From 75b1898128f1ef695ab96328db34028213fb772f Mon Sep 17 00:00:00 2001
From: Lukas Vrabec <lvrabec@redhat.com>
Date: Tue, 3 Oct 2017 17:11:40 +0200
Subject: [PATCH] * Tue Oct 03 2017 Lukas Vrabec <lvrabec@redhat.com> -
 3.13.1-292 - Allow cupsd_t to execute ld_so_cache_t BZ(1478602) - Allow
 firewalld_t domain to change object identity because of relabeling after
 using firewall-cmd BZ(1469806) - Allow postfix_cleanup_t domain to stream
 connect to all milter sockets BZ(1436026) - Allow nsswitch_domain to read
 virt_var_lib_t files, because of libvirt NSS plugin. BZ(1487531) - Add
 unix_stream_socket recvfrom perm for init_t domain BZ(1496318) - Allow
 systemd to maange sysfs BZ(1471361)

---
 container-selinux.tgz        | Bin 7086 -> 7085 bytes
 policy-rawhide-base.patch    |  20 +++--
 policy-rawhide-contrib.patch | 145 +++++++++++++++++++----------------
 selinux-policy.spec          |  10 ++-
 4 files changed, 99 insertions(+), 76 deletions(-)

diff --git a/container-selinux.tgz b/container-selinux.tgz
index 50495508e3d8ec07ea4b07a34be883c830ffe6db..8bef0f0b82361e344e5c4e01e39329750a14ab8c 100644
GIT binary patch
literal 7085
zcmbW&Wm^*r!+>EBC8WE%ySt^NyOfX^jflj+IYMG|=V+uGZbCXnch_hTq+>J#-sd;G
z$8r6G^TS0Sjfs*_G-r;2c4~PXzb2M6wRG71p$^TDt<F&<xeC{>0c6I4u?Ci4Shn1f
zvpAD-QD3i)u}YjrNWh+2tc@=jqnJ1~s_VfD#2;6gjh{b~Sr6FOlccIpm#7$6m%u%8
zIXlCy&(`tpLC-I`9t+kVH@gEt2$=ZNrgitz_VdKV#Lbh(hE-so*YmS@FZ_Tj0g9(h
zy{LGh?Q0FmVriI-?R*V{n($kr%Zou|@Q+Kok#>1+0jVS&&?`MPbpjLPG*z3dG!=r#
zI3kt-ya4{d4k9;hluOOdwXOL70>N5^N?9ELoCzC2H;NYf7x9|5od$j(^p$mZh<r@M
z-V{H@LUcFI_xnt%w>D|1`06x`fayh>nIbbz;(w$Cech(cGi*0vF-eF`d*{WQ0;f3{
zbESY##L<mM<$sn2RmXerN}te9k4~z<6)997b8nlrZQc->wY1>XbgYUgUmn>uNkxxJ
zMPB)>v)Is{E@d@Jyxu<A`mnuktmz{gjnzF}$=qlp=N|vkTe3H-k$l!DUbTSCx^**{
z%Uyw*jOFwF*N^fl?#I&$<IsRQ;E*O3*0oWc%3Vm8A9z>uTSeYFRL4^)wJ#l_XKlf$
zh0#CA44J)S1UI3PN+U`1$1eZTxa*q{6nmx6O6I?$g$j<eRA`?3M6EJnc=;|(V~ZWj
z5U=x<P>jS!dmw9}k~^cxj8@H|)=uRS=%T6;VBUsh%i%De<^vTWmO4jZCfx~hq{TCw
z!>H7y6%Af`Tb9_M_<B=8yD<4BV}k=+fv<Bs&dP(?P^pK$%HAb57pmWRhSO=1N>{vs
zme&K?+D`-Tw3E>m6QYDQ*B0e|sBWD!`5z^i<tgq@$W<lRsvj9K1hxu)$1itup0nL-
z#>zpXq<auqkpP;kO{iXYTqt_IrmD*FjcBJTABu&c+u}wZX$WOpaZF|SVD8BqSpOLG
zzxWepo4Mi;vBq%yiW&W_l%K_Vh+?eVX-cfc^WM%uJXlcdORi5EP2-m7!jBE!p*?o^
z#BU!7$aZ4j*dKv3_taW-$=$wQR)>H&39_;&_JvyQQ{#Oe>qDKq2AZV6#ms&7X}oXI
z9S^j7>-k_NBj}s&hoVEo4KhWia+tvv)4xLDBJay?b52pye2cJCMY}8JK;syk@^&FE
z!yP29JYlHxv8_g_-!(sB5WnZ*B2;(QFo^-u0&M2Y8VZ514l%4LzT71Gmsb@%6OLDb
zCq#6!+;T-k(WmAt7G7Vg6(}UaY^oEtV-R(xVUR22f9m(=p!;(O;Et&q`7~ucBBe<M
zN*$c@E_&26W1|UjVRL)I9KQeNNvxJUe-}+-!()HYyqu8>6&v|2mgQ18w@Dk-$a)FH
z9jLSGDkq?<U(`tK&}kqNFJUMrc_i+{@*^7WFmGW+tNmi@A5qVOGxP<duW^MM_+~}8
z=mroPP0q1}P4Q~@El`!16?eBTA_O8O>duB>futUf;U8fn=*x|*x;kO0qn##T;Cvnq
z_$A_FgC5K_@lsc{T3W8@m%sgafKp4QMnYtIWtAOD=gD&&#-$p;wkpwD`)L+*$@>0%
zAnp}uD1D)<p|}2^UKAiSCNfi1$`120nAB#sJE<^-$wdp6O~b?<u5Noy<}xmCg)p$?
zz84Q^Kz`;Z>U_I-h{nPV#4`c#HtL;>$;>>VSd%;ya^t<{)nrcUz_S_#ruW?K*ox^`
zr~(m+R9jZ~8lk!e`N0*nI~|b?Bv7CnQ6>BhYbGmoxV|car7|^tn_~LeH=o~7ys<!!
zoD_4#Zhp+lJJ6KyPlGFGpH_A-0~<31)QfE}3#X)A_0&A~vAfr4{pQ8Jtz9eXiB<m&
zFej#oHXGosI4<Qpdh$ZVT8GKwT8>T<to@L|V+an9)Hwb1jrD}S;lkO!KkFSMta;o}
z5F=>E09Mh7w=2WD{3#TY+q?}U;|})bv_@G?EXix&2n8!~(V9Il;3&)l;y}ralCl@m
zi=KBLg}HH$sLhU6tn3GIYX-c=8zRrr?H5&78}P3}7B!@AQvH?6JOc<!Zu5aZC6u0g
zd^@^duMADY_g&Ax#(V2%iDWlI_m@p$bwiDRKPj23E82*9H1f&>2P$AiUJ0}XkyrA@
zyU{MEV;+A22N}HU2(VWzkmL@Fu{mX<_Sl@bk*gkK%4>A?&)qNlPUl)(Pqm>E-8LZ&
zv&8;)xKA#<>s2!82Sp7XgR3nUEiuIAs{>Us>QSkGw&ge^1dluU2oXp9YSk69z#P2{
z^U;dA^olMTj5oMN`4Stv_8}`BDb4R|1rAC4mi_sVeRomP#u4Uh^TnPR{nf|V!TDNQ
z)`H?)E2%&z;q-gQ5bVFt5i=JHvx6Hxeol95GhSaVi_@($m3UHtQE(~2YX|J&QMI<;
z+#f@Rh93T9P#>9@{&j>dg^_e*?Q)#kzuR8+G6`vz*hAhN$rwEyy4-yuF<L<_G4lWn
zYho=5f;YA41;Q8S@hgUV{&3=}tW5{?&dme%g?t%!w&TAYpGQd?<9w*zPI#YIySt!c
z_71i)f-<#)!-lOVX`@(~S3y)UCbH0Ierq+}XKLEEGudgfZSYJ%E8Tzm-L|@bB${&l
zQErVk!;fcu8IrAfXI3n+>WYyx6KKF4O`kNAQ>Qd*t;r&ua(yMpwEbBvF}#K#YEhyt
z>8J~bto{y+DpD|(9%pc)Tj#D(nQ1EPWN0>EXIcYmf;mii7G$(+)O0>vwg{e>Mly&G
z*k2YeIaRe!SuzPx$E?vYK~<0=RG;dpq|_W#L){}aCfVF(%esT!KRoiL8|S#qsfEY{
z7LcdlHh+RRq_cY?-%l|Zc?xwk`2kWKfv$Q7hD#b5RZme67D9iN8A&3`VKpbp!9)I1
z%k?(gW6Rn1P#M=n0gsbEf}cQ?qRV$P0%(~7JA!=rYwGrv2(eyMwVDNJyu$Dgys|oP
z78;{NN1rP%oEV5`+Cag@b$FPAUGir;nMd7d@UPU<(~M%?Yt2n{`QoW`d-8U-<bzQd
z?d$e>``!5_?v6b2qSO!xnM%wkcF#!{<Z(M_5bwbI%IC3R+0|+0OpNP=04z4;^Nlrk
zWJx{OSfR_a2N@cE!J3vd5kVVNC-x+-jFL8G{a5&Q0E_Mxt16`FNQY$h_G312f~fr1
zuR!Frre3NKH@J>Vu2aanN(;o%7yHSyRTOf%di;gjLHm0FX=HlD>CwGl!;e|C)`PXn
zK+|*xm&Ad?2)0}+DCHOTUz~hyh&wy>g0_;8$j8c1^Uc=FBg5zk3V-`Sn<UuPcv_v8
zl1>fw+0SwhysXWo{6A_Si`jOS&A05C-z4w$63}@KFHefS4#l{A28>cEYQ&)_xH{F*
zP)eIeCWk5X>O!hm$hFn!j>wo5$BhAw5m>$eu>rTCPadLtX5#w#6<LE5HTLtpt+)O$
z468+STS4K7Nmf~I`6=%hsbt~lJ*Rf212vO;*fjFlt&hKSs*LB1Yp1Yf%buU~;Uiwn
z4?;$0-E~MUWzhVVuSFL|kxSx53v`N*HDMQ`%fPS8WDZt_$e-TB2Nx^LV7Q>v)^zC9
zkciQ`#3}|o)TP@0UlFV-#jYxVuQSBJla7@>mzpsAqED?Qe!cZx2)KTG_;Xn3?Jk`(
znCCETG&CW7+TPwunqGkFEpFwJLdW%qZ`c8W%IxgsffRO4@u8Sb^FcRj<9@Xb2m;DT
zN2;Rmp<D`%5uDs?qI<kq6BRl<pIfIhu@dUJ_L^KibFPo^q^{hTG$%e1p~{f&<N5MP
z(P0Z0pX=LXS-DjrG1+FDn7!q^r%-;nD!@E5&<kq5;P0@3v$#`XJXq=vqKe_tZq0U!
zIWwMHPlrgo&0%wHL5alPpvpPtKrWTS>kWd)m}$i1zNdS<h|8DPCgU{j<6Qst6tIzg
zU?*Xdnx8IS^~~*JlKRjYJ7ejdjRPDJk<u_CQ7uo6z4;=2I#Ff8e!Dl3MN9h|R?CiI
zRYOocZ&^oSw+hq(S+jA>(f`7JJsolQ{&vT_5?^*^wd@nhUjlr+k~$#T4cl@;+%yf8
zi_@08R1Q*MtQbv<Yg-#I&Q^*Nu1;C3=NC_?k}6#|s8-i!l)^XTAW#i(_H60eB{#(%
zk!_2m(H9EF#3d}<)(Ii<a8zv5U`;nUK@stS?F*LAIpGqw>p!<8@GN_>Hv}O|8}z0^
z&n(zyWW8=-r+0oM`xkmMGKa-IY}1-bL0N!e_s+&SDq;M*P4P^+GaKdIFGo8UBVh_D
z<PKy(*O`fbn90#wABWTL+%5M<4dO@jtp@9MYGV|IRHN7}`XO+6L+@a_-tbFt2j;l8
zJ`fZ2&)s(-{Ee=)ZvVUu-?B9iIN*;+o*t^&>*ZfQjFqF!pAmOvm;#!;#2*YN%WG)0
z|D*L=FwO_}x6Pi$ZY6hwh}Jep!$Mk(eQdSqK8eX7NJZrZRK8si^{{tm#u3OxFpd{m
z_q2t9Xc7H)k?z$`aq-LpB5eRf!|@WsCUPTXfVJc2c14fcZ%z*<>U)vv27gMVXk2Ek
zGu;NOtXdtIX#E{N01U*ke>E`~xlI7*Iz?b$?fsQCKaAdD#Jb&<rThJrh(uvJWd)VD
zz2_z`8^wPoDXzJNbrFr~P89L;2M50SxbRT7mszf&<*(;2Z%}kvc)ywe<Q4pmN2XU4
zLjgs^Smke2l_E<%<WrXn4({|8toN3vjZ<{V3g_MobZpBIg4%Wj1w%#<5dMJ8k4K_e
zPSa`Te}~CvTVK7sD<600nf+d+zKsoeIWYCn$~e*`i#~Gt-}4w!5j*dXK6)R^$$I_m
zGIoD9gkV)>RkVy(#^IRHnD05n2$?ERx8@9>d3`^)=&_*kxN-v8JT?lj=a!j2+}fI_
z0E`3?;B&{`GrmB1cI3p>eM!)}spK#sx2*@Eo_mzabXx6nL;jEB-!<0FwE88{Hi^Bi
ziVh;B{dW-kIW^ut-stAO8~O%z=(8HXk8Ia6EF*el;xFrod$*DW2XzXRawX>WAlfo9
zE~>un_nk_M_yN)IoR82O&gL0^wp|KzWGn*d_hevGVFiJ|z0zLpiGf~Qj*MUr3_D9H
za!lKPSDHU}UoW{J{sCQR1?-gF4n4^Bf6c*}7R7u?WT*69d)@;N<&mr71|*8epkb>b
zhGw=^_Im4mzkInggcGA_j`%CoVh&cOeQxt_fDB!Sez#poi;>>ne>rQAReoDH<E#+8
zxchxpmv=3O>C`WtmN)545H891ehFqeX){pf&`yf!dv-KUSvtMkBnbLraa|4tCjscZ
z15|66bp$|;(Z6`tC%-^5)Ay(CZL&b)e>~u$!q~k;ss2`gkzMHHo`lDF(SqqORkm)#
z{z_?^a9q=nj`PasN2Q!8;P}}3huQ?S99UWMpRC;<|DjoxXOD|QDdmlCnD<+zmEaO4
zTp*{59s9T%Ot}OerbyEpymy&yBGhfwt<$UhMY?nslTzO`9GIv$J0Jqk08NSSV6*gh
z*k8tBl$pn~jeyuyx<|w5>*t8LaAz;a0(S8?7X48r{vY8^9wobsGS_ElpyfY5>l6@W
zV>>#<nNblJ&%FlBI(jBw1K{4u=L2!cc^d{i#Mh&qBG(nzjv;8dE;-`T*go+TDO55l
zXfAL$S$8G?MZy!{vAf`z=)=&oC~Et3O9`yrCuRA_!<Llmf-D#1113dWxe_<8puheZ
z{Z1V&?QX=px8T2%cYc&O<+Qv9%VGjnlx3d<jcS*FGRnI<Q(BA^XtzSC+2I!nP2(&G
zC*sJ_-nKm4$MRlQw*8V^(P$-SN|EdgqXO^ae$lsLE>JM=aBcWzbll9ebph{3ua)qO
z8x4ssie}Ac3M61LrZF~5vN|JNBA&YY<IkxQ6@F9htKRSzsI2Nqo7jc`0$BQTpmz1k
zq3st0-f*;q)!|Q3Ju~~M)bm52z?3UL&DAj{R8r-SzTc_Jg-`DbMbGMom#r%d5YCH9
zy9i#toHs$*#L@v_3CiIyMIG+Nbnq-Z<jV8&@k^hYzx@@~qo2Z+V;s=uVA9Pud5Cmu
zOl@O};dy48gIbv>X6NIsnO4$zCR}83J2U6}F!o1ejO%G9tJfN`-mW?2sqvR{>v9@%
zbCNus`dp2A=^TGA)jxmmqGSw_p2ONAmEs8?T0au3rFe~{D$hM7O!+$~#YYYQQxmQ_
zB{@3p&W-&k=jY!GbS|HUcV^AkVtf~zdWM+tc0zG1xmMUIaa7YEJ3kGKbhcsCn-!8U
z5zyq0!N)BW)F<$ws{xH4lR_}GeRW;Geol`o+;)_%Gt!Bw;^F4!=;o>amTxexLmZS~
zzFH*cA0GR4=E3AIX7~*4V-U;{U+zoN5HR`A-u7BXXYgf=W6uF!(QN_umi*PB<^*~G
z@z?II=G%Q4yC=T|q3zW(b~^hmBBw`jq@|?>JFQ??Ps;i?c3M-*JyqA|VX@qRetUcK
zemo`3#TOKqAY6h$)?F|(jSP_WHE)eAi*Hr?U_!)z*?jcxgdX$N&x<k8LJm;fuE~d;
zQ@v6w&^rNh1TD$<N}1yX<#(v91<iXShTjQPy#ZnnDvFc&_E@GyOEmmbxKEqw1dr*w
z%^s<17H7U)IlKv}`7>^OgxCYG3>;d<cV+-D<UDt|KQU(IJ*LjRlX{yze{vCwAgJ8^
zg1ZFROGr&r_nXl9Tdxb$K*0o*{qKmcM4zVE{7FcidH(1Y=#Rv;0mwVs%Sm!2M)L`!
zxXSc};u%Us&33;{5j%dz;&wwj)-vzOR&M+iZ(M4)U+#uy{F17<rJdpNL3>aCh*yK@
z#)Ymho6X0Tl3Y5{wQAgi@uEzDC59L2!7cxHku+2mI6wFCj3YL2!_u(#!#c!M0!u{~
z!N7_dN51N|uY?n35#POf9XgKJ$}du)SY|9uEbN%EL5(z85vBA+`d0p3x$71}<+_ag
z_qN-(%d=!jfhrVS;fhJ(;s_U$jmKFm(ITxE-X^QuC32O7?`5{~u&vb<?&7*I957bp
zlWa(y`AjFlYmSU4?^_mnzSxukazW@bQM#Kk|D~jdxe!GKM@Kl*tk;vfaHRnz9vI)s
z^Y$y}g*eUiImp@RGiytF%t`qN5faCnT&EhB{mID#Jj)M*yG|8ggJ#NpEQVVnm7>jK
z14qRg%a-I>DWtezGjpt}`x0$7%%e)KBKlDU5@{_o4K-nzWntV!{GECaKXB%;crExj
zd)#j+JcG^<WXBsPw#}5$%WmXkXZn1#q6!Tf@mzc~f|OjTO+Es)K`R{nXgoUciCzX#
zS1y?trw1tEZz_ZRey~?K%I=)~Dr~o=6?1h;^>P$U5K$FE+-1qln*LPNWzjk^O8-3n
z&VgifKIR)P*XK=nPVay5KODMpwUe0@Y~FsgJ7FgazmI@-)DVP+oc~9mHpW0rX#(Qv
z-uW>}NF$s5h79PKxHzY(wC91yzZ*-uGYr9yyEa+KqXgA7Um$p5*q?91GQ3und|4w}
zwGA1sbSx7yMl}ftbfQN;Z;E<ZrW7H4%1#8IxJ;)g7h~5Zc%C1k_qE|9eB>yXxKi$;
z;^VG`*^exT-(t?|aZCtbt9)cPqZ^}J4kE^N1YGodPrXp1K<OW(SawnSpOg_wi}n03
zG5yuMz50%!8itbW=;+B=WZ2m|XN)1c>lL2hs!tjBTa&{onU}TbtsAi$ndX=q{$qdw
z84Gf&xQRaS-2es{`4asXq0KzDUcc#82#e)RuPectJl_aCIbLO@2+7n-YLhW%P29=l
zc=Jlpi?k47efV>i%aS9x-Sp^oCv+dFQZb%u){&F~7Q#*;T~^(a0Y&DK;o?ZOBYD(J
zyRhl%L*JPj{|C@rE{u>8cP?&uG$!V?=YA4EN2PjWbI14XvT5MBVJZ8Gvj)6itMGe9
z7LrQPVy}gbKBZwTVCH0upt5sl#d=Jn4}rfVXdKJqC}~tpbs`9*NN4aKS+*nM7C@?K
zD&o<NZ9`2nkx=?Za#m^8#lj%$bqF#Hu&f@Cv@XnmtzpN$uhVzZkRpP5_`-@Op0IfK
zZceJhy76%2hi8%K+O{p}k+cN<t_RhQ1h#q%9Z$YW;}b<)?yFvF;&lt3%eGX7URF(6
z=1=8^#a~ss`9Z3{ah=>fHtRu~xcZ&)A7j#W-iKrhAANeM!<$FGE>+~Zh*FJV*j3Tq
zfn1*gywQic7thl;=*4Qd`Mhh+LDn@l-6{)@YWHsJ%C~OpYtKTdzM+%;O*J?1YtB>^
z!gfz|<Ys;pA|Q<t)uluA$q@uIax&rs<fgp&m+67;FOOVym-3#E4;3-tGAEUE+50ui
zm!1Hw>yj2Vn<2DXS#;rpL^vtXfU?jMtMcgm#ta-aB4lVgX_v4DM(oVNm!oP)ATP9Z
z5k#+IP#x1^4_)q}Y{|-!!5ia&JkTmmVdw(g1s*S)zhW$^zffjl{>;H(lfaFU!uFHE
zx|hVbj|z=9OuyPCHUh-}HDb;MtFRD@l}o5}Dc_$z-+X9U2VbXB3ntGGo*VwK>(juV
z)88$R#H$gBMZ{Q?Ug<fN+8+UfM>R!6fS}PZr%o;yr!_9K)^wcuM!g+~O-1c2(75F{
z8pF*~Al&h(Ip^sqaA`^Wyar?Q74&p_{oFm3SfdC3^LUd4o`Fm<)M>KB^S*|zKVAgu
z+T1{D3@`QmPJI5SYzisq8lA<RyfDQ%IJ#>8Pu!zpre7>B&=^BsJO9Ly(rLO|s-qa?
zzoCD)eZ1zto{mpt5%%pxzuu@cnpIOS8#pB$b-x@Ob$8p990RD4xKx%|zV$?2MlU0U
z#WvAbUE_HER}O6)Dd%r|r*W}bb;bsyxNa&2Z1PGoru0XJG<J(Gs7SwMnit7~_%`xV
zXws<bX+<`NFE{-So3B=6<8m8q^(7%AH#^po9ra9?r&vS^5Ey&v?sgrJF07%g4L|c_
z8WPR;@W#hV%7_kio_K-D48><a<C%Lf`Uai!>qoYa>I)2ye}UaQ=|sq|;jUHzJf08J
zkIYZx(84J`w3rul!>2^-cs2aoWh@y2kGP-{0clCTIqg(mEVz(vX&j5)0I41wql<d|
z>P$Rgedv&}Gvx}?Ea|2IyCHmR4XLKxH<=k_CkG2<O_)F|&djAz2F$FC<qilXXY^S6
z@e$WW>pD|iTnbZ{slqbd4Z0mB6&kAEN+`kV6ei{h-2M{1^(vus-45uin)OR+lXwGB
z{oLc4)(e7pkn^t4nQCF=ty!bX*^km-_e9A_+V~burI#zT`%BoSJ<X#3XDC(t|BgTV
P1s{t`N*m<@1?B$$ep&Oa

literal 7086
zcmbW(bvqr7!+>$abTg(WrklyLW4dFLM{{&{cX#{huBqvEw8J>MyUuiXdw#Fsxvu*a
zeEzzrW6%)ng(pA=NT>S832XexlZ%Hv;&n)#40RTO-N6rl<?n3CNM}F_yb}&bY7P&|
z=9068c!Q+5Yr%o%Rzr<TnrK>P`I>saAB3_ibQ-U+#D+sA^+ah><YiL749iv>@|YoE
zH*c@^4?eHExDNA%vgiK3KG&}Ti|2nfd!FCcaTi6q-uF&#JF}0eyU{m*T0wKJmMe8Q
z!43`2!fW(NY4#_t@3T$bk30_*LU1o_(bvcGXL_cp63^Mx2x0l)y2=JVjMXN#U|HAH
zFU;;2K993$M!Fv&4Uhhz1mwIPg9#{CB*j!>3f8M|cX%QK^azgA`pI9^!`w1Zr7{=;
zy!(C|ym%!JaNf|OHCFq|?i8?xwBW=r49REys73qq29b~9uV^(+&3WfgX#9gKmA&_u
z?20Z&t2V$e_cYl=pD}=9hRjmS!s1k|bneGhQ!O?wVPbCw#Le;Fd<#vq7D?4SNPR&r
zb@-S8{n)Z+qh#o@b&;fs_h*6IrxsOvU+c+<n=**DF$yOCR~gML*K&w)&E95{MM~Bk
zY@ta9#VzwI%0o{-7@bP`=L{eCcO+5R{JiCT(5Bq?avQ%(`6dAyKiKCLh_b*E^5#Yc
zH{OmAlm+duit_i;c6p>uyv)93On)#_Zt=;;hucN^Sh;QueUp7mqf*4n^wn)VT}xyy
zSLc|z!rwM58`TE-ebqxpf;>KytTR17d0DQ;W|Z(GxQkn=XG=1tyz*rdyYj{AeUZJW
z7i3q^ldo{QA^g+6f!-(-)Nk#7l7$@towCj4=y>+#=KhixV0ZKXoc;Wo6WjtLO?HSn
zEaJ4cUg6}h%%Z3ZSI+_MwA@YeB3jgrt3?bxVevTJ8Rz;c{VGR%9Lr7ek^QcaP5j)V
zbU-n3F;e~)+TOTh&mSBRf}8cs$#>)=XJ1J#-^$E~XCtewmE4yq;{~mj`0}3gG{ZX)
zGVDe)2IH52qZGc&XorgU(L4%6wUwoOTH50VsChflW9vU$S2w~7KK4{DT-ysVh%Vbx
z)eHz>CA{cD!|H9Te3eE?NpLv0ud|``Km33d{&v>2JQk1g9#5(N5?>l8_(Vh819jo!
zqCYmUR~W@hnZKkPxBzIzBv#Hs@X&DCW!sdB1Fbigsf?^-I#fZ|Rl<;A-^43k{@>v+
zg?i|(&ll4f3L4C<C2m}W1w{l&sb!`^o{K+;`QyH_dJDj8QZ7z*m>;*_4Ux^lu5cSg
zA(qD>HPNz_W}R{~Ci`hMUXhWvYpcCB6kj-Os(H}5AwlmOeF2-Cog|O9n*opV3!s^$
zD!#ljy7`EHo^1qmUgK+-AJB-HY{9IOZbLX4m`0>^2zoQuBuCY}tgf5;cBWdw9@S&R
z6i#`q6gCpstQie=OHOO!{wP;Em4Bern_{##-oZ}l`H^r;BKE7XAj)dYuVmZ@!jU|h
z8csUBt{)!^dmr+HpLw&GtUgCbQ2^#DtavjSg{t)o{Z&N+W3NC91`-OgWR?*Cqb2b>
z!jcM1UNk<dy9l#+ppt$+680v`gwc-EP+`!-0&w~!5?sis&MnS24gKpkpS%&n`BU}5
zCb9O*3*KpFQ4CM`FE%<;MHt@<sl?Jz6&m?_8qq1yPcYdY98ZW_k-(=_75sLYl}@1B
z*F&26Z&RG+^y`B%^%qdPOC5_%VVH^GUepHaL(vF{zLTmYh%5>2b|K!~iQG*>(&)6q
z(~*rkgK+PyO6x0(immSVX<sR|bgJt*Nqe1`=`Y(dS1eB!Bd7)$dpPi{70EBNqYyi+
z<M)pds$zq?qUX-&-ZXs$eDfVFWNy;FsT^MJ4O6c5Z`PAnbMM&F$A9h}X4lPrt#L+m
zaAvoF$P({tFijTZ)XeYGnS!K@KnmXq&}>JCO*4;p71gatLRpR96T?)-=r-8UNL$SE
zqJ<EM(#bSW-9GPI^)1i>Zkn*ETeQ(j6dn<$;`v@vrD#sbe;xLYq8cMazk#Qk3X<VX
z-Snp<i}@fc)y>{tlXtYd_Kxg%;Qy3dd*~baXa4g`q;Aq&si=jKi^pAu)HR?&b_YmT
zY8!W7PZ#q$dH4)n&Z}t8sUn+xr}rh)>W6<XV_zg2mB+xS@+!95Mt?z)mraeB{@A5$
z=Vf}_+byY$dW@9HvUN+xi!lyjHpQ|LSoVCj|8sApPyAS-G<MBLl6I|a6E}asp)+T<
zL3*b1Lq(uxi8P<r4LXbUMQ;Px&j3NOLRRWv?T^J?+L}G(3&Ap#u1d*NC4%`iY>TVL
zb5?^*V)J$Bzxk&&pd#2{!HHM8;G16c*GJ^Bp}TAHqNJ@8=py9Gm`HTlTo1KXJPO5(
zN89~OBQ=3Ev4NU`<a$i!GO^*c|MB1b8Ib7QkIzGj;e@=5QkYb9sjV$U6$<DwX#i&^
z^~J~lzzLb*HPzt`7SY)*j*_i)3K=g(R<z-~MzT~phW%Qt{lXO$t<H$zf>9i<A#YX*
z1Npl6!)N=aK<=h8e^n_IsFD}cPB;oyUKs~(dOeacdO)adfYu<$0?!&dLcPwHvevzy
z<ukDgif6Yu7btKP9aHC3Jxx`=tfFkZ;ogL}yJO~)$5}H*`qA*g5{*GRp$&GaHtb;G
ze*3I<5PS#)!udLeS%#(!L=t1)QglEsiLqy)l*w;8wC#l@=?VDgo5In2u3@T8(4aK+
zd$YPo$T?;Kx_-B7YGpvMotn;g*O6FuKMPf-GvyyjexG>Ep{`r^)A59!IO869<aTC;
z|H(*$*Zs~2l9r9&cX-omJ1PrP(eqP6JiN5F3hK`M#wpUTAJs<|9onmpOtXPx@JCii
zfo<KqFkdI2a97I{r7$|>vSx_27|^L3BAnl$*>Ae81)z@_L5iG6IuHknk8vpn2%R1+
z*lC|9YfiyIjp1J4;kfCQvEO~&3E`w8Y{UspQ9H`C$62lD-NMc_3%<zW3obvxO6j%>
z<VCAe^1()c>UuVuuyO%5KJx4}vfb$bofE=pTZdsbyF$Y!<tJvpZu-t8vuuDC)!75?
z`R4n>?z7lS#CZT<DByu23beA|MLN*$&fzm~ytQ|=_xf)&CXIiZOTf@vAM>cecC52v
z_Wa1~LIF|m+sFS9a=}u(Mmc==9`%)NE*ilc@~Syo#`(R%+Er(gG<FGtLLWfajcgCk
zlRYRJpw=1Gs-0O@iQ&<v2->yZZfUwMOMf6ZEyfG<Bsxi+QA>Z~sp+a1zbE=kP`-P(
zdHoJ{vH!1YE2UG0x$V~kLWlE`dxPpapQKbslYGW)E_p4mc_}tY#+-sdh;7mqT|@v5
z@7S71f7+{i93~^Ww@gs*Zav7}q9^3o&!d<rFk{JsxN@wUm;TA9BpA4rPHE_?aQn$i
zr)W5MvRt5{UVNFjQKg?_zKmIF5FJ!`&gi<~BXR=15-c{992$??OcQg;R1u5iu=W$&
zZegH6lhrSY7(w-UcgYQiWR16f8d;YkWMzEMuCxc-aZ}mdat}F?NWel<R@x`b#L0;g
zsgn-#wD!qTz&HEzMku{94Q5-o*!9Cll2D}U5Bx6li3b<ulmV+t-k;psjB9!Be_cOj
zgjbTwJa0*;)qKOvb<Id~j-8(@^-yJ*D25NX(DmaPJRIEBi;x)Z{aFR(;)24B*1+Wn
zUm>cQcvl2ju`ru`B<YX>V-3p4^t|;y7ZgRZI#17f7Jbcp>(IY<FZZDfUEgfa9dWOd
zH_>`OegT@321DLfx0C`qr5RrRI#vfp6;Lw#CrDSnv;W6!51t1w+KA^$BVEg6d{m?k
z(XxFu*LldMU-ggdXIU!&tpGn#hgcc{iTd<0Fs6v#!USxyOO$rM^stT!_LdbQ={+qn
zu)|+5y;UO$X6a9fzc}^j7GG0_y+65%Xktv6gbqMu&aTGa_ZV;8l7kj<g8cb#7;G8e
zL;EEo$U4+TCT6uHWq!AEcT~ltY;$Bv%S1)@Gc`BVQ`we7GSiL+^SZnmi@~lBxA5Mv
zPeo}Rn8aYk=Xk60F=VqR3CHc8@5_quKL9qjg^W7n8khwXJ0C`g?(7RTkjZE8vn15M
zN}cS??W;DkSUMGnoy;dJ!-;yin2U)p&bf<zJIl;HplN1A&wO3MDr;tAKU?s4**T(V
zmuXF+lV`vyq}kzHvr^qTWs}vafX_rz2AbP10T|rKYK%<;Dh)}JKZ=}55+}Z^6CY(x
z<sQ>_SWNi0y;5;5Q&6#FF+zxzkiD(Y92={fYSP_xz<b-*&kVBz-(xK)6!j^9?Rb$_
z{V>EtATNOjy#I?9_2X4{&6pnO=%>)=*k{d`G;Ud_>}6=ogX6PBG>0SG64x8lcJQZ`
zr;2HaLs#HlnEPoOcCLMN?_kT)35`(s_w`6D3_f6hkXzu2UlGZ5CCvSdAz)N!zPZ?{
z1*x_JqbWgKs{?}Xo9t1yr{Qkl$<<n^T>V#KEZm~IXb-gvP1ykP0WL6$-;c^23cA76
zZgs2$=RE-HYuq+3ok}vKTWt;8U&-Lv0eogo=$wXaEEm(3qvR_nKx~Mu0ZKp=c+Vy)
z!b5Hn-!@;;qfY{~sgJnalcv$|-E^6dY)1^y%S%P`iPlp#*v~Uz_;)t)M?5|=_a9>%
zj<1Z2Kl0j2icjsLZUdoy<A8jsQ3>K}*yTCJe-^6gMxq%AfwOio*&55ZcpKh4uI_lo
zq=%B?m4VZ$MHP4l;T84uo{p9tb%*%8;SQ6r7Jl3gf+~Y~e>@doMprM}F`EL(-s22p
zO=g-x4N@{^qLk~E-4DZP8$CE{SC=`Nk&dX7nZu@W{_<47u~evJR(k_*y+dVEuiZgI
z_kGT||ETPU{koD)LerJFowOMC3E$P;;<7hqO$fl14$TIv=w|@gVNs0Mn%xj>Vlz?=
znD6E@sIGHta}qtE5zx(S)OT%Kh)nL;jl~7*Ju;J-{Wph6(3tZ}fSAx}qW69<2XN@M
zqn!5ua4Kib&Ff9E=;PMQ&#WWi_21!`C8`|k8Np<!1B>15-5GGgD&$KTFS_jaJ^-q+
z+Z~^Aus7BNC9*n#szuz;^6ddwoMpG`s6vw$F2)C&2RWspZ-eU;4<Omi)jsX?iI2gb
zFUe5PAi7<n#(DYYKMv%ewWM6{936H>3|bX2B~s53oI?6e{?<kOjYLv-qF)+Fm?LYV
z?&MC=g{Xcf`~&EWXzY*oFf871S<m`>_O1^LnjL;P!&4iPF`&9DbNZ|DKv>pknSa}s
zbEAeSP%JC50hWm=@qxK3NA}-dq`7EwS1#Ls49@Koc7-zYx!b|0I7s{|&GSt&QFHT?
zjw1<S8_PvT3az{u=6j_=e4wR0D&DizmMfTeoupZw7U-(23@9|QDq?k;R*>}fyvysZ
z;w%<?TCb+l!ZV|~e@%Jq+&aYy|GCd~M1Qu|ws8`u#lq+kXAV`-c#V8yznS8XPaCBo
z>k`Z?W(~%rkCENcfJlfjkdKGk+i*1Tb04Olb~VQ5BxgoSW1Q2(mTeNm>rpS5^&x(~
zc9h=h;Iji2w?w=V@%f1s6&tUtfe!x0A&}G;Sy9dKuVf#3qTxcGd#U(2sM)3fM-6Ri
zR%Nubz5#V}k%Xyf*_-^7(?0dP@bXroF=U7{1vccUe|amgTxWlLLVTSLr4&VFI&h^$
zMI~F76b0^|`Q~8R6FSB1s?^JIQ*-EOOZm0sDO)=XqbrOt5DzgNd^9DmplFc#93f~c
zF)T>?O&?3x=Ys)?gtg3=Pz!df7Rr$();ue};fRW^4vLnurP`l8=wE(-DLe09z=~v%
zbKRLmh`+UCR8)I~#rTe@4hl9Sg9g*OuoHGrT$cH!zOaBZgok%Q!@fDhpl(r-j~q3O
zvN!pd7$qR{8=W24SednqW?~o0NwC>yH9a;T?ORvaW1fKD`6o^Q_Of2_{+QHNkojk8
zyQNy#6VZW6+NP;#!768p8g{*c8S&yBZLW-OPh{YO@2g)Yic;5-DBAYYM-|dD&k=`I
zk4qV9c75v=%KYO=7{wL|;978VSKzz0(9v`8lPc3U7)X`)lDVtD-p-r74tE;5x=Iod
zlnrnd97Rb&D;As)Bu+8)*yE3L^EBW0@h&!?-PQ4N_)8%WaFW6P4_ITQ!_o3DvId?Y
zG1Fu-b9kdrhvIFJ?}k&1oJ!i-ERE;0Y@%*Lt%m0pJUuyjtq5iMVzxdVqG>1b3mPUC
z<M|!rGrC~e9Faxb(B?`kP^|xr?4o|8T#!a0UH(oEC1kqPzgE-9x%Nzq?LVe4G~|f=
zD}G)Q)nAPRCN`w($?z?)l=a!H)rHbx%ZFtgwzL#l*0E8{QBDOmir+-dv&dge|Kqn(
z%rh?5b?w#=3O06)0B&6@hu~(wFW2cgyaWZz9gG0Gq!;a&6@CX84+*|czZ!!!Lsx5S
zYal|COF)BW#kQ8`DAdea<g7RB0Il>HIT=M7E;E5OxnT{G_Gul_hPZNSZc-3&{lHXm
zvuLj)j2}l<MHj2ERBE|wm9h12S&aLv7jN90?0?Q)ymOHN>X$16w|)H?ZM$_j`I*Xb
zYD#+Xt3cB<06vCDFH_-Xk_g04BTOaIb@}6kC@3Pg_Qhy+i@g%h?zv|=ykno-K6?$V
zm}4AhAGx!?6XesmTn%O;SyR(g#&piLSdMm*0ev*&#-76WAvk?szlr#60S1o*wFlft
zg-p#%2@D$5yiR6w2@u3dD`S&(dO{Z(<*1~j$S}{;EY%x|?U$v_?ODPY<9RGY<1wsL
zVRR!_*b9Pd*MpgQ{TQpg!fM1^jQBNM;Q7N;FP3bHw19sEo`ieZs)Syt-Z9CtkgN!%
za=Bb>=#cUb8Ec~k8h`~49gO+DI;zs{_R)Bf@|G`IL>^q?v8Z0BdT&gjEIvI8kd+JE
z4dc&##FL;|+^yyRPSYrHh8bstXFWeL2qP`KM-kO<R|==>S-1AOd#zOrl=r0-?sG_U
z$T|F$h+>?7M1~l)vfQFHNf*-0tR{7$*fw<3HmEbf?`6&rgDy~g;2A<T;)TY_6y_1{
zL)ipxsS?&ed9(Y*rM+a8xt}N2v@<KP%l6N#Fe}t#i`Ilp#^WR`E7}a?;*Zv+g2_F-
z|7E4AE^|_QPF8JVwMm)EXmGIjlb_iq7W;h*&^xYkzJthA9XByP)n6jdE9<yZ=X&o7
z0{6us1~VxM;~UqgB%yfwrO2x(GNn`#rucvC5!E)v4A$EihYFnP-Bd_!;+TsH7>?QB
zr6~%YyM{UhIy3B`wEU}KVLqv2HrR>PGsV%EGK%5yW_FaZpN;r2E)im8!SI~aqAs01
zv1g&c!d~kyc^gqjpoF&0f`c=yh;cHVe`_Et`nV+6%WGM}&8N+2Li7~j`G3T2L8M_k
z-{|y0Mi=f?Fesmj^D=8KX5nb6pMzFEKSzbp0C)InSwpwCp4p(&JR{QK^LeASZFw%p
zGPvb|L+hZD+oox}$5p_=t26v{ZYu~EqH${h&8uR60buUR_4v{3>D@K!qnp^zsz-LI
zY0;Nm5g>=o7F{iPjO&qnWe%WZ@qu-Z&bx%W(RuJH1iTe_&GLthef;4YqMUt&eVxTr
z4wMt7*!5ux(HIo9(Vx7hJ>5AKqHQFMB}>(R)(hO(C{4uq>xpm)oPJ4kJBbmcb2|2P
zoFgrqQJ;tk>VuaJA(prKjBI(fTI*3)5i<bWc%6Tmzf_6+@hJ8%Cl2=5a0W5qE{3Ip
z8yz?OF2$&O-c25TXGfepPVRFK9KoYstF3~sI|XQ-JKWKsMhvMX94eY}C2fq+y`s`w
zq9jUkz%vM=oQ1My4R95L<!_$E(#S|$OK+ABLp1x?f-g8}uv0FD6f(gfIyRkl9xTIV
zET%bcyG+=^R5YQab6Dd)FNwK43XByC4F9nN!PN7$yX-jmw(lQpW7zz8%F=bx`0F4$
z>1=Rc;|vKFvCe!KGy`NG><=H_Y7s4&dBPn?Bsg|C_YGB+Y6=0$2^N8G^QM1HkJHwi
zIoY}XZ#++>{>CRYGi{0A(*zikx+mwG-eZjf&n!i?r*L($eO3C=5fC+iUDE8+*MxIU
zV&~mpKw*XL(WV{tgflVlkR2{KAx=<?ifM^|3Ph>i7ge{Xf31npX^Ur>D`T~0p#It2
z{N-4XsbHG2F@>@HZ@N<kxZ1OF;|hmOzeDQVFa3+~Lc505=E`!NIOtX1XPe>Ijg@Zd
z+`h}&+s?0}5pl=Sn7PN#8|gN$4nLdU@PVu7N#9q|J$e*NDGOZ;YHVKVJhH-%U`yS@
zABm|@#`BUZrro@gU9MixdU$D{smP~2+GV>Hgko^ZIq|*pbD@&R?$J=3N<@!z(YkyL
z$l>YFrORHMgg%%T+<holJ={{Ozp^9P<Hj9fXUnM#?iqS~AxRdkQ2vu-Fah=ruqBhE
z&brH<$<X2eJ>6qS7~mN*_LrHu?wi#oj|KW>tp>Rz2cR$_8tw<7D<c(8AW|tK`cHi5
zrrqA1D}8xDo~PQ)CD`@Bvgz--J#q^~E!BJ1giP6aQ2YIphS4`)KBsPE)Xns}&UsoF
zg|I5^0_YYi07NUynNRu!R|MGO>v_&JI<=#Yqgn%KgiYXNkCUZ5x#^^5!}-$#1liZO
z&Aa7pyZyJf&D-1Y=i|Qn_l=F5?)Q74nNQZ_T0Qy=oKI7v$nH__`hWR#y41i6=IXa8
zHx{bOE-%d7gQKZAEl@`v>09)+p1!}w-CmqP))Mrx_UKC`dg?11684i;L@SZe-Dikc
z+t*{93@yx0Nw(?gss)k6Ro{?wF_eD2F23u%-h04YA+{ksV#PMI9GWKaqoSZDKHHxg
z>B}@K8;T@hSNgp;9W*qHR_)p{r3TG{C)Y&RLh>MKt1cpgVnhz!m>Y}9q34w30cX0F
zkUestHxY+XO<?Enbc!Y$%RX1T!OK{tfF^zScQM2R$A=PU0L9%zv8txlJxvPblOs31
zVZnq##3)^$caaV<X2Borihu#n`i+8q?7zs&6=ae<FJ}TTzk+-4mIX+lK~iWs0jBTb
zYB$SffzzT^)}qeamj``>B0;D-<M@e`=8VH;9ThVi#=3ilb4jMvZHS|ElI+ZyB2V13
z|6R1Pu+!;EcI=SvnOgf~X21WITM|-pf>~tLAvbt!2z#&a3~&njEH`SK6A(UNPMRUQ
zUotBp0sYO9<}C#qm5vr+q_Y2|Ay`;`CjRXuoLZw7Y&5|KW?yqi*C12*MIy5`Wr^uI
z&g1Fua9Z?rbvOEOE9H5tH$pKJ{6Tw~krAeR^T_kbQUF&5=4`lP<St+C`v2`FZ1(+w
NCKz2B;Q|5S{{ZdR0#^V4

diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 4c617887..db0fe0f1 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -34767,7 +34767,7 @@ index 3efd5b669..a8cb6df3d 100644
 +	allow $1 login_pgm:key manage_key_perms;
 +')
 diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
-index 09b791dcc..598dd5ed1 100644
+index 09b791dcc..78d158ca9 100644
 --- a/policy/modules/system/authlogin.te
 +++ b/policy/modules/system/authlogin.te
 @@ -5,6 +5,19 @@ policy_module(authlogin, 2.5.1)
@@ -35067,8 +35067,7 @@ index 09b791dcc..598dd5ed1 100644
 +    allow nsswitch_domain self:tcp_socket create_socket_perms;
 +')
 +
- tunable_policy(`authlogin_nsswitch_use_ldap',`
--	files_list_var_lib(nsswitch_domain)
++tunable_policy(`authlogin_nsswitch_use_ldap',`
 +	corenet_tcp_sendrecv_generic_if(nsswitch_domain)
 +	corenet_tcp_sendrecv_generic_node(nsswitch_domain)
 +	corenet_tcp_sendrecv_ldap_port(nsswitch_domain)
@@ -35076,7 +35075,8 @@ index 09b791dcc..598dd5ed1 100644
 +	corenet_sendrecv_ldap_client_packets(nsswitch_domain)
 +')
 +
-+tunable_policy(`authlogin_nsswitch_use_ldap',`
+ tunable_policy(`authlogin_nsswitch_use_ldap',`
+-	files_list_var_lib(nsswitch_domain)
 +	# Support for LDAPS
 +	dev_read_rand(nsswitch_domain)
 +	# LDAP Configuration using encrypted requires
@@ -35109,7 +35109,7 @@ index 09b791dcc..598dd5ed1 100644
  optional_policy(`
  	kerberos_use(nsswitch_domain)
  ')
-@@ -456,10 +520,159 @@ optional_policy(`
+@@ -456,10 +520,163 @@ optional_policy(`
  
  optional_policy(`
  	sssd_stream_connect(nsswitch_domain)
@@ -35134,6 +35134,10 @@ index 09b791dcc..598dd5ed1 100644
  	samba_dontaudit_write_var_files(nsswitch_domain)
  ')
 +
++optional_policy(`
++    virt_read_lib_files(nsswitch_domain)
++')
++
 +#######################################
 +#
 +# Login Program local policy
@@ -37885,7 +37889,7 @@ index 79a45f62e..6ed0c399a 100644
 +    allow $1 init_var_lib_t:dir search_dir_perms;
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda2480..f049f18e3 100644
+index 17eda2480..fa8d5f276 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -38084,7 +38088,7 @@ index 17eda2480..f049f18e3 100644
 +corenet_udp_bind_all_ports(init_t)
 +
 +dev_create_all_chr_files(init_t)
-+dev_rw_sysfs(init_t)
++dev_manage_sysfs(init_t)
 +dev_read_urand(init_t)
 +dev_read_raw_memory(init_t)
  # Early devtmpfs
@@ -38311,7 +38315,7 @@ index 17eda2480..f049f18e3 100644
 +allow init_t self:unix_dgram_socket { create_socket_perms sendto };
 +allow init_t self:process { setkeycreate setsockcreate setfscreate setrlimit setexec };
 +allow init_t self:process { getcap setcap };
-+allow init_t self:unix_stream_socket { create_stream_socket_perms connectto };
++allow init_t self:unix_stream_socket { create_stream_socket_perms connectto recvfrom };
 +allow init_t self:netlink_kobject_uevent_socket create_socket_perms; 
 +allow init_t self:netlink_selinux_socket create_socket_perms;
 +allow init_t self:unix_dgram_socket lock;
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index fec6564c..6f06d16b 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -21367,7 +21367,7 @@ index 3023be7f6..5afde8039 100644
 +	files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
  ')
 diff --git a/cups.te b/cups.te
-index c91813ccb..05ea50b72 100644
+index c91813ccb..774431956 100644
 --- a/cups.te
 +++ b/cups.te
 @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -21644,7 +21644,7 @@ index c91813ccb..05ea50b72 100644
  
  selinux_compute_access_vector(cupsd_t)
  selinux_validate_context(cupsd_t)
-@@ -244,22 +289,29 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,22 +289,30 @@ auth_dontaudit_read_pam_pid(cupsd_t)
  auth_rw_faillog(cupsd_t)
  auth_use_nsswitch(cupsd_t)
  
@@ -21653,6 +21653,7 @@ index c91813ccb..05ea50b72 100644
 +libs_exec_ldconfig(cupsd_t)
 +libs_exec_ld_so(cupsd_t)
 +libs_use_ld_so(cupsd_t)
++libs_legacy_use_ld_so(cupsd_t)
  
  logging_send_audit_msgs(cupsd_t)
  logging_send_syslog_msg(cupsd_t)
@@ -21679,7 +21680,7 @@ index c91813ccb..05ea50b72 100644
  
  optional_policy(`
  	apm_domtrans_client(cupsd_t)
-@@ -272,6 +324,8 @@ optional_policy(`
+@@ -272,6 +325,8 @@ optional_policy(`
  optional_policy(`
  	dbus_system_bus_client(cupsd_t)
  
@@ -21688,7 +21689,7 @@ index c91813ccb..05ea50b72 100644
  	userdom_dbus_send_all_users(cupsd_t)
  
  	optional_policy(`
-@@ -279,11 +333,17 @@ optional_policy(`
+@@ -279,11 +334,17 @@ optional_policy(`
  	')
  
  	optional_policy(`
@@ -21706,7 +21707,7 @@ index c91813ccb..05ea50b72 100644
  	')
  ')
  
-@@ -296,8 +356,8 @@ optional_policy(`
+@@ -296,8 +357,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21716,7 +21717,7 @@ index c91813ccb..05ea50b72 100644
  ')
  
  optional_policy(`
-@@ -306,7 +366,6 @@ optional_policy(`
+@@ -306,7 +367,6 @@ optional_policy(`
  
  optional_policy(`
  	lpd_exec_lpr(cupsd_t)
@@ -21724,7 +21725,7 @@ index c91813ccb..05ea50b72 100644
  	lpd_read_config(cupsd_t)
  	lpd_relabel_spool(cupsd_t)
  ')
-@@ -316,6 +375,10 @@ optional_policy(`
+@@ -316,6 +376,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21735,7 +21736,7 @@ index c91813ccb..05ea50b72 100644
  	samba_read_config(cupsd_t)
  	samba_rw_var_files(cupsd_t)
  	samba_stream_connect_nmbd(cupsd_t)
-@@ -326,7 +389,7 @@ optional_policy(`
+@@ -326,7 +390,7 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21744,7 +21745,7 @@ index c91813ccb..05ea50b72 100644
  ')
  
  optional_policy(`
-@@ -334,7 +397,11 @@ optional_policy(`
+@@ -334,7 +398,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21757,7 +21758,7 @@ index c91813ccb..05ea50b72 100644
  ')
  
  ########################################
-@@ -342,12 +409,11 @@ optional_policy(`
+@@ -342,12 +410,11 @@ optional_policy(`
  # Configuration daemon local policy
  #
  
@@ -21773,7 +21774,7 @@ index c91813ccb..05ea50b72 100644
  allow cupsd_config_t cupsd_t:process signal;
  ps_process_pattern(cupsd_config_t, cupsd_t)
  
-@@ -367,23 +433,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
+@@ -367,23 +434,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
  files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
  
  allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@@ -21801,7 +21802,7 @@ index c91813ccb..05ea50b72 100644
  corenet_all_recvfrom_netlabel(cupsd_config_t)
  corenet_tcp_sendrecv_generic_if(cupsd_config_t)
  corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -392,20 +458,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -392,20 +459,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
  corenet_sendrecv_all_client_packets(cupsd_config_t)
  corenet_tcp_connect_all_ports(cupsd_config_t)
  
@@ -21822,7 +21823,7 @@ index c91813ccb..05ea50b72 100644
  fs_search_auto_mountpoints(cupsd_config_t)
  
  domain_use_interactive_fds(cupsd_config_t)
-@@ -417,11 +475,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,11 +476,6 @@ auth_use_nsswitch(cupsd_config_t)
  
  logging_send_syslog_msg(cupsd_config_t)
  
@@ -21834,7 +21835,7 @@ index c91813ccb..05ea50b72 100644
  userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
  userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
  userdom_read_all_users_state(cupsd_config_t)
-@@ -449,9 +502,12 @@ optional_policy(`
+@@ -449,9 +503,12 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21848,7 +21849,7 @@ index c91813ccb..05ea50b72 100644
  ')
  
  optional_policy(`
-@@ -467,6 +523,10 @@ optional_policy(`
+@@ -467,6 +524,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21859,7 +21860,7 @@ index c91813ccb..05ea50b72 100644
  	rpm_read_db(cupsd_config_t)
  ')
  
-@@ -487,10 +547,6 @@ optional_policy(`
+@@ -487,10 +548,6 @@ optional_policy(`
  # Lpd local policy
  #
  
@@ -21870,7 +21871,7 @@ index c91813ccb..05ea50b72 100644
  allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
  
  allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +564,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +565,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
  
  kernel_read_kernel_sysctls(cupsd_lpd_t)
  kernel_read_system_state(cupsd_lpd_t)
@@ -21888,7 +21889,7 @@ index c91813ccb..05ea50b72 100644
  corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
  
  corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +593,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +594,6 @@ auth_use_nsswitch(cupsd_lpd_t)
  
  logging_send_syslog_msg(cupsd_lpd_t)
  
@@ -21898,7 +21899,7 @@ index c91813ccb..05ea50b72 100644
  optional_policy(`
  	inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
  ')
-@@ -549,9 +602,9 @@ optional_policy(`
+@@ -549,9 +603,9 @@ optional_policy(`
  # Pdf local policy
  #
  
@@ -21910,7 +21911,7 @@ index c91813ccb..05ea50b72 100644
  
  append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
  create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +619,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +620,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
  
  kernel_read_system_state(cups_pdf_t)
  
@@ -22062,7 +22063,7 @@ index c91813ccb..05ea50b72 100644
  
  ########################################
  #
-@@ -735,7 +663,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +664,6 @@ kernel_read_kernel_sysctls(ptal_t)
  kernel_list_proc(ptal_t)
  kernel_read_proc_symlinks(ptal_t)
  
@@ -22070,7 +22071,7 @@ index c91813ccb..05ea50b72 100644
  corenet_all_recvfrom_netlabel(ptal_t)
  corenet_tcp_sendrecv_generic_if(ptal_t)
  corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +672,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +673,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
  corenet_tcp_bind_ptal_port(ptal_t)
  corenet_tcp_sendrecv_ptal_port(ptal_t)
  
@@ -22084,7 +22085,7 @@ index c91813ccb..05ea50b72 100644
  files_read_etc_runtime_files(ptal_t)
  
  fs_getattr_all_fs(ptal_t)
-@@ -759,8 +684,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +685,6 @@ fs_search_auto_mountpoints(ptal_t)
  
  logging_send_syslog_msg(ptal_t)
  
@@ -22093,7 +22094,7 @@ index c91813ccb..05ea50b72 100644
  sysnet_read_config(ptal_t)
  
  userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +696,4 @@ optional_policy(`
+@@ -773,3 +697,4 @@ optional_policy(`
  optional_policy(`
  	udev_read_db(ptal_t)
  ')
@@ -29731,7 +29732,7 @@ index c62c5670a..a74f123da 100644
 +	allow $1 firewalld_unit_file_t:service all_service_perms;
  ')
 diff --git a/firewalld.te b/firewalld.te
-index 98072a3a1..04cd1a61b 100644
+index 98072a3a1..dc0aeb347 100644
 --- a/firewalld.te
 +++ b/firewalld.te
 @@ -21,15 +21,21 @@ logging_log_file(firewalld_var_log_t)
@@ -29789,9 +29790,11 @@ index 98072a3a1..04cd1a61b 100644
  corecmd_exec_bin(firewalld_t)
  corecmd_exec_shell(firewalld_t)
  
-@@ -63,20 +79,27 @@ dev_search_sysfs(firewalld_t)
+@@ -62,21 +78,29 @@ dev_read_urand(firewalld_t)
+ dev_search_sysfs(firewalld_t)
  
  domain_use_interactive_fds(firewalld_t)
++domain_obj_id_change_exemption(firewalld_t)
  
 -files_read_etc_files(firewalld_t)
 -files_read_usr_files(firewalld_t)
@@ -29824,7 +29827,7 @@ index 98072a3a1..04cd1a61b 100644
  
  optional_policy(`
  	dbus_system_domain(firewalld_t, firewalld_exec_t)
-@@ -91,10 +114,15 @@ optional_policy(`
+@@ -91,10 +115,15 @@ optional_policy(`
  
  	optional_policy(`
  		networkmanager_dbus_chat(firewalld_t)
@@ -76895,7 +76898,7 @@ index ded95ec3a..210018ce4 100644
 +	postfix_config_filetrans($1, postfix_prng_t, file, "prng_exch")
  ')
 diff --git a/postfix.te b/postfix.te
-index 5cfb83eca..708c908d1 100644
+index 5cfb83eca..6835f1e58 100644
 --- a/postfix.te
 +++ b/postfix.te
 @@ -6,27 +6,23 @@ policy_module(postfix, 1.15.1)
@@ -77073,9 +77076,8 @@ index 5cfb83eca..708c908d1 100644
 -########################################
 -#
 -# Common postfix user domain local policy
-+# Postfix master process local policy
- #
- 
+-#
+-
 -allow postfix_user_domains self:capability dac_override;
 -
 -domain_use_interactive_fds(postfix_user_domains)
@@ -77083,8 +77085,9 @@ index 5cfb83eca..708c908d1 100644
 -########################################
 -#
 -# Master local policy
--#
--
++# Postfix master process local policy
+ #
+ 
 -allow postfix_master_t self:capability { chown dac_override kill fowner setgid setuid sys_tty_config };
 +dontaudit postfix_master_t self:capability { net_admin };
 +# chown is to set the correct ownership of queue dirs
@@ -77273,7 +77276,7 @@ index 5cfb83eca..708c908d1 100644
  
  manage_dirs_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
  manage_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
-@@ -363,37 +256,34 @@ manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool
+@@ -363,74 +256,89 @@ manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool
  
  ########################################
  #
@@ -77320,8 +77323,12 @@ index 5cfb83eca..708c908d1 100644
  
  optional_policy(`
  	mailman_read_data_files(postfix_cleanup_t)
-@@ -401,36 +291,50 @@ optional_policy(`
+ ')
  
++optional_policy(`
++	milter_stream_connect_all(postfix_cleanup_t)
++')
++
  ########################################
  #
 -# Local local policy
@@ -77380,7 +77387,7 @@ index 5cfb83eca..708c908d1 100644
  ')
  
  optional_policy(`
-@@ -442,16 +346,25 @@ optional_policy(`
+@@ -442,16 +350,25 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -77406,7 +77413,7 @@ index 5cfb83eca..708c908d1 100644
  	procmail_domtrans(postfix_local_t)
  ')
  
-@@ -466,15 +379,17 @@ optional_policy(`
+@@ -466,15 +383,17 @@ optional_policy(`
  
  ########################################
  #
@@ -77431,7 +77438,7 @@ index 5cfb83eca..708c908d1 100644
  
  manage_dirs_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
  manage_files_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
-@@ -484,14 +399,15 @@ kernel_read_kernel_sysctls(postfix_map_t)
+@@ -484,14 +403,15 @@ kernel_read_kernel_sysctls(postfix_map_t)
  kernel_dontaudit_list_proc(postfix_map_t)
  kernel_dontaudit_read_system_state(postfix_map_t)
  
@@ -77451,7 +77458,7 @@ index 5cfb83eca..708c908d1 100644
  
  corecmd_list_bin(postfix_map_t)
  corecmd_read_bin_symlinks(postfix_map_t)
-@@ -500,7 +416,6 @@ corecmd_read_bin_pipes(postfix_map_t)
+@@ -500,7 +420,6 @@ corecmd_read_bin_pipes(postfix_map_t)
  corecmd_read_bin_sockets(postfix_map_t)
  
  files_list_home(postfix_map_t)
@@ -77459,7 +77466,7 @@ index 5cfb83eca..708c908d1 100644
  files_read_etc_runtime_files(postfix_map_t)
  files_dontaudit_search_var(postfix_map_t)
  
-@@ -508,21 +423,24 @@ auth_use_nsswitch(postfix_map_t)
+@@ -508,21 +427,24 @@ auth_use_nsswitch(postfix_map_t)
  
  logging_send_syslog_msg(postfix_map_t)
  
@@ -77487,7 +77494,7 @@ index 5cfb83eca..708c908d1 100644
  stream_connect_pattern(postfix_pickup_t, postfix_private_t, postfix_private_t, postfix_master_t)
  
  rw_fifo_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t)
-@@ -532,21 +450,21 @@ allow postfix_pickup_t postfix_spool_t:dir list_dir_perms;
+@@ -532,21 +454,21 @@ allow postfix_pickup_t postfix_spool_t:dir list_dir_perms;
  read_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t)
  delete_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t)
  
@@ -77513,7 +77520,7 @@ index 5cfb83eca..708c908d1 100644
  
  write_fifo_files_pattern(postfix_pipe_t, postfix_public_t, postfix_public_t)
  
-@@ -557,6 +475,10 @@ domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t)
+@@ -557,6 +479,10 @@ domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t)
  corecmd_exec_bin(postfix_pipe_t)
  
  optional_policy(`
@@ -77524,7 +77531,7 @@ index 5cfb83eca..708c908d1 100644
  	dovecot_domtrans_deliver(postfix_pipe_t)
  ')
  
-@@ -584,19 +506,28 @@ optional_policy(`
+@@ -584,19 +510,28 @@ optional_policy(`
  
  ########################################
  #
@@ -77558,7 +77565,7 @@ index 5cfb83eca..708c908d1 100644
  
  term_dontaudit_use_all_ptys(postfix_postdrop_t)
  term_dontaudit_use_all_ttys(postfix_postdrop_t)
-@@ -611,10 +542,7 @@ optional_policy(`
+@@ -611,10 +546,7 @@ optional_policy(`
  	cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t)
  ')
  
@@ -77570,7 +77577,7 @@ index 5cfb83eca..708c908d1 100644
  optional_policy(`
  	fstools_read_pipes(postfix_postdrop_t)
  ')
-@@ -629,17 +557,24 @@ optional_policy(`
+@@ -629,17 +561,24 @@ optional_policy(`
  
  #######################################
  #
@@ -77598,7 +77605,7 @@ index 5cfb83eca..708c908d1 100644
  
  init_sigchld_script(postfix_postqueue_t)
  init_use_script_fds(postfix_postqueue_t)
-@@ -655,69 +590,80 @@ optional_policy(`
+@@ -655,69 +594,80 @@ optional_policy(`
  
  ########################################
  #
@@ -77696,7 +77703,7 @@ index 5cfb83eca..708c908d1 100644
  ')
  
  optional_policy(`
-@@ -730,28 +676,32 @@ optional_policy(`
+@@ -730,28 +680,32 @@ optional_policy(`
  
  ########################################
  #
@@ -77737,7 +77744,7 @@ index 5cfb83eca..708c908d1 100644
  
  optional_policy(`
  	dovecot_stream_connect_auth(postfix_smtpd_t)
-@@ -764,6 +714,7 @@ optional_policy(`
+@@ -764,6 +718,7 @@ optional_policy(`
  
  optional_policy(`
  	milter_stream_connect_all(postfix_smtpd_t)
@@ -77745,7 +77752,7 @@ index 5cfb83eca..708c908d1 100644
  ')
  
  optional_policy(`
-@@ -774,31 +725,101 @@ optional_policy(`
+@@ -774,31 +729,101 @@ optional_policy(`
  	sasl_connect(postfix_smtpd_t)
  ')
  
@@ -117242,7 +117249,7 @@ index facdee8b3..2a619ba9e 100644
 +	dgram_send_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
  ')
 diff --git a/virt.te b/virt.te
-index f03dcf567..a287ebdf0 100644
+index f03dcf567..844aa6e9e 100644
 --- a/virt.te
 +++ b/virt.te
 @@ -1,451 +1,424 @@
@@ -117855,10 +117862,10 @@ index f03dcf567..a287ebdf0 100644
 -manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t)
 -manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
 -manage_sock_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
+-
+-filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, dir, "qemu")
 +allow svirt_t self:process ptrace;
  
--filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, dir, "qemu")
--
 -stream_connect_pattern(svirt_t, svirt_home_t, svirt_home_t, virtd_t)
 +# it was a part of auth_use_nsswitch
 +allow svirt_t self:netlink_route_socket r_netlink_socket_perms;
@@ -118034,20 +118041,20 @@ index f03dcf567..a287ebdf0 100644
 -manage_dirs_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t)
 -manage_files_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t)
 -filetrans_pattern(virtd_t, virt_var_run_t, virtd_lxc_var_run_t, dir, "lxc")
+-
+-stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t)
+-stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
 +manage_dirs_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
 +manage_files_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
 +filetrans_pattern(virtd_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc")
 +allow virtd_t virt_lxc_var_run_t:file { relabelfrom relabelto };
 +stream_connect_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t, virtd_lxc_t)
  
--stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t)
--stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
+-can_exec(virtd_t, virt_tmp_t)
 +# libvirtd is permitted to talk to virtlogd
 +stream_connect_pattern(virtd_t, virt_var_run_t, virtlogd_var_run_t, virtlogd_t)
 +allow virtd_t virtlogd_t:fifo_file rw_inherited_fifo_file_perms;
  
--can_exec(virtd_t, virt_tmp_t)
--
 -kernel_read_crypto_sysctls(virtd_t)
  kernel_read_system_state(virtd_t)
  kernel_read_network_state(virtd_t)
@@ -118207,7 +118214,7 @@ index f03dcf567..a287ebdf0 100644
  ')
  
  optional_policy(`
-@@ -691,99 +653,437 @@ optional_policy(`
+@@ -691,99 +653,441 @@ optional_policy(`
  	dnsmasq_kill(virtd_t)
  	dnsmasq_signull(virtd_t)
  	dnsmasq_create_pid_dirs(virtd_t)
@@ -118352,6 +118359,10 @@ index f03dcf567..a287ebdf0 100644
 +')
 +
 +optional_policy(`
++    dbus_system_bus_client(virtlogd_t)
++')
++
++optional_policy(`
 +    systemd_write_inhibit_pipes(virtlogd_t)
 +')
 +
@@ -118696,7 +118707,7 @@ index f03dcf567..a287ebdf0 100644
  kernel_read_system_state(virsh_t)
  kernel_read_network_state(virsh_t)
  kernel_read_kernel_sysctls(virsh_t)
-@@ -794,25 +1094,18 @@ kernel_write_xen_state(virsh_t)
+@@ -794,25 +1098,18 @@ kernel_write_xen_state(virsh_t)
  corecmd_exec_bin(virsh_t)
  corecmd_exec_shell(virsh_t)
  
@@ -118723,7 +118734,7 @@ index f03dcf567..a287ebdf0 100644
  
  fs_getattr_all_fs(virsh_t)
  fs_manage_xenfs_dirs(virsh_t)
-@@ -821,23 +1114,25 @@ fs_search_auto_mountpoints(virsh_t)
+@@ -821,23 +1118,25 @@ fs_search_auto_mountpoints(virsh_t)
  
  storage_raw_read_fixed_disk(virsh_t)
  
@@ -118757,7 +118768,7 @@ index f03dcf567..a287ebdf0 100644
  
  tunable_policy(`virt_use_nfs',`
  	fs_manage_nfs_dirs(virsh_t)
-@@ -856,14 +1151,20 @@ optional_policy(`
+@@ -856,14 +1155,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -118779,7 +118790,7 @@ index f03dcf567..a287ebdf0 100644
  	xen_stream_connect(virsh_t)
  	xen_stream_connect_xenstore(virsh_t)
  ')
-@@ -888,49 +1189,66 @@ optional_policy(`
+@@ -888,49 +1193,66 @@ optional_policy(`
  	kernel_read_xen_state(virsh_ssh_t)
  	kernel_write_xen_state(virsh_ssh_t)
  
@@ -118864,7 +118875,7 @@ index f03dcf567..a287ebdf0 100644
  
  corecmd_exec_bin(virtd_lxc_t)
  corecmd_exec_shell(virtd_lxc_t)
-@@ -942,17 +1260,16 @@ dev_read_urand(virtd_lxc_t)
+@@ -942,17 +1264,16 @@ dev_read_urand(virtd_lxc_t)
  
  domain_use_interactive_fds(virtd_lxc_t)
  
@@ -118884,7 +118895,7 @@ index f03dcf567..a287ebdf0 100644
  fs_getattr_all_fs(virtd_lxc_t)
  fs_manage_tmpfs_dirs(virtd_lxc_t)
  fs_manage_tmpfs_chr_files(virtd_lxc_t)
-@@ -964,15 +1281,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
+@@ -964,15 +1285,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
  fs_unmount_all_fs(virtd_lxc_t)
  fs_relabelfrom_tmpfs(virtd_lxc_t)
  
@@ -118903,7 +118914,7 @@ index f03dcf567..a287ebdf0 100644
  
  term_use_generic_ptys(virtd_lxc_t)
  term_use_ptmx(virtd_lxc_t)
-@@ -982,186 +1295,307 @@ auth_use_nsswitch(virtd_lxc_t)
+@@ -982,186 +1299,307 @@ auth_use_nsswitch(virtd_lxc_t)
  
  logging_send_syslog_msg(virtd_lxc_t)
  
@@ -119340,7 +119351,7 @@ index f03dcf567..a287ebdf0 100644
  allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
  allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
  
-@@ -1174,12 +1608,12 @@ dev_read_sysfs(virt_qmf_t)
+@@ -1174,12 +1612,12 @@ dev_read_sysfs(virt_qmf_t)
  dev_read_rand(virt_qmf_t)
  dev_read_urand(virt_qmf_t)
  
@@ -119355,7 +119366,7 @@ index f03dcf567..a287ebdf0 100644
  sysnet_read_config(virt_qmf_t)
  
  optional_policy(`
-@@ -1192,7 +1626,7 @@ optional_policy(`
+@@ -1192,7 +1630,7 @@ optional_policy(`
  
  ########################################
  #
@@ -119364,7 +119375,7 @@ index f03dcf567..a287ebdf0 100644
  #
  
  allow virt_bridgehelper_t self:process { setcap getcap };
-@@ -1201,11 +1635,264 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
+@@ -1201,11 +1639,264 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
  allow virt_bridgehelper_t self:tun_socket create_socket_perms;
  allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms;
  
diff --git a/selinux-policy.spec b/selinux-policy.spec
index c49814a1..f62959c7 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 291%{?dist}
+Release: 292%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -682,6 +682,14 @@ exit 0
 %endif
 
 %changelog
+* Tue Oct 03 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-292
+- Allow cupsd_t to execute ld_so_cache_t BZ(1478602)
+- Allow firewalld_t domain to change object identity because of relabeling after using firewall-cmd BZ(1469806)
+- Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026)
+- Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. BZ(1487531)
+- Add unix_stream_socket recvfrom perm for init_t domain BZ(1496318)
+- Allow systemd to maange sysfs BZ(1471361)
+
 * Tue Oct 03 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-291
 - Switch default value of SELinux boolean httpd_graceful_shutdown to off.