diff --git a/docker-selinux.tgz b/docker-selinux.tgz
index 9b3e5ae..b94176b 100644
Binary files a/docker-selinux.tgz and b/docker-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index ddf081b..1c19c4d 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -46,9 +46,18 @@ index ec7b5cb..a027110 100644
ifndef LOCAL_ROOT
rm -f $(fcsort)
diff --git a/Rules.modular b/Rules.modular
-index 313d837..ef3c532 100644
+index 313d837..4f261a9 100644
--- a/Rules.modular
+++ b/Rules.modular
+@@ -71,7 +71,7 @@ $(modpkgdir)/%.pp: $(builddir)%.pp
+ # Build module packages
+ #
+ $(tmpdir)/%.mod: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf %.te
+- @echo "Compliling $(NAME) $(@F) module"
++ @echo "Compiling $(NAME) $(@F) module"
+ @test -d $(tmpdir) || mkdir -p $(tmpdir)
+ $(verbose) $(M4) $(M4PARAM) -s $^ > $(@:.mod=.tmp)
+ $(verbose) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
@@ -201,6 +201,7 @@ validate: $(base_pkg) $(mod_pkgs)
@echo "Validating policy linking."
$(verbose) $(SEMOD_LNK) -o $(tmpdir)/test.lnk $^
@@ -868,7 +877,7 @@ index 3a45f23..ee7d7b3 100644
constrain socket_class_set { create relabelto relabelfrom }
(
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
-index a94b169..d0a8a5b 100644
+index a94b169..2e137e6 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -329,6 +329,7 @@ class process
@@ -879,7 +888,7 @@ index a94b169..d0a8a5b 100644
}
-@@ -393,6 +394,15 @@ class system
+@@ -393,6 +394,13 @@ class system
syslog_mod
syslog_console
module_request
@@ -890,12 +899,10 @@ index a94b169..d0a8a5b 100644
+ enable
+ disable
+ reload
-+ stop
-+ start
}
#
-@@ -443,10 +453,13 @@ class capability
+@@ -443,10 +451,13 @@ class capability
class capability2
{
mac_override # unused by SELinux
@@ -910,7 +917,7 @@ index a94b169..d0a8a5b 100644
}
#
-@@ -690,6 +703,8 @@ class nscd
+@@ -690,6 +701,8 @@ class nscd
shmemhost
getserv
shmemserv
@@ -919,7 +926,7 @@ index a94b169..d0a8a5b 100644
}
# Define the access vector interpretation for controlling
-@@ -831,6 +846,38 @@ inherits socket
+@@ -831,6 +844,38 @@ inherits socket
attach_queue
}
@@ -958,7 +965,7 @@ index a94b169..d0a8a5b 100644
class x_pointer
inherits x_device
-@@ -865,3 +912,18 @@ inherits database
+@@ -865,3 +910,18 @@ inherits database
implement
execute
}
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 2d560ab..b3d2b38 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -9425,10 +9425,10 @@ index c3fd7b1..e189593 100644
-
-miscfiles_read_localization(bcfg2_t)
diff --git a/bind.fc b/bind.fc
-index 2b9a3a1..750788c 100644
+index 2b9a3a1..49accb6 100644
--- a/bind.fc
+++ b/bind.fc
-@@ -1,54 +1,76 @@
+@@ -1,54 +1,77 @@
-/etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
@@ -9463,6 +9463,7 @@ index 2b9a3a1..750788c 100644
-/usr/sbin/r?ndc -- gen_context(system_u:object_r:ndc_exec_t,s0)
+/usr/sbin/named -- gen_context(system_u:object_r:named_exec_t,s0)
+/usr/sbin/named-sdb -- gen_context(system_u:object_r:named_exec_t,s0)
++/usr/sbin/named-pkcs11 -- gen_context(system_u:object_r:named_exec_t,s0)
+/usr/sbin/named-checkconf -- gen_context(system_u:object_r:named_checkconf_exec_t,s0)
+/usr/sbin/r?ndc -- gen_context(system_u:object_r:ndc_exec_t,s0)
/usr/sbin/unbound -- gen_context(system_u:object_r:named_exec_t,s0)
@@ -99864,10 +99865,10 @@ index 0000000..88490d5
+
diff --git a/snapper.te b/snapper.te
new file mode 100644
-index 0000000..3984dba
+index 0000000..939b8be
--- /dev/null
+++ b/snapper.te
-@@ -0,0 +1,82 @@
+@@ -0,0 +1,83 @@
+policy_module(snapper, 1.0.0)
+
+########################################
@@ -99893,7 +99894,8 @@ index 0000000..3984dba
+# snapperd local policy
+#
+
-+allow snapperd_t self:capability dac_override;
++allow snapperd_t self:capability { dac_override sys_admin };
++allow snapperd_t self:process setsched;
+
+allow snapperd_t self:fifo_file rw_fifo_file_perms;
+allow snapperd_t self:unix_stream_socket create_stream_socket_perms;
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 94b2f6c..fe4b660 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 185%{?dist}
+Release: 186%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -653,6 +653,12 @@ exit 0
%endif
%changelog
+* Fri Apr 29 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-186
+- Allow snapperd sys_admin capability Allow snapperd to set scheduler. BZ(1323732)
+- Label named-pkcs11 binary as named_exec_t. BZ(1331316)
+- Revert "Add new permissions stop/start to class system. rhbz#1324453"
+- Fix typo in module compilation message
+
* Wed Apr 27 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-185
- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
- Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. BZ(1330895)