diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 18fa17b..1679ed1 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -22555,7 +22555,7 @@ index cc877c7..07f129b 100644
 +	xserver_rw_xdm_pipes(ssh_agent_type)
 +')
 diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
-index 8274418..abeb351 100644
+index 8274418..0069d82 100644
 --- a/policy/modules/services/xserver.fc
 +++ b/policy/modules/services/xserver.fc
 @@ -2,13 +2,35 @@
@@ -22617,7 +22617,7 @@ index 8274418..abeb351 100644
  /etc/X11/[wx]dm/Xreset.* --	gen_context(system_u:object_r:xsession_exec_t,s0)
  /etc/X11/[wxg]dm/Xsession --	gen_context(system_u:object_r:xsession_exec_t,s0)
  /etc/X11/wdm(/.*)?		gen_context(system_u:object_r:xdm_rw_etc_t,s0)
-@@ -46,26 +76,32 @@ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
+@@ -46,26 +76,33 @@ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
  # /tmp
  #
  
@@ -22643,6 +22643,7 @@ index 8274418..abeb351 100644
 -/usr/s?bin/[xkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
 +/usr/s?bin/[mxgkw]dm	--	gen_context(system_u:object_r:xdm_exec_t,s0)
 +
++/usr/bin/sddm-greeter	--	gen_context(system_u:object_r:xdm_exec_t,s0)
  /usr/bin/gpe-dm		--	gen_context(system_u:object_r:xdm_exec_t,s0)
  /usr/bin/iceauth	--	gen_context(system_u:object_r:iceauth_exec_t,s0)
 +/usr/bin/razor-lightdm-.*    --  gen_context(system_u:object_r:xdm_exec_t,s0)
@@ -22656,7 +22657,7 @@ index 8274418..abeb351 100644
  
  /usr/lib/qt-.*/etc/settings(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
  
-@@ -92,18 +128,31 @@ ifndef(`distro_debian',`
+@@ -92,18 +129,31 @@ ifndef(`distro_debian',`
  
  /var/lib/gdm(3)?(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
  /var/lib/lxdm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
@@ -22692,7 +22693,7 @@ index 8274418..abeb351 100644
  /var/run/xdm\.pid	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
  /var/run/lxdm\.auth	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
  /var/run/lxdm\.pid	--	gen_context(system_u:object_r:xdm_var_run_t,s0)
-@@ -112,6 +161,16 @@ ifndef(`distro_debian',`
+@@ -112,6 +162,16 @@ ifndef(`distro_debian',`
  /var/run/xauth(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
  /var/run/xdmctl(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
  
@@ -40629,7 +40630,7 @@ index 0abaf84..8b34dbc 100644
 -/usr/lib/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
 -')
 diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
-index 5ca20a9..7bbabfc 100644
+index 5ca20a9..e749152 100644
 --- a/policy/modules/system/unconfined.if
 +++ b/policy/modules/system/unconfined.if
 @@ -12,53 +12,57 @@
@@ -41133,14 +41134,14 @@ index 5ca20a9..7bbabfc 100644
  	gen_require(`
 -		type unconfined_t;
 -		class dbus send_msg;
-+		type unconfined_server_t;
++		type unconfined_service_t;
  	')
  
 -	allow $1 unconfined_t:dbus send_msg;
 -	allow unconfined_t $1:dbus send_msg;
 +	files_search_pids($1)
 +	files_write_generic_pid_pipes($1)
-+	allow $1 unconfined_server_t:unix_stream_socket { getattr connectto };
++	allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
  ')
  
  ########################################
@@ -41160,11 +41161,11 @@ index 5ca20a9..7bbabfc 100644
  	gen_require(`
 -		type unconfined_t;
 -		class dbus acquire_svc;
-+		type unconfined_server_t;
++		type unconfined_service_t;
  	')
  
 -	allow $1 unconfined_t:dbus acquire_svc;
-+	corecmd_bin_domtrans($1, unconfined_server_t)
++	corecmd_bin_domtrans($1, unconfined_service_t)
  ')
 diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
 index 5fe902d..fe042f9 100644
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 1beefa1..1c6e10c 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -10747,7 +10747,7 @@ index 008f8ef..144c074 100644
  	admin_pattern($1, certmonger_var_run_t)
  ')
 diff --git a/certmonger.te b/certmonger.te
-index 550b287..8dd67f1 100644
+index 550b287..6f366b4 100644
 --- a/certmonger.te
 +++ b/certmonger.te
 @@ -18,6 +18,9 @@ files_type(certmonger_var_lib_t)
@@ -10809,16 +10809,16 @@ index 550b287..8dd67f1 100644
  files_list_tmp(certmonger_t)
  
  fs_search_cgroup_dirs(certmonger_t)
-@@ -70,16 +83,17 @@ init_getattr_all_script_files(certmonger_t)
+@@ -70,16 +83,18 @@ init_getattr_all_script_files(certmonger_t)
  
  logging_send_syslog_msg(certmonger_t)
  
 -miscfiles_read_localization(certmonger_t)
  miscfiles_manage_generic_cert_files(certmonger_t)
  
--userdom_search_user_home_content(certmonger_t)
 +systemd_exec_systemctl(certmonger_t)
 +
+ userdom_search_user_home_content(certmonger_t)
 +userdom_manage_home_certs(certmonger_t)
  
  optional_policy(`
@@ -10830,7 +10830,7 @@ index 550b287..8dd67f1 100644
  ')
  
  optional_policy(`
-@@ -92,11 +106,47 @@ optional_policy(`
+@@ -92,11 +107,47 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -12310,14 +12310,15 @@ index 4a5b3d1..cd146bd 100644
  ')
 diff --git a/cloudform.fc b/cloudform.fc
 new file mode 100644
-index 0000000..51990d0
+index 0000000..6cc6774
 --- /dev/null
 +++ b/cloudform.fc
-@@ -0,0 +1,27 @@
+@@ -0,0 +1,28 @@
 +/etc/rc\.d/init\.d/iwhd --      gen_context(system_u:object_r:iwhd_initrc_exec_t,s0)
 +/etc/rc\.d/init\.d/mongod	--	gen_context(system_u:object_r:mongod_initrc_exec_t,s0)
 +
 +/usr/bin/cloud-init     --      gen_context(system_u:object_r:cloud_init_exec_t,s0)
++/usr/libexec/min-metadata-service     --      gen_context(system_u:object_r:cloud_init_exec_t,s0)
 +/usr/bin/deltacloudd    --	gen_context(system_u:object_r:deltacloudd_exec_t,s0)
 +/usr/bin/iwhd           --      gen_context(system_u:object_r:iwhd_exec_t,s0)
 +/usr/bin/mongod		    --	gen_context(system_u:object_r:mongod_exec_t,s0)
@@ -26847,7 +26848,7 @@ index 4498143..77bbcef 100644
  	ftp_run_ftpdctl($1, $2)
  ')
 diff --git a/ftp.te b/ftp.te
-index 36838c2..34b08ac 100644
+index 36838c2..a09e8b2 100644
 --- a/ftp.te
 +++ b/ftp.te
 @@ -13,7 +13,7 @@ policy_module(ftp, 1.15.1)
@@ -26913,7 +26914,18 @@ index 36838c2..34b08ac 100644
  manage_dirs_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
  manage_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
  manage_lnk_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
-@@ -206,14 +219,13 @@ logging_log_filetrans(ftpd_t, xferlog_t, file)
+@@ -198,22 +211,19 @@ files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir })
+ 
+ allow ftpd_t ftpdctl_tmp_t:sock_file delete_sock_file_perms;
+ 
+-allow ftpd_t xferlog_t:dir setattr_dir_perms;
+-append_files_pattern(ftpd_t, xferlog_t, xferlog_t)
+-create_files_pattern(ftpd_t, xferlog_t, xferlog_t)
+-setattr_files_pattern(ftpd_t, xferlog_t, xferlog_t)
+-logging_log_filetrans(ftpd_t, xferlog_t, file)
++manage_dirs_pattern(ftpd_t, xferlog_t, xferlog_t)
++manage_files_pattern(ftpd_t, xferlog_t, xferlog_t)
++logging_log_filetrans(ftpd_t, xferlog_t, { dir file })
  
  kernel_read_kernel_sysctls(ftpd_t)
  kernel_read_system_state(ftpd_t)
@@ -26929,7 +26941,7 @@ index 36838c2..34b08ac 100644
  corenet_all_recvfrom_netlabel(ftpd_t)
  corenet_tcp_sendrecv_generic_if(ftpd_t)
  corenet_udp_sendrecv_generic_if(ftpd_t)
-@@ -229,9 +241,12 @@ corenet_tcp_bind_ftp_port(ftpd_t)
+@@ -229,9 +239,12 @@ corenet_tcp_bind_ftp_port(ftpd_t)
  corenet_sendrecv_ftp_data_server_packets(ftpd_t)
  corenet_tcp_bind_ftp_data_port(ftpd_t)
  
@@ -26943,7 +26955,7 @@ index 36838c2..34b08ac 100644
  files_read_etc_runtime_files(ftpd_t)
  files_search_var_lib(ftpd_t)
  
-@@ -250,7 +265,6 @@ logging_send_audit_msgs(ftpd_t)
+@@ -250,7 +263,6 @@ logging_send_audit_msgs(ftpd_t)
  logging_send_syslog_msg(ftpd_t)
  logging_set_loginuid(ftpd_t)
  
@@ -26951,7 +26963,7 @@ index 36838c2..34b08ac 100644
  miscfiles_read_public_files(ftpd_t)
  
  seutil_dontaudit_search_config(ftpd_t)
-@@ -259,32 +273,50 @@ sysnet_use_ldap(ftpd_t)
+@@ -259,32 +271,50 @@ sysnet_use_ldap(ftpd_t)
  
  userdom_dontaudit_use_unpriv_user_fds(ftpd_t)
  userdom_dontaudit_search_user_home_dirs(ftpd_t)
@@ -27009,7 +27021,7 @@ index 36838c2..34b08ac 100644
  ')
  
  tunable_policy(`ftpd_use_passive_mode',`
-@@ -304,22 +336,19 @@ tunable_policy(`ftpd_connect_db',`
+@@ -304,22 +334,19 @@ tunable_policy(`ftpd_connect_db',`
  	corenet_sendrecv_mssql_client_packets(ftpd_t)
  	corenet_tcp_connect_mssql_port(ftpd_t)
  	corenet_tcp_sendrecv_mssql_port(ftpd_t)
@@ -27037,7 +27049,7 @@ index 36838c2..34b08ac 100644
  	userdom_tmp_filetrans_user_tmp(ftpd_t, { dir file })
  ')
  
-@@ -363,9 +392,8 @@ optional_policy(`
+@@ -363,9 +390,8 @@ optional_policy(`
  
  optional_policy(`
  	selinux_validate_context(ftpd_t)
@@ -27048,7 +27060,7 @@ index 36838c2..34b08ac 100644
  	kerberos_use(ftpd_t)
  ')
  
-@@ -416,21 +444,20 @@ optional_policy(`
+@@ -416,21 +442,20 @@ optional_policy(`
  #
  
  stream_connect_pattern(ftpdctl_t, ftpd_var_run_t, ftpd_var_run_t, ftpd_t)
@@ -27072,7 +27084,7 @@ index 36838c2..34b08ac 100644
  
  miscfiles_read_public_files(anon_sftpd_t)
  
-@@ -443,23 +470,34 @@ tunable_policy(`sftpd_anon_write',`
+@@ -443,23 +468,34 @@ tunable_policy(`sftpd_anon_write',`
  # Sftpd local policy
  #
  
@@ -27113,7 +27125,7 @@ index 36838c2..34b08ac 100644
  ')
  
  tunable_policy(`sftpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -481,21 +519,11 @@ tunable_policy(`sftpd_anon_write',`
+@@ -481,21 +517,11 @@ tunable_policy(`sftpd_anon_write',`
  tunable_policy(`sftpd_full_access',`
  	allow sftpd_t self:capability { dac_override dac_read_search };
  	fs_read_noxattr_fs_files(sftpd_t)
@@ -33114,10 +33126,10 @@ index 0000000..deb738f
 +
 diff --git a/ipa.te b/ipa.te
 new file mode 100644
-index 0000000..589066e
+index 0000000..0fd2678
 --- /dev/null
 +++ b/ipa.te
-@@ -0,0 +1,38 @@
+@@ -0,0 +1,40 @@
 +policy_module(ipa, 1.0.0)
 +
 +########################################
@@ -33139,6 +33151,8 @@ index 0000000..589066e
 +# ipa_otpd local policy
 +#
 +
++allow ipa_otpd_t self:capability2 block_suspend;
++
 +allow ipa_otpd_t self:fifo_file rw_fifo_file_perms;
 +allow ipa_otpd_t self:unix_stream_socket create_stream_socket_perms;
 +
@@ -60638,7 +60652,7 @@ index 0000000..a989aea
 +
 +sysnet_read_config(piranha_domain)
 diff --git a/pkcs.te b/pkcs.te
-index 8eb3f7b..7c08f64 100644
+index 8eb3f7b..1ff0fe3 100644
 --- a/pkcs.te
 +++ b/pkcs.te
 @@ -7,21 +7,27 @@ policy_module(pkcs, 1.0.1)
@@ -60669,7 +60683,7 @@ index 8eb3f7b..7c08f64 100644
  files_tmpfs_file(pkcs_slotd_tmpfs_t)
  
  ########################################
-@@ -53,8 +59,5 @@ manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t)
+@@ -53,8 +59,6 @@ manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t)
  manage_files_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t)
  fs_tmpfs_filetrans(pkcs_slotd_t, pkcs_slotd_tmpfs_t, dir)
  
@@ -60678,6 +60692,7 @@ index 8eb3f7b..7c08f64 100644
  logging_send_syslog_msg(pkcs_slotd_t)
  
 -miscfiles_read_localization(pkcs_slotd_t)
++userdom_read_all_users_state(pkcs_slotd_t)
 diff --git a/pki.fc b/pki.fc
 new file mode 100644
 index 0000000..726d992
@@ -101457,7 +101472,7 @@ index 0000000..7933d80
 +')
 diff --git a/vmtools.te b/vmtools.te
 new file mode 100644
-index 0000000..b881c53
+index 0000000..c47cb0e
 --- /dev/null
 +++ b/vmtools.te
 @@ -0,0 +1,82 @@
@@ -101480,7 +101495,7 @@ index 0000000..b881c53
 +type vmtools_helper_t;
 +type vmtools_helper_exec_t;
 +application_domain(vmtools_helper_t, vmtools_helper_exec_t)
-+role vmtools_helper_roles types vmtools_t;
++role vmtools_helper_roles types vmtools_helper_t;
 +
 +type vmtools_unit_file_t;
 +systemd_unit_file(vmtools_unit_file_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index c19f68e..ab2ad46 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 25%{?dist}
+Release: 26%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -580,6 +580,24 @@ SELinux Reference policy mls base module.
 %endif
 
 %changelog
+* Fri Feb 21 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-26
+- Add labeling for /usr/sbin/amavi
+- Colin asked for this program to be treated as cloud-init
+- Allow ftp services to manage xferlog_t
+- Fix vmtools policy to allow user roles to access vmtools_helper_t
+- Allow block_suspend cap2 for ipa-otpd
+- Allow certmonger to search home content
+- Allow pkcsslotd to read users state
+- Allow exim to use pam stack to check passwords
+- Add labeling for /usr/sbin/amavi
+- Colin asked for this program to be treated as cloud-init
+- Allow ftp services to manage xferlog_t
+- Fix vmtools policy to allow user roles to access vmtools_helper_t
+- Allow block_suspend cap2 for ipa-otpd
+- Allow certmonger to search home content
+- Allow pkcsslotd to read users state
+- Allow exim to use pam stack to check passwords
+
 * Tue Feb 18 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-25
 - Add lvm_read_metadata()
 - Allow auditadm to search /var/log/audit dir