diff --git a/.gitignore b/.gitignore
index ff3c090..759e0ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -87,3 +87,4 @@
 /container-selinux-1e99f1d.tar.gz
 /container-selinux-e3ebc68.tar.gz
 /container-selinux-a6c9822.tar.gz
+/container-selinux-aa7b807.tar.gz
diff --git a/container-selinux.spec b/container-selinux.spec
index 2256278..7066869 100644
--- a/container-selinux.spec
+++ b/container-selinux.spec
@@ -2,7 +2,7 @@
 
 # container-selinux
 %global git0 https://github.com/projectatomic/container-selinux
-%global commit0 a6c98225aa149b432c0b752c15da760d5559647d
+%global commit0 aa7b8073fc449efad54710b0325a0e5eaf7b3479
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 # container-selinux stuff (prefix with ds_ for version/release etc.)
@@ -26,7 +26,7 @@ Name: container-selinux
 %if 0%{?fedora}
 Epoch: 2
 %endif
-Version: 2.97
+Version: 2.98
 Release: 1.git%{shortcommit0}%{?dist}
 License: GPLv2
 URL: %{git0}
@@ -109,6 +109,9 @@ fi
 %{_datadir}/selinux/*
 
 %changelog
+* Mon Apr 15 2019 Dan Walsh <dwalsh@fedoraproject.org> - 2.98-1
+- Allow iptables to append to container_file_t
+
 * Fri Apr 12 2019 Dan Walsh <dwalsh@fedoraproject.org> - 2.97-1
 - Allow containers to read/write sysctl_kernel_ns_last_pid_t
 - Allow containers to manage fusefs sockets and named pipes
diff --git a/sources b/sources
index c467ad6..291237d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (container-selinux-a6c9822.tar.gz) = 285c481a04ebc0697270d7f3c0f4e02c8f2da305e256fbebd1b8e9f689d27a0adb1129a50181e98036d87e20eb7440844ce30168649f6b19deacd844205a5a4e
+SHA512 (container-selinux-aa7b807.tar.gz) = 65e754254a81985f60fc54502e179c772d48d43a9fef007fbd85842df844e4d3ccaeb679edff332cd22583163e79d21c5bf062b04f960b833fc100c85fb0a169