diff --git a/config.tgz b/config.tgz
index 32fecce..2619187 100644
Binary files a/config.tgz and b/config.tgz differ
diff --git a/policy-F14.patch b/policy-F14.patch
index 65dad37..c703b07 100644
--- a/policy-F14.patch
+++ b/policy-F14.patch
@@ -7898,7 +7898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
  #
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.8/policy/modules/kernel/kernel.if
 --- nsaserefpolicy/policy/modules/kernel/kernel.if	2010-06-08 10:35:48.000000000 -0400
-+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if	2010-07-20 10:46:10.000000000 -0400
++++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if	2010-07-27 11:47:12.000000000 -0400
 @@ -1977,7 +1977,7 @@
  	')
  
@@ -11831,14 +11831,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.8/policy/modules/services/boinc.fc
 --- nsaserefpolicy/policy/modules/services/boinc.fc	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc	2010-07-20 10:46:10.000000000 -0400
-@@ -0,0 +1,6 @@
++++ serefpolicy-3.8.8/policy/modules/services/boinc.fc	2010-07-27 09:18:03.000000000 -0400
+@@ -0,0 +1,8 @@
 +
-+/etc/rc\.d/init\.d/boinc_client		--  gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
++/etc/rc\.d/init\.d/boinc_client		-- 	gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
 +
-+/usr/bin/boinc_client				--	gen_context(system_u:object_r:boinc_exec_t,s0)
++/usr/bin/boinc_client			--	gen_context(system_u:object_r:boinc_exec_t,s0)
 +
-+/var/lib/boinc(/.*)?					gen_context(system_u:object_r:boinc_var_lib_t,s0)
++/var/lib/boinc(/.*)?				gen_context(system_u:object_r:boinc_var_lib_t,s0)
++/var/lib/boinc/projects(/.*)?			gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
++/var/lib/boinc/slots(/.*)?          	 	gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.8/policy/modules/services/boinc.if
 --- nsaserefpolicy/policy/modules/services/boinc.if	1969-12-31 19:00:00.000000000 -0500
 +++ serefpolicy-3.8.8/policy/modules/services/boinc.if	2010-07-20 10:46:10.000000000 -0400
@@ -11996,8 +11998,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.8/policy/modules/services/boinc.te
 --- nsaserefpolicy/policy/modules/services/boinc.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.8.8/policy/modules/services/boinc.te	2010-07-20 10:46:10.000000000 -0400
-@@ -0,0 +1,96 @@
++++ serefpolicy-3.8.8/policy/modules/services/boinc.te	2010-07-27 09:18:03.000000000 -0400
+@@ -0,0 +1,143 @@
 +policy_module(boinc,1.0.0)
 +
 +########################################
@@ -12021,13 +12023,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +type boinc_var_lib_t;
 +files_type(boinc_var_lib_t)
 +
++type boinc_project_t;
++domain_type(boinc_project_t)
++role system_r types boinc_project_t;
++
++permissive boinc_project_t;
++
++type boinc_project_var_lib_t;
++files_type(boinc_project_var_lib_t)
++
 +########################################
 +#
 +# boinc local policy
 +#
 +
 +allow boinc_t self:capability { kill };
-+allow boinc_t self:process { execmem ptrace setsched signal signull sigstop sigkill };
++allow boinc_t self:process { setsched };
 +
 +allow boinc_t self:fifo_file rw_fifo_file_perms;
 +allow boinc_t self:unix_stream_socket create_stream_socket_perms;
@@ -12047,10 +12058,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +manage_files_pattern(boinc_t, boinc_var_lib_t,  boinc_var_lib_t)
 +files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } )
 +
++manage_dirs_pattern(boinc_t, boinc_project_var_lib_t,  boinc_project_var_lib_t)
++manage_files_pattern(boinc_t, boinc_project_var_lib_t,  boinc_project_var_lib_t)
++
 +kernel_read_system_state(boinc_t)
-+kernel_read_network_state(boinc_t)
-+kernel_read_kernel_sysctls(boinc_t)
-+kernel_search_vm_sysctl(boinc_t)
++
++files_getattr_all_dirs(boinc_t)
++files_getattr_all_files(boinc_t)
 +
 +corecmd_exec_bin(boinc_t)
 +corecmd_exec_shell(boinc_t)
@@ -12094,6 +12108,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
 +sysnet_dns_name_resolve(boinc_t)
 +
 +mta_send_mail(boinc_t)
++
++########################################
++#
++# boinc-projects local policy
++#
++
++domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
++
++allow boinc_project_t self:process { ptrace setsched signal signull sigkill sigstop };
++allow boinc_project_t self:process { execmem execstack };
++
++allow boinc_project_t boinc_project_var_lib_t:file entrypoint;
++exec_files_pattern(boinc_project_t, boinc_project_var_lib_t,  boinc_project_var_lib_t)
++manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t,  boinc_project_var_lib_t)
++manage_files_pattern(boinc_project_t, boinc_project_var_lib_t,  boinc_project_var_lib_t)
++files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, { file dir })
++
++allow boinc_project_t boinc_project_var_lib_t:file execmod;
++
++allow boinc_project_t boinc_t:shm rw_shm_perms;
++allow boinc_project_t boinc_tmpfs_t:file { read write };
++
++rw_files_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t)
++
++kernel_read_system_state(boinc_project_t)
++kernel_read_kernel_sysctls(boinc_project_t)
++kernel_search_vm_sysctl(boinc_project_t)
++kernel_read_network_state(boinc_project_t)
++
++corenet_tcp_connect_boinc_port(boinc_project_t)
++
++dev_rw_xserver_misc(boinc_project_t)
++
++miscfiles_read_localization(boinc_project_t)
++
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.8/policy/modules/services/bugzilla.fc
 --- nsaserefpolicy/policy/modules/services/bugzilla.fc	1969-12-31 19:00:00.000000000 -0500
 +++ serefpolicy-3.8.8/policy/modules/services/bugzilla.fc	2010-07-20 10:46:10.000000000 -0400
@@ -13716,7 +13765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
 +/var/log/mcelog.*		--	gen_context(system_u:object_r:cron_log_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.8/policy/modules/services/cron.if
 --- nsaserefpolicy/policy/modules/services/cron.if	2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.8.8/policy/modules/services/cron.if	2010-07-23 08:29:53.000000000 -0400
++++ serefpolicy-3.8.8/policy/modules/services/cron.if	2010-07-27 11:02:51.000000000 -0400
 @@ -12,6 +12,10 @@
  ## </param>
  #
@@ -13768,11 +13817,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  	')
  
  	role $1 types { cronjob_t crontab_t };
-@@ -116,6 +128,12 @@
+@@ -116,6 +128,13 @@
  	# Transition from the user domain to the derived domain.
  	domtrans_pattern($2, crontab_exec_t, crontab_t)
  
 +	allow crond_t $2:process transition;
++	dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
 +	allow $2 crond_t:process sigchld;
 +
 +	# needs to be authorized SELinux context for cron
@@ -13781,7 +13831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  	# crontab shows up in user ps
  	ps_process_pattern($2, crontab_t)
  	allow $2 crontab_t:process signal;
-@@ -154,27 +172,14 @@
+@@ -154,27 +173,14 @@
  #
  interface(`cron_unconfined_role',`
  	gen_require(`
@@ -13811,7 +13861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  	optional_policy(`
  		gen_require(`
  			class dbus send_msg;
-@@ -408,7 +413,43 @@
+@@ -408,7 +414,43 @@
  		type crond_t;
  	')
  
@@ -13856,7 +13906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  ')
  
  ########################################
-@@ -554,7 +595,7 @@
+@@ -554,7 +596,7 @@
  		type system_cronjob_t;
  	')
  
@@ -13865,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  ')
  
  ########################################
-@@ -587,11 +628,14 @@
+@@ -587,11 +629,14 @@
  #
  interface(`cron_read_system_job_tmp_files',`
  	gen_require(`
@@ -13881,7 +13931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  ')
  
  ########################################
-@@ -627,7 +671,48 @@
+@@ -627,7 +672,48 @@
  interface(`cron_dontaudit_write_system_job_tmp_files',`
  	gen_require(`
  		type system_cronjob_tmp_t;
@@ -23045,8 +23095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun
  kernel_read_system_state(stunnel_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te
 --- nsaserefpolicy/policy/modules/services/sysstat.te	2010-06-18 13:07:19.000000000 -0400
-+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te	2010-07-20 10:46:11.000000000 -0400
-@@ -68,3 +68,8 @@
++++ serefpolicy-3.8.8/policy/modules/services/sysstat.te	2010-07-27 09:40:49.000000000 -0400
+@@ -18,8 +18,7 @@
+ # Local policy
+ #
+ 
+-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config };
+-dontaudit sysstat_t self:capability sys_admin;
++allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config };
+ allow sysstat_t self:fifo_file rw_fifo_file_perms;
+ 
+ can_exec(sysstat_t, sysstat_exec_t)
+@@ -68,3 +67,8 @@
  optional_policy(`
  	logging_send_syslog_msg(sysstat_t)
  ')
@@ -27720,6 +27780,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.
  
  domain_use_interactive_fds(iscsid_t)
  domain_dontaudit_read_all_domains_state(iscsid_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.8.8/policy/modules/system/kdump.te
+--- nsaserefpolicy/policy/modules/system/kdump.te	2010-06-18 13:07:19.000000000 -0400
++++ serefpolicy-3.8.8/policy/modules/system/kdump.te	2010-07-27 11:47:26.000000000 -0400
+@@ -29,6 +29,7 @@
+ 
+ kernel_read_system_state(kdump_t)
+ kernel_read_core_if(kdump_t)
++kernel_read_debugfs(kdump_t)
+ 
+ dev_read_framebuffer(kdump_t)
+ dev_read_sysfs(kdump_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc
 --- nsaserefpolicy/policy/modules/system/libraries.fc	2010-03-23 11:19:40.000000000 -0400
 +++ serefpolicy-3.8.8/policy/modules/system/libraries.fc	2010-07-22 10:09:46.000000000 -0400
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 8ef795b..4467fc6 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.8.8
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,11 @@ exit 0
 %endif
 
 %changelog
+* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7
+- Update boinc policy
+- Fix sysstat policy to allow sys_admin
+- Change failsafe_context to unconfined_r:unconfined_t:s0
+
 * Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6
 - New paths for upstart
 
diff --git a/sources b/sources
index dd0fbd8..581c4ed 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
-4c7d323036f1662a06a7a4f2a7da57a5  config.tgz
 1f8151f0184945098f3cc3ca0b53e861  serefpolicy-3.8.8.tgz