openvpn_var_run_t)
-@@ -97,7 +113,6 @@ kernel_request_load_module(openvpn_t)
+ manage_files_pattern(openvpn_t, openvpn_var_run_t, openvpn_var_run_t)
+-files_pid_filetrans(openvpn_t, openvpn_var_run_t, { file dir })
++manage_sock_files_pattern(openvpn_t, openvpn_var_run_t, openvpn_var_run_t)
++files_pid_filetrans(openvpn_t, openvpn_var_run_t, { sock_file file dir })
+
+ can_exec(openvpn_t, openvpn_etc_t)
+
+@@ -97,7 +114,6 @@ kernel_request_load_module(openvpn_t)
corecmd_exec_bin(openvpn_t)
corecmd_exec_shell(openvpn_t)
@@ -66442,7 +66536,7 @@ index 63957a3..a6cf637 100644
corenet_all_recvfrom_netlabel(openvpn_t)
corenet_tcp_sendrecv_generic_if(openvpn_t)
corenet_udp_sendrecv_generic_if(openvpn_t)
-@@ -117,13 +132,15 @@ corenet_udp_sendrecv_openvpn_port(openvpn_t)
+@@ -117,13 +133,15 @@ corenet_udp_sendrecv_openvpn_port(openvpn_t)
corenet_sendrecv_http_server_packets(openvpn_t)
corenet_tcp_bind_http_port(openvpn_t)
corenet_sendrecv_http_client_packets(openvpn_t)
@@ -66459,7 +66553,7 @@ index 63957a3..a6cf637 100644
corenet_rw_tun_tap_dev(openvpn_t)
dev_read_rand(openvpn_t)
-@@ -132,21 +149,31 @@ files_read_etc_runtime_files(openvpn_t)
+@@ -132,21 +150,31 @@ files_read_etc_runtime_files(openvpn_t)
fs_getattr_all_fs(openvpn_t)
fs_search_auto_mountpoints(openvpn_t)
@@ -66494,7 +66588,7 @@ index 63957a3..a6cf637 100644
')
tunable_policy(`openvpn_enable_homedirs && use_nfs_home_dirs',`
-@@ -164,10 +191,20 @@ tunable_policy(`openvpn_can_network_connect',`
+@@ -164,10 +192,20 @@ tunable_policy(`openvpn_can_network_connect',`
')
optional_policy(`
@@ -66515,7 +66609,7 @@ index 63957a3..a6cf637 100644
dbus_system_bus_client(openvpn_t)
dbus_connect_system_bus(openvpn_t)
-@@ -175,3 +212,27 @@ optional_policy(`
+@@ -175,3 +213,27 @@ optional_policy(`
networkmanager_dbus_chat(openvpn_t)
')
')
@@ -68449,10 +68543,10 @@ index 0000000..80246e6
+
diff --git a/pcp.te b/pcp.te
new file mode 100644
-index 0000000..a9ca49d
+index 0000000..e81f463
--- /dev/null
+++ b/pcp.te
-@@ -0,0 +1,285 @@
+@@ -0,0 +1,287 @@
+policy_module(pcp, 1.0.0)
+
+########################################
@@ -68563,6 +68657,7 @@ index 0000000..a9ca49d
+# pcp_pmcd local policy
+#
+
++allow pcp_pmcd_t self:capability sys_admin;
+allow pcp_pmcd_t self:process { setsched };
+allow pcp_pmcd_t self:unix_dgram_socket create_socket_perms;
+
@@ -68580,6 +68675,7 @@ index 0000000..a9ca49d
+corenet_tcp_connect_http_port(pcp_pmcd_t)
+
+dev_read_sysfs(pcp_pmcd_t)
++dev_rw_lvm_control(pcp_pmcd_t)
+
+domain_read_all_domains_state(pcp_pmcd_t)
+domain_getattr_all_domains(pcp_pmcd_t)
@@ -70450,13 +70546,15 @@ index 0000000..a989aea
+
+sysnet_read_config(piranha_domain)
diff --git a/pkcs.fc b/pkcs.fc
-index 9a72226..0351b1e 100644
+index 9a72226..b296894 100644
--- a/pkcs.fc
+++ b/pkcs.fc
-@@ -4,4 +4,6 @@
+@@ -4,4 +4,8 @@
/var/lib/opencryptoki(/.*)? gen_context(system_u:object_r:pkcs_slotd_var_lib_t,s0)
++/var/log/opencryptoki(/.*)? gen_context(system_u:object_r:pkcs_slotd_log_t,s0)
++
+/var/lock/opencryptoki(/.*)? gen_context(system_u:object_r:pkcs_slotd_lock_t,s0)
+
/var/run/pkcsslotd.* gen_context(system_u:object_r:pkcs_slotd_var_run_t,s0)
@@ -70484,10 +70582,10 @@ index 69be2aa..2d7b3f6 100644
admin_pattern($1, pkcs_slotd_var_run_t)
diff --git a/pkcs.te b/pkcs.te
-index 8eb3f7b..ee837c6 100644
+index 8eb3f7b..81ee57d 100644
--- a/pkcs.te
+++ b/pkcs.te
-@@ -7,21 +7,31 @@ policy_module(pkcs, 1.0.1)
+@@ -7,21 +7,34 @@ policy_module(pkcs, 1.0.1)
type pkcs_slotd_t;
type pkcs_slotd_exec_t;
@@ -70506,6 +70604,9 @@ index 8eb3f7b..ee837c6 100644
+typealias pkcs_slotd_lock_t alias pkcsslotd_lock_t;
+files_lock_file(pkcs_slotd_lock_t)
+
++type pkcs_slotd_log_t;
++logging_log_file(pkcs_slotd_log_t)
++
type pkcs_slotd_var_run_t;
+typealias pkcs_slotd_var_run_t alias pkcsslotd_var_run_t;
files_pid_file(pkcs_slotd_var_run_t)
@@ -70519,16 +70620,22 @@ index 8eb3f7b..ee837c6 100644
files_tmpfs_file(pkcs_slotd_tmpfs_t)
########################################
-@@ -40,6 +50,8 @@ manage_files_pattern(pkcs_slotd_t, pkcs_slotd_var_lib_t, pkcs_slotd_var_lib_t)
+@@ -40,6 +53,14 @@ manage_files_pattern(pkcs_slotd_t, pkcs_slotd_var_lib_t, pkcs_slotd_var_lib_t)
manage_lnk_files_pattern(pkcs_slotd_t, pkcs_slotd_var_lib_t, pkcs_slotd_var_lib_t)
files_var_lib_filetrans(pkcs_slotd_t, pkcs_slotd_var_lib_t, dir)
+manage_files_pattern(pkcs_slotd_t, pkcs_slotd_lock_t, pkcs_slotd_lock_t)
++manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_lock_t, pkcs_slotd_lock_t)
++files_lock_filetrans(pkcs_slotd_t, pkcs_slotd_lock_t, dir)
++
++manage_files_pattern(pkcs_slotd_t, pkcs_slotd_log_t, pkcs_slotd_log_t)
++manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_log_t, pkcs_slotd_log_t)
++logging_log_filetrans(pkcs_slotd_t, pkcs_slotd_log_t, dir)
+
manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_var_run_t, pkcs_slotd_var_run_t)
manage_files_pattern(pkcs_slotd_t, pkcs_slotd_var_run_t, pkcs_slotd_var_run_t)
manage_sock_files_pattern(pkcs_slotd_t, pkcs_slotd_var_run_t, pkcs_slotd_var_run_t)
-@@ -51,10 +63,12 @@ files_tmp_filetrans(pkcs_slotd_t, pkcs_slotd_tmp_t, dir)
+@@ -51,10 +72,12 @@ files_tmp_filetrans(pkcs_slotd_t, pkcs_slotd_tmp_t, dir)
manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t)
manage_files_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t)
@@ -77580,10 +77687,10 @@ index 0000000..8231f4f
+')
diff --git a/prosody.te b/prosody.te
new file mode 100644
-index 0000000..71f9abb
+index 0000000..5a9f1d4
--- /dev/null
+++ b/prosody.te
-@@ -0,0 +1,98 @@
+@@ -0,0 +1,99 @@
+policy_module(prosody, 1.0.0)
+
+########################################
@@ -77656,6 +77763,7 @@ index 0000000..71f9abb
+corenet_tcp_connect_postgresql_port(prosody_t)
+corenet_tcp_connect_jabber_interserver_port(prosody_t)
+corenet_tcp_connect_jabber_client_port(prosody_t)
++corenet_tcp_bind_prosody_port(prosody_t)
+corenet_tcp_bind_jabber_client_port(prosody_t)
+corenet_tcp_bind_jabber_interserver_port(prosody_t)
+corenet_tcp_bind_jabber_router_port(prosody_t)
@@ -86085,7 +86193,7 @@ index 47de2d6..bc62d96 100644
+/var/log/pacemaker\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0)
+/var/log/pcsd(/.*)? gen_context(system_u:object_r:cluster_var_log_t,s0)
diff --git a/rhcs.if b/rhcs.if
-index c8bdea2..1574225 100644
+index c8bdea2..8ad3e01 100644
--- a/rhcs.if
+++ b/rhcs.if
@@ -1,19 +1,19 @@
@@ -86114,7 +86222,7 @@ index c8bdea2..1574225 100644
')
##############################
-@@ -43,33 +43,29 @@ template(`rhcs_domain_template',`
+@@ -43,11 +43,6 @@ template(`rhcs_domain_template',`
manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
fs_tmpfs_filetrans($1_t, $1_tmpfs_t, { dir file })
@@ -86126,11 +86234,9 @@ index c8bdea2..1574225 100644
logging_log_filetrans($1_t, $1_var_log_t, { dir file sock_file })
manage_dirs_pattern($1_t, $1_var_run_t, $1_var_run_t)
- manage_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
- manage_fifo_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
+@@ -56,20 +51,21 @@ template(`rhcs_domain_template',`
manage_sock_files_pattern($1_t, $1_var_run_t, $1_var_run_t)
-- files_pid_filetrans($1_t, $1_var_run_t, { dir file sock_file fifo_file })
-+ files_pid_filetrans($1_t, $1_var_run_t, { file sock_file fifo_file })
+ files_pid_filetrans($1_t, $1_var_run_t, { dir file sock_file fifo_file })
- optional_policy(`
- dbus_system_bus_client($1_t)
@@ -97212,6 +97318,204 @@ index 6c3bc20..14e8575 100644
')
optional_policy(`
+diff --git a/sbd.fc b/sbd.fc
+new file mode 100644
+index 0000000..41768ee
+--- /dev/null
++++ b/sbd.fc
+@@ -0,0 +1,7 @@
++/usr/lib/systemd/system/sbd.service -- gen_context(system_u:object_r:sbd_unit_file_t,s0)
++
++/usr/lib/systemd/system/sbd_remote.service -- gen_context(system_u:object_r:sbd_unit_file_t,s0)
++
++/usr/sbin/sbd -- gen_context(system_u:object_r:sbd_exec_t,s0)
++
++/var/run/sbd.* -- gen_context(system_u:object_r:sbd_var_run_t,s0)
+diff --git a/sbd.if b/sbd.if
+new file mode 100644
+index 0000000..7a058a8
+--- /dev/null
++++ b/sbd.if
+@@ -0,0 +1,126 @@
++
++## <summary>policy for sbd</summary>
++
++########################################
++## <summary>
++## Execute sbd_exec_t in the sbd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`sbd_domtrans',`
++ gen_require(`
++ type sbd_t, sbd_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ domtrans_pattern($1, sbd_exec_t, sbd_t)
++')
++
++######################################
++## <summary>
++## Execute sbd in the caller domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`sbd_exec',`
++ gen_require(`
++ type sbd_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ can_exec($1, sbd_exec_t)
++')
++########################################
++## <summary>
++## Read sbd PID files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`sbd_read_pid_files',`
++ gen_require(`
++ type sbd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ read_files_pattern($1, sbd_var_run_t, sbd_var_run_t)
++')
++
++########################################
++## <summary>
++## Execute sbd server in the sbd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`sbd_systemctl',`
++ gen_require(`
++ type sbd_t;
++ type sbd_unit_file_t;
++ ')
++
++ systemd_exec_systemctl($1)
++ systemd_read_fifo_file_passwd_run($1)
++ allow $1 sbd_unit_file_t:file read_file_perms;
++ allow $1 sbd_unit_file_t:service manage_service_perms;
++
++ ps_process_pattern($1, sbd_t)
++')
++
++
++########################################
++## <summary>
++## All of the rules required to administrate
++## an sbd environment
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## Role allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`sbd_admin',`
++ gen_require(`
++ type sbd_t;
++ type sbd_var_run_t;
++ type sbd_unit_file_t;
++ ')
++
++ allow $1 sbd_t:process { signal_perms };
++ ps_process_pattern($1, sbd_t)
++
++ tunable_policy(`deny_ptrace',`',`
++ allow $1 sbd_t:process ptrace;
++ ')
++
++ files_search_pids($1)
++ admin_pattern($1, sbd_var_run_t)
++
++ sbd_systemctl($1)
++ admin_pattern($1, sbd_unit_file_t)
++ allow $1 sbd_unit_file_t:service all_service_perms;
++ optional_policy(`
++ systemd_passwd_agent_exec($1)
++ systemd_read_fifo_file_passwd_run($1)
++ ')
++')
+diff --git a/sbd.te b/sbd.te
+new file mode 100644
+index 0000000..8666aec
+--- /dev/null
++++ b/sbd.te
+@@ -0,0 +1,47 @@
++policy_module(sbd, 1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type sbd_t;
++type sbd_exec_t;
++init_daemon_domain(sbd_t, sbd_exec_t)
++
++type sbd_var_run_t;
++files_pid_file(sbd_var_run_t)
++
++type sbd_unit_file_t;
++systemd_unit_file(sbd_unit_file_t)
++
++########################################
++#
++# sbd local policy
++#
++allow sbd_t self:capability { dac_override ipc_lock sys_nice };
++allow sbd_t self:process { fork setsched signal_perms };
++allow sbd_t self:fifo_file rw_fifo_file_perms;
++allow sbd_t self:unix_stream_socket create_stream_socket_perms;
++
++manage_dirs_pattern(sbd_t, sbd_var_run_t, sbd_var_run_t)
++manage_files_pattern(sbd_t, sbd_var_run_t, sbd_var_run_t)
++manage_lnk_files_pattern(sbd_t, sbd_var_run_t, sbd_var_run_t)
++files_pid_filetrans(sbd_t, sbd_var_run_t, { dir file lnk_file })
++
++kernel_read_system_state(sbd_t)
++
++dev_read_rand(sbd_t)
++dev_write_watchdog(sbd_t)
++
++domain_read_all_domains_state(sbd_t)
++
++files_read_etc_files(sbd_t)
++
++miscfiles_read_localization(sbd_t)
++
++optional_policy(`
++ rhcs_rw_cluster_tmpfs(sbd_t)
++ rhcs_stream_connect_cluster(sbd_t)
++
++')
diff --git a/sblim.fc b/sblim.fc
index 68a550d..e976fc6 100644
--- a/sblim.fc
@@ -101113,7 +101417,7 @@ index 7d86b34..5f58180 100644
+ files_list_pids($1)
')
diff --git a/snort.te b/snort.te
-index 1af72df..7e55b50 100644
+index 1af72df..ffccc41 100644
--- a/snort.te
+++ b/snort.te
@@ -32,10 +32,13 @@ files_pid_file(snort_var_run_t)
@@ -101150,7 +101454,7 @@ index 1af72df..7e55b50 100644
corenet_all_recvfrom_netlabel(snort_t)
corenet_tcp_sendrecv_generic_if(snort_t)
corenet_udp_sendrecv_generic_if(snort_t)
-@@ -86,18 +86,17 @@ dev_rw_generic_usb_dev(snort_t)
+@@ -86,18 +86,19 @@ dev_rw_generic_usb_dev(snort_t)
domain_use_interactive_fds(snort_t)
@@ -101162,6 +101466,8 @@ index 1af72df..7e55b50 100644
+auth_read_passwd(snort_t)
+
++auth_use_nsswitch(snort_t)
++
init_read_utmp(snort_t)
logging_send_syslog_msg(snort_t)
@@ -103037,10 +103343,10 @@ index b38b8b1..eb36653 100644
userdom_dontaudit_search_user_home_dirs(speedmgmt_t)
diff --git a/squid.fc b/squid.fc
-index 0a8b0f7..0630506 100644
+index 0a8b0f7..03fb6b1 100644
--- a/squid.fc
+++ b/squid.fc
-@@ -1,20 +1,26 @@
+@@ -1,20 +1,28 @@
-/etc/squid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0)
+/dev/shm/squid-* -- gen_context(system_u:object_r:squid_tmpfs_t,s0)
@@ -103050,6 +103356,8 @@ index 0a8b0f7..0630506 100644
+/etc/lightsquid(/.*)? gen_context(system_u:object_r:squid_conf_t,s0)
-/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
++/usr/libexec/squid/cache_swap\.sh -- gen_context(system_u:object_r:squid_exec_t,s0)
++
+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:squid_script_exec_t,s0)
+
+/usr/sbin/lightparser.pl -- gen_context(system_u:object_r:squid_cron_exec_t,s0)
@@ -103990,10 +104298,10 @@ index a240455..04419ae 100644
- admin_pattern($1, sssd_log_t)
')
diff --git a/sssd.te b/sssd.te
-index 2d8db1f..a696686 100644
+index 2d8db1f..c420309 100644
--- a/sssd.te
+++ b/sssd.te
-@@ -28,17 +28,25 @@ logging_log_file(sssd_var_log_t)
+@@ -28,19 +28,28 @@ logging_log_file(sssd_var_log_t)
type sssd_var_run_t;
files_pid_file(sssd_var_run_t)
@@ -104021,8 +104329,11 @@ index 2d8db1f..a696686 100644
+allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto };
read_files_pattern(sssd_t, sssd_conf_t, sssd_conf_t)
++list_dirs_pattern(sssd_t, sssd_conf_t, sssd_conf_t)
-@@ -51,9 +59,7 @@ manage_lnk_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
+ manage_dirs_pattern(sssd_t, sssd_public_t, sssd_public_t)
+ manage_files_pattern(sssd_t, sssd_public_t, sssd_public_t)
+@@ -51,9 +60,7 @@ manage_lnk_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir })
@@ -104033,7 +104344,7 @@ index 2d8db1f..a696686 100644
logging_log_filetrans(sssd_t, sssd_var_log_t, file)
manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t)
-@@ -62,17 +68,13 @@ files_pid_filetrans(sssd_t, sssd_var_run_t, { file dir })
+@@ -62,17 +69,13 @@ files_pid_filetrans(sssd_t, sssd_var_run_t, { file dir })
kernel_read_network_state(sssd_t)
kernel_read_system_state(sssd_t)
@@ -104055,7 +104366,7 @@ index 2d8db1f..a696686 100644
corecmd_exec_bin(sssd_t)
-@@ -83,28 +85,35 @@ domain_read_all_domains_state(sssd_t)
+@@ -83,28 +86,35 @@ domain_read_all_domains_state(sssd_t)
domain_obj_id_change_exemption(sssd_t)
files_list_tmp(sssd_t)
@@ -104095,7 +104406,7 @@ index 2d8db1f..a696686 100644
init_read_utmp(sssd_t)
-@@ -112,18 +121,64 @@ logging_send_syslog_msg(sssd_t)
+@@ -112,18 +122,64 @@ logging_send_syslog_msg(sssd_t)
logging_send_audit_msgs(sssd_t)
miscfiles_read_generic_certs(sssd_t)
@@ -112786,7 +113097,7 @@ index facdee8..816d860 100644
+ ps_process_pattern(virtd_t, $1)
')
diff --git a/virt.te b/virt.te
-index f03dcf5..4f5b8cd 100644
+index f03dcf5..88489f7 100644
--- a/virt.te
+++ b/virt.te
@@ -1,451 +1,402 @@
@@ -113798,7 +114109,7 @@ index f03dcf5..4f5b8cd 100644
kernel_read_xen_state(virtd_t)
kernel_write_xen_state(virtd_t)
-@@ -746,44 +707,327 @@ optional_policy(`
+@@ -746,44 +707,331 @@ optional_policy(`
udev_read_pid_files(virtd_t)
')
@@ -113943,7 +114254,7 @@ index f03dcf5..4f5b8cd 100644
+append_files_pattern(virt_domain, virt_log_t, virt_log_t)
+
+append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
-
++
+corecmd_exec_bin(virt_domain)
+corecmd_exec_shell(virt_domain)
+
@@ -114011,6 +114322,10 @@ index f03dcf5..4f5b8cd 100644
+')
+
+optional_policy(`
++ nscd_dontaudit_read_pid(virt_domain)
++')
++
++optional_policy(`
+ ptchown_domtrans(virt_domain)
+')
+
@@ -114023,7 +114338,7 @@ index f03dcf5..4f5b8cd 100644
+ sssd_dontaudit_read_lib(virt_domain)
+ sssd_dontaudit_read_public_files(virt_domain)
+')
-+
+
+optional_policy(`
+ virt_read_config(virt_domain)
+ virt_read_lib_files(virt_domain)
@@ -114148,7 +114463,7 @@ index f03dcf5..4f5b8cd 100644
kernel_read_system_state(virsh_t)
kernel_read_network_state(virsh_t)
kernel_read_kernel_sysctls(virsh_t)
-@@ -794,25 +1038,18 @@ kernel_write_xen_state(virsh_t)
+@@ -794,25 +1042,18 @@ kernel_write_xen_state(virsh_t)
corecmd_exec_bin(virsh_t)
corecmd_exec_shell(virsh_t)
@@ -114175,7 +114490,7 @@ index f03dcf5..4f5b8cd 100644
fs_getattr_all_fs(virsh_t)
fs_manage_xenfs_dirs(virsh_t)
-@@ -821,23 +1058,25 @@ fs_search_auto_mountpoints(virsh_t)
+@@ -821,23 +1062,25 @@ fs_search_auto_mountpoints(virsh_t)
storage_raw_read_fixed_disk(virsh_t)
@@ -114192,10 +114507,10 @@ index f03dcf5..4f5b8cd 100644
-logging_send_syslog_msg(virsh_t)
+systemd_exec_systemctl(virsh_t)
-+
-+auth_read_passwd(virsh_t)
-miscfiles_read_localization(virsh_t)
++auth_read_passwd(virsh_t)
++
+logging_send_syslog_msg(virsh_t)
sysnet_dns_name_resolve(virsh_t)
@@ -114209,7 +114524,7 @@ index f03dcf5..4f5b8cd 100644
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virsh_t)
-@@ -856,14 +1095,20 @@ optional_policy(`
+@@ -856,14 +1099,20 @@ optional_policy(`
')
optional_policy(`
@@ -114231,7 +114546,7 @@ index f03dcf5..4f5b8cd 100644
xen_stream_connect(virsh_t)
xen_stream_connect_xenstore(virsh_t)
')
-@@ -888,49 +1133,66 @@ optional_policy(`
+@@ -888,49 +1137,66 @@ optional_policy(`
kernel_read_xen_state(virsh_ssh_t)
kernel_write_xen_state(virsh_ssh_t)
@@ -114316,7 +114631,7 @@ index f03dcf5..4f5b8cd 100644
corecmd_exec_bin(virtd_lxc_t)
corecmd_exec_shell(virtd_lxc_t)
-@@ -942,17 +1204,16 @@ dev_read_urand(virtd_lxc_t)
+@@ -942,17 +1208,16 @@ dev_read_urand(virtd_lxc_t)
domain_use_interactive_fds(virtd_lxc_t)
@@ -114336,7 +114651,7 @@ index f03dcf5..4f5b8cd 100644
fs_getattr_all_fs(virtd_lxc_t)
fs_manage_tmpfs_dirs(virtd_lxc_t)
fs_manage_tmpfs_chr_files(virtd_lxc_t)
-@@ -964,8 +1225,23 @@ fs_rw_cgroup_files(virtd_lxc_t)
+@@ -964,8 +1229,23 @@ fs_rw_cgroup_files(virtd_lxc_t)
fs_unmount_all_fs(virtd_lxc_t)
fs_relabelfrom_tmpfs(virtd_lxc_t)
@@ -114360,7 +114675,7 @@ index f03dcf5..4f5b8cd 100644
selinux_get_enforce_mode(virtd_lxc_t)
selinux_get_fs_mount(virtd_lxc_t)
selinux_validate_context(virtd_lxc_t)
-@@ -974,194 +1250,355 @@ selinux_compute_create_context(virtd_lxc_t)
+@@ -974,194 +1254,355 @@ selinux_compute_create_context(virtd_lxc_t)
selinux_compute_relabel_context(virtd_lxc_t)
selinux_compute_user_contexts(virtd_lxc_t)
@@ -114389,7 +114704,8 @@ index f03dcf5..4f5b8cd 100644
+optional_policy(`
+ docker_exec_lib(virtd_lxc_t)
+')
-+
+
+-sysnet_domtrans_ifconfig(virtd_lxc_t)
+optional_policy(`
+ gnome_read_generic_cache_files(virtd_lxc_t)
+')
@@ -114397,8 +114713,7 @@ index f03dcf5..4f5b8cd 100644
+optional_policy(`
+ setrans_manage_pid_files(virtd_lxc_t)
+')
-
--sysnet_domtrans_ifconfig(virtd_lxc_t)
++
+optional_policy(`
+ unconfined_domain(virtd_lxc_t)
+')
@@ -114614,9 +114929,11 @@ index f03dcf5..4f5b8cd 100644
- udev_read_pid_files(svirt_lxc_domain)
+ apache_exec_modules(svirt_sandbox_domain)
+ apache_read_sys_content(svirt_sandbox_domain)
-+')
-+
-+optional_policy(`
+ ')
+
+ optional_policy(`
+- apache_exec_modules(svirt_lxc_domain)
+- apache_read_sys_content(svirt_lxc_domain)
+ gear_read_pid_files(svirt_sandbox_domain)
+')
+
@@ -114654,11 +114971,9 @@ index f03dcf5..4f5b8cd 100644
+ fs_manage_fusefs_dirs(svirt_sandbox_domain)
+ fs_manage_fusefs_files(svirt_sandbox_domain)
+ fs_manage_fusefs_symlinks(svirt_sandbox_domain)
- ')
-
- optional_policy(`
-- apache_exec_modules(svirt_lxc_domain)
-- apache_read_sys_content(svirt_lxc_domain)
++')
++
++optional_policy(`
+ docker_read_share_files(svirt_sandbox_domain)
+ docker_exec_share_files(svirt_sandbox_domain)
+ docker_lib_filetrans(svirt_sandbox_domain,svirt_sandbox_file_t, sock_file)
@@ -114801,11 +115116,11 @@ index f03dcf5..4f5b8cd 100644
+manage_lnk_files_pattern(sandbox_net_domain, svirt_home_t, svirt_home_t)
+manage_sock_files_pattern(sandbox_net_domain, svirt_home_t, svirt_home_t)
+filetrans_pattern(sandbox_net_domain, virt_home_t, svirt_home_t, { dir sock_file file })
-+
-+term_use_generic_ptys(svirt_qemu_net_t)
-+term_use_ptmx(svirt_qemu_net_t)
-allow svirt_prot_exec_t self:process { execmem execstack };
++term_use_generic_ptys(svirt_qemu_net_t)
++term_use_ptmx(svirt_qemu_net_t)
++
+dev_rw_kvm(svirt_qemu_net_t)
+
+manage_sock_files_pattern(svirt_qemu_net_t, qemu_var_run_t, qemu_var_run_t)
@@ -114857,7 +115172,7 @@ index f03dcf5..4f5b8cd 100644
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
-@@ -1174,12 +1611,12 @@ dev_read_sysfs(virt_qmf_t)
+@@ -1174,12 +1615,12 @@ dev_read_sysfs(virt_qmf_t)
dev_read_rand(virt_qmf_t)
dev_read_urand(virt_qmf_t)
@@ -114872,7 +115187,7 @@ index f03dcf5..4f5b8cd 100644
sysnet_read_config(virt_qmf_t)
optional_policy(`
-@@ -1192,7 +1629,7 @@ optional_policy(`
+@@ -1192,7 +1633,7 @@ optional_policy(`
########################################
#
@@ -114881,7 +115196,7 @@ index f03dcf5..4f5b8cd 100644
#
allow virt_bridgehelper_t self:process { setcap getcap };
-@@ -1201,11 +1638,255 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
+@@ -1201,11 +1642,255 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
allow virt_bridgehelper_t self:tun_socket create_socket_perms;
allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms;
@@ -115295,10 +115610,10 @@ index 0000000..afd0c97
+')
diff --git a/vmtools.te b/vmtools.te
new file mode 100644
-index 0000000..1928ad9
+index 0000000..f98f288
--- /dev/null
+++ b/vmtools.te
-@@ -0,0 +1,96 @@
+@@ -0,0 +1,100 @@
+policy_module(vmtools, 1.0.0)
+
+########################################
@@ -115374,6 +115689,10 @@ index 0000000..1928ad9
+')
+
+optional_policy(`
++ rpm_transition_script(vmtools_t,system_r)
++')
++
++optional_policy(`
+ unconfined_domain(vmtools_t)
+')
+
diff --git a/selinux-policy.spec b/selinux-policy.spec
index ecb8f22..77c4a2c 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 199%{?dist}
+Release: 200%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -647,6 +647,34 @@ exit 0
%endif
%changelog
+* Tue Jul 05 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-200
+- Fix typo in brltty policy
+- Add new SELinux module sbd
+- Allow pcp dmcache metrics collection
+- Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
+- Allow openvpn to create sock files labeled as openvpn_var_run_t
+- Allow hypervkvp daemon to getattr on all filesystem types.
+- Allow firewalld to create net_conf_t files
+- Allow mock to use lvm
+- Allow mirromanager creating log files in /tmp
+- Allow vmtools_t to transition to rpm_script domain
+- Allow nsd daemon to manage nsd_conf_t dirs and files
+- Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
+- Allow sssd read also sssd_conf_t dirs
+- Allow opensm daemon to rw infiniband_mgmt_device_t
+- Allow krb5kdc_t to communicate with sssd
+- Allow prosody to bind on prosody ports
+- Add dac_override caps for fail2ban-client Resolves: rhbz#1316678
+- dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637
+- Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726
+- Add label for brltty log file Resolves: rhbz#1328818
+- Allow snort_t to communicate with sssd Resolves: rhbz#1284908
+- Add interface lttng_sessiond_tmpfs_t()
+- Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
+- Add interface lvm_getattr_exec_files()
+- Make label for new infiniband_mgmt deivices
+- Add prosody ports Resolves: rhbz#1304664
+
* Tue Jun 28 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-199
- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
- Allow glusterd daemon to get systemd status