- Add cron unconfined role support for uncofined SELinux user

- Call kernel_rw_usermodehelper_state() in init.te
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Fix calling usermodehelper to use _state in interface name
- Allow xkbcomp running as bumblebee_t to execute  bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Call kernel_read_usermodhelper/kernel_rw_usermodhelper
- Make rpm_transition_script accept a role
- Added new policy for pcp
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata

policy-rawhide-base.patch

@@ -19854,10 +19854,10 @@ index 0000000..cf6582f
 +
 diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
 new file mode 100644
-index 0000000..c212063
+index 0000000..ca62aef
 --- /dev/null
 +++ b/policy/modules/roles/unconfineduser.te
-@@ -0,0 +1,335 @@
+@@ -0,0 +1,339 @@
 +policy_module(unconfineduser, 1.0.0)
 +
 +########################################
@@ -20037,6 +20037,10 @@ index 0000000..c212063
 +')
 +
 +optional_policy(`
++    cron_unconfined_role(unconfined_r, unconfined_t)
++')
++
++optional_policy(`
 +	chrome_role_notrans(unconfined_r, unconfined_t)
 +
 +	tunable_policy(`unconfined_chrome_sandbox_transition',`

policy-rawhide-contrib.patch

@@ -2984,10 +2984,10 @@ index 0000000..8ba9c95
 +	spamassassin_read_pid_files(antivirus_domain)
 +')
 diff --git a/apache.fc b/apache.fc
-index 7caefc3..ad4ec67 100644
+index 7caefc3..3d2065e 100644
 --- a/apache.fc
 +++ b/apache.fc
-@@ -1,162 +1,195 @@
+@@ -1,162 +1,196 @@
 -HOME_DIR/((www)|(web)|(public_html))(/.+)?	gen_context(system_u:object_r:httpd_user_content_t,s0)
 -HOME_DIR/((www)|(web)|(public_html))/cgi-bin(/.+)?	gen_context(system_u:object_r:httpd_user_script_exec_t,s0)
 +HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
@@ -3241,6 +3241,7 @@ index 7caefc3..ad4ec67 100644
  /var/log/roundcubemail(/.*)?	gen_context(system_u:object_r:httpd_log_t,s0)
  /var/log/suphp\.log.*	--	gen_context(system_u:object_r:httpd_log_t,s0)
 -/var/log/z-push(/.*)?	gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
++/var/log/php_errors\.log.*	--	gen_context(system_u:object_r:httpd_log_t,s0)
 +/var/log/z-push(/.*)?		gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
 +ifdef(`distro_debian', `
 +/var/log/horde2(/.*)?			gen_context(system_u:object_r:httpd_log_t,s0)
@@ -10053,10 +10054,10 @@ index 0000000..de66654
 +')
 diff --git a/bumblebee.te b/bumblebee.te
 new file mode 100644
-index 0000000..92e9d8b
+index 0000000..00e1ff2
 --- /dev/null
 +++ b/bumblebee.te
-@@ -0,0 +1,56 @@
+@@ -0,0 +1,58 @@
 +policy_module(bumblebee, 1.0.0)
 +
 +########################################
@@ -10107,6 +10108,8 @@ index 0000000..92e9d8b
 +sysnet_dns_name_resolve(bumblebee_t)
 +
 +xserver_domtrans(bumblebee_t)
++xserver_signal(bumblebee_t)
++xserver_stream_connect(bumblebee_t)
 +xserver_manage_xkb_libs(bumblebee_t)
 +corenet_tcp_connect_xserver_port(bumblebee_t)
 +
@@ -14660,7 +14663,7 @@ index c086302..4f33119 100644
  
  /etc/rc\.d/init\.d/couchdb	--	gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
 diff --git a/couchdb.if b/couchdb.if
-index 715a826..afa2f78 100644
+index 715a826..36d5a7d 100644
 --- a/couchdb.if
 +++ b/couchdb.if
 @@ -2,7 +2,7 @@
@@ -14761,7 +14764,7 @@ index 715a826..afa2f78 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -73,19 +112,63 @@ interface(`couchdb_read_pid_files',`
+@@ -73,19 +112,85 @@ interface(`couchdb_read_pid_files',`
  	')
  
  	files_search_pids($1)
@@ -14786,6 +14789,28 @@ index 715a826..afa2f78 100644
 +
 +        files_search_pids($1)
 +        allow $1 couchdb_var_run_t:dir search_dir_perms;
++')
++
++#######################################
++## <summary>
++##  Allow domain to manage couchdb content.
++## </summary>
++## <param name="domain">
++##      <summary>
++##      Domain allowed access.
++##      </summary>
++## </param>
++#
++interface(`couchdb_manage_files',`
++        gen_require(`
++                type couchdb_var_run_t;
++                type couchdb_log_t;
++                type couchdb_var_lib_t;
++        ')
++
++    manage_files_pattern($1, couchdb_log_t, couchdb_log_t)
++    manage_files_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t)
++    manage_files_pattern($1, couchdb_var_run_t, couchdb_var_run_t)
  ')
  
  ########################################
@@ -14829,7 +14854,7 @@ index 715a826..afa2f78 100644
  ## <param name="role">
  ##	<summary>
  ##	Role allowed access.
-@@ -95,14 +178,19 @@ interface(`couchdb_read_pid_files',`
+@@ -95,14 +200,19 @@ interface(`couchdb_read_pid_files',`
  #
  interface(`couchdb_admin',`
  	gen_require(`
@@ -14850,7 +14875,7 @@ index 715a826..afa2f78 100644
  	init_labeled_script_domtrans($1, couchdb_initrc_exec_t)
  	domain_system_change_exemption($1)
  	role_transition $2 couchdb_initrc_exec_t system_r;
-@@ -122,4 +210,13 @@ interface(`couchdb_admin',`
+@@ -122,4 +232,13 @@ interface(`couchdb_admin',`
  
  	files_search_pids($1)
  	admin_pattern($1, couchdb_var_run_t)
@@ -22802,10 +22827,10 @@ index c7bb4e7..e6fe2f40 100644
  sysnet_etc_filetrans_config(dnssec_triggerd_t)
 diff --git a/docker.fc b/docker.fc
 new file mode 100644
-index 0000000..484dd44
+index 0000000..b24266e
 --- /dev/null
 +++ b/docker.fc
-@@ -0,0 +1,12 @@
+@@ -0,0 +1,14 @@
 +/usr/bin/docker			--	gen_context(system_u:object_r:docker_exec_t,s0)
 +
 +/usr/lib/systemd/system/docker.service		--	gen_context(system_u:object_r:docker_unit_file_t,s0)
@@ -22815,16 +22840,17 @@ index 0000000..484dd44
 +/var/run/docker\.pid		--	gen_context(system_u:object_r:docker_var_run_t,s0)
 +/var/run/docker\.sock		-s	gen_context(system_u:object_r:docker_var_run_t,s0)
 +
++/var/lock/lxc(/.*)?		gen_context(system_u:object_r:docker_lock_t,s0)
++
 +/var/log/lxc(/.*)?		gen_context(system_u:object_r:docker_log_t,s0)
 +
-+/usr/lib/lxc/rootfs		gen_context(system_u:object_r:mnt_t,s0)
-\ No newline at end of file
++
 diff --git a/docker.if b/docker.if
 new file mode 100644
-index 0000000..543baf1
+index 0000000..c77a25f
 --- /dev/null
 +++ b/docker.if
-@@ -0,0 +1,250 @@
+@@ -0,0 +1,257 @@
 +
 +## <summary>The open-source application container engine.</summary>
 +
@@ -23020,44 +23046,6 @@ index 0000000..543baf1
 +	ps_process_pattern($1, docker_t)
 +')
 +
-+
-+########################################
-+## <summary>
-+##	All of the rules required to administrate
-+##	an docker environment
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`docker_admin',`
-+	gen_require(`
-+		type docker_t;
-+		type docker_var_lib_t, docker_var_run_t;
-+	    type docker_unit_file_t;
-+	')
-+
-+	allow $1 docker_t:process { ptrace signal_perms };
-+	ps_process_pattern($1, docker_t)
-+
-+	files_search_var_lib($1)
-+	admin_pattern($1, docker_var_lib_t)
-+
-+	files_search_pids($1)
-+	admin_pattern($1, docker_var_run_t)
-+
-+	docker_systemctl($1)
-+	admin_pattern($1, docker_unit_file_t)
-+	allow $1 docker_unit_file_t:service all_service_perms;
-+
-+	optional_policy(`
-+		systemd_passwd_agent_exec($1)
-+		systemd_read_fifo_file_passwd_run($1)
-+	')
-+')
-+
 +########################################
 +## <summary>
 +##	Read and write docker shared memory.
@@ -23075,12 +23063,57 @@ index 0000000..543baf1
 +
 +	allow $1 docker_t:sem rw_sem_perms;
 +')
++
++########################################
++## <summary>
++##	All of the rules required to administrate
++##	an docker environment
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`docker_admin',`
++	gen_require(`
++		type docker_t;
++		type docker_var_lib_t, docker_var_run_t;
++		type docker_unit_file_t;
++		type docker_lock_t;
++		type docker_log_t;
++	')
++
++	allow $1 docker_t:process { ptrace signal_perms };
++	ps_process_pattern($1, docker_t)
++
++	files_search_var_lib($1)
++	admin_pattern($1, docker_var_lib_t)
++
++	files_search_pids($1)
++	admin_pattern($1, docker_var_run_t)
++
++	files_search_locks($1)
++	admin_pattern($1, docker_lock_t)
++
++	logging_search_logs($1)
++	admin_pattern($1, docker_log_t)
++
++	docker_systemctl($1)
++	admin_pattern($1, docker_unit_file_t)
++	allow $1 docker_unit_file_t:service all_service_perms;
++
++	optional_policy(`
++		systemd_passwd_agent_exec($1)
++		systemd_read_fifo_file_passwd_run($1)
++	')
++')
 diff --git a/docker.te b/docker.te
 new file mode 100644
-index 0000000..5c6eaab
+index 0000000..68c225c
 --- /dev/null
 +++ b/docker.te
-@@ -0,0 +1,157 @@
+@@ -0,0 +1,172 @@
 +policy_module(docker, 1.0.0)
 +
 +########################################
@@ -23095,6 +23128,9 @@ index 0000000..5c6eaab
 +type docker_var_lib_t;
 +files_type(docker_var_lib_t)
 +
++type docker_lock_t;
++files_lock_file(docker_lock_t)
++
 +type docker_log_t;
 +logging_log_file(docker_log_t)
 +
@@ -23117,6 +23153,10 @@ index 0000000..5c6eaab
 +allow docker_t self:unix_stream_socket create_stream_socket_perms;
 +allow docker_t self:capability2 block_suspend;
 +
++manage_dirs_pattern(docker_t, docker_lock_t, docker_lock_t)
++manage_files_pattern(docker_t, docker_lock_t, docker_lock_t)
++files_lock_filetrans(docker_t, docker_lock_t, { dir file }, "lxc")
++
 +manage_dirs_pattern(docker_t, docker_log_t, docker_log_t)
 +manage_files_pattern(docker_t, docker_log_t, docker_log_t)
 +manage_lnk_files_pattern(docker_t, docker_log_t, docker_log_t)
@@ -23160,6 +23200,8 @@ index 0000000..5c6eaab
 +
 +auth_use_nsswitch(docker_t)
 +
++init_read_state(docker_t)
++
 +logging_send_audit_msgs(docker_t)
 +logging_send_syslog_msg(docker_t)
 +
@@ -23183,7 +23225,8 @@ index 0000000..5c6eaab
 +#
 +
 +allow docker_t self:capability { sys_admin sys_boot dac_override setpcap sys_ptrace };
-+allow docker_t self:process { getcap setcap setpgid setsched signal_perms };
++allow docker_t self:process { getcap setcap setexec setpgid setsched signal_perms };
++
 +allow docker_t self:netlink_route_socket rw_netlink_socket_perms;;
 +allow docker_t self:netlink_audit_socket create_netlink_socket_perms;
 +allow docker_t self:unix_dgram_socket create_socket_perms;
@@ -23219,10 +23262,12 @@ index 0000000..5c6eaab
 +fs_manage_cgroup_dirs(docker_t)
 +fs_manage_cgroup_files(docker_t)
 +fs_relabelfrom_xattr_fs(docker_t)
++fs_relabelfrom_tmpfs(docker_t)
 +
 +term_use_generic_ptys(docker_t)
 +term_use_ptmx(docker_t)
 +term_getattr_pty_fs(docker_t)
++term_relabel_pty_fs(docker_t)
 +
 +modutils_domtrans_insmod(docker_t)
 +
@@ -23237,6 +23282,9 @@ index 0000000..5c6eaab
 +	virt_stream_connect_sandbox(docker_t)
 +	virt_manage_sandbox_files(docker_t)
 +	virt_relabel_sandbox_filesystem(docker_t)
++	# for lxc
++	virt_transition_svirt_sandbox(docker_t, system_r)
++	virt_mounton_sandbox_file(docker_t)
 +')
 diff --git a/dovecot.fc b/dovecot.fc
 index c880070..4448055 100644
@@ -40487,10 +40535,10 @@ index cba62db..562833a 100644
 +	delete_files_pattern($1, dkim_milter_data_t, dkim_milter_data_t)
 +')
 diff --git a/milter.te b/milter.te
-index 4dc99f4..22dbcb9 100644
+index 4dc99f4..c11bec2 100644
 --- a/milter.te
 +++ b/milter.te
-@@ -5,73 +5,113 @@ policy_module(milter, 1.5.0)
+@@ -5,73 +5,117 @@ policy_module(milter, 1.5.0)
  # Declarations
  #
  
@@ -40532,6 +40580,8 @@ index 4dc99f4..22dbcb9 100644
  allow milter_domains self:fifo_file rw_fifo_file_perms;
 -allow milter_domains self:tcp_socket { accept listen };
 +
++allow milter_domains self:process signull;
++
 +# Allow communication with MTA over a TCP socket
 +allow milter_domains self:tcp_socket create_stream_socket_perms;
  
@@ -40573,6 +40623,8 @@ index 4dc99f4..22dbcb9 100644
 +
 +kernel_read_kernel_sysctls(dkim_milter_t)
 +
++corenet_udp_bind_all_ports(dkim_milter_t)
++
 +auth_use_nsswitch(dkim_milter_t)
 +
 +sysnet_dns_name_resolve(dkim_milter_t)
@@ -40631,7 +40683,7 @@ index 4dc99f4..22dbcb9 100644
  
  optional_policy(`
  	mysql_stream_connect(greylist_milter_t)
-@@ -79,30 +119,45 @@ optional_policy(`
+@@ -79,30 +123,45 @@ optional_policy(`
  
  ########################################
  #
@@ -40846,10 +40898,10 @@ index 0000000..c713b27
 +/var/run/mirrormanager(/.*)?		gen_context(system_u:object_r:mirrormanager_var_run_t,s0)
 diff --git a/mirrormanager.if b/mirrormanager.if
 new file mode 100644
-index 0000000..adf2319
+index 0000000..fbb831d
 --- /dev/null
 +++ b/mirrormanager.if
-@@ -0,0 +1,243 @@
+@@ -0,0 +1,237 @@
 +
 +## <summary>policy for mirrormanager</summary>
 +
@@ -41057,12 +41109,6 @@ index 0000000..adf2319
 +##	Domain allowed access.
 +##	</summary>
 +## </param>
-+## <param name="role">
-+##	<summary>
-+##	Role allowed access.
-+##	</summary>
-+## </param>
-+## <rolecap/>
 +#
 +interface(`mirrormanager_admin',`
 +	gen_require(`
@@ -41471,10 +41517,10 @@ index 0000000..6568bfe
 +')
 diff --git a/mock.te b/mock.te
 new file mode 100644
-index 0000000..92c3b35
+index 0000000..fc64201
 --- /dev/null
 +++ b/mock.te
-@@ -0,0 +1,275 @@
+@@ -0,0 +1,276 @@
 +policy_module(mock,1.0.0)
 +
 +## <desc>
@@ -41522,6 +41568,7 @@ index 0000000..92c3b35
 +#
 +
 +allow mock_t self:capability { sys_admin sys_ptrace setfcap setuid sys_chroot chown audit_write dac_override sys_nice mknod fsetid setgid fowner };
++allow mock_t self:capability2 block_suspend;
 +allow mock_t self:process { siginh noatsecure signal_perms transition rlimitinh setsched setpgid };
 +# Needed because mock can run java and mono withing build environment
 +allow mock_t self:process { execmem execstack };
@@ -70924,7 +70971,7 @@ index 2c3d338..cf3e5ad 100644
  
  ########################################
 diff --git a/rabbitmq.te b/rabbitmq.te
-index dc3b0ed..750df0e 100644
+index dc3b0ed..d760e9e 100644
 --- a/rabbitmq.te
 +++ b/rabbitmq.te
 @@ -19,6 +19,9 @@ init_script_file(rabbitmq_initrc_exec_t)
@@ -70982,7 +71029,7 @@ index dc3b0ed..750df0e 100644
  
  corenet_sendrecv_amqp_server_packets(rabbitmq_beam_t)
  corenet_tcp_bind_amqp_port(rabbitmq_beam_t)
-@@ -69,37 +81,50 @@ corenet_sendrecv_epmd_client_packets(rabbitmq_beam_t)
+@@ -69,37 +81,49 @@ corenet_sendrecv_epmd_client_packets(rabbitmq_beam_t)
  corenet_tcp_connect_epmd_port(rabbitmq_beam_t)
  corenet_tcp_sendrecv_epmd_port(rabbitmq_beam_t)
  
@@ -71027,10 +71074,9 @@ index dc3b0ed..750df0e 100644
 +logging_send_syslog_msg(rabbitmq_beam_t)
 +
 +optional_policy(`
++    couchdb_manage_files(rabbitmq_beam_t)
 +    couchdb_manage_lib_files(rabbitmq_beam_t)
 +    couchdb_read_conf_files(rabbitmq_beam_t)
-+    couchdb_read_log_files(rabbitmq_beam_t)
-+    couchdb_search_pid_dirs(rabbitmq_beam_t)
 +')
 +
 +optional_policy(`
@@ -71046,7 +71092,7 @@ index dc3b0ed..750df0e 100644
  allow rabbitmq_epmd_t self:process signal;
  allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms;
  allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms;
-@@ -117,8 +142,5 @@ corenet_sendrecv_epmd_server_packets(rabbitmq_epmd_t)
+@@ -117,8 +141,5 @@ corenet_sendrecv_epmd_server_packets(rabbitmq_epmd_t)
  corenet_tcp_bind_epmd_port(rabbitmq_epmd_t)
  corenet_tcp_sendrecv_epmd_port(rabbitmq_epmd_t)
  
@@ -74754,7 +74800,7 @@ index c8bdea2..1337d42 100644
 +    allow $1 cluster_unit_file_t:service all_service_perms;
  ')
 diff --git a/rhcs.te b/rhcs.te
-index 6cf79c4..00a6db2 100644
+index 6cf79c4..8ee9185 100644
 --- a/rhcs.te
 +++ b/rhcs.te
 @@ -20,6 +20,27 @@ gen_tunable(fenced_can_network_connect, false)
@@ -75130,15 +75176,16 @@ index 6cf79c4..00a6db2 100644
  
  corecmd_exec_bin(fenced_t)
  corecmd_exec_shell(fenced_t)
-@@ -140,6 +425,7 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
+@@ -140,6 +425,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
  
  corenet_sendrecv_zented_server_packets(fenced_t)
  corenet_tcp_bind_zented_port(fenced_t)
 +corenet_udp_bind_zented_port(fenced_t)
++corenet_tcp_connect_zented_port(fenced_t)
  corenet_tcp_sendrecv_zented_port(fenced_t)
  
  corenet_sendrecv_http_client_packets(fenced_t)
-@@ -148,9 +434,7 @@ corenet_tcp_sendrecv_http_port(fenced_t)
+@@ -148,9 +435,7 @@ corenet_tcp_sendrecv_http_port(fenced_t)
  
  dev_read_sysfs(fenced_t)
  dev_read_urand(fenced_t)
@@ -75149,7 +75196,7 @@ index 6cf79c4..00a6db2 100644
  
  storage_raw_read_fixed_disk(fenced_t)
  storage_raw_write_fixed_disk(fenced_t)
-@@ -160,7 +444,7 @@ term_getattr_pty_fs(fenced_t)
+@@ -160,7 +445,7 @@ term_getattr_pty_fs(fenced_t)
  term_use_generic_ptys(fenced_t)
  term_use_ptmx(fenced_t)
  
@@ -75158,7 +75205,7 @@ index 6cf79c4..00a6db2 100644
  
  tunable_policy(`fenced_can_network_connect',`
  	corenet_sendrecv_all_client_packets(fenced_t)
-@@ -182,7 +466,8 @@ optional_policy(`
+@@ -182,7 +467,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -75168,7 +75215,7 @@ index 6cf79c4..00a6db2 100644
  ')
  
  optional_policy(`
-@@ -190,12 +475,12 @@ optional_policy(`
+@@ -190,12 +476,12 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -75184,7 +75231,7 @@ index 6cf79c4..00a6db2 100644
  ')
  
  optional_policy(`
-@@ -203,6 +488,13 @@ optional_policy(`
+@@ -203,6 +489,13 @@ optional_policy(`
  	snmp_manage_var_lib_dirs(fenced_t)
  ')
  
@@ -75198,7 +75245,7 @@ index 6cf79c4..00a6db2 100644
  #######################################
  #
  # foghorn local policy
-@@ -221,16 +513,18 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
+@@ -221,16 +514,18 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
  corenet_tcp_connect_agentx_port(foghorn_t)
  corenet_tcp_sendrecv_agentx_port(foghorn_t)
  
@@ -75219,7 +75266,7 @@ index 6cf79c4..00a6db2 100644
  	snmp_stream_connect(foghorn_t)
  ')
  
-@@ -257,6 +551,8 @@ storage_getattr_removable_dev(gfs_controld_t)
+@@ -257,6 +552,8 @@ storage_getattr_removable_dev(gfs_controld_t)
  
  init_rw_script_tmp_files(gfs_controld_t)
  
@@ -75228,7 +75275,7 @@ index 6cf79c4..00a6db2 100644
  optional_policy(`
  	lvm_exec(gfs_controld_t)
  	dev_rw_lvm_control(gfs_controld_t)
-@@ -275,10 +571,39 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
+@@ -275,10 +572,39 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
  
  dev_list_sysfs(groupd_t)
  
@@ -75270,7 +75317,7 @@ index 6cf79c4..00a6db2 100644
  ######################################
  #
  # qdiskd local policy
-@@ -321,6 +646,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
+@@ -321,6 +647,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
  
  auth_use_nsswitch(qdiskd_t)
  
@@ -92875,10 +92922,10 @@ index 0000000..c1fd8b4
 +')
 diff --git a/thumb.te b/thumb.te
 new file mode 100644
-index 0000000..2ddef5c
+index 0000000..ed78f6f
 --- /dev/null
 +++ b/thumb.te
-@@ -0,0 +1,150 @@
+@@ -0,0 +1,154 @@
 +policy_module(thumb, 1.0.0)
 +
 +########################################
@@ -92994,6 +93041,10 @@ index 0000000..2ddef5c
 +xserver_use_user_fonts(thumb_t)
 +
 +optional_policy(`
++    bumblebee_stream_connect(thumb_t)
++')
++
++optional_policy(`
 +	dbus_dontaudit_stream_connect_session_bus(thumb_t)
 +	dbus_dontaudit_chat_session_bus(thumb_t)
 +')
@@ -95712,7 +95763,7 @@ index a4f20bc..6351bcb 100644
 +/var/log/qemu-ga\.log.*           --      gen_context(system_u:object_r:virt_qemu_ga_log_t,s0)
 +/var/log/qemu-ga(/.*)?		gen_context(system_u:object_r:virt_qemu_ga_log_t,s0)
 diff --git a/virt.if b/virt.if
-index facdee8..3ad56e3 100644
+index facdee8..09db35b 100644
 --- a/virt.if
 +++ b/virt.if
 @@ -1,120 +1,51 @@
@@ -96727,44 +96778,40 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -860,74 +658,227 @@ interface(`virt_read_lib_files',`
+@@ -860,74 +658,245 @@ interface(`virt_read_lib_files',`
  ##	</summary>
  ## </param>
  #
 -interface(`virt_manage_lib_files',`
 +interface(`virt_manage_cache',`
- 	gen_require(`
--		type virt_var_lib_t;
++	gen_require(`
 +		type virt_cache_t;
- 	')
- 
--	files_search_var_lib($1)
--	manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
++	')
++
 +	files_search_var($1)
 +	manage_dirs_pattern($1, virt_cache_t, virt_cache_t)
 +	manage_files_pattern($1, virt_cache_t, virt_cache_t)
 +	manage_lnk_files_pattern($1, virt_cache_t, virt_cache_t)
- ')
- 
- ########################################
- ## <summary>
--##	Create objects in virt pid
--##	directories with a private type.
++')
++
++########################################
++## <summary>
 +##	Allow domain to manage virt image files
- ## </summary>
- ## <param name="domain">
- ##	<summary>
- ##	Domain allowed access.
- ##	</summary>
- ## </param>
--## <param name="private type">
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
 +#
 +interface(`virt_manage_images',`
-+	gen_require(`
-+		type virt_var_lib_t;
+ 	gen_require(`
+ 		type virt_var_lib_t;
 +		attribute virt_image_type;
-+	')
-+
+ 	')
+ 
+-	files_search_var_lib($1)
+-	manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
 +	virt_search_lib($1)
 +	allow $1 virt_image_type:dir list_dir_perms;
 +	manage_dirs_pattern($1, virt_image_type, virt_image_type)
@@ -96794,10 +96841,12 @@ index facdee8..3ad56e3 100644
 +    manage_dirs_pattern($1, virt_image_t, virt_image_t)
 +    manage_files_pattern($1, virt_image_t, virt_image_t)
 +    read_lnk_files_pattern($1, virt_image_t, virt_image_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Create objects in virt pid
+-##	directories with a private type.
 +##	Execute virt server in the virt domain.
 +## </summary>
 +## <param name="domain">
@@ -96824,12 +96873,10 @@ index facdee8..3ad56e3 100644
 +##	Ptrace the svirt domain
 +## </summary>
 +## <param name="domain">
- ##	<summary>
--##	The type of the object to be created.
++##	<summary>
 +##	Domain allowed to transition.
- ##	</summary>
- ## </param>
--## <param name="object">
++##	</summary>
++## </param>
 +#
 +interface(`virt_ptrace',`
 +	gen_require(`
@@ -96842,14 +96889,13 @@ index facdee8..3ad56e3 100644
 +#######################################
 +## <summary>
 +##	Manage Sandbox Files
-+## </summary>
-+## <param name="domain">
+ ## </summary>
+ ## <param name="domain">
  ##	<summary>
--##	The object class of the object being created.
-+##	Domain allowed access.
+ ##	Domain allowed access.
  ##	</summary>
  ## </param>
--## <param name="name" optional="true">
+-## <param name="private type">
 +#
 +interface(`virt_manage_sandbox_files',`
 +	gen_require(`
@@ -96867,16 +96913,14 @@ index facdee8..3ad56e3 100644
 +## </summary>
 +## <param name="domain">
  ##	<summary>
--##	The name of the object being created.
+-##	The type of the object to be created.
 +##	Domain allowed access.
  ##	</summary>
  ## </param>
--## <infoflow type="write" weight="10"/>
- #
--interface(`virt_pid_filetrans',`
+-## <param name="object">
++#
 +interface(`virt_relabel_sandbox_filesystem',`
- 	gen_require(`
--		type virt_var_run_t;
++	gen_require(`
 +		type svirt_sandbox_file_t;
 +	')
 +
@@ -96885,16 +96929,40 @@ index facdee8..3ad56e3 100644
 +
 +#######################################
 +## <summary>
++##	Mounton Sandbox Files
++## </summary>
++## <param name="domain">
+ ##	<summary>
+-##	The object class of the object being created.
++##	Domain allowed access.
+ ##	</summary>
+ ## </param>
+-## <param name="name" optional="true">
++#
++interface(`virt_mounton_sandbox_file',`
++	gen_require(`
++		type svirt_sandbox_file_t;
++	')
++
++	allow $1 svirt_sandbox_file_t:dir_file_class_set mounton;
++')
++
++#######################################
++## <summary>
 +##	Connect to virt over a unix domain stream socket.
 +## </summary>
 +## <param name="domain">
-+##	<summary>
+ ##	<summary>
+-##	The name of the object being created.
 +##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
+ ##	</summary>
+ ## </param>
+-## <infoflow type="write" weight="10"/>
+ #
+-interface(`virt_pid_filetrans',`
 +interface(`virt_stream_connect_sandbox',`
-+	gen_require(`
+ 	gen_require(`
+-		type virt_var_run_t;
 +		attribute svirt_sandbox_domain;
 +		type svirt_sandbox_file_t;
  	')
@@ -96978,7 +97046,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -935,19 +886,17 @@ interface(`virt_read_log',`
+@@ -935,19 +904,17 @@ interface(`virt_read_log',`
  ##	</summary>
  ## </param>
  #
@@ -97002,7 +97070,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -955,20 +904,17 @@ interface(`virt_append_log',`
+@@ -955,20 +922,17 @@ interface(`virt_append_log',`
  ##	</summary>
  ## </param>
  #
@@ -97027,7 +97095,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -976,18 +922,17 @@ interface(`virt_manage_log',`
+@@ -976,18 +940,17 @@ interface(`virt_manage_log',`
  ##	</summary>
  ## </param>
  #
@@ -97050,7 +97118,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -995,36 +940,57 @@ interface(`virt_search_images',`
+@@ -995,36 +958,57 @@ interface(`virt_search_images',`
  ##	</summary>
  ## </param>
  #
@@ -97127,7 +97195,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1032,20 +998,28 @@ interface(`virt_read_images',`
+@@ -1032,20 +1016,28 @@ interface(`virt_read_images',`
  ##	</summary>
  ## </param>
  #
@@ -97163,7 +97231,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1053,37 +1027,129 @@ interface(`virt_rw_all_image_chr_files',`
+@@ -1053,37 +1045,131 @@ interface(`virt_rw_all_image_chr_files',`
  ##	</summary>
  ## </param>
  #
@@ -97187,7 +97255,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
 -## <param name="domain">
 +## <param name="prefix">
- ##	<summary>
++##	<summary>
 +##	Prefix for the domain.
 +##	</summary>
 +## </param>
@@ -97212,7 +97280,7 @@ index facdee8..3ad56e3 100644
 +##	Make the specified type usable as a lxc domain
 +## </summary>
 +## <param name="type">
-+##	<summary>
+ ##	<summary>
 +##	Type to be used as a lxc domain
 +##	</summary>
 +## </param>
@@ -97298,7 +97366,9 @@ index facdee8..3ad56e3 100644
 +	role $2 types svirt_sandbox_domain;
 +	allow $1 svirt_sandbox_domain:unix_dgram_socket sendto;
 +
++	allow svirt_sandbox_domain $1:fifo_file rw_fifo_file_perms;
 +	allow svirt_sandbox_domain $1:process sigchld;
++	ps_process_pattern($1, svirt_sandbox_domain)
 +')
 +
 +########################################
@@ -97307,7 +97377,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1091,36 +1157,54 @@ interface(`virt_manage_virt_cache',`
+@@ -1091,36 +1177,54 @@ interface(`virt_manage_virt_cache',`
  ##	</summary>
  ## </param>
  #
@@ -97381,7 +97451,7 @@ index facdee8..3ad56e3 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1136,50 +1220,36 @@ interface(`virt_manage_images',`
+@@ -1136,50 +1240,36 @@ interface(`virt_manage_images',`
  #
  interface(`virt_admin',`
  	gen_require(`
@@ -97423,7 +97493,8 @@ index facdee8..3ad56e3 100644
 -
 -	files_search_tmp($1)
 -	admin_pattern($1, { virt_tmp_type virt_tmp_t })
--
++	allow $1 virt_domain:process signal_perms;
+ 
 -	files_search_etc($1)
 -	admin_pattern($1, { virt_etc_t virt_etc_rw_t virtd_keytab_t })
 -
@@ -97432,8 +97503,7 @@ index facdee8..3ad56e3 100644
 -
 -	files_search_pids($1)
 -	admin_pattern($1, { virt_var_run_t virtd_lxc_var_run_t svirt_var_run_t })
-+	allow $1 virt_domain:process signal_perms;
- 
+-
 -	files_search_var($1)
 -	admin_pattern($1, svirt_cache_t)
 -

selinux-policy.spec

@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 14%{?dist}
+Release: 15%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -579,6 +579,31 @@ SELinux Reference policy mls base module.
 %endif
 
 %changelog
+* Mon Jan 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-15
+- Add cron unconfined role support for uncofined SELinux user
+- Call kernel_rw_usermodehelper_state() in init.te
+- Call corenet_udp_bind_all_ports() in milter.te
+- Allow fence_virtd to connect to zented port
+- Fix header for mirrormanager_admin()
+- Allow dkim-milter to bind udp ports
+- Allow milter domains to send signull itself
+- Allow block_suspend for yum running as mock_t
+- Allow beam.smp to manage couchdb files
+- Add couchdb_manage_files()
+- Add labeling for /var/log/php_errors.log
+- Allow bumblebee to stream connect to xserver
+- Allow bumblebee to send a signal to xserver
+- gnome-thumbnail to stream connect to bumblebee
+- Fix calling usermodehelper to use _state in interface name
+- Allow xkbcomp running as bumblebee_t to execute  bin_t
+- Allow logrotate to read squid.conf
+- Additional rules to get docker and lxc to play well with SELinux
+- Call kernel_read_usermodhelper/kernel_rw_usermodhelper
+- Make rpm_transition_script accept a role
+- Added new policy for pcp
+- Allow bumbleed to connect to xserver port
+- Allow pegasus_openlmi_storage_t to read hwdata
+
 * Fri Jan 17 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-14
 - Make rpm_transition_script accept a role
 - Clean up pcp.te