From 3622c018967f8699fbbc299045829fafb9929ad7 Mon Sep 17 00:00:00 2001
From: Lukas Vrabec <lvrabec@redhat.com>
Date: Mon, 17 Jul 2017 14:32:35 +0200
Subject: [PATCH] * Mon Jul 17 2017 Lukas Vrabec <lvrabec@redhat.com> -
 3.13.1-264 - Dontaudit xdm_t to setattr lib_t dirs. BZ(#1458518)

---
 container-selinux.tgz     | Bin 6887 -> 6901 bytes
 policy-rawhide-base.patch |  49 +++++++++++++++++++-------------------
 selinux-policy.spec       |   5 +++-
 3 files changed, 29 insertions(+), 25 deletions(-)

diff --git a/container-selinux.tgz b/container-selinux.tgz
index da42431575cfcf74dd7e02d19401c0ce622a6b32..423a8cbbc3581e46792f029fa15c49461f69ae52 100644
GIT binary patch
delta 6646
zcmV<S842d+HT5-rABzY8b**e!00Zq^ZExf@lFnE6uMlPej2(>au_u`W#@RhAk_GNQ
z91!d-a33yr9krzH)>?0o)P6Z*_P1YE@kJCxQj}Vr@gBxN;;~fqkSvnLVzF3?%AyU^
zBB?LZ?KjW#^A3JKeE1%JU;WDu@6_M$^Zvv8tE+FW-e0|ce}8rT;RmF<dVhWO?wjD<
zb5%(FIW%op2f;VlT^(+c$VxZ%{-5+`_4;-2V{^#!uzvjG-}XsRR!MQ*l!rP>g0QNx
zGz#0aEP_Z3lprZ~@cZJ&OTo4R5Wk;ZY4FF%pC6Lw&?X9cS_JK0eGr#9{NsXHFBRV4
z$11GDJSf6{Jo&>bM)m5CgA#tG7eSb1<$V$dZ5gz6STrd%$^?2zsPOMqTC_>M4Ws1r
zH(8r?eJI*APu5T#;k<eK+v;SO6ze+q{gBo`yE-{(A1kE=lBa!Zc$k0$*6odhE3dW<
zQM@@@txlq{PNF<sH%VAW`}HO*PQSf6Tb+mst*fwqg?i&tdvT^W?b!+oSg<QOveKnH
z?G5WS|E@im)U_wJuGI>t%PcX#{{<dP@Gy#!rWr#;q$sQ|M~4smo-}g0-WRV#f3x1l
zf}!8*bc0>+?X?*LA)aHdf{<S9M8yF=MbvUWI%iuH7DVZsWk*h^za(Ky@~!F;2VVdy
z6^Or+`vD$*rEXN@m!+E^hH6G_S*J-eVemeWAo)0hYWWEAF07HX6C{-%e0yc0`3UU{
zI6nMyT_tti0OK~zl13EFscDceyc)bTQPUj#oPxIK49T~Iy6B6Wy7r3;nv?^!kg79F
z+}1IALg4JRS#?OP&mi+=AJ)lBk~&q$U+#?DL+V+7+O#;fZ9?ZjhDSbKHqM<Dx3dxa
zJABaHf1+8BOL9{sQMyf`gIGtRxsnW29+erh0fGES+Dp%<2ag*l7R@$8<OZStM_7bA
zeIa=nb1bK-J)3Uh@W*I3fiX5=o>fZ@dhkW{o_EhN`N@9s=pD{sc;w$RE{tV+<s}(s
zTsXLY#LVv+#{%{Fr25j#UPWj5N_V=-a!CGJHO)_89pDyu^LLPUgZ_z7=?W;N*By_@
za-X*QAOylg3leVAD4^DNz6V&^kuFr${HjjxupFfPj2)^W^IEL276yED=2BD2Em<8*
zC}^leB&8`uG2V5Qg-v5Airx*&+9bTVcuILX`2SZyS)u&H><_Qn`e17!l4`|nlC;=)
z6>FX%Vm<eE@ERwG%Nwgqf^V<kzxVLp_si}@e);#GU&xct0~LRKxVVd>N$R^rjxZMT
zb6b2&k4>B8QJYQm)#>jJMcR`1yN+VmG2c{(f>>{*NM0vdi5pXpR0`vX-UR$dF!OHR
zmJGZC#d05GO&E^B_oCF~BmN5H$dKNb5iVY#fG=SDPr>~eU6eG9!y*pu>(sQF%#$2e
zt}j2S??FcSEN_!!1Q>rGr!L`vhHn*TF!8wJ(7<48A4xspT<8l`%n(hqadKC+WcT7r
z6cqk8$X5`4jP}gXMHxdamJu@kFxN=u3}LIUB5eFuQnXV<jX%SZ93m%%Nn-C7YAioq
z^IBpr_;-V{{97obzXadu6C^8l4pwC?v{3BJJkiGhUljSGD-M4OElVSkybWH-cNf6-
z>TEVnTt>I^K^ov*4{C%@=b(Y9ui~6XSqj}dABnYXftt*c4Z|p-d6Ly?&~OYGemk(2
zX&Bm2Xow1g>>=tEFNVLX3f$PWRADC0KoFA=4Ba^s<2(a(*Qg`Q)BZO&t-H~`O?MYb
zaknJuzHHiNX+VG4uPumKCrz2%U7!ROfn`0_fFZCcAChI7&oI%bT@bE>{X-T$E{}M<
zAY|B<c`9@O7%nxe+UqdR(}Jx<c<5=HK5VfPNEh-2pdIP@DT_k*H>A;ljSs>A4E=|o
zX~87PX?;oBFK$1x+MvCGwVoYCX58RfBF8M7=zdLRZKOgi`yfAPt+rENnKy(Q=SSgX
z4|>OkGpt|d!29bjKXr9zUh?RxBJUB1v}l*XFJHe5drVudHPn?16xQ-a+rkt0N0U1S
zCVzKnT^9MIP0RCi7uEAvZ;jRQE_&4M-Wl#%z)m;6*cqQQbH>vRAVS`rV3S^hG=e7G
z6=B9EZ1Cx3nnMN(qt(ewC@SVY*>E8!#~0Q)F~-k5k{Uls*#m%e2678)Uh?m}*m?5}
zPQr0+Wt@zA=Y*dP)xyBZCLI3js?5^pk$*<Ga0+rSU<fmy6~P8)%KH(g;hUwMz3cGM
z?s=f+z~f6VUsyma)pttRIx+OLh0^3B!_gI_!Q<m%bj%%fY^d@x>2)Cm@9sD%I$1$D
z_MFvVY%@8(T$_hlKi%ve&VnjCfQt1thP;em9n<&S^a*3=P5q#X9E_XtP{a*Q7=JuX
zT}GF&17Qh&L|A`U#aU+%Y72){uzVeFcETzc7LNvazGg64fXN99TK!m+&|GGzrp>bV
zVivx-(p7ivwF;N%$LQE0URM(94W(Ml>DG_o?!d%j8OA>3G=|42)zMx%kc{z@T3!5*
zjNybGlKxsExuIl~j}ZyqI;u1bg?~`2#(|eqk7clky&nsp30=N))T)1iZ8KWUyy`)l
z!YUrSN*%5pHh+!_#k}=)?ahzBjbXn^1f?l1i!Z%KW7~c15|P_r<n|EJED}%F(2CX2
zIWlu1Y)dq9Her)S{RLFW*KfJ3>SUWf807g2y`W;S*E%%2JYnEhcm|=0lYjB8#Veyc
zyIX@gpSo6pvhEuml0=jNM5jn}CLf_^7}Z}+ySjB7*1Mz?G<nvnL2vB1Gg^BYH8}Rs
zF$0Cg;xR5!JV<0+^FF~>v^sq0i`4(5Ke9(J+T^*)aNqy`@ZsGL?+5q)-+#UT|5<*R
zr)8a&F(|fEIU3#u*B94U7k}^0R+_$GVV=yp64YhcmbX()<<;xp=LB$SN-O|t&Wco7
zoHP*+v8i})O@bjRP@Uj@pMV~$)o_xK%wypvCU0(*1%LbLm!K-^R>t5|Tu(A|Y)pG7
z!j0NixitfG{cW%fvnDyys>Ex=ta^TosCxRL^qdEN@9OeU1*hCCb$`aSv_~ztQN{qe
zdf0X{(A+e{g@&vO(1A|FyH72Qaf--`!z2gw%#`-2p(NJ@XRhj-!{+a6Fx;X&s`O6j
zo8Tl9s&h{c>CiA$&t5y%+O|>+33U<Uc7tiL;ncdQ*(SU%V)ks%E2`6QNbl7zPPg2d
z(k{h8(T@{3?Y$k2F@NdK?pIL>bK-X;P+Vp&xG_Yj4=2Kw!~rsy3-l2AVDERT^AB-_
z>%NcNoiwm|^1rF+Mz_E5XrqrQjyo7)CW4esbuJUypo08}M31~V)tDT!Kd%NF03XSo
zfj>0F9;*`>4@?Kx>>yd9!=HBiZDSi%G~kA#$~;QV=OY@b?tdKXgAZMG)-rU`VNuF4
zM!%HaL76y@kPlCd2t#-gquIyqLOfZxX8U+LWEq0-h>bp$j6!5W$V=!la<7~Y7!87k
zRdpa<dUmryKXj3_^!KUGf@^8Ijg#%^Zwak=YcTI|EApC0gyRAbAF~X>UhiFS9^kHl
zNq?X2_OSBO27kO?a>n-kixrI97`4pFmQZKWfc^-xfZ1d4iuuS)3xAVj+mBILg_|@>
z+sEK3i1y`u5!|L=0Bzx4c*C+u+B6RG+oFsE>>4`2qknDELdM_IgE|D8CTX_-i3{Eu
zgRdz4)2ExUT7VTJ4(#hB1N%6`1N#vsu}A&~6dE0B7=JqLI8Wc;9HHLE7?w0nhE7JB
z1tl5;qtyIt5o4#7gGP3E>CLQM8};PPn;jjO!f#Iw45DWN*lHmC7}LIE+WRs=oqiWw
z_-{`(Q@{r=T7Bq=)<)F=D2I4}GKIaHkk`S6Y=P#`R7nxLICWjAHU(WoG+DjIF;hYT
zOp`K7p?~roGm08_M2nAL1(lO7(PyB(vb4Be-|`EJhvW{!1CFSfK!lEn({QIjiMO*L
zUA2-+C=LM9(6C8N>NHw|0ymmjXOaa6?nD-l|5O$lnJ}E|B)VfkUAWC2uh|?Ps+uRg
z6xalMx#4%Sth6nb=9M?|aQ(i?^lSYimIX5lhZ0ZD1fskcu>hoxM&bcGn9S&jlWGi2
zf2(;-W;=9K+}xbz+R-#0fmd4v+7q^wqV$7L@~+Li#_kLc<~G%dHF;{;@XS|{{J<2!
z$zbnKewvODK8h*KvK+v=)dHqj@qJ=j=zf6PNHvY&x4iE9b+_}sH)U}FFJHMD@MLt^
z4SfKghS3zSgFnSFiz&>*+oTupvrnSif8f5XZ!duC-^wc49<uBa9qu53yu2fCd=cCy
z!9IjP!eEo20D`8>4(P!JuK(l&$P<@zgt;xT9niUNS%k}ddB|d3IR2f(@(kt@><1G7
zaE9k__bK}Ygg2fHoxekPKsu3-DPVMnXeI=P+i7ep?-%+PY<9$q>DzPHSzpYXJI)ia
zCr@u*{JyW!YqD$5mPvo4z(=m394&NT{9^>~-v;iOc+Nt^t@GzBW3s_Lr3{}{L}Mbu
zSy?`Alkg2cfBP)h-5uQLguh-M-*j*Md5Tc(d_P|Scujltx})hz>gDQK&gL3RO*d!a
zdty#jdY-tG6`v>WbZ3+&@MJAGhU=pVd#Sr8ZURjiBmAqppaDCU>um1m^}?KLM0x_x
z8)hEBvxb=qw;xyFJq$RcX&A`1(}3_9#=|U6+St99e|m;rq=oT~F;e>DPdwUyA64{&
z4vcN-A`yrYqv>&L++sw%SwG)`(36Zud$TYr3i>vatJFo(qI<%ZoNk&vHc^{dsv?N*
z5!s6r#MVUnB=##D&$}%`=pv=p6b~OpZF&duDYlf)>0^9%h$)>OFND2mTtX4Cdg(6O
zXFV<_fBn?T&8X6j55v(a>CvcNfS(BKd*hrdjB55#zF_C!1)W0(9ZVZ@^vGGCs@W%5
z=0WG@SUTd=uy>v(*wXC`rkQ1F!9oik?d{vP@+?BIL}i{=S@N)^F*(lLJKgk^ppnV%
zjCb})>Wri0v6E4@+|g9$>W)Q_Tj&+?s0+q)e-d{(uBRRFy4qx}(ZcvirXMlC;TziK
zvC`N>gO}2BJpT8AWZ53Pns+G352N|5ZQX?~Bqn`|E_b$(Q!>BLNaa0*(e!)5QR@A=
zELd__o+`%NmZmLhG~qCYfz<Z{2JxlMt%aVB?r{+-n&v)jqrI7qr$^9-4{S{1^4<c?
ze>2*O`)Xz?BEt6vON%%`S-JUb>WJQpZ6rT2r92TB3FGMKRhKFRCp@(}Z*~^y9x>QR
zcya~Qw#|3iM9MUv(8lzCLwkUK$Ix{FyG6LB1F3bC*xGMm6?W|wo&Z7!7!K8;)s~pN
zDEIeq*oKaIM7Fn>boL6o4u;f@o^$L4e;BV!f~<I-S4>~X&jwm1S8`}mZo9_GHaui4
z^RqnIM51!A;b((>Y;cK*x&LO(a{O5)4JRg3DBU`74M}5~X5U@tHFCW%GuBmZb#9)q
z*Gx1U2ZbHLQtB2af0;ESePdxxD`p|i<HoPO-Z8c472ZVg%`jfGhlpK;#oJr{f1%3%
zc%lenW-EBa7pp;)z?+BB8r`RL8YlDzi)!}5p;(%tnNx*ph1XsM->~PW0M-_YwU)nd
z#Nh90m&SqETn<uR`NkQ73Xt)I0o&CMgBHD`79X~?9;16y6eL&B#{*IfalEU$5aK6O
zY-NBe7IW844@!P=1g8d(NKrS^e>oOEV|S1?jdges=X)fhUeMxJdvD1c_i5~ygXAu)
zKrI*Ba>N1h`ypxCHQ99f1ych(Z_hf1Spvq4+XW+t-3}H5v5$X;K5yrR{9GO;AZ5eR
zgI4WBGRB3Mig-O)d&bsivxk-zvbby(H>2G&8t}2KlBkejNG1CugURSJf4^6&IJr~z
zAQn%QLIi@t!*-jS3n;1EVX?K$7D;mOpvmrN&28(_Q8oM|0@lh&k(FiT1?5*HRt`*x
z+UWuiGE18@rf96uEjr(-9KkTULmzPX?7;_2@=R_LmppMB^EWV_@dCK+LTVqn0{){o
zy438oH{tf%YwK^$Gq#Uclco|N0SA-E5*;V#cG;xGK0%EfD<MiFEt0id-VHS(&wIbJ
zSKT3&bXHq;l9IG)^9Pd)6D5DpzFnt#%*=B|14dq7wz&d2mbzWbzr?4WoILU7fYwKd
z=Hf23Et>LvgwI}8(z3DPd6z<PNy`o&I1jNp4%Ts9K@M3NnM5e;R35v!Q<5tvQ<X7N
zZk5nxT&{SA66q|sOQBQAkGf@-s5?~(PaJj72ptX7C|Q_~(;KXDxb=U;iCn@8+r&Ci
z7BD9ft>9zL>5O@*o5PfU;}Uoi=9^Fxd6asKl1RO}hbX5>omj@jPU0G?vsDN@;|>X9
z3;)~7&t!EKVb2}yG?F`NW2AStRIt$SVH{3EG15FpNr2;(HoN%{Lm}65TQ)r*vqSDP
zjcJg^($2)(8K(D!;8TBgHH96&-DqX@gQ`q`O70&z!EcrCN9iq)4q>0>8j>*D*|tqD
zB7^lQGezu7xW($Y#9Gcad1fw)3pcFjc!N5~c?c^gMaYeN9ki6Tt2$E#{%v(ISlDTq
z=ixrI;?wuIEcIn+kc462B4QRtckG3hie*`ICYkrMLQM2Ih&F#MZ0<9bNYPaCHm#F;
zm@)BaL*H11ire{F-v5K#=i3f6Y>Y*OM=}MTyjt_7oULA~gxwXbNk!3A7(HELWR9a7
zHlsYOMiZr&ieqKVDeGF8iCV-r`qB%Nug5@x(8Beal80sw5eMi#9kA|c7qib;<UNzQ
znn$#`WR<Z|yqSMOttr*E4HaSly%OS46sO1hGASjAwP-ZEN8eCkL%JGvHhR({?ymQ_
zN62Bb2Kk;ktAV63l9|79^F-e|9X(qx8Ae@cQJ20@m_;*^9jI*mNTbkU3F?LU#wbnB
zlZ1JSjTw?CC*Lu5VO@#-24Ar-&Xz$jGWqaSekC%TBRGFXIDI;)J5{uv8yfN>n<u?r
ziF}+I0_0(|s^P{sa<wI#7hycJw=b!j%f3o0sh({%2a$J%hs0D~f`CvxDsO#PzjaZP
z8P}n*$L!lhy|7j{a;I7P`iu1D*_bL9U+U_Vw@t5!dg@Bj5w|`oowl0bjC~(uB+D63
zr8y(vmdbxQF};*D!!2-10E0}WcB5v8vDy{l^Bg1hImW*+;(9lFwPPW8=VgqA%5dGw
zIJOA)6%8Ns@oO5EkG+hj{bRrWLhkx0cZH@2&hI9G9P8R$4TIxLlDc9uC6N+vC(_3l
z!Tf>_CHZ(fnk1d6@LFBly$*h2`3|#3mh~cKAJ~6^MH|d%RK^$hA;Q35yUHZ~UH#5@
z-V2tJQ!SP~VT%LWo@AZf=$9w71fML8J^>oiCim_c@w*mYcarAZxNz++76Tg15jkvx
zxc6aNFnCe=g257Tn%5XJ%XQGt9~j*9r&L=1ZkSTSN!0WBlb>HZx{`z=wnpz6O%#2j
z-|Bxc#Ky2-eso-v>|j*O8O^+QJOWlGFXU&lJ(sAUG!9}O_R6mRNT-G#G2sYoaKv@E
z;yE<+WW5T}8g3=A2K7UBhglpAS$~BjMqTCT<Lf>hs+T`BZY2GUi&_LjD%7S+SEi^(
zZeo+aw}FlRE%W>)xhXntSYoWiUf%ElEQ5cPMKe-e@P?^v@<g?2>{X5K-@zPf$0NDg
zeq@*-l&$r<%*dyW>(U0DRQuilYyIy9wf=b`+X?w0+X=UsOtl@Mb6yr}{qsMXrs~WL
zvB#yS9i~{GQm8Q)cv86S{5-KU^1~jR7k0UPuuFwM57n2*)2*s8k*}L_cY~?G1HgX|
z>{o^H;r5)}c!aaZl-NAaw-O*J6M8GjIbAs>dOHAdlr~&)JhDo7A`Qi*)2IvL6AN|@
z_~9D0%6RXiiS3(lyW7R%_{VZQ-4XPn%Jjo}V^o@UkZx7-&u}d6dmKLD7<}~j+vC{V
z@3`AnBz&H_j31xW%wxP$GDVMJP0)W^Z{7yKb)WlI<Em}9`F!O@%p|q(8-m`Lu+oA$
zYCJ8`!6lt>o{<Ye9tQ1{LjA4;d5MN}x2If))~hj`^35=30_~XOtueM|Qf%b@H#j@G
zuV2{vfB7SO{$l%V-?npq|L^ME_t!rRzW?{`>-YaY%g-g+kC(q*urK=1*Fk@ANF)y}
z|AgK8@R2V{^~X+4@D%3FJJ2teho-*F(haWJmkj6f;=7acb8j@UG3Q^^K~xhc`?U--
zSkxWfQh?b*bdGRKwjD4p7px+@i<YS%qDiX%`k%}H{*Ij-EZaNh=<{yc#cIq^`FDqw
zhAqmwGCSnS`E*ezAMxv;8xntVot8_Ds^`EfqcmO$uTcS)nMHl=v3M6LB`h}yI%vK%
z<-g~tEakIv96f1;QauIba`vw$-dK_NCIbne!{PJvcsLxLN1?1P??NU!jLu?6zCd04
z4b?{g^+dG@7C>FHTK|fPTD?I<fRPDOQZ<Nv@!hZZ1p$8{vTqTL1B-v$ul~sXm8P_>
z%K&5K(bRF|!sBUsCk_G+#Oos<JIqdw%M4ScU&6M`)2TDb*l-1uXK`9mtakKcL@eQP
zRa!>2h;+$a0Lj$;GI#$`O4zBXIOa1bEP-s+TSu!cGyJ03%U;AXN=)D{tjh%K;wnu8
zK3=ndX*APL=|Y=iJrPz+63m&(20T`|UoWaOo@A1Zz@e)b@S0`t&iO5yWkkqVFJ|X9
zQ$YujXNn#JV8v#epaJO9St`(O9*)o?U)m}2_2=u)*PpLHpW)~K00c+^tN_RW0B^t!
AWdHyG

delta 6618
zcmV<0871cRHRm;dABzY8{Pkp600Zq^>yO+vlF!%aze2DBcqZ`7c*c1Ep6nhL$pUvD
z4hVJ^xDS`Rj#^T8E2CE=^*qk-{_R&)e2Ah*ic+g>FW?TGnQ2x1NEXRru~;lcWzmLd
zk<?e|_Nx<p-oWSk@4v;LH$Qy$M*Rt&x8J|Lx%ukmE&O+X^TX{AKLFj$+uNJluYxzH
zs*w6QG;LT1!B^Qs9d44yN;mfWU-Ywj`7-#iIpld*KmYk3`y?o<q_}L#LmeeSSXEgX
zg>70EK_muBkQ6)kdG+J9U|Ru*-=|j^{BiczrzASGiGrRMLAzJKh|3&)xgyqUg*W)I
z3hOWriZD-q{`7)Tz4-H>grDg_5N28Vn8ZO_25lV{O^S^&fnF0T{Ju(yHmSE^l$`%2
zYqPEoMVscy8p<P_SFe9to$ZohT_=AW(i&)2XJ_qmrL;iuw66_cCLn=zd*|TFt8GIR
zuP#=rv#6|-D38}o64udvy-ADnuWv3^XQD#uDr}*D-uSJ(IMb8%Vub}P*p(bv>C&C{
zg!P(#*Pc!4+A~|%Y6a9~mKfmw2473?Fp83<8AC;+D6FnWhY$RmG;+G$7mq}Lv);#o
zq2KFtgI)0Ttr-I$PBB+ONT2OQ#Q{G>)N(#LXIm5&MCqJmM^31}C1FhRt?Cj7UjQo=
zh`-#E{Q(_+r*2f_m!+E^hH6G_S*J-eVep<tkbIm$wR{Bm5Y|ZA36jbWzP>Thyn}WI
z93OsNS4o{Wz_?Abq!9&kY8vDVuLhr+sA-OVOhH?8hU8m9UG&9GUHi!eP09gVNY$Ao
zZtEC5BXIWEtU4stN052559{P}k~&q$U+#?DL+V+7+O#;fZ9?ZjhOd0OY@9nQ?q?(T
zcle;Y|3b4Km*l2OqI8==2eFPsb0rz5JSsD00|NPvw3kk(2ag*l7R@$8<OZStXIO+g
zeIfZg=2%WuJDG0d@W*I3fiX5=PO2pbJ@{Gmo_EhN`N@9s=pD{s_{zU$To}vt%I9R9
zapB;95;MPR91GOPlj`SY_9{BdSGv<xmP7I<)ighWb%0ys&F>)Z2K^JE(iKojuRETR
z<uPsdK?sD079`xJQ9!Nld=Id+BVDMh`Bj}hU^z(n5j#{v=CxR3Ee!bR%%!H3Te3Qs
zP|#3`NJ>+RV!Z1p3!BDL6g?Z3wMlq!@s#p9@c%D@vO@WX*`Hpt^}*IeB-M)DBx$kp
zD%Lzj#Cq=S;5AMVmp4|K1Yh66zqj!3+hzA6zx>C~pUIQa0~LS#a&Z?&lhhB39APZv
z=eGEmo|`twqc)rBtJ9wyinJy1cOAvBW4@^n1+m^rk-Sc_5;vwGsT9T&Jqh?nF!OHR
zmJGZC#qt<qO&E^B_oCF~9sUU9$dKNb5iVY#fG=SDPr>~WU6eG9!y*nI>(sQF%#$2e
zu1`OyA3;X>EN_!#1Q>sxr!L`vhHn*TF!8wJ(7<48pGiI9T<8l`%n(hqaq>{LWcT7j
z6cqk6$X5`)i}uXWMHxdamJu?3m}{hShOpIF5jOso6zvpI<7ZfsL*&FTN$lN1jpfH{
zUQ6r+|87v0e+z~5m*6vff@I~+!K$o<7K(kDC;AxRiy~ii#X*0eWobl`*TD<<><ai^
zT+GIa%jkYSNCVvKL5=X+IcQ+&t2mcYmO}T=M`CSTpeD0q!!XKdo@BKeG#mql-wy0$
z8iqC$8lnOrdy0C+i{bC80ylOoRhWr05X58zLwC-^xXeJ^HR{OnwEqoG>u&UK)7@24
zJS>U2FPpYm8jyeXYYSr5NmFJIS15r+U|CN!U<ho=r(~JtGfXsU7lbQe|B!{x%Ol<{
z2pP6zo(dfRhD!~r_BxF7v|wuy9(vlQ4_mAR(v^GwXh*t!%Ayed4QX^><AX2&L;opg
zS};j+T3?d(liSa%HfV2Pt!GD(88^6=$T7<%x?hu78)-tzKFAMRtL@ZB<_)37`A&G*
zgWmDs4C~i9@c#bGPhB0F&w2D!k@pBhTC~gHhp%6TeN9`gHPn?16xQ-a+rkt0JCi&H
zCVvlUT^9MIP0MMzi|To-x5nyt7d`5B?+kY>V5gfO?2O+tbH>vRAVS{W!zR53X#`EW
zE5eLT*x<w6G=~fnMyr#VP*lu)vf)BdjxVfpVvL`ABsG4NvIhX`4CEHpyyV|`vGe8|
zoP^`t$~YPK&Ivyos)d1*O*s75RhgyHGk=Y6;S}Uvzz}9YD}oI!l;<N(!&gf?d)MKi
z-Sa@tfyb8~er5r&RNpCK>%`F07D|(k3`bXx245c+qhs!<V?&isq}PQMyu0J5=wt=q
z*mG8cvCZWC`Pw|x`srr(a28bA0aUEFG2~?g>zKaJrcW3{Z|VnC<Y3&Chazrh!hhgt
z>N2{F9SBSKBf|Q-D$Y8CP+K^pg5~RYvlCXquy{7W^EHFX0!&U=(CX)^gyu3!HEou?
z7qjrym9DyTuT{8AKSsw6@w$>&Zz$DbPPcvxcLyfEmSOBePGfkiQXTEF1IZXasnx{~
z$rw)9A?c4Lk{e1!`52M#siR86P=5%;Y8-e;^;iar*!!^nn$YD#N3HrN*fyip%&Q)>
zDXijaSE<9b!{*O%p_sScuD$v3w=wKjiJ&yaW$~%kXl%RBT_SQDjNBd~nnmKt8d|X$
zI!9(sgl&mN&L(WqsK0;;`T8xFRh?|pCxbkHp$Ak9_F9K#mnRJT3eO-^aep$twRmKd
zXLoB*=Tp~8P}Y6JLz0Lxfan~FF639}8AkP&)2?pahV?FK1x=ncYtS1z?u^zRMh%XA
zbj(0uvG^L7C>|uTu6du}BU&9k^+oD`(U0uWt2Q}R8SeZ4-+%YRci#@~|9^Y)<^KQ2
z_%Kh)Ixk~TZ0B+`ybf-!Zhzlgy}4Lv`htadGVe-Imt|YtPc@ZSFN2>Gz^N&*0IWGH
zQe|<{L_EZ%;=wfuhNwVwg2#OVdazc*NkTG@g`b$bxmgzc<ELMOs;pZXgHv%m$<VPe
z?V$)aYFp*j49xY{!8XjA<U*?wuMxBA`7xsE>4(yD9{9bh%R?2MbAPwg1=rFZwcth>
z1L*2u+sQz4(-0RLvMN9aIt}kWwJ^phA}<b;9Mm&Y+UJInTo;_Vs&5XP-`8NcMSE1~
zozgeKNhVb1o*dGlVXB_JcCNK;r5Y0IBF60o(_+J^by2fTcwfZqyFst0PQxL+SHC#j
zau-Uw6bD5=PUO7zbbmO;q&vG`MJ3FM-<3ddnZ4k~5T!nx2wM^d$Yd_im&gZuzjK{`
zh$~$8edO+>fz^}$O-(nt{f$Q(eN1uO!4NYMq;#%xna~Cm<VPfW<juLp<e2?=HP8U~
zmFyY#LqqJbI+5|fbb!qck|jF)X~*9-woyd`ZaAvUqttvpqJN?4&apoD&{bzGLnj>;
zr5t1QOX(eyiSr2g<+%}I2rptZ``BHGCkxkXpU;OZLogn((Z`Zeh)f8130+3+mGc3k
zLC~<O4#Z2}-L23MT_i32eXg_MTAFU-WPAQwLTla{%zNC5yyOw#xB$e*EJLu@dlOs+
zxNBh2->17htbe?;0q>Wbv3>ty1>-hGEpxIZ)LAs3Kf)|v_82^3J~Gq7-z3@gT@+T~
zCe70JId~sL`|_~}?o%*;w(uL?uxyexjf4EYDB}RTh7R!Pw@q5e_<Q=I4#B2L+AToh
zg15%tD@y<L;cl!JV8w_7`#Q<MKF;vKeuPQvk^c#WMt_GIhE6-q(>FLrsJAhOC5@Az
zlaXdYi3Y(aH9uR#*lFdUksV%oGb`6dJ$dtHN5`e`(~|>(=ve@^8c09JwC|YqzD!W3
zKLi*4?#X5f_~1pWUwWdoQMCZdAs(PiVecm7ZLlF*pgA;EQp7G!U0142K^GBCR<Ci)
zlu!WEq<@T3sJzFFqQ)K3;v-l=<)lmW8K|!;E$-L%{DR^kdBE_1BWflPp(Eln+-Xqa
z=`2WBt>hAl1AsI%Y!Z_?jn<&Rjb_$`WWj+ukp<*Gm4!wo4CgwD9#~KpZnMX0Hiw6*
z=1DIFHi2Gl_}wfkZHuLO<;^@?zi%@ATK|Y;!4=HH;WrloQC^H#0MbVz@qisnX7rwu
zXbeq%i+N3EJ9Jar+??jx(KH`{S6c<zdu%I3=?5R=U7LB0-5I`^+f*mk<f&!DGhapW
z15*SigS|iaX*xo9C#EpVascaA3z%lb_knGp`vGnv)ij3R^1AES-7bG`%Hj$hzHl|*
zz0qYi^Z|SrMpL{D{u0M5rZ5lhlU~5jK8fysgU7PIzXGy<FRNsG$g*d2xPt`p@`1eZ
zMevve`w;#JgH3`02%0iGpa&PY{)-bJPh8Rw=C;IkK<B<@5iXDAA&Yt8_;(J=Gnh-T
zA4~wi8J@%4r|bt1-gz=~{tn>*=|n=NfYBkMnGhImr?IiTU+7=3*%33QZ_iz4eK2o3
zI#0x&JiUGK`@TxA$*w_LCjF5DAGwBdw9tL=j}g3o8@OZQl!b^}=cg=VvcWy244+j*
zV<N*@Sw8NQ?hQYGdlKyK4(=)8Z<oh6-5Wnm5z3wK(-nZ%v{x@Xny#c?u8!qwuCdf~
zb0)qg=47Ski91>GdE!oYMtK5H)`DZWKANzXx_ja#(3CO4zsd_5uw%K-=8j%3%&A7C
zC-A&s<^eown7MHKaRuJPfJ2&wfowYs2%lj*%<`m--AAc^XZS^07~dEprGNc_M;q{?
zihj_6u`OLB0x@DVJ#LL#jHoy3=X(%(lJRJ77G_03-)3@^x=31dPxzA4P1ENlYBNh!
z1o0yxdy#_JnrNTIeud+Cw?znDr1YBN;lrp+A7DPkmhw4$jL!}+rPJeuuqTa6C?Zxb
z-9`JX$K|AdpIW&YRod}kI9eq=8np}X6JdR?oO6Xy%|6N(>^!`na|oe>X=9Eax#&|h
z`y|Ue==>Z@N1Ph=&hrFYx}Cu^vn(xGXyK#1ecM)^MF^It%=0Qsp4K!b$9a3Fo4yh>
zGWnhH&OS+<ag;oEGRl@an(AELu?TVty+R&!!I(~e;!el)v;$sOo6I#@7(dDMBjz`J
zL)$!78hdE)Qd*A3|2~i`+k;p04h8vPG{3d2yU>Niq)*Z1&NgyN=Jy$?yoWHFeor_`
zeO#9XOAgCZ#hBaDv}KJZ9L6w^`hLP7zO=cw(9_X9E@DN~Jf>~5H`DR-2>S4WjcHsy
zTA+D<Mq6=T%}hl^`21jL5ho}sH@{6C(Q~nl<R_+-Cjuj3938#tQib4zr&j09&O+TI
z1{(=au7KLM`A(ZinFbWvnEqdA5Ag38x-MY12-kEVwT=>7`%SFEuHC{nfDi(PLv?7i
zB_=P*{bL-qp<^DA?JXvqy#g<TA+@9D9D4zO#w(K`E8gc7(--o!ftJaY9NLuIu5q#r
z4_V9nEKfF(s2ptg*`S{rTw-GGzge>!f0jwZiOCd7w@zF`(wL^%cNcn%T(8WGb(LG4
zn-}ac6V1j!VF$33x`oMKX3a?7SeVm_S%~wv@oldUOf7naH&J{ujMwZbVpn1D_LhG-
zsPaGGQ-m?I6+GgL)u2k?&BJJo?$bJr6Z(TiHGAPuEKSkOslu(oYp;TD*z@}U))tDj
zmOpUB;Lnp`5gLD=wzVFkdsGx8SJ1};QVemttGf{5_omp&09P#LuA3f|{N53q8bl&R
z-ALzH{EXc}+BDYTL7eZAjCw(fTkX9ibKIw~V-Avsv;wtUY|9Y`$RCHKY1d@a=@(25
z^t?Um9A*g^Gj11*Aa*-g48%VE9eTZ;7xJk*OhC$pqX&Pj+J|I}3ojM%db0M6t<h!=
zEiGhm*(`2GyJ<AwV_79pA;XYL_DKel(Pe(GR&ny6?m;Y`D1`_FhllMpHy2P+x5Hv<
znJtp!;6al;(3;!UrK4*2N(8KxlOik2$_vV`NUR)~6t&X@AY_&{X-v^rqg!;oRXKuT
zbca6R@YxxI518bc+$1h};x^`QU_9dmaNUK}K6C~AladlLMJKlL^dlxG%OZXlTC(;B
zn2y=T0qN<BA+)q8+jRTvcG;xGK0%EfD<MiFEt0id-VHS(&qu$qSKT3&bXHq;l9IG)
z^Cy!D6D5D8eY;Ngn3?B_28_JEY;y&4EOon<e~DK;IeFsE0j-Y^&Ba}6TQueU2%o*G
zq-A5n^Dc$pl9nBQ;XK6ZI9SJZ1vzA8WD=pUQ+e#_PD!qyOjX86xm7}&ak=6dN~E*k
zA%#vQKkAlUqV7~FeB-EtM(AjuM#;i_oZeuK!>xZO&g2qS*e2GQvVb{>Xayf@PG`(h
z-5jR;E0@5VFyDll$fML-ltk*)Jw!Q8>clcGb`sZEovlLP8Fxq+Tln8rz9y@y2>agA
zP9wRaHb#1PO9cxJAI9M%6eG=plms|lX|tOTF%)t=w`J24GCSnH(3l2kEPa^zQBfui
zC3$}j9l^KC3!ro~>CyEm+K@%j&bDoOAr-7sm@Q#v!aY*QB^G10OEYs>e6V3f=MyAh
z=P9b76fraIh0IdguIg+N_}%Iuu&~oQ&Es`w$)*=-S?bI37>SkLMZ`>o?%WDZ4a>UZ
z%o6WsMwsYx5N%r6{9h~+qN(I<S|^WSC&YiF4Si)5D(=T;x$h5hqi#EqurU@9o~aag
zbZSj}a<O`;5_Wg2CKW|fVf1*2kvYy@*o^Wp`%IK#Dvp&cr>tvbC2A3%=u0nbwjKiw
zLJQYR%Kn)>MI4~Z{lD&M7qin>BrcQ5mQ5PT<Z_n5O}v>xttr*E4HaSly%OSC5~qL1
z1TiUPd9`RXyG!0sVMD$dcDQ-gBku0!xkt!hvj+K|JF9`DF_M{IQ}do)Ryuk(V6tqw
z(xNW^ps;IZWGhhF`k_Lh!<5qt^9?eZoahJ>4I5J&QBu8QF0;Ba^$lJ_VVo_4Vr2H<
zsr*W4H%D-caC-MqcPwZ<_%kFpHcx+gzY_U4HAJ|>XjS8dapY=CI4{C@=x$$9IhTEv
zR&q7lYz`vt3=fH^JOlxudQ_hJu72yHBr~o<WnZ(G5B1_w-N>D0>FY1jn-^oMT)b+l
zQ{FbcChDmxNk`!MtbEvNhBEeokC8NGJQwDSj9Dt@#Qadw47b235ePCD+MR!z-o<KH
zi1%xZT*w%INr>y&=-rHk;GMTA7AnJavEtYw+;=Q|(8uptSl-q$qV|t{eGB>9r(E`#
zCOE%PemT~)%N7RDl_YfqS4tu!Vov0LF@pI;4NCIyfHFxsQ{lC`wtE@;#1a-}&n#_4
z%HEIzi#C|ksEn`hO@e{Jc9nlw_`CXD@Wd4?r>0sg`-UwJXnT@%cBkKd&@yzgJop4?
z$a~zoD8w&IcwH)*b7jJ{zgP@tG|A(z5#r*8X~Ez{=?ezSq-kDb%q+J-KLKEH*Pl{p
z{fA*n2`5p{WlxTJ?d(Ysj@TN#?`Wdv8~s)f0yf6=^0VKfWG9<i(r16>wc{bIGW#Gu
zT<!TZ1*LHi^SD)Ze@8ks^pFQfWP&3w!xfOBsVD1QhSqSch&8Amb307KXh_>DBr)pi
zMjv1I?oYk^p>ZSW?_AU(no*%P-I_9mEpii^a_=;-(Z6Ro;F8=FUN<Z;R)Qz*_yCqs
z#-bUiE_lP#HhH32HF$rjM)&Vvj<w^VSZzPF%Mgp!`rSt4)5dk{f{vPfuW+^g7kgU&
zM33!+1dr{6>qw^Bj?g)8d$s-v98FVoW{TJ2^2-i$Bu^>S7|lB=UUq(>*BJ?3k4@~l
zTte5S;+Kc&OC;J>)tE@QP06>xRNxWZ2lk`F0B?KJZ9Kx+V@`i-o~T=iaFiLjmF$|X
zBoVzGfH+DUE;$})Av}?W;?il<1@S$LRu1^#8nw!JaifXtn{m6_#pC$La=zRV^uogQ
z({^K6nRXIxRq`h|*Y-Wno^XymdVcM3ZtZto?JE*KPhG~3Pj2Ng-YKb`$FL^otyiyu
z-@5m8tAWwB>v(^@awBGv+V~YeZ%kNeK^--omgwM?%{b4<4IdAKc1odscY3@;L%Q2j
zE=23q7*6?WnDl^lO!C?n+cPOPa{nco9i90Vd6MyJd$M<%x!?bG^XA*z?*{LGdvp8c
z{cj)RbB*T5^{-d#jV|<dNE{N$Q_Ejrwm!V$I<0=!jWU0p!n%0_!}I#k)Yn<ML6v{a
zaIUYuIlH{{Micuw{#F%4HG#4p%Rqxc*5NG$m_0?82)AV00rPsnD#Ej9nF=DBr26mw
zz5btXnB#fb-nm4VY11xNV~)z-JF_%wQ9hK}Ax|!+i$ZycTL;~ckn6NuYE+#9uZ+@o
zDZEAnTxNe3^|i<1U8Iz-+$89r`Ob#_oTsvs*N$=Yq!mi_9F)t&znytwMIt9Z382H_
z^YnN)9Gyp@tgatICOZu7VMx9}UHAsoM*#IiwFnkKU9(#MiitYCK}CFu2~tuuh<^3W
zub4sJUx+Lh{W!45{ppYFUujDFxePD{u1p<AE<Aspwsqnl@Ibsh0<y#G<haZ*Rr)1t
z%RHSrlZ*{lKzSCQCB<q-KSsn79#^GhWQ$1Gd<U6K?JslpAEktynu=qdKw$}Fv)(#d
zZJFU0)n4`@mQi8?e_>rFU>8?u8u0O&4NRk%c1jl+BkPG^l3>nMHsG<!{d!fU@g$RM
z1P(?$g@D&AgLla<X)Gf`zIrh`x0wn$2wYP17yv6a+XM|juTD~dcJpwACi&D(nJ=F&
YpD&*;pD&*;pA&!nA59n1q5#MM04f*u761SM

diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 4b194df5..daa96903 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -30397,7 +30397,7 @@ index 6bf0ecc..e6be63a 100644
 +')
 +
 diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 8b40377..950a3dd 100644
+index 8b40377..e3436b4 100644
 --- a/policy/modules/services/xserver.te
 +++ b/policy/modules/services/xserver.te
 @@ -26,28 +26,66 @@ gen_require(`
@@ -30998,7 +30998,7 @@ index 8b40377..950a3dd 100644
  
  storage_dontaudit_read_fixed_disk(xdm_t)
  storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,28 +650,47 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
+@@ -442,28 +650,48 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
  storage_dontaudit_raw_write_removable_device(xdm_t)
  storage_dontaudit_setattr_removable_dev(xdm_t)
  storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -31031,6 +31031,7 @@ index 8b40377..950a3dd 100644
  libs_exec_lib_files(xdm_t)
 +libs_exec_ldconfig(xdm_t)
 +libs_dontaudit_setattr_lib_files(xdm_t)
++libs_dontaudit_setattr_lib_dirs(xdm_t)
  
  logging_read_generic_logs(xdm_t)
  
@@ -31050,7 +31051,7 @@ index 8b40377..950a3dd 100644
  
  userdom_dontaudit_use_unpriv_user_fds(xdm_t)
  userdom_create_all_users_keys(xdm_t)
-@@ -472,24 +699,163 @@ userdom_read_user_home_content_files(xdm_t)
+@@ -472,24 +700,163 @@ userdom_read_user_home_content_files(xdm_t)
  # Search /proc for any user domain processes.
  userdom_read_all_users_state(xdm_t)
  userdom_signal_all_users(xdm_t)
@@ -31220,7 +31221,7 @@ index 8b40377..950a3dd 100644
  tunable_policy(`xdm_sysadm_login',`
  	userdom_xsession_spec_domtrans_all_users(xdm_t)
  	# FIXME:
-@@ -502,12 +868,31 @@ tunable_policy(`xdm_sysadm_login',`
+@@ -502,12 +869,31 @@ tunable_policy(`xdm_sysadm_login',`
  #	allow xserver_t xdm_tmpfs_t:file rw_file_perms;
  ')
  
@@ -31252,7 +31253,7 @@ index 8b40377..950a3dd 100644
  ')
  
  optional_policy(`
-@@ -518,8 +903,36 @@ optional_policy(`
+@@ -518,8 +904,36 @@ optional_policy(`
  	dbus_system_bus_client(xdm_t)
  	dbus_connect_system_bus(xdm_t)
  
@@ -31290,7 +31291,7 @@ index 8b40377..950a3dd 100644
  	')
  ')
  
-@@ -530,6 +943,20 @@ optional_policy(`
+@@ -530,6 +944,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31311,7 +31312,7 @@ index 8b40377..950a3dd 100644
  	hostname_exec(xdm_t)
  ')
  
-@@ -547,28 +974,78 @@ optional_policy(`
+@@ -547,28 +975,78 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31399,7 +31400,7 @@ index 8b40377..950a3dd 100644
  ')
  
  optional_policy(`
-@@ -580,6 +1057,14 @@ optional_policy(`
+@@ -580,6 +1058,14 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31414,7 +31415,7 @@ index 8b40377..950a3dd 100644
  	xfs_stream_connect(xdm_t)
  ')
  
-@@ -594,7 +1079,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+@@ -594,7 +1080,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
  type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
  
  allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@@ -31423,7 +31424,7 @@ index 8b40377..950a3dd 100644
  
  # setuid/setgid for the wrapper program to change UID
  # sys_rawio is for iopl access - should not be needed for frame-buffer
-@@ -604,8 +1089,11 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -604,8 +1090,11 @@ allow xserver_t input_xevent_t:x_event send;
  # execheap needed until the X module loader is fixed.
  # NVIDIA Needs execstack
  
@@ -31436,7 +31437,7 @@ index 8b40377..950a3dd 100644
  allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  allow xserver_t self:fd use;
  allow xserver_t self:fifo_file rw_fifo_file_perms;
-@@ -618,8 +1106,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -618,8 +1107,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
  allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
  allow xserver_t self:tcp_socket create_stream_socket_perms;
  allow xserver_t self:udp_socket create_socket_perms;
@@ -31452,7 +31453,7 @@ index 8b40377..950a3dd 100644
  manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
  manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
  manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -627,6 +1122,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+@@ -627,6 +1123,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
  
  filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
  
@@ -31463,7 +31464,7 @@ index 8b40377..950a3dd 100644
  manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
  manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
  manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -638,25 +1137,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+@@ -638,25 +1138,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  files_search_var_lib(xserver_t)
  
@@ -31505,7 +31506,7 @@ index 8b40377..950a3dd 100644
  corenet_all_recvfrom_netlabel(xserver_t)
  corenet_tcp_sendrecv_generic_if(xserver_t)
  corenet_udp_sendrecv_generic_if(xserver_t)
-@@ -677,23 +1188,28 @@ dev_rw_apm_bios(xserver_t)
+@@ -677,23 +1189,28 @@ dev_rw_apm_bios(xserver_t)
  dev_rw_agp(xserver_t)
  dev_rw_framebuffer(xserver_t)
  dev_manage_dri_dev(xserver_t)
@@ -31537,7 +31538,7 @@ index 8b40377..950a3dd 100644
  
  # brought on by rhgb
  files_search_mnt(xserver_t)
-@@ -705,6 +1221,14 @@ fs_search_nfs(xserver_t)
+@@ -705,6 +1222,14 @@ fs_search_nfs(xserver_t)
  fs_search_auto_mountpoints(xserver_t)
  fs_search_ramfs(xserver_t)
  
@@ -31552,7 +31553,7 @@ index 8b40377..950a3dd 100644
  mls_xwin_read_to_clearance(xserver_t)
  
  selinux_validate_context(xserver_t)
-@@ -718,20 +1242,18 @@ init_getpgid(xserver_t)
+@@ -718,20 +1243,18 @@ init_getpgid(xserver_t)
  term_setattr_unallocated_ttys(xserver_t)
  term_use_unallocated_ttys(xserver_t)
  
@@ -31576,7 +31577,7 @@ index 8b40377..950a3dd 100644
  
  userdom_search_user_home_dirs(xserver_t)
  userdom_use_user_ttys(xserver_t)
-@@ -739,8 +1261,6 @@ userdom_setattr_user_ttys(xserver_t)
+@@ -739,8 +1262,6 @@ userdom_setattr_user_ttys(xserver_t)
  userdom_read_user_tmp_files(xserver_t)
  userdom_rw_user_tmpfs_files(xserver_t)
  
@@ -31585,7 +31586,7 @@ index 8b40377..950a3dd 100644
  ifndef(`distro_redhat',`
  	allow xserver_t self:process { execmem execheap execstack };
  	domain_mmap_low_uncond(xserver_t)
-@@ -785,17 +1305,54 @@ optional_policy(`
+@@ -785,17 +1306,54 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31642,7 +31643,7 @@ index 8b40377..950a3dd 100644
  ')
  
  optional_policy(`
-@@ -803,6 +1360,10 @@ optional_policy(`
+@@ -803,6 +1361,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31653,7 +31654,7 @@ index 8b40377..950a3dd 100644
  	xfs_stream_connect(xserver_t)
  ')
  
-@@ -818,18 +1379,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -818,18 +1380,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
  
  # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
  # handle of a file inside the dir!!!
@@ -31678,7 +31679,7 @@ index 8b40377..950a3dd 100644
  can_exec(xserver_t, xkb_var_lib_t)
  
  # VNC v4 module in X server
-@@ -842,26 +1402,21 @@ init_use_fds(xserver_t)
+@@ -842,26 +1403,21 @@ init_use_fds(xserver_t)
  # to read ROLE_home_t - examine this in more detail
  # (xauth?)
  userdom_read_user_home_content_files(xserver_t)
@@ -31713,7 +31714,7 @@ index 8b40377..950a3dd 100644
  ')
  
  optional_policy(`
-@@ -912,7 +1467,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -912,7 +1468,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
  allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
  # operations allowed on my windows
  allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -31722,7 +31723,7 @@ index 8b40377..950a3dd 100644
  # operations allowed on all windows
  allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
  
-@@ -966,11 +1521,31 @@ allow x_domain self:x_resource { read write };
+@@ -966,11 +1522,31 @@ allow x_domain self:x_resource { read write };
  # can mess with the screensaver
  allow x_domain xserver_t:x_screen { getattr saver_getattr };
  
@@ -31754,7 +31755,7 @@ index 8b40377..950a3dd 100644
  tunable_policy(`! xserver_object_manager',`
  	# should be xserver_unconfined(x_domain),
  	# but typeattribute doesnt work in conditionals
-@@ -992,18 +1567,148 @@ tunable_policy(`! xserver_object_manager',`
+@@ -992,18 +1568,148 @@ tunable_policy(`! xserver_object_manager',`
  	allow x_domain xevent_type:{ x_event x_synthetic_event } *;
  ')
  
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 58fd76af..c214cd80 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 263%{?dist}
+Release: 264%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -690,6 +690,9 @@ exit 0
 %endif
 
 %changelog
+* Mon Jul 17 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
+- Dontaudit xdm_t to setattr lib_t dirs. BZ(#1458518)
+
 * Tue Jul 11 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-263
 - Add new boolean gluster_use_execmem