@@ -49829,7 +49912,7 @@ index 3eca020..4dec4ad 100644
type virt_etc_t;
files_config_file(virt_etc_t)
-@@ -62,23 +72,31 @@ files_config_file(virt_etc_t)
+@@ -62,23 +73,31 @@ files_config_file(virt_etc_t)
type virt_etc_rw_t;
files_type(virt_etc_rw_t)
@@ -49862,7 +49945,7 @@ index 3eca020..4dec4ad 100644
type virtd_t;
type virtd_exec_t;
-@@ -89,6 +107,11 @@ domain_subj_id_change_exemption(virtd_t)
+@@ -89,6 +108,11 @@ domain_subj_id_change_exemption(virtd_t)
type virtd_initrc_exec_t;
init_script_file(virtd_initrc_exec_t)
@@ -49874,7 +49957,7 @@ index 3eca020..4dec4ad 100644
ifdef(`enable_mcs',`
init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh)
')
-@@ -104,15 +127,12 @@ ifdef(`enable_mls',`
+@@ -104,15 +128,12 @@ ifdef(`enable_mls',`
allow svirt_t self:udp_socket create_socket_perms;
@@ -49891,7 +49974,7 @@ index 3eca020..4dec4ad 100644
fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
-@@ -133,6 +153,8 @@ dev_list_sysfs(svirt_t)
+@@ -133,6 +154,8 @@ dev_list_sysfs(svirt_t)
userdom_search_user_home_content(svirt_t)
userdom_read_user_home_content_symlinks(svirt_t)
userdom_read_all_users_state(svirt_t)
@@ -49900,7 +49983,7 @@ index 3eca020..4dec4ad 100644
tunable_policy(`virt_use_comm',`
term_use_unallocated_ttys(svirt_t)
-@@ -147,11 +169,15 @@ tunable_policy(`virt_use_fusefs',`
+@@ -147,11 +170,15 @@ tunable_policy(`virt_use_fusefs',`
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(svirt_t)
fs_manage_nfs_files(svirt_t)
@@ -49916,7 +49999,7 @@ index 3eca020..4dec4ad 100644
')
tunable_policy(`virt_use_sysfs',`
-@@ -160,11 +186,22 @@ tunable_policy(`virt_use_sysfs',`
+@@ -160,11 +187,22 @@ tunable_policy(`virt_use_sysfs',`
tunable_policy(`virt_use_usb',`
dev_rw_usbfs(svirt_t)
@@ -49939,7 +50022,7 @@ index 3eca020..4dec4ad 100644
xen_rw_image_files(svirt_t)
')
-@@ -174,21 +211,34 @@ optional_policy(`
+@@ -174,21 +212,34 @@ optional_policy(`
#
allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice sys_ptrace };
@@ -49978,7 +50061,7 @@ index 3eca020..4dec4ad 100644
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
-@@ -200,8 +250,14 @@ filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
+@@ -200,8 +251,15 @@ filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
manage_blk_files_pattern(virtd_t, virt_image_type, virt_image_type)
@@ -49987,6 +50070,7 @@ index 3eca020..4dec4ad 100644
+manage_lnk_files_pattern(virtd_t, virt_image_type, virt_image_type)
+allow virtd_t virt_image_type:file relabel_file_perms;
+allow virtd_t virt_image_type:blk_file relabel_blk_file_perms;
++allow virtd_t virt_ptynode:chr_file rw_term_perms;
+
+manage_dirs_pattern(virtd_t, virt_tmp_t, virt_tmp_t)
+manage_files_pattern(virtd_t, virt_tmp_t, virt_tmp_t)
@@ -49995,7 +50079,7 @@ index 3eca020..4dec4ad 100644
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
-@@ -220,6 +276,7 @@ files_pid_filetrans(virtd_t, virt_var_run_t, { file dir })
+@@ -220,6 +278,7 @@ files_pid_filetrans(virtd_t, virt_var_run_t, { file dir })
kernel_read_system_state(virtd_t)
kernel_read_network_state(virtd_t)
kernel_rw_net_sysctls(virtd_t)
@@ -50003,7 +50087,7 @@ index 3eca020..4dec4ad 100644
kernel_request_load_module(virtd_t)
kernel_search_debugfs(virtd_t)
-@@ -239,22 +296,31 @@ corenet_tcp_connect_soundd_port(virtd_t)
+@@ -239,22 +298,31 @@ corenet_tcp_connect_soundd_port(virtd_t)
corenet_rw_tun_tap_dev(virtd_t)
dev_rw_sysfs(virtd_t)
@@ -50036,7 +50120,7 @@ index 3eca020..4dec4ad 100644
fs_list_auto_mountpoints(virtd_t)
fs_getattr_xattr_fs(virtd_t)
-@@ -262,6 +328,18 @@ fs_rw_anon_inodefs_files(virtd_t)
+@@ -262,6 +330,18 @@ fs_rw_anon_inodefs_files(virtd_t)
fs_list_inotifyfs(virtd_t)
fs_manage_cgroup_dirs(virtd_t)
fs_rw_cgroup_files(virtd_t)
@@ -50055,7 +50139,7 @@ index 3eca020..4dec4ad 100644
mcs_process_set_categories(virtd_t)
-@@ -285,16 +363,29 @@ modutils_read_module_config(virtd_t)
+@@ -285,16 +365,29 @@ modutils_read_module_config(virtd_t)
modutils_manage_module_config(virtd_t)
logging_send_syslog_msg(virtd_t)
@@ -50085,7 +50169,7 @@ index 3eca020..4dec4ad 100644
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virtd_t)
-@@ -313,6 +404,10 @@ optional_policy(`
+@@ -313,6 +406,10 @@ optional_policy(`
')
optional_policy(`
@@ -50096,7 +50180,7 @@ index 3eca020..4dec4ad 100644
dbus_system_bus_client(virtd_t)
optional_policy(`
-@@ -329,6 +424,10 @@ optional_policy(`
+@@ -329,6 +426,10 @@ optional_policy(`
')
optional_policy(`
@@ -50107,7 +50191,7 @@ index 3eca020..4dec4ad 100644
dnsmasq_domtrans(virtd_t)
dnsmasq_signal(virtd_t)
dnsmasq_kill(virtd_t)
-@@ -365,6 +464,12 @@ optional_policy(`
+@@ -365,6 +466,12 @@ optional_policy(`
qemu_signal(virtd_t)
qemu_kill(virtd_t)
qemu_setsched(virtd_t)
@@ -50120,7 +50204,7 @@ index 3eca020..4dec4ad 100644
')
optional_policy(`
-@@ -385,23 +490,37 @@ optional_policy(`
+@@ -385,23 +492,37 @@ optional_policy(`
udev_read_db(virtd_t)
')
@@ -50163,7 +50247,7 @@ index 3eca020..4dec4ad 100644
append_files_pattern(virt_domain, virt_log_t, virt_log_t)
append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
-@@ -418,10 +537,11 @@ corenet_tcp_sendrecv_generic_node(virt_domain)
+@@ -418,10 +539,11 @@ corenet_tcp_sendrecv_generic_node(virt_domain)
corenet_tcp_sendrecv_all_ports(virt_domain)
corenet_tcp_bind_generic_node(virt_domain)
corenet_tcp_bind_vnc_port(virt_domain)
@@ -50176,7 +50260,7 @@ index 3eca020..4dec4ad 100644
dev_read_rand(virt_domain)
dev_read_sound(virt_domain)
dev_read_urand(virt_domain)
-@@ -429,10 +549,12 @@ dev_write_sound(virt_domain)
+@@ -429,10 +551,12 @@ dev_write_sound(virt_domain)
dev_rw_ksm(virt_domain)
dev_rw_kvm(virt_domain)
dev_rw_qemu(virt_domain)
@@ -50189,7 +50273,7 @@ index 3eca020..4dec4ad 100644
files_read_usr_files(virt_domain)
files_read_var_files(virt_domain)
files_search_all(virt_domain)
-@@ -440,8 +562,16 @@ files_search_all(virt_domain)
+@@ -440,8 +564,16 @@ files_search_all(virt_domain)
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
@@ -50207,7 +50291,7 @@ index 3eca020..4dec4ad 100644
term_getattr_pty_fs(virt_domain)
term_use_generic_ptys(virt_domain)
term_use_ptmx(virt_domain)
-@@ -457,8 +587,117 @@ optional_policy(`
+@@ -457,8 +589,117 @@ optional_policy(`
')
optional_policy(`
@@ -50232,7 +50316,7 @@ index 3eca020..4dec4ad 100644
+typealias virsh_exec_t alias xm_exec_t;
+
+allow virsh_t self:capability { setpcap dac_override ipc_lock sys_tty_config };
-+allow virsh_t self:process { getcap getsched setcap signal };
++allow virsh_t self:process { getcap getsched setsched setcap signal };
+allow virsh_t self:fifo_file rw_fifo_file_perms;
+allow virsh_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow virsh_t self:tcp_socket create_stream_socket_perms;
@@ -54096,7 +54180,7 @@ index 354ce93..b8b14b9 100644
')
+/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index 94fd8dd..2ae760f 100644
+index 94fd8dd..99fe8d1 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -79,6 +79,41 @@ interface(`init_script_domain',`
@@ -54165,7 +54249,7 @@ index 94fd8dd..2ae760f 100644
')
typeattribute $1 daemon;
-@@ -204,7 +245,23 @@ interface(`init_daemon_domain',`
+@@ -204,7 +245,24 @@ interface(`init_daemon_domain',`
role system_r types $1;
@@ -54184,13 +54268,14 @@ index 94fd8dd..2ae760f 100644
+ tunable_policy(`init_systemd',`
+ allow init_t $1:unix_stream_socket create_stream_socket_perms;
+ allow init_t $1:unix_dgram_socket create_socket_perms;
++ allow init_t $1:tcp_socket create_stream_socket_perms;
+ allow $1 init_t:unix_dgram_socket sendto;
+ dontaudit $1 init_t:unix_stream_socket { read ioctl getattr };
+ ')
# daemons started from init will
# inherit fds from init for the console
-@@ -231,6 +288,8 @@ interface(`init_daemon_domain',`
+@@ -231,6 +289,8 @@ interface(`init_daemon_domain',`
ifdef(`distro_rhel4',`
kernel_dontaudit_use_fds($1)
')
@@ -54199,7 +54284,7 @@ index 94fd8dd..2ae760f 100644
')
optional_policy(`
-@@ -283,17 +342,20 @@ interface(`init_daemon_domain',`
+@@ -283,17 +343,20 @@ interface(`init_daemon_domain',`
interface(`init_ranged_daemon_domain',`
gen_require(`
type initrc_t;
@@ -54221,7 +54306,7 @@ index 94fd8dd..2ae760f 100644
')
')
-@@ -336,15 +398,32 @@ interface(`init_ranged_daemon_domain',`
+@@ -336,15 +399,32 @@ interface(`init_ranged_daemon_domain',`
#
interface(`init_system_domain',`
gen_require(`
@@ -54255,7 +54340,7 @@ index 94fd8dd..2ae760f 100644
ifdef(`hide_broken_symptoms',`
# RHEL4 systems seem to have a stray
-@@ -353,6 +432,41 @@ interface(`init_system_domain',`
+@@ -353,6 +433,41 @@ interface(`init_system_domain',`
kernel_dontaudit_use_fds($1)
')
')
@@ -54297,7 +54382,7 @@ index 94fd8dd..2ae760f 100644
')
########################################
-@@ -401,16 +515,19 @@ interface(`init_system_domain',`
+@@ -401,16 +516,19 @@ interface(`init_system_domain',`
interface(`init_ranged_system_domain',`
gen_require(`
type initrc_t;
@@ -54317,7 +54402,7 @@ index 94fd8dd..2ae760f 100644
mls_rangetrans_target($1)
')
')
-@@ -451,6 +568,10 @@ interface(`init_exec',`
+@@ -451,6 +569,10 @@ interface(`init_exec',`
corecmd_search_bin($1)
can_exec($1, init_exec_t)
@@ -54328,7 +54413,7 @@ index 94fd8dd..2ae760f 100644
')
########################################
-@@ -509,6 +630,24 @@ interface(`init_sigchld',`
+@@ -509,6 +631,24 @@ interface(`init_sigchld',`
########################################
##