diff --git a/fapolicyd-selinux-allow-boot-home.patch b/fapolicyd-selinux-allow-boot-home.patch
new file mode 100644
index 0000000..f676d59
--- /dev/null
+++ b/fapolicyd-selinux-allow-boot-home.patch
@@ -0,0 +1,40 @@
+From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Tue, 6 Apr 2021 16:06:48 +0200
+Subject: [PATCH] Allow fapolicyd watch boot and home directories
+
+The fapolicyd service needs watch_mount and watch_with_perm permissions
+for fanotify/inotify/dnotify calls on the following directories:
+- /boot and /boot/efi directories
+- /home directories
+
+Note the /boot/efi directory has the dosfs_t label.
+---
+ fapolicyd.te | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
+index f5d0052..c12f385 100644
+--- a/fapolicyd-selinux-0.4/fapolicyd.te
++++ b/fapolicyd-selinux-0.4/fapolicyd.te
+@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t)
+ 
+ files_mmap_usr_files(fapolicyd_t)
+ files_read_all_files(fapolicyd_t)
++files_watch_mount_boot_dirs(fapolicyd_t)
++files_watch_with_perm_boot_dirs(fapolicyd_t)
+ files_watch_mount_generic_tmp_dirs(fapolicyd_t)
+ files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
++files_watch_mount_home(fapolicyd_t)
++files_watch_with_perm_home(fapolicyd_t)
+ files_watch_mount_root_dirs(fapolicyd_t)
+ files_watch_with_perm_root_dirs(fapolicyd_t)
+ 
+ fs_getattr_xattr_fs(fapolicyd_t)
+ fs_watch_mount_tmpfs_dirs(fapolicyd_t)
+ fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
++fs_watch_mount_dos_dirs(fapolicyd_t)
++fs_watch_with_perm_dos_dirs(fapolicyd_t)
+ 
+ logging_send_syslog_msg(fapolicyd_t)
+ dbus_system_bus_client(fapolicyd_t)
diff --git a/fapolicyd-selinux-watch-perm.patch b/fapolicyd-selinux-watch-perm.patch
new file mode 100644
index 0000000..4128b8e
--- /dev/null
+++ b/fapolicyd-selinux-watch-perm.patch
@@ -0,0 +1,31 @@
+From 6a966a3ee89233a0a055712f39ca564ba91183bf Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Thu, 15 Apr 2021 16:56:08 +0200
+Subject: [PATCH] Allow fapolicyd watch_mount/watch_with_perm all files and
+ directories
+
+For the fanotify_mark() syscall, fapolicyd uses the FAN_MARK_MOUNT flag
+to mark the file's mount point to monitor. As this can be any file or
+directory on the filesystem, the SELinux watch_mount and watch_with_perm
+permissions are allowed for the file_type attribute.
+---
+ fapolicyd.te | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
+index c12f385..582e03f 100644
+--- a/fapolicyd-selinux-0.4/fapolicyd.te
++++ b/fapolicyd-selinux-0.4/fapolicyd.te
+@@ -36,6 +36,12 @@ allow fapolicyd_t self:process { setcap setsched };
+ allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
+ allow fapolicyd_t self:unix_dgram_socket create_socket_perms;
+ 
++gen_require(`
++	attribute file_type;
++')
++allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };
++allow fapolicyd_t file_type:file { watch_mount watch_with_perm };
++
+ manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)
+ logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
+ 
diff --git a/fapolicyd.spec b/fapolicyd.spec
index 3c25d74..844e3b2 100644
--- a/fapolicyd.spec
+++ b/fapolicyd.spec
@@ -5,7 +5,7 @@
 Summary: Application Whitelisting Daemon
 Name: fapolicyd
 Version: 1.0.3
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: GPLv3+
 URL: http://people.redhat.com/sgrubb/fapolicyd
 Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
@@ -31,7 +31,9 @@ Requires(preun): systemd-units
 Requires(postun): systemd-units
 
 Patch1: fapolicyd-uthash-bundle.patch
-Patch2: fapolicyd-revert-watch-selinux.patch
+
+Patch2: fapolicyd-selinux-watch-perm.patch
+Patch3: fapolicyd-selinux-allow-boot-home.patch
 
 %description
 Fapolicyd (File Access Policy Daemon) implements application whitelisting
@@ -77,7 +79,8 @@ Don't use dnf and rpm plugin together.
 %patch1 -p1 -b .uthash
 %endif
 
-%patch2 -p1 -b .selinux
+%patch2 -p1 -b .watch-perm
+%patch3 -p1 -b .home
 
 sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
 sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
@@ -204,6 +207,9 @@ fi
 
 
 %changelog
+* Wed Sep 01 2021 Radovan Sroka <rsroka@redhat.com> - 1.0.3-4
+- selinux: use watch perm correctly
+
 * Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.3-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild