diff --git a/container-selinux.tgz b/container-selinux.tgz
index 5bac115..f68e784 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 51ae228..61241e1 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -37845,7 +37845,7 @@ index 79a45f62e..6ed0c399a 100644
 +    allow $1 init_var_lib_t:dir search_dir_perms;
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda2480..4593a868a 100644
+index 17eda2480..6c22a0a1f 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -38167,7 +38167,7 @@ index 17eda2480..4593a868a 100644
  
  ifdef(`distro_gentoo',`
  	allow init_t self:process { getcap setcap };
-@@ -186,29 +347,283 @@ ifdef(`distro_gentoo',`
+@@ -186,29 +347,292 @@ ifdef(`distro_gentoo',`
  ')
  
  ifdef(`distro_redhat',`
@@ -38202,22 +38202,30 @@ index 17eda2480..4593a868a 100644
 +')
 +
 +optional_policy(`
++    fprintd_exec(init_t)
++    fprintd_mounton_var_lib(init_t)
++')
++
++optional_policy(`
++    apache_delete_tmp(init_t)
++')
++
++optional_policy(`
 +	journalctl_exec(init_t)
 +')
 +
 +optional_policy(`
 +	kdump_read_crash(init_t)
 +	kdump_read_config(init_t)
- ')
- 
- optional_policy(`
--	auth_rw_login_records(init_t)
++')
++
++optional_policy(`
 +	gnome_filetrans_home_content(init_t)
 +	gnome_manage_data(init_t)
 +	gnome_manage_config(init_t)
- ')
- 
- optional_policy(`
++')
++
++optional_policy(`
 +    gssproxy_noatsecure(init_t)
 +')
 +
@@ -38245,16 +38253,17 @@ index 17eda2480..4593a868a 100644
 +optional_policy(`
 +	modutils_domtrans_insmod(init_t)
 +	modutils_list_module_config(init_t)
-+')
-+
-+optional_policy(`
+ ')
+ 
+ optional_policy(`
+-	auth_rw_login_records(init_t)
 +	postfix_exec(init_t)
 +	postfix_list_spool(init_t)
 +	mta_read_config(init_t)
 +	mta_manage_aliases(init_t)
-+')
-+
-+optional_policy(`
+ ')
+ 
+ optional_policy(`
 +    systemd_allow_mount_dir(init_t)
 +')
 +
@@ -38433,18 +38442,18 @@ index 17eda2480..4593a868a 100644
 +	optional_policy(`
 +		devicekit_dbus_chat_power(init_t)
 +	')
- ')
- 
- optional_policy(`
--	nscd_use(init_t)
++')
++
++optional_policy(`
 +	# /var/run/dovecot/login/ssl-parameters.dat is a hard link to
 +	# /var/lib/dovecot/ssl-parameters.dat and init tries to clean up
 +	# the directory. But we do not want to allow this.
 +	# The master process of dovecot will manage this file.
 +	dovecot_dontaudit_unlink_lib_files(initrc_t)
-+')
-+
-+optional_policy(`
+ ')
+ 
+ optional_policy(`
+-	nscd_use(init_t)
 +	networkmanager_stream_connect(init_t)
 +	networkmanager_stream_connect(initrc_t)
 +')
@@ -38460,7 +38469,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -216,7 +631,30 @@ optional_policy(`
+@@ -216,7 +640,30 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38492,7 +38501,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  ########################################
-@@ -225,9 +663,9 @@ optional_policy(`
+@@ -225,9 +672,9 @@ optional_policy(`
  #
  
  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -38504,7 +38513,7 @@ index 17eda2480..4593a868a 100644
  allow initrc_t self:passwd rootok;
  allow initrc_t self:key manage_key_perms;
  
-@@ -258,12 +696,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
+@@ -258,12 +705,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
  
  allow initrc_t initrc_var_run_t:file manage_file_perms;
  files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -38521,7 +38530,7 @@ index 17eda2480..4593a868a 100644
  
  manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
  manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
-@@ -279,23 +721,36 @@ kernel_change_ring_buffer_level(initrc_t)
+@@ -279,23 +730,36 @@ kernel_change_ring_buffer_level(initrc_t)
  kernel_clear_ring_buffer(initrc_t)
  kernel_get_sysvipc_info(initrc_t)
  kernel_read_all_sysctls(initrc_t)
@@ -38564,7 +38573,7 @@ index 17eda2480..4593a868a 100644
  corenet_tcp_sendrecv_all_ports(initrc_t)
  corenet_udp_sendrecv_all_ports(initrc_t)
  corenet_tcp_connect_all_ports(initrc_t)
-@@ -303,9 +758,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
+@@ -303,9 +767,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
  
  dev_read_rand(initrc_t)
  dev_read_urand(initrc_t)
@@ -38576,7 +38585,7 @@ index 17eda2480..4593a868a 100644
  dev_rw_sysfs(initrc_t)
  dev_list_usbfs(initrc_t)
  dev_read_framebuffer(initrc_t)
-@@ -313,8 +770,10 @@ dev_write_framebuffer(initrc_t)
+@@ -313,8 +779,10 @@ dev_write_framebuffer(initrc_t)
  dev_read_realtime_clock(initrc_t)
  dev_read_sound_mixer(initrc_t)
  dev_write_sound_mixer(initrc_t)
@@ -38587,7 +38596,7 @@ index 17eda2480..4593a868a 100644
  dev_delete_lvm_control_dev(initrc_t)
  dev_manage_generic_symlinks(initrc_t)
  dev_manage_generic_files(initrc_t)
-@@ -322,8 +781,7 @@ dev_manage_generic_files(initrc_t)
+@@ -322,8 +790,7 @@ dev_manage_generic_files(initrc_t)
  dev_delete_generic_symlinks(initrc_t)
  dev_getattr_all_blk_files(initrc_t)
  dev_getattr_all_chr_files(initrc_t)
@@ -38597,7 +38606,7 @@ index 17eda2480..4593a868a 100644
  
  domain_kill_all_domains(initrc_t)
  domain_signal_all_domains(initrc_t)
-@@ -332,7 +790,6 @@ domain_sigstop_all_domains(initrc_t)
+@@ -332,7 +799,6 @@ domain_sigstop_all_domains(initrc_t)
  domain_sigchld_all_domains(initrc_t)
  domain_read_all_domains_state(initrc_t)
  domain_getattr_all_domains(initrc_t)
@@ -38605,7 +38614,7 @@ index 17eda2480..4593a868a 100644
  domain_getsession_all_domains(initrc_t)
  domain_use_interactive_fds(initrc_t)
  # for lsof which is used by alsa shutdown:
-@@ -340,6 +797,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
+@@ -340,6 +806,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
  domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
  domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
  domain_dontaudit_getattr_all_pipes(initrc_t)
@@ -38613,7 +38622,7 @@ index 17eda2480..4593a868a 100644
  
  files_getattr_all_dirs(initrc_t)
  files_getattr_all_files(initrc_t)
-@@ -347,14 +805,15 @@ files_getattr_all_symlinks(initrc_t)
+@@ -347,14 +814,15 @@ files_getattr_all_symlinks(initrc_t)
  files_getattr_all_pipes(initrc_t)
  files_getattr_all_sockets(initrc_t)
  files_purge_tmp(initrc_t)
@@ -38631,7 +38640,7 @@ index 17eda2480..4593a868a 100644
  files_read_usr_files(initrc_t)
  files_manage_urandom_seed(initrc_t)
  files_manage_generic_spool(initrc_t)
-@@ -364,8 +823,12 @@ files_list_isid_type_dirs(initrc_t)
+@@ -364,8 +832,12 @@ files_list_isid_type_dirs(initrc_t)
  files_mounton_isid_type_dirs(initrc_t)
  files_list_default(initrc_t)
  files_mounton_default(initrc_t)
@@ -38645,7 +38654,7 @@ index 17eda2480..4593a868a 100644
  fs_list_inotifyfs(initrc_t)
  fs_register_binary_executable_type(initrc_t)
  # rhgb-console writes to ramfs
-@@ -375,10 +838,11 @@ fs_mount_all_fs(initrc_t)
+@@ -375,10 +847,11 @@ fs_mount_all_fs(initrc_t)
  fs_unmount_all_fs(initrc_t)
  fs_remount_all_fs(initrc_t)
  fs_getattr_all_fs(initrc_t)
@@ -38659,7 +38668,7 @@ index 17eda2480..4593a868a 100644
  mcs_process_set_categories(initrc_t)
  
  mls_file_read_all_levels(initrc_t)
-@@ -387,8 +851,10 @@ mls_process_read_up(initrc_t)
+@@ -387,8 +860,10 @@ mls_process_read_up(initrc_t)
  mls_process_write_down(initrc_t)
  mls_rangetrans_source(initrc_t)
  mls_fd_share_all_levels(initrc_t)
@@ -38670,7 +38679,7 @@ index 17eda2480..4593a868a 100644
  
  storage_getattr_fixed_disk_dev(initrc_t)
  storage_setattr_fixed_disk_dev(initrc_t)
-@@ -398,6 +864,7 @@ term_use_all_terms(initrc_t)
+@@ -398,6 +873,7 @@ term_use_all_terms(initrc_t)
  term_reset_tty_labels(initrc_t)
  
  auth_rw_login_records(initrc_t)
@@ -38678,7 +38687,7 @@ index 17eda2480..4593a868a 100644
  auth_setattr_login_records(initrc_t)
  auth_rw_lastlog(initrc_t)
  auth_read_pam_pid(initrc_t)
-@@ -416,20 +883,18 @@ logging_read_all_logs(initrc_t)
+@@ -416,20 +892,18 @@ logging_read_all_logs(initrc_t)
  logging_append_all_logs(initrc_t)
  logging_read_audit_config(initrc_t)
  
@@ -38702,7 +38711,7 @@ index 17eda2480..4593a868a 100644
  
  ifdef(`distro_debian',`
  	dev_setattr_generic_dirs(initrc_t)
-@@ -451,7 +916,6 @@ ifdef(`distro_gentoo',`
+@@ -451,7 +925,6 @@ ifdef(`distro_gentoo',`
  	allow initrc_t self:process setfscreate;
  	dev_create_null_dev(initrc_t)
  	dev_create_zero_dev(initrc_t)
@@ -38710,7 +38719,7 @@ index 17eda2480..4593a868a 100644
  	term_create_console_dev(initrc_t)
  
  	# unfortunately /sbin/rc does stupid tricks
-@@ -486,6 +950,10 @@ ifdef(`distro_gentoo',`
+@@ -486,6 +959,10 @@ ifdef(`distro_gentoo',`
  	sysnet_setattr_config(initrc_t)
  
  	optional_policy(`
@@ -38721,7 +38730,7 @@ index 17eda2480..4593a868a 100644
  		alsa_read_lib(initrc_t)
  	')
  
-@@ -506,7 +974,7 @@ ifdef(`distro_redhat',`
+@@ -506,7 +983,7 @@ ifdef(`distro_redhat',`
  
  	# Red Hat systems seem to have a stray
  	# fd open from the initrd
@@ -38730,7 +38739,7 @@ index 17eda2480..4593a868a 100644
  	files_dontaudit_read_root_files(initrc_t)
  
  	# These seem to be from the initrd
-@@ -521,6 +989,7 @@ ifdef(`distro_redhat',`
+@@ -521,6 +998,7 @@ ifdef(`distro_redhat',`
  	files_create_boot_dirs(initrc_t)
  	files_create_boot_flag(initrc_t)
  	files_rw_boot_symlinks(initrc_t)
@@ -38738,7 +38747,7 @@ index 17eda2480..4593a868a 100644
  	# wants to read /.fonts directory
  	files_read_default_files(initrc_t)
  	files_mountpoint(initrc_tmp_t)
-@@ -541,6 +1010,7 @@ ifdef(`distro_redhat',`
+@@ -541,6 +1019,7 @@ ifdef(`distro_redhat',`
  	miscfiles_rw_localization(initrc_t)
  	miscfiles_setattr_localization(initrc_t)
  	miscfiles_relabel_localization(initrc_t)
@@ -38746,7 +38755,7 @@ index 17eda2480..4593a868a 100644
  
  	miscfiles_read_fonts(initrc_t)
  	miscfiles_read_hwdata(initrc_t)
-@@ -550,8 +1020,44 @@ ifdef(`distro_redhat',`
+@@ -550,8 +1029,44 @@ ifdef(`distro_redhat',`
  	')
  
  	optional_policy(`
@@ -38791,7 +38800,7 @@ index 17eda2480..4593a868a 100644
  	')
  
  	optional_policy(`
-@@ -559,14 +1065,31 @@ ifdef(`distro_redhat',`
+@@ -559,14 +1074,31 @@ ifdef(`distro_redhat',`
  		rpc_write_exports(initrc_t)
  		rpc_manage_nfs_state_data(initrc_t)
  	')
@@ -38823,7 +38832,7 @@ index 17eda2480..4593a868a 100644
  	')
  ')
  
-@@ -577,6 +1100,39 @@ ifdef(`distro_suse',`
+@@ -577,6 +1109,39 @@ ifdef(`distro_suse',`
  	')
  ')
  
@@ -38863,7 +38872,7 @@ index 17eda2480..4593a868a 100644
  optional_policy(`
  	amavis_search_lib(initrc_t)
  	amavis_setattr_pid_files(initrc_t)
-@@ -589,6 +1145,8 @@ optional_policy(`
+@@ -589,6 +1154,8 @@ optional_policy(`
  optional_policy(`
  	apache_read_config(initrc_t)
  	apache_list_modules(initrc_t)
@@ -38872,7 +38881,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -610,6 +1168,7 @@ optional_policy(`
+@@ -610,6 +1177,7 @@ optional_policy(`
  
  optional_policy(`
  	cgroup_stream_connect_cgred(initrc_t)
@@ -38880,7 +38889,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -626,6 +1185,17 @@ optional_policy(`
+@@ -626,6 +1194,17 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38898,7 +38907,7 @@ index 17eda2480..4593a868a 100644
  	dev_getattr_printer_dev(initrc_t)
  
  	cups_read_log(initrc_t)
-@@ -642,9 +1212,13 @@ optional_policy(`
+@@ -642,9 +1221,13 @@ optional_policy(`
  	dbus_connect_system_bus(initrc_t)
  	dbus_system_bus_client(initrc_t)
  	dbus_read_config(initrc_t)
@@ -38912,7 +38921,7 @@ index 17eda2480..4593a868a 100644
  	')
  
  	optional_policy(`
-@@ -657,15 +1231,11 @@ optional_policy(`
+@@ -657,15 +1240,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38930,7 +38939,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -686,6 +1256,15 @@ optional_policy(`
+@@ -686,6 +1265,15 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38946,7 +38955,7 @@ index 17eda2480..4593a868a 100644
  	inn_exec_config(initrc_t)
  ')
  
-@@ -726,6 +1305,7 @@ optional_policy(`
+@@ -726,6 +1314,7 @@ optional_policy(`
  	lpd_list_spool(initrc_t)
  
  	lpd_read_config(initrc_t)
@@ -38954,7 +38963,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -743,7 +1323,13 @@ optional_policy(`
+@@ -743,7 +1332,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38969,7 +38978,7 @@ index 17eda2480..4593a868a 100644
  	mta_dontaudit_read_spool_symlinks(initrc_t)
  ')
  
-@@ -766,6 +1352,10 @@ optional_policy(`
+@@ -766,6 +1361,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38980,7 +38989,7 @@ index 17eda2480..4593a868a 100644
  	postgresql_manage_db(initrc_t)
  	postgresql_read_config(initrc_t)
  ')
-@@ -775,10 +1365,20 @@ optional_policy(`
+@@ -775,10 +1374,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39001,7 +39010,7 @@ index 17eda2480..4593a868a 100644
  	quota_manage_flags(initrc_t)
  ')
  
-@@ -787,6 +1387,10 @@ optional_policy(`
+@@ -787,6 +1396,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39012,7 +39021,7 @@ index 17eda2480..4593a868a 100644
  	fs_write_ramfs_sockets(initrc_t)
  	fs_search_ramfs(initrc_t)
  
-@@ -808,8 +1412,6 @@ optional_policy(`
+@@ -808,8 +1421,6 @@ optional_policy(`
  	# bash tries ioctl for some reason
  	files_dontaudit_ioctl_all_pids(initrc_t)
  
@@ -39021,7 +39030,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -818,6 +1420,10 @@ optional_policy(`
+@@ -818,6 +1429,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39032,7 +39041,7 @@ index 17eda2480..4593a868a 100644
  	# shorewall-init script run /var/lib/shorewall/firewall
  	shorewall_lib_domtrans(initrc_t)
  ')
-@@ -827,10 +1433,12 @@ optional_policy(`
+@@ -827,10 +1442,12 @@ optional_policy(`
  	squid_manage_logs(initrc_t)
  ')
  
@@ -39045,7 +39054,7 @@ index 17eda2480..4593a868a 100644
  
  optional_policy(`
  	ssh_dontaudit_read_server_keys(initrc_t)
-@@ -857,21 +1465,62 @@ optional_policy(`
+@@ -857,21 +1474,62 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39109,7 +39118,7 @@ index 17eda2480..4593a868a 100644
  ')
  
  optional_policy(`
-@@ -887,6 +1536,10 @@ optional_policy(`
+@@ -887,6 +1545,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -39120,7 +39129,7 @@ index 17eda2480..4593a868a 100644
  	# Set device ownerships/modes.
  	xserver_setattr_console_pipes(initrc_t)
  
-@@ -897,3 +1550,218 @@ optional_policy(`
+@@ -897,3 +1559,218 @@ optional_policy(`
  optional_policy(`
  	zebra_read_config(initrc_t)
  ')
@@ -40917,7 +40926,7 @@ index 808ba93eb..b717d9709 100644
 +	files_etc_filetrans($1, ld_so_cache_t, file, "ld.so.preload~")
 +')
 diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
-index 54f8fa5c8..b9dbbe005 100644
+index 54f8fa5c8..e14ec857c 100644
 --- a/policy/modules/system/libraries.te
 +++ b/policy/modules/system/libraries.te
 @@ -32,14 +32,14 @@ files_tmp_file(ldconfig_tmp_t)
@@ -40937,7 +40946,7 @@ index 54f8fa5c8..b9dbbe005 100644
  
  ifdef(`distro_gentoo',`
  	# openrc unfortunately mounts a tmpfs
-@@ -57,11 +57,13 @@ optional_policy(`
+@@ -57,11 +57,14 @@ optional_policy(`
  # ldconfig local policy
  #
  
@@ -40947,13 +40956,14 @@ index 54f8fa5c8..b9dbbe005 100644
 +manage_dirs_pattern(ldconfig_t, ldconfig_cache_t, ldconfig_cache_t)
  manage_files_pattern(ldconfig_t, ldconfig_cache_t, ldconfig_cache_t)
 +files_var_filetrans(ldconfig_t, ldconfig_cache_t, dir, "ldconfig")
++allow ldconfig_t ldconfig_cache_t:file map;
  
 -allow ldconfig_t ld_so_cache_t:file manage_file_perms;
 +manage_files_pattern(ldconfig_t, ld_so_cache_t, ld_so_cache_t)
  files_etc_filetrans(ldconfig_t, ld_so_cache_t, file)
  
  manage_dirs_pattern(ldconfig_t, ldconfig_tmp_t, ldconfig_tmp_t)
-@@ -72,14 +74,19 @@ files_tmp_filetrans(ldconfig_t, ldconfig_tmp_t, { file dir lnk_file })
+@@ -72,14 +75,19 @@ files_tmp_filetrans(ldconfig_t, ldconfig_tmp_t, { file dir lnk_file })
  manage_lnk_files_pattern(ldconfig_t, lib_t, lib_t)
  
  kernel_read_system_state(ldconfig_t)
@@ -40974,7 +40984,7 @@ index 54f8fa5c8..b9dbbe005 100644
  files_read_etc_files(ldconfig_t)
  files_read_usr_files(ldconfig_t)
  files_search_tmp(ldconfig_t)
-@@ -90,11 +97,11 @@ files_delete_etc_files(ldconfig_t)
+@@ -90,11 +98,11 @@ files_delete_etc_files(ldconfig_t)
  init_use_script_ptys(ldconfig_t)
  init_read_script_tmp_files(ldconfig_t)
  
@@ -40988,7 +40998,7 @@ index 54f8fa5c8..b9dbbe005 100644
  userdom_use_all_users_fds(ldconfig_t)
  
  ifdef(`distro_ubuntu',`
-@@ -103,6 +110,13 @@ ifdef(`distro_ubuntu',`
+@@ -103,6 +111,13 @@ ifdef(`distro_ubuntu',`
  	')
  ')
  
@@ -41002,7 +41012,7 @@ index 54f8fa5c8..b9dbbe005 100644
  ifdef(`hide_broken_symptoms',`
  	ifdef(`distro_gentoo',`
  		# leaked fds from portage
-@@ -114,6 +128,11 @@ ifdef(`hide_broken_symptoms',`
+@@ -114,6 +129,11 @@ ifdef(`hide_broken_symptoms',`
  		')
  	')
  
@@ -41014,7 +41024,7 @@ index 54f8fa5c8..b9dbbe005 100644
  	optional_policy(`
  		unconfined_dontaudit_rw_tcp_sockets(ldconfig_t)
  	')
-@@ -131,6 +150,18 @@ optional_policy(`
+@@ -131,6 +151,18 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -41033,7 +41043,7 @@ index 54f8fa5c8..b9dbbe005 100644
  	puppet_rw_tmp(ldconfig_t)
  ')
  
-@@ -141,6 +172,3 @@ optional_policy(`
+@@ -141,6 +173,3 @@ optional_policy(`
  	rpm_manage_script_tmp_files(ldconfig_t)
  ')
  
@@ -50022,10 +50032,10 @@ index 000000000..634d9596a
 +')
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
 new file mode 100644
-index 000000000..e7c2cc70b
+index 000000000..1927b4fc0
 --- /dev/null
 +++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,1021 @@
+@@ -0,0 +1,1025 @@
 +policy_module(systemd, 1.0.0)
 +
 +#######################################
@@ -50334,6 +50344,10 @@ index 000000000..e7c2cc70b
 +')
 +
 +optional_policy(`
++	nis_use_ypbind(systemd_logind_t)
++')
++
++optional_policy(`
 +	rpm_dbus_chat(systemd_logind_t)
 +')
 +
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 859d32f..902c1f0 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -3925,7 +3925,7 @@ index 7caefc353..966c2f3e6 100644
 +/var/run/dirsrv/admin-serv.*	gen_context(system_u:object_r:httpd_var_run_t,s0)
 +/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)?       gen_context(system_u:object_r:httpd_var_run_t,s0)
 diff --git a/apache.if b/apache.if
-index f6eb4851f..fe461a3fc 100644
+index f6eb4851f..422f408d4 100644
 --- a/apache.if
 +++ b/apache.if
 @@ -1,9 +1,9 @@
@@ -4218,11 +4218,11 @@ index f6eb4851f..fe461a3fc 100644
 -	')
 +		# privileged users run the script:
 +		domtrans_pattern(httpd_exec_scripts, $1_script_exec_t, $1_script_t)
-+
-+		allow httpd_exec_scripts $1_script_exec_t:file read_file_perms;
  
 -	tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
 -		filetrans_pattern(httpd_t, httpd_$1_content_t, httpd_$1_rw_content_t, { file dir fifo_file lnk_file sock_file })
++		allow httpd_exec_scripts $1_script_exec_t:file read_file_perms;
++
 +		# apache runs the script:
 +		domtrans_pattern(httpd_t, $1_script_exec_t, $1_script_t)
 +		allow httpd_t $1_script_t:unix_dgram_socket sendto;
@@ -4499,10 +4499,12 @@ index f6eb4851f..fe461a3fc 100644
  
 -	dontaudit $1 httpd_t:fifo_file rw_fifo_file_perms;
 +	dontaudit $1 httpd_t:fifo_file rw_inherited_fifo_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Do not audit attempts to read and
+-##	write httpd unix domain stream sockets.
 +##	Allow attempts to read and write Apache
 +##	unix domain stream sockets.
 +## </summary>
@@ -4518,12 +4520,10 @@ index f6eb4851f..fe461a3fc 100644
 +	')
 +
 +	allow $1 httpd_t:unix_stream_socket { getattr read write };
- ')
- 
- ########################################
- ## <summary>
--##	Do not audit attempts to read and
--##	write httpd unix domain stream sockets.
++')
++
++########################################
++## <summary>
 +##	Do not audit attempts to read and write Apache
 +##	unix domain stream sockets.
  ## </summary>
@@ -5017,31 +5017,11 @@ index f6eb4851f..fe461a3fc 100644
 +')
 +
 +######################################
-+## <summary>
-+##	Allow the specified domain to read
-+##	apache system content rw dirs.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`apache_read_sys_content_rw_dirs',`
-+	gen_require(`
-+		type httpd_sys_rw_content_t;
-+	')
-+
-+	list_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
-+')
-+
-+######################################
  ## <summary>
 -##	Create, read, write, and delete
 -##	httpd system rw content.
-+##	Allow the specified domain to manage
-+##	apache system content rw files.
++##	Allow the specified domain to read
++##	apache system content rw dirs.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
@@ -5051,12 +5031,32 @@ index f6eb4851f..fe461a3fc 100644
 +## <rolecap/>
  #
 -interface(`apache_manage_sys_rw_content',`
-+interface(`apache_manage_sys_content_rw',`
++interface(`apache_read_sys_content_rw_dirs',`
  	gen_require(`
  		type httpd_sys_rw_content_t;
  	')
  
 -	apache_search_sys_content($1)
++	list_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
++')
++
++######################################
++## <summary>
++##	Allow the specified domain to manage
++##	apache system content rw files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`apache_manage_sys_content_rw',`
++	gen_require(`
++		type httpd_sys_rw_content_t;
++	')
++
 +	files_search_var($1)
  	manage_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
 -	manage_files_pattern($1,httpd_sys_rw_content_t, httpd_sys_rw_content_t)
@@ -5390,7 +5390,7 @@ index f6eb4851f..fe461a3fc 100644
  	admin_pattern($1, httpd_log_t)
  
  	admin_pattern($1, httpd_modules_t)
-@@ -1224,9 +1625,183 @@ interface(`apache_admin',`
+@@ -1224,9 +1625,201 @@ interface(`apache_admin',`
  	admin_pattern($1, httpd_var_run_t)
  	files_pid_filetrans($1, httpd_var_run_t, file)
  
@@ -5554,9 +5554,7 @@ index f6eb4851f..fe461a3fc 100644
 +	files_search_pids($1)
 +	read_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
 +')
- 
--	apache_run_all_scripts($1, $2)
--	apache_run_helper($1, $2)
++
 +########################################
 +## <summary>
 +##      Send and receive messages from
@@ -5577,6 +5575,26 @@ index f6eb4851f..fe461a3fc 100644
 +        allow $1 httpd_t:dbus send_msg;
 +        allow httpd_t $1:dbus send_msg;
 +		ps_process_pattern(httpd_t, $1)
++')
++
++########################################
++## <summary>
++##	Delete the httpd tmp.
++## </summary>
++## <param name="file_type">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`apache_delete_tmp',`
++	gen_require(`
++		type httpd_tmp_t;
++	')
+ 
+-	apache_run_all_scripts($1, $2)
+-	apache_run_helper($1, $2)
++	allow $1 httpd_tmp_t:file unlink;
  ')
 diff --git a/apache.te b/apache.te
 index 6649962b6..1a0189a44 100644
@@ -20908,7 +20926,7 @@ index b25b01d12..06895f39a 100644
  ')
 +
 diff --git a/ctdb.te b/ctdb.te
-index 001b502e6..73da04ae1 100644
+index 001b502e6..b264e198a 100644
 --- a/ctdb.te
 +++ b/ctdb.te
 @@ -24,6 +24,9 @@ files_tmp_file(ctdbd_tmp_t)
@@ -20926,9 +20944,10 @@ index 001b502e6..73da04ae1 100644
  #
  
 -allow ctdbd_t self:capability { chown ipc_lock net_admin net_raw sys_nice };
-+allow ctdbd_t self:capability { chown dac_override dac_read_search ipc_lock net_admin net_raw sys_nice };
+-allow ctdbd_t self:process { setpgid signal_perms setsched };
++allow ctdbd_t self:capability { chown dac_override dac_read_search ipc_lock net_admin net_raw sys_nice sys_resource };
 +allow ctdbd_t self:capability2 block_suspend;
- allow ctdbd_t self:process { setpgid signal_perms setsched };
++allow ctdbd_t self:process { setpgid setrlimit signal_perms setsched };
  allow ctdbd_t self:fifo_file rw_fifo_file_perms;
  allow ctdbd_t self:unix_stream_socket { accept connectto listen };
  allow ctdbd_t self:netlink_route_socket r_netlink_socket_perms;
@@ -30088,6 +30107,59 @@ index 5010f04e1..0341ae121 100644
  ')
  
  optional_policy(`
+diff --git a/fprintd.if b/fprintd.if
+index 8081132cd..4fb5a13bc 100644
+--- a/fprintd.if
++++ b/fprintd.if
+@@ -19,6 +19,25 @@ interface(`fprintd_domtrans',`
+ 	domtrans_pattern($1, fprintd_exec_t, fprintd_t)
+ ')
+ 
++######################################
++## <summary>
++##	Execute fprintd in the caller domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`fprintd_exec',`
++	gen_require(`
++		type fprintd_exec_t;
++	')
++
++	corecmd_search_bin($1)
++	can_exec($1, fprintd_exec_t)
++')
++
+ ########################################
+ ## <summary>
+ ##	Send and receive messages from
+@@ -39,3 +58,22 @@ interface(`fprintd_dbus_chat',`
+ 	allow $1 fprintd_t:dbus send_msg;
+ 	allow fprintd_t $1:dbus send_msg;
+ ')
++
++########################################
++
++## <summary>
++##	Mounton fprintd lib  directory.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`fprintd_mounton_var_lib',`
++	gen_require(`
++		type fprintd_var_lib_t;
++	')
++
++	allow $1 fprintd_var_lib_t:dir mounton;
++')
 diff --git a/fprintd.te b/fprintd.te
 index 92a6479a2..f064c940d 100644
 --- a/fprintd.te
@@ -53630,7 +53702,7 @@ index 6194b806b..e27c53d6e 100644
  ')
 +
 diff --git a/mozilla.te b/mozilla.te
-index 11ac8e4fc..94822ad40 100644
+index 11ac8e4fc..7cba596af 100644
 --- a/mozilla.te
 +++ b/mozilla.te
 @@ -6,17 +6,56 @@ policy_module(mozilla, 2.8.0)
@@ -54084,7 +54156,7 @@ index 11ac8e4fc..94822ad40 100644
  ')
  
  optional_policy(`
-@@ -300,259 +340,260 @@ optional_policy(`
+@@ -300,259 +340,261 @@ optional_policy(`
  
  ########################################
  #
@@ -54299,6 +54371,7 @@ index 11ac8e4fc..94822ad40 100644
  dev_rw_xserver_misc(mozilla_plugin_t)
 +dev_rwx_zero(mozilla_plugin_t)
 +dev_dontaudit_read_mtrr(mozilla_plugin_t)
++dev_map_video_dev(mozilla_plugin_t)
 +xserver_dri_domain(mozilla_plugin_t)
  
 -dev_dontaudit_getattr_generic_files(mozilla_plugin_t)
@@ -54491,7 +54564,7 @@ index 11ac8e4fc..94822ad40 100644
  ')
  
  optional_policy(`
-@@ -560,7 +601,11 @@ optional_policy(`
+@@ -560,7 +602,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -54504,7 +54577,7 @@ index 11ac8e4fc..94822ad40 100644
  ')
  
  optional_policy(`
-@@ -568,108 +613,144 @@ optional_policy(`
+@@ -568,108 +614,144 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -112156,10 +112229,10 @@ index 000000000..e5cec8fda
 +')
 diff --git a/tomcat.te b/tomcat.te
 new file mode 100644
-index 000000000..7726f7594
+index 000000000..9c3b00220
 --- /dev/null
 +++ b/tomcat.te
-@@ -0,0 +1,109 @@
+@@ -0,0 +1,117 @@
 +policy_module(tomcat, 1.0.0)
 +
 +########################################
@@ -112167,6 +112240,13 @@ index 000000000..7726f7594
 +# Declarations
 +#
 +
++## <desc>
++## <p>
++## Allow tomcat to read rpm database.
++## </p>
++## </desc>
++gen_tunable(tomcat_read_rpm_db, false)
++
 +attribute tomcat_domain;
 +
 +tomcat_domain_template(tomcat)
@@ -112245,6 +112325,7 @@ index 000000000..7726f7594
 +corenet_tcp_connect_ibm_dt_2_port(tomcat_domain)
 +corenet_tcp_connect_unreserved_ports(tomcat_domain)
 +corenet_tcp_connect_mssql_port(tomcat_domain)
++corenet_tcp_connect_mysqld_port(tomcat_domain)
 +
 +dev_read_rand(tomcat_domain)
 +dev_read_urand(tomcat_domain)
@@ -112265,7 +112346,7 @@ index 000000000..7726f7594
 +	tomcat_search_lib(tomcat_domain)
 +')
 +
-+optional_policy(`
++tunable_policy(`tomcat_read_rpm_db',`
 +    rpm_exec(tomcat_domain)
 +    rpm_read_db(tomcat_domain)
 +')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 4abaa6d..290d069 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 285%{?dist}
+Release: 286%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -682,6 +682,20 @@ exit 0
 %endif
 
 %changelog
+* Mon Sep 18 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-286
+- Add new boolean tomcat_read_rpm_db()
+- Allow tomcat to connect on mysqld tcp ports
+- Add new interface apache_delete_tmp()
+- Add interface fprintd_exec()
+- Add interface fprintd_mounton_var_lib()
+- Allow mozilla plugin to mmap video devices BZ(1492580)
+- Add ctdbd_t domain sys_source capability and allow setrlimit
+- Allow systemd-logind to use ypbind
+- Allow systemd to remove apache tmp files
+- Allow ldconfig domain to mmap ldconfig cache files
+- Allow systemd to exec fprintd BZ(1491808)
+- Allow systemd to mounton fprintd lib dir
+
 * Thu Sep 14 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-285
 - Allow svirt_t read userdomain state