diff --git a/container-selinux.tgz b/container-selinux.tgz
index b2056496..398c449e 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index eb3682f9..f2267638 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -6673,7 +6673,7 @@ index 3f6e16889..abd046c56 100644
 +ifelse(`$2',`',`',`declare_ibendportcons($1_ibendport_t,shift($*))')dnl
 +')
 diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
-index b31c05491..3ad1127cc 100644
+index b31c05491..3b3faeeae 100644
 --- a/policy/modules/kernel/devices.fc
 +++ b/policy/modules/kernel/devices.fc
 @@ -15,15 +15,18 @@
@@ -6697,8 +6697,11 @@ index b31c05491..3ad1127cc 100644
  /dev/efirtc		-c	gen_context(system_u:object_r:clock_device_t,s0)
  /dev/elographics/e2201	-c	gen_context(system_u:object_r:mouse_device_t,s0)
  /dev/em8300.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
-@@ -44,6 +47,12 @@
+@@ -42,8 +45,15 @@
+ /dev/hpet		-c	gen_context(system_u:object_r:clock_device_t,s0)
+ /dev/hw_random		-c	gen_context(system_u:object_r:random_device_t,s0)
  /dev/hwrng		-c	gen_context(system_u:object_r:random_device_t,s0)
++/dev/gpiochip[0-9]+		-c	gen_context(system_u:object_r:gpio_device_t,s0)
  /dev/i915		-c	gen_context(system_u:object_r:dri_device_t,s0)
  /dev/inportbm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 +/dev/infiniband/.*	-c	gen_context(system_u:object_r:infiniband_device_t,mls_systemhigh)
@@ -6710,7 +6713,7 @@ index b31c05491..3ad1127cc 100644
  /dev/ipmi[0-9]+		-c	gen_context(system_u:object_r:ipmi_device_t,s0)
  /dev/ipmi/[0-9]+	-c	gen_context(system_u:object_r:ipmi_device_t,s0)
  /dev/irlpt[0-9]+	-c	gen_context(system_u:object_r:printer_device_t,s0)
-@@ -61,8 +70,10 @@
+@@ -61,8 +71,10 @@
  /dev/loop-control	-c	gen_context(system_u:object_r:loop_control_device_t,s0)
  /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
  /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
@@ -6722,7 +6725,7 @@ index b31c05491..3ad1127cc 100644
  /dev/mergemem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
  /dev/mga_vid.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
  /dev/mice		-c	gen_context(system_u:object_r:mouse_device_t,s0)
-@@ -72,7 +83,9 @@
+@@ -72,7 +84,9 @@
  /dev/mixer.*		-c	gen_context(system_u:object_r:sound_device_t,s0)
  /dev/mmetfgrab		-c	gen_context(system_u:object_r:scanner_device_t,s0)
  /dev/modem		-c	gen_context(system_u:object_r:modem_device_t,s0)
@@ -6732,7 +6735,7 @@ index b31c05491..3ad1127cc 100644
  /dev/msr.*		-c	gen_context(system_u:object_r:cpu_device_t,s0)
  /dev/net/vhost		-c	gen_context(system_u:object_r:vhost_device_t,s0)
  /dev/network_latency	-c	gen_context(system_u:object_r:netcontrol_device_t,s0)
-@@ -80,7 +93,10 @@
+@@ -80,7 +94,10 @@
  /dev/noz.* 		-c	gen_context(system_u:object_r:modem_device_t,s0)
  /dev/null		-c	gen_context(system_u:object_r:null_device_t,s0)
  /dev/nvidia.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
@@ -6743,7 +6746,7 @@ index b31c05491..3ad1127cc 100644
  /dev/oldmem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
  /dev/opengl		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
  /dev/par.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
-@@ -90,9 +106,11 @@
+@@ -90,9 +107,11 @@
  /dev/pmu		-c	gen_context(system_u:object_r:power_device_t,s0)
  /dev/port		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
  /dev/pps.*		-c	gen_context(system_u:object_r:clock_device_t,s0)
@@ -6755,7 +6758,7 @@ index b31c05491..3ad1127cc 100644
  /dev/radio.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/random		-c	gen_context(system_u:object_r:random_device_t,s0)
  /dev/raw1394.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
-@@ -106,6 +124,7 @@
+@@ -106,6 +125,7 @@
  /dev/snapshot		-c	gen_context(system_u:object_r:apm_bios_t,s0)
  /dev/sndstat		-c	gen_context(system_u:object_r:sound_device_t,s0)
  /dev/sonypi		-c	gen_context(system_u:object_r:v4l_device_t,s0)
@@ -6763,7 +6766,7 @@ index b31c05491..3ad1127cc 100644
  /dev/tlk[0-3]		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/tpm[0-9]*		-c	gen_context(system_u:object_r:tpm_device_t,s0)
  /dev/uinput		-c	gen_context(system_u:object_r:event_device_t,s0)
-@@ -118,6 +137,12 @@
+@@ -118,6 +138,12 @@
  ifdef(`distro_suse', `
  /dev/usbscanner		-c	gen_context(system_u:object_r:scanner_device_t,s0)
  ')
@@ -6776,7 +6779,7 @@ index b31c05491..3ad1127cc 100644
  /dev/vhost-net		-c	gen_context(system_u:object_r:vhost_device_t,s0)
  /dev/vbi.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/vbox.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
-@@ -129,12 +154,14 @@ ifdef(`distro_suse', `
+@@ -129,12 +155,14 @@ ifdef(`distro_suse', `
  /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/watchdog.*		-c	gen_context(system_u:object_r:watchdog_device_t,s0)
@@ -6791,7 +6794,7 @@ index b31c05491..3ad1127cc 100644
  /dev/card.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
  /dev/cmx.*		-c	gen_context(system_u:object_r:smartcard_device_t,s0)
  
-@@ -169,18 +196,26 @@ ifdef(`distro_suse', `
+@@ -169,18 +197,26 @@ ifdef(`distro_suse', `
  
  /dev/s(ou)?nd/.*	-c	gen_context(system_u:object_r:sound_device_t,s0)
  
@@ -6818,7 +6821,7 @@ index b31c05491..3ad1127cc 100644
  
  ifdef(`distro_debian',`
  # this is a static /dev dir "backup mount"
-@@ -198,12 +233,27 @@ ifdef(`distro_debian',`
+@@ -198,12 +234,27 @@ ifdef(`distro_debian',`
  /lib/udev/devices/null	-c	gen_context(system_u:object_r:null_device_t,s0)
  /lib/udev/devices/zero	-c	gen_context(system_u:object_r:zero_device_t,s0)
  
@@ -6849,7 +6852,7 @@ index b31c05491..3ad1127cc 100644
 +/usr/lib/udev/devices/null	-c	gen_context(system_u:object_r:null_device_t,s0)
 +/usr/lib/udev/devices/zero	-c	gen_context(system_u:object_r:zero_device_t,s0)
 diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285ea6..917fc3cc5 100644
+index 76f285ea6..ac044aea2 100644
 --- a/policy/modules/kernel/devices.if
 +++ b/policy/modules/kernel/devices.if
 @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -8924,7 +8927,7 @@ index 76f285ea6..917fc3cc5 100644
  ')
  
  ########################################
-@@ -4851,3 +6037,1042 @@ interface(`dev_unconfined',`
+@@ -4851,3 +6037,1064 @@ interface(`dev_unconfined',`
  
  	typeattribute $1 devices_unconfined_type;
  ')
@@ -9059,6 +9062,24 @@ index 76f285ea6..917fc3cc5 100644
 +
 +########################################
 +## <summary>
++##	Allow read/write the gpiochip device
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_read_gpio',`
++	gen_require(`
++		type device_t, gpio_device_t;
++	')
++
++	read_chr_files_pattern($1, device_t, gpio_device_t)
++')
++
++########################################
++## <summary>
 +##	Allow read/write the hypervvssd device
 +## </summary>
 +## <param name="domain">
@@ -9197,6 +9218,7 @@ index 76f285ea6..917fc3cc5 100644
 +    type hypervkvp_device_t;
 +    type hypervvssd_device_t;
 +    type gpfs_device_t;
++    type gpio_device_t;
 +')
 +
 +	dev_filetrans_printer_named_dev($1)
@@ -9900,6 +9922,9 @@ index 76f285ea6..917fc3cc5 100644
 +	filetrans_pattern($1, device_t, hypervkvp_device_t, chr_file, "hv_kvp")
 +	filetrans_pattern($1, device_t, hypervvssd_device_t, chr_file, "hv_vss")
 +	filetrans_pattern($1, device_t, gpfs_device_t, chr_file, "ss0")
++	filetrans_pattern($1, device_t, gpio_device_t, chr_file, "gpiochip0")
++	filetrans_pattern($1, device_t, gpio_device_t, chr_file, "gpiochip1")
++	filetrans_pattern($1, device_t, gpio_device_t, chr_file, "gpiochip2")
 +	dev_filetrans_xserver_named_dev($1)
 +')
 +
@@ -9968,7 +9993,7 @@ index 76f285ea6..917fc3cc5 100644
 +	filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
 +')
 diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
-index 0b1a8715a..db382e7c2 100644
+index 0b1a8715a..5c45b9323 100644
 --- a/policy/modules/kernel/devices.te
 +++ b/policy/modules/kernel/devices.te
 @@ -15,11 +15,12 @@ attribute devices_unconfined_type;
@@ -10015,7 +10040,7 @@ index 0b1a8715a..db382e7c2 100644
  type event_device_t;
  dev_node(event_device_t)
  
-@@ -88,12 +92,39 @@ type framebuf_device_t;
+@@ -88,12 +92,45 @@ type framebuf_device_t;
  dev_node(framebuf_device_t)
  
  #
@@ -10033,6 +10058,12 @@ index 0b1a8715a..db382e7c2 100644
 +type gpfs_device_t;
 +dev_node(gpfs_device_t)
 +
++#
++# Type for /dev/gpiochip*
++#
++type gpio_device_t;
++dev_node(gpio_device_t)
++
 +#
  # Type for /dev/ipmi/0
  #
@@ -10055,7 +10086,7 @@ index 0b1a8715a..db382e7c2 100644
  # Type for /dev/kmsg
  #
  type kmsg_device_t;
-@@ -111,6 +142,7 @@ dev_node(ksm_device_t)
+@@ -111,6 +148,7 @@ dev_node(ksm_device_t)
  #
  type kvm_device_t;
  dev_node(kvm_device_t)
@@ -10063,7 +10094,7 @@ index 0b1a8715a..db382e7c2 100644
  
  #
  # Type for /dev/lirc
-@@ -118,6 +150,9 @@ dev_node(kvm_device_t)
+@@ -118,6 +156,9 @@ dev_node(kvm_device_t)
  type lirc_device_t;
  dev_node(lirc_device_t)
  
@@ -10073,7 +10104,7 @@ index 0b1a8715a..db382e7c2 100644
  type loop_control_device_t;
  dev_node(loop_control_device_t)
  
-@@ -150,16 +185,29 @@ type modem_device_t;
+@@ -150,16 +191,29 @@ type modem_device_t;
  dev_node(modem_device_t)
  
  #
@@ -10103,7 +10134,7 @@ index 0b1a8715a..db382e7c2 100644
  genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
  
  #
-@@ -183,6 +231,12 @@ type nvram_device_t;
+@@ -183,6 +237,12 @@ type nvram_device_t;
  dev_node(nvram_device_t)
  
  #
@@ -10116,7 +10147,7 @@ index 0b1a8715a..db382e7c2 100644
  # Type for /dev/pmu
  #
  type power_device_t;
-@@ -227,6 +281,10 @@ files_mountpoint(sysfs_t)
+@@ -227,6 +287,10 @@ files_mountpoint(sysfs_t)
  fs_type(sysfs_t)
  genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
  
@@ -10127,7 +10158,7 @@ index 0b1a8715a..db382e7c2 100644
  #
  # Type for /dev/tpm
  #
-@@ -266,6 +324,15 @@ dev_node(usbmon_device_t)
+@@ -266,6 +330,15 @@ dev_node(usbmon_device_t)
  type userio_device_t;
  dev_node(userio_device_t)
  
@@ -10143,7 +10174,7 @@ index 0b1a8715a..db382e7c2 100644
  type v4l_device_t;
  dev_node(v4l_device_t)
  
-@@ -274,6 +341,7 @@ dev_node(v4l_device_t)
+@@ -274,6 +347,7 @@ dev_node(v4l_device_t)
  #
  type vhost_device_t;
  dev_node(vhost_device_t)
@@ -10151,7 +10182,7 @@ index 0b1a8715a..db382e7c2 100644
  
  # Type for vmware devices.
  type vmware_device_t;
-@@ -319,5 +387,8 @@ files_associate_tmp(device_node)
+@@ -319,5 +393,8 @@ files_associate_tmp(device_node)
  #
  
  allow devices_unconfined_type self:capability sys_rawio;
@@ -36483,7 +36514,7 @@ index 79a45f62e..6ed0c399a 100644
 +    allow $1 init_var_lib_t:dir search_dir_perms;
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda2480..c9e91f8e1 100644
+index 17eda2480..a980b4d3f 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -36693,7 +36724,7 @@ index 17eda2480..c9e91f8e1 100644
  
  domain_getpgid_all_domains(init_t)
  domain_kill_all_domains(init_t)
-@@ -139,45 +241,102 @@ domain_signal_all_domains(init_t)
+@@ -139,45 +241,103 @@ domain_signal_all_domains(init_t)
  domain_signull_all_domains(init_t)
  domain_sigstop_all_domains(init_t)
  domain_sigchld_all_domains(init_t)
@@ -36780,6 +36811,7 @@ index 17eda2480..c9e91f8e1 100644
  logging_rw_generic_logs(init_t)
 +logging_relabel_devlog_dev(init_t)
 +logging_manage_audit_config(init_t)
++logging_create_syslog_netlink_audit_socket(init_t)
  
  seutil_read_config(init_t)
 +seutil_read_default_contexts(init_t)
@@ -36803,7 +36835,7 @@ index 17eda2480..c9e91f8e1 100644
  
  ifdef(`distro_gentoo',`
  	allow init_t self:process { getcap setcap };
-@@ -186,29 +345,283 @@ ifdef(`distro_gentoo',`
+@@ -186,29 +346,283 @@ ifdef(`distro_gentoo',`
  ')
  
  ifdef(`distro_redhat',`
@@ -37096,7 +37128,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -216,7 +629,30 @@ optional_policy(`
+@@ -216,7 +630,30 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37128,7 +37160,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  ########################################
-@@ -225,9 +661,9 @@ optional_policy(`
+@@ -225,9 +662,9 @@ optional_policy(`
  #
  
  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -37140,7 +37172,7 @@ index 17eda2480..c9e91f8e1 100644
  allow initrc_t self:passwd rootok;
  allow initrc_t self:key manage_key_perms;
  
-@@ -258,12 +694,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
+@@ -258,12 +695,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
  
  allow initrc_t initrc_var_run_t:file manage_file_perms;
  files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -37157,7 +37189,7 @@ index 17eda2480..c9e91f8e1 100644
  
  manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
  manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
-@@ -279,23 +719,36 @@ kernel_change_ring_buffer_level(initrc_t)
+@@ -279,23 +720,36 @@ kernel_change_ring_buffer_level(initrc_t)
  kernel_clear_ring_buffer(initrc_t)
  kernel_get_sysvipc_info(initrc_t)
  kernel_read_all_sysctls(initrc_t)
@@ -37200,7 +37232,7 @@ index 17eda2480..c9e91f8e1 100644
  corenet_tcp_sendrecv_all_ports(initrc_t)
  corenet_udp_sendrecv_all_ports(initrc_t)
  corenet_tcp_connect_all_ports(initrc_t)
-@@ -303,9 +756,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
+@@ -303,9 +757,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
  
  dev_read_rand(initrc_t)
  dev_read_urand(initrc_t)
@@ -37212,7 +37244,7 @@ index 17eda2480..c9e91f8e1 100644
  dev_rw_sysfs(initrc_t)
  dev_list_usbfs(initrc_t)
  dev_read_framebuffer(initrc_t)
-@@ -313,8 +768,10 @@ dev_write_framebuffer(initrc_t)
+@@ -313,8 +769,10 @@ dev_write_framebuffer(initrc_t)
  dev_read_realtime_clock(initrc_t)
  dev_read_sound_mixer(initrc_t)
  dev_write_sound_mixer(initrc_t)
@@ -37223,7 +37255,7 @@ index 17eda2480..c9e91f8e1 100644
  dev_delete_lvm_control_dev(initrc_t)
  dev_manage_generic_symlinks(initrc_t)
  dev_manage_generic_files(initrc_t)
-@@ -322,8 +779,7 @@ dev_manage_generic_files(initrc_t)
+@@ -322,8 +780,7 @@ dev_manage_generic_files(initrc_t)
  dev_delete_generic_symlinks(initrc_t)
  dev_getattr_all_blk_files(initrc_t)
  dev_getattr_all_chr_files(initrc_t)
@@ -37233,7 +37265,7 @@ index 17eda2480..c9e91f8e1 100644
  
  domain_kill_all_domains(initrc_t)
  domain_signal_all_domains(initrc_t)
-@@ -332,7 +788,6 @@ domain_sigstop_all_domains(initrc_t)
+@@ -332,7 +789,6 @@ domain_sigstop_all_domains(initrc_t)
  domain_sigchld_all_domains(initrc_t)
  domain_read_all_domains_state(initrc_t)
  domain_getattr_all_domains(initrc_t)
@@ -37241,7 +37273,7 @@ index 17eda2480..c9e91f8e1 100644
  domain_getsession_all_domains(initrc_t)
  domain_use_interactive_fds(initrc_t)
  # for lsof which is used by alsa shutdown:
-@@ -340,6 +795,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
+@@ -340,6 +796,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
  domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
  domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
  domain_dontaudit_getattr_all_pipes(initrc_t)
@@ -37249,7 +37281,7 @@ index 17eda2480..c9e91f8e1 100644
  
  files_getattr_all_dirs(initrc_t)
  files_getattr_all_files(initrc_t)
-@@ -347,14 +803,15 @@ files_getattr_all_symlinks(initrc_t)
+@@ -347,14 +804,15 @@ files_getattr_all_symlinks(initrc_t)
  files_getattr_all_pipes(initrc_t)
  files_getattr_all_sockets(initrc_t)
  files_purge_tmp(initrc_t)
@@ -37267,7 +37299,7 @@ index 17eda2480..c9e91f8e1 100644
  files_read_usr_files(initrc_t)
  files_manage_urandom_seed(initrc_t)
  files_manage_generic_spool(initrc_t)
-@@ -364,8 +821,12 @@ files_list_isid_type_dirs(initrc_t)
+@@ -364,8 +822,12 @@ files_list_isid_type_dirs(initrc_t)
  files_mounton_isid_type_dirs(initrc_t)
  files_list_default(initrc_t)
  files_mounton_default(initrc_t)
@@ -37281,7 +37313,7 @@ index 17eda2480..c9e91f8e1 100644
  fs_list_inotifyfs(initrc_t)
  fs_register_binary_executable_type(initrc_t)
  # rhgb-console writes to ramfs
-@@ -375,10 +836,11 @@ fs_mount_all_fs(initrc_t)
+@@ -375,10 +837,11 @@ fs_mount_all_fs(initrc_t)
  fs_unmount_all_fs(initrc_t)
  fs_remount_all_fs(initrc_t)
  fs_getattr_all_fs(initrc_t)
@@ -37295,7 +37327,7 @@ index 17eda2480..c9e91f8e1 100644
  mcs_process_set_categories(initrc_t)
  
  mls_file_read_all_levels(initrc_t)
-@@ -387,8 +849,10 @@ mls_process_read_up(initrc_t)
+@@ -387,8 +850,10 @@ mls_process_read_up(initrc_t)
  mls_process_write_down(initrc_t)
  mls_rangetrans_source(initrc_t)
  mls_fd_share_all_levels(initrc_t)
@@ -37306,7 +37338,7 @@ index 17eda2480..c9e91f8e1 100644
  
  storage_getattr_fixed_disk_dev(initrc_t)
  storage_setattr_fixed_disk_dev(initrc_t)
-@@ -398,6 +862,7 @@ term_use_all_terms(initrc_t)
+@@ -398,6 +863,7 @@ term_use_all_terms(initrc_t)
  term_reset_tty_labels(initrc_t)
  
  auth_rw_login_records(initrc_t)
@@ -37314,7 +37346,7 @@ index 17eda2480..c9e91f8e1 100644
  auth_setattr_login_records(initrc_t)
  auth_rw_lastlog(initrc_t)
  auth_read_pam_pid(initrc_t)
-@@ -416,20 +881,18 @@ logging_read_all_logs(initrc_t)
+@@ -416,20 +882,18 @@ logging_read_all_logs(initrc_t)
  logging_append_all_logs(initrc_t)
  logging_read_audit_config(initrc_t)
  
@@ -37338,7 +37370,7 @@ index 17eda2480..c9e91f8e1 100644
  
  ifdef(`distro_debian',`
  	dev_setattr_generic_dirs(initrc_t)
-@@ -451,7 +914,6 @@ ifdef(`distro_gentoo',`
+@@ -451,7 +915,6 @@ ifdef(`distro_gentoo',`
  	allow initrc_t self:process setfscreate;
  	dev_create_null_dev(initrc_t)
  	dev_create_zero_dev(initrc_t)
@@ -37346,7 +37378,7 @@ index 17eda2480..c9e91f8e1 100644
  	term_create_console_dev(initrc_t)
  
  	# unfortunately /sbin/rc does stupid tricks
-@@ -486,6 +948,10 @@ ifdef(`distro_gentoo',`
+@@ -486,6 +949,10 @@ ifdef(`distro_gentoo',`
  	sysnet_setattr_config(initrc_t)
  
  	optional_policy(`
@@ -37357,7 +37389,7 @@ index 17eda2480..c9e91f8e1 100644
  		alsa_read_lib(initrc_t)
  	')
  
-@@ -506,7 +972,7 @@ ifdef(`distro_redhat',`
+@@ -506,7 +973,7 @@ ifdef(`distro_redhat',`
  
  	# Red Hat systems seem to have a stray
  	# fd open from the initrd
@@ -37366,7 +37398,7 @@ index 17eda2480..c9e91f8e1 100644
  	files_dontaudit_read_root_files(initrc_t)
  
  	# These seem to be from the initrd
-@@ -521,6 +987,7 @@ ifdef(`distro_redhat',`
+@@ -521,6 +988,7 @@ ifdef(`distro_redhat',`
  	files_create_boot_dirs(initrc_t)
  	files_create_boot_flag(initrc_t)
  	files_rw_boot_symlinks(initrc_t)
@@ -37374,7 +37406,7 @@ index 17eda2480..c9e91f8e1 100644
  	# wants to read /.fonts directory
  	files_read_default_files(initrc_t)
  	files_mountpoint(initrc_tmp_t)
-@@ -541,6 +1008,7 @@ ifdef(`distro_redhat',`
+@@ -541,6 +1009,7 @@ ifdef(`distro_redhat',`
  	miscfiles_rw_localization(initrc_t)
  	miscfiles_setattr_localization(initrc_t)
  	miscfiles_relabel_localization(initrc_t)
@@ -37382,7 +37414,7 @@ index 17eda2480..c9e91f8e1 100644
  
  	miscfiles_read_fonts(initrc_t)
  	miscfiles_read_hwdata(initrc_t)
-@@ -550,8 +1018,44 @@ ifdef(`distro_redhat',`
+@@ -550,8 +1019,44 @@ ifdef(`distro_redhat',`
  	')
  
  	optional_policy(`
@@ -37427,7 +37459,7 @@ index 17eda2480..c9e91f8e1 100644
  	')
  
  	optional_policy(`
-@@ -559,14 +1063,31 @@ ifdef(`distro_redhat',`
+@@ -559,14 +1064,31 @@ ifdef(`distro_redhat',`
  		rpc_write_exports(initrc_t)
  		rpc_manage_nfs_state_data(initrc_t)
  	')
@@ -37459,7 +37491,7 @@ index 17eda2480..c9e91f8e1 100644
  	')
  ')
  
-@@ -577,6 +1098,39 @@ ifdef(`distro_suse',`
+@@ -577,6 +1099,39 @@ ifdef(`distro_suse',`
  	')
  ')
  
@@ -37499,7 +37531,7 @@ index 17eda2480..c9e91f8e1 100644
  optional_policy(`
  	amavis_search_lib(initrc_t)
  	amavis_setattr_pid_files(initrc_t)
-@@ -589,6 +1143,8 @@ optional_policy(`
+@@ -589,6 +1144,8 @@ optional_policy(`
  optional_policy(`
  	apache_read_config(initrc_t)
  	apache_list_modules(initrc_t)
@@ -37508,7 +37540,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -610,6 +1166,7 @@ optional_policy(`
+@@ -610,6 +1167,7 @@ optional_policy(`
  
  optional_policy(`
  	cgroup_stream_connect_cgred(initrc_t)
@@ -37516,7 +37548,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -626,6 +1183,17 @@ optional_policy(`
+@@ -626,6 +1184,17 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37534,7 +37566,7 @@ index 17eda2480..c9e91f8e1 100644
  	dev_getattr_printer_dev(initrc_t)
  
  	cups_read_log(initrc_t)
-@@ -642,9 +1210,13 @@ optional_policy(`
+@@ -642,9 +1211,13 @@ optional_policy(`
  	dbus_connect_system_bus(initrc_t)
  	dbus_system_bus_client(initrc_t)
  	dbus_read_config(initrc_t)
@@ -37548,7 +37580,7 @@ index 17eda2480..c9e91f8e1 100644
  	')
  
  	optional_policy(`
-@@ -657,15 +1229,11 @@ optional_policy(`
+@@ -657,15 +1230,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37566,7 +37598,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -686,6 +1254,15 @@ optional_policy(`
+@@ -686,6 +1255,15 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37582,7 +37614,7 @@ index 17eda2480..c9e91f8e1 100644
  	inn_exec_config(initrc_t)
  ')
  
-@@ -726,6 +1303,7 @@ optional_policy(`
+@@ -726,6 +1304,7 @@ optional_policy(`
  	lpd_list_spool(initrc_t)
  
  	lpd_read_config(initrc_t)
@@ -37590,7 +37622,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -743,7 +1321,13 @@ optional_policy(`
+@@ -743,7 +1322,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37605,7 +37637,7 @@ index 17eda2480..c9e91f8e1 100644
  	mta_dontaudit_read_spool_symlinks(initrc_t)
  ')
  
-@@ -766,6 +1350,10 @@ optional_policy(`
+@@ -766,6 +1351,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37616,7 +37648,7 @@ index 17eda2480..c9e91f8e1 100644
  	postgresql_manage_db(initrc_t)
  	postgresql_read_config(initrc_t)
  ')
-@@ -775,10 +1363,20 @@ optional_policy(`
+@@ -775,10 +1364,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37637,7 +37669,7 @@ index 17eda2480..c9e91f8e1 100644
  	quota_manage_flags(initrc_t)
  ')
  
-@@ -787,6 +1385,10 @@ optional_policy(`
+@@ -787,6 +1386,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37648,7 +37680,7 @@ index 17eda2480..c9e91f8e1 100644
  	fs_write_ramfs_sockets(initrc_t)
  	fs_search_ramfs(initrc_t)
  
-@@ -808,8 +1410,6 @@ optional_policy(`
+@@ -808,8 +1411,6 @@ optional_policy(`
  	# bash tries ioctl for some reason
  	files_dontaudit_ioctl_all_pids(initrc_t)
  
@@ -37657,7 +37689,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -818,6 +1418,10 @@ optional_policy(`
+@@ -818,6 +1419,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37668,7 +37700,7 @@ index 17eda2480..c9e91f8e1 100644
  	# shorewall-init script run /var/lib/shorewall/firewall
  	shorewall_lib_domtrans(initrc_t)
  ')
-@@ -827,10 +1431,12 @@ optional_policy(`
+@@ -827,10 +1432,12 @@ optional_policy(`
  	squid_manage_logs(initrc_t)
  ')
  
@@ -37681,7 +37713,7 @@ index 17eda2480..c9e91f8e1 100644
  
  optional_policy(`
  	ssh_dontaudit_read_server_keys(initrc_t)
-@@ -857,21 +1463,62 @@ optional_policy(`
+@@ -857,21 +1464,62 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37745,7 +37777,7 @@ index 17eda2480..c9e91f8e1 100644
  ')
  
  optional_policy(`
-@@ -887,6 +1534,10 @@ optional_policy(`
+@@ -887,6 +1535,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37756,7 +37788,7 @@ index 17eda2480..c9e91f8e1 100644
  	# Set device ownerships/modes.
  	xserver_setattr_console_pipes(initrc_t)
  
-@@ -897,3 +1548,218 @@ optional_policy(`
+@@ -897,3 +1549,218 @@ optional_policy(`
  optional_policy(`
  	zebra_read_config(initrc_t)
  ')
@@ -40052,10 +40084,35 @@ index b50c5fe81..9eacd9ba1 100644
 +/var/webmin(/.*)?		gen_context(system_u:object_r:var_log_t,s0)
 +
 diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
-index 4e9488463..5f5045ae1 100644
+index 4e9488463..e7d5f42a5 100644
 --- a/policy/modules/system/logging.if
 +++ b/policy/modules/system/logging.if
-@@ -233,7 +233,7 @@ interface(`logging_run_auditd',`
+@@ -81,6 +81,24 @@ interface(`logging_dontaudit_send_audit_msgs',`
+ 
+ ########################################
+ ## <summary>
++##      Create netlink audit socket
++## </summary>
++## <param name="domain">
++##      <summary>
++##      Domain allowed access.
++##      </summary>
++## </param>
++#
++interface(`logging_create_syslog_netlink_audit_socket',`
++	gen_require(`
++		type syslogd_t;
++	')
++
++	allow $1 syslogd_t:netlink_audit_socket create_netlink_socket_perms;
++')
++
++########################################
++## <summary>
+ ##	Set login uid
+ ## </summary>
+ ## <param name="domain">
+@@ -233,7 +251,7 @@ interface(`logging_run_auditd',`
  
  ########################################
  ## <summary>
@@ -40064,7 +40121,7 @@ index 4e9488463..5f5045ae1 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -318,7 +318,7 @@ interface(`logging_dispatcher_domain',`
+@@ -318,7 +336,7 @@ interface(`logging_dispatcher_domain',`
  
  ########################################
  ## <summary>
@@ -40073,7 +40130,7 @@ index 4e9488463..5f5045ae1 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -496,6 +496,68 @@ interface(`logging_log_filetrans',`
+@@ -496,6 +514,68 @@ interface(`logging_log_filetrans',`
  	filetrans_pattern($1, var_log_t, $2, $3, $4)
  ')
  
@@ -40142,7 +40199,7 @@ index 4e9488463..5f5045ae1 100644
  ########################################
  ## <summary>
  ##	Send system log messages.
-@@ -530,22 +592,107 @@ interface(`logging_log_filetrans',`
+@@ -530,22 +610,107 @@ interface(`logging_log_filetrans',`
  #
  interface(`logging_send_syslog_msg',`
  	gen_require(`
@@ -40188,19 +40245,12 @@ index 4e9488463..5f5045ae1 100644
 +interface(`logging_relabel_devlog_dev',`
 +	gen_require(`
 +		type devlog_t;
- 	')
- 
--	allow $1 devlog_t:lnk_file read_lnk_file_perms;
--	allow $1 devlog_t:sock_file write_sock_file_perms;
++	')
++
 +	allow $1 devlog_t:sock_file relabel_sock_file_perms;
 +	allow $1 devlog_t:lnk_file relabelto_lnk_file_perms;
 +')
- 
--	# the type of socket depends on the syslog daemon
--	allow $1 syslogd_t:unix_dgram_socket sendto;
--	allow $1 syslogd_t:unix_stream_socket connectto;
--	allow $1 self:unix_dgram_socket create_socket_perms;
--	allow $1 self:unix_stream_socket create_socket_perms;
++
 +########################################
 +## <summary>
 +##	Allow domain to read the syslog pid files.
@@ -40215,11 +40265,7 @@ index 4e9488463..5f5045ae1 100644
 +	gen_require(`
 +		type syslogd_var_run_t;
 +	')
- 
--	# If syslog is down, the glibc syslog() function
--	# will write to the console.
--	term_write_console($1)
--	term_dontaudit_read_console($1)
++
 +    read_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
 +    list_dirs_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
 +')
@@ -40237,11 +40283,18 @@ index 4e9488463..5f5045ae1 100644
 +interface(`logging_relabel_syslog_pid_socket',`
 +	gen_require(`
 +		type syslogd_var_run_t;
-+	')
-+
+ 	')
+ 
+-	allow $1 devlog_t:lnk_file read_lnk_file_perms;
+-	allow $1 devlog_t:sock_file write_sock_file_perms;
 +	allow $1 syslogd_var_run_t:sock_file relabel_sock_file_perms;
 +')
-+
+ 
+-	# the type of socket depends on the syslog daemon
+-	allow $1 syslogd_t:unix_dgram_socket sendto;
+-	allow $1 syslogd_t:unix_stream_socket connectto;
+-	allow $1 self:unix_dgram_socket create_socket_perms;
+-	allow $1 self:unix_stream_socket create_socket_perms;
 +########################################
 +## <summary>
 +##	Connect to the syslog control unix stream socket.
@@ -40256,13 +40309,17 @@ index 4e9488463..5f5045ae1 100644
 +	gen_require(`
 +		type syslogd_t, syslogd_var_run_t;
 +	')
-+
+ 
+-	# If syslog is down, the glibc syslog() function
+-	# will write to the console.
+-	term_write_console($1)
+-	term_dontaudit_read_console($1)
 +	files_search_pids($1)
 +	stream_connect_pattern($1, syslogd_var_run_t, syslogd_var_run_t, syslogd_t)
  ')
  
  ########################################
-@@ -571,6 +718,25 @@ interface(`logging_read_audit_config',`
+@@ -571,6 +736,25 @@ interface(`logging_read_audit_config',`
  
  ########################################
  ## <summary>
@@ -40288,7 +40345,7 @@ index 4e9488463..5f5045ae1 100644
  ##	dontaudit search of auditd configuration files.
  ## </summary>
  ## <param name="domain">
-@@ -609,6 +775,25 @@ interface(`logging_read_syslog_config',`
+@@ -609,6 +793,25 @@ interface(`logging_read_syslog_config',`
  
  ########################################
  ## <summary>
@@ -40314,7 +40371,7 @@ index 4e9488463..5f5045ae1 100644
  ##	Allows the domain to open a file in the
  ##	log directory, but does not allow the listing
  ##	of the contents of the log directory.
-@@ -722,6 +907,25 @@ interface(`logging_setattr_all_log_dirs',`
+@@ -722,6 +925,25 @@ interface(`logging_setattr_all_log_dirs',`
  	allow $1 logfile:dir setattr;
  ')
  
@@ -40340,7 +40397,7 @@ index 4e9488463..5f5045ae1 100644
  ########################################
  ## <summary>
  ##	Do not audit attempts to get the attributes
-@@ -776,7 +980,25 @@ interface(`logging_append_all_logs',`
+@@ -776,7 +998,25 @@ interface(`logging_append_all_logs',`
  	')
  
  	files_search_var($1)
@@ -40367,7 +40424,7 @@ index 4e9488463..5f5045ae1 100644
  ')
  
  ########################################
-@@ -859,7 +1081,7 @@ interface(`logging_manage_all_logs',`
+@@ -859,7 +1099,7 @@ interface(`logging_manage_all_logs',`
  
  	files_search_var($1)
  	manage_files_pattern($1, logfile, logfile)
@@ -40376,7 +40433,7 @@ index 4e9488463..5f5045ae1 100644
  ')
  
  ########################################
-@@ -880,11 +1102,69 @@ interface(`logging_read_generic_logs',`
+@@ -880,11 +1120,69 @@ interface(`logging_read_generic_logs',`
  
  	files_search_var($1)
  	allow $1 var_log_t:dir list_dir_perms;
@@ -40446,7 +40503,7 @@ index 4e9488463..5f5045ae1 100644
  ##	Write generic log files.
  ## </summary>
  ## <param name="domain">
-@@ -905,6 +1185,24 @@ interface(`logging_write_generic_logs',`
+@@ -905,6 +1203,24 @@ interface(`logging_write_generic_logs',`
  
  ########################################
  ## <summary>
@@ -40471,7 +40528,7 @@ index 4e9488463..5f5045ae1 100644
  ##	Dontaudit Write generic log files.
  ## </summary>
  ## <param name="domain">
-@@ -984,11 +1282,16 @@ interface(`logging_admin_audit',`
+@@ -984,11 +1300,16 @@ interface(`logging_admin_audit',`
  		type auditd_t, auditd_etc_t, auditd_log_t;
  		type auditd_var_run_t;
  		type auditd_initrc_exec_t;
@@ -40489,7 +40546,7 @@ index 4e9488463..5f5045ae1 100644
  	manage_dirs_pattern($1, auditd_etc_t, auditd_etc_t)
  	manage_files_pattern($1, auditd_etc_t, auditd_etc_t)
  
-@@ -1004,6 +1307,55 @@ interface(`logging_admin_audit',`
+@@ -1004,6 +1325,55 @@ interface(`logging_admin_audit',`
  	domain_system_change_exemption($1)
  	role_transition $2 auditd_initrc_exec_t system_r;
  	allow $2 system_r;
@@ -40545,7 +40602,7 @@ index 4e9488463..5f5045ae1 100644
  ')
  
  ########################################
-@@ -1032,10 +1384,15 @@ interface(`logging_admin_syslog',`
+@@ -1032,10 +1402,15 @@ interface(`logging_admin_syslog',`
  		type syslogd_initrc_exec_t;
  	')
  
@@ -40563,7 +40620,7 @@ index 4e9488463..5f5045ae1 100644
  
  	manage_dirs_pattern($1, klogd_var_run_t, klogd_var_run_t)
  	manage_files_pattern($1, klogd_var_run_t, klogd_var_run_t)
-@@ -1057,6 +1414,8 @@ interface(`logging_admin_syslog',`
+@@ -1057,6 +1432,8 @@ interface(`logging_admin_syslog',`
  	manage_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
  
  	logging_manage_all_logs($1)
@@ -40572,7 +40629,7 @@ index 4e9488463..5f5045ae1 100644
  
  	init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
  	domain_system_change_exemption($1)
-@@ -1085,3 +1444,110 @@ interface(`logging_admin',`
+@@ -1085,3 +1462,110 @@ interface(`logging_admin',`
  	logging_admin_audit($1, $2)
  	logging_admin_syslog($1, $2)
  ')
@@ -46140,7 +46197,7 @@ index 2cea692c0..e3cb4f2ef 100644
 +	files_etc_filetrans($1, net_conf_t, file)
 +')
 diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index a392fc4bc..41a5b082f 100644
+index a392fc4bc..95c64150b 100644
 --- a/policy/modules/system/sysnetwork.te
 +++ b/policy/modules/system/sysnetwork.te
 @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4)
@@ -46385,7 +46442,7 @@ index a392fc4bc..41a5b082f 100644
  	vmware_append_log(dhcpc_t)
  ')
  
-@@ -264,32 +322,72 @@ allow ifconfig_t self:msgq create_msgq_perms;
+@@ -264,32 +322,73 @@ allow ifconfig_t self:msgq create_msgq_perms;
  allow ifconfig_t self:msg { send receive };
  # Create UDP sockets, necessary when called from dhcpc
  allow ifconfig_t self:udp_socket create_socket_perms;
@@ -46451,6 +46508,7 @@ index a392fc4bc..41a5b082f 100644
 +files_read_usr_files(ifconfig_t)
  
  fs_getattr_xattr_fs(ifconfig_t)
++fs_unmount_xattr_fs(ifconfig_t)
  fs_search_auto_mountpoints(ifconfig_t)
 +fs_read_nsfs_files(ifconfig_t)
 +fs_mount_nsfs(ifconfig_t)
@@ -46458,7 +46516,7 @@ index a392fc4bc..41a5b082f 100644
  
  selinux_dontaudit_getattr_fs(ifconfig_t)
  
-@@ -299,33 +397,51 @@ term_dontaudit_use_all_ptys(ifconfig_t)
+@@ -299,33 +398,51 @@ term_dontaudit_use_all_ptys(ifconfig_t)
  term_dontaudit_use_ptmx(ifconfig_t)
  term_dontaudit_use_generic_ptys(ifconfig_t)
  
@@ -46516,7 +46574,7 @@ index a392fc4bc..41a5b082f 100644
  	optional_policy(`
  		dev_dontaudit_rw_cardmgr(ifconfig_t)
  	')
-@@ -336,7 +452,11 @@ ifdef(`hide_broken_symptoms',`
+@@ -336,7 +453,11 @@ ifdef(`hide_broken_symptoms',`
  ')
  
  optional_policy(`
@@ -46529,7 +46587,7 @@ index a392fc4bc..41a5b082f 100644
  ')
  
  optional_policy(`
-@@ -350,7 +470,16 @@ optional_policy(`
+@@ -350,7 +471,16 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -46547,7 +46605,7 @@ index a392fc4bc..41a5b082f 100644
  ')
  
  optional_policy(`
-@@ -371,3 +500,17 @@ optional_policy(`
+@@ -371,3 +501,17 @@ optional_policy(`
  	xen_append_log(ifconfig_t)
  	xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
  ')
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 91888eb7..c5040c00 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -40879,7 +40879,7 @@ index 1a354203e..8101022be 100644
  	logging_search_logs($1)
  	admin_pattern($1, iscsi_log_t)
 diff --git a/iscsi.te b/iscsi.te
-index ca020faa9..9c628b22e 100644
+index ca020faa9..c53375b3b 100644
 --- a/iscsi.te
 +++ b/iscsi.te
 @@ -5,12 +5,15 @@ policy_module(iscsi, 1.9.0)
@@ -40944,7 +40944,7 @@ index ca020faa9..9c628b22e 100644
  corenet_all_recvfrom_netlabel(iscsid_t)
  corenet_tcp_sendrecv_generic_if(iscsid_t)
  corenet_tcp_sendrecv_generic_node(iscsid_t)
-@@ -85,22 +90,38 @@ corenet_sendrecv_isns_client_packets(iscsid_t)
+@@ -85,22 +90,40 @@ corenet_sendrecv_isns_client_packets(iscsid_t)
  corenet_tcp_connect_isns_port(iscsid_t)
  corenet_tcp_sendrecv_isns_port(iscsid_t)
  
@@ -40975,6 +40975,8 @@ index ca020faa9..9c628b22e 100644
 -miscfiles_read_localization(iscsid_t)
 +modutils_read_module_config(iscsid_t)
 +
++mount_read_pid_files(iscsid_t)
++
 +optional_policy(`
 +    iscsi_systemctl(iscsid_t)
 +')
@@ -43238,10 +43240,10 @@ index 000000000..bd7e7fa17
 +')
 diff --git a/keepalived.te b/keepalived.te
 new file mode 100644
-index 000000000..04c46e714
+index 000000000..202ac2b59
 --- /dev/null
 +++ b/keepalived.te
-@@ -0,0 +1,95 @@
+@@ -0,0 +1,99 @@
 +policy_module(keepalived, 1.0.0)
 +
 +########################################
@@ -43306,6 +43308,10 @@ index 000000000..04c46e714
 +logging_send_syslog_msg(keepalived_t)
 +
 +optional_policy(`
++    iptables_domtrans(keepalived_t)
++')
++
++optional_policy(`
 +    rhcs_signull_haproxy(keepalived_t)
 +')
 +
@@ -45304,7 +45310,7 @@ index 93a64bc50..af6d741d6 100644
 +	allow $1 ksmtuned_unit_file_t:service all_service_perms;
  ')
 diff --git a/ksmtuned.te b/ksmtuned.te
-index 8eef134ac..a2ca1a009 100644
+index 8eef134ac..9636a5343 100644
 --- a/ksmtuned.te
 +++ b/ksmtuned.te
 @@ -5,10 +5,27 @@ policy_module(ksmtuned, 1.1.1)
@@ -45335,8 +45341,12 @@ index 8eef134ac..a2ca1a009 100644
  type ksmtuned_initrc_exec_t;
  init_script_file(ksmtuned_initrc_exec_t)
  
-@@ -43,6 +60,7 @@ corecmd_exec_shell(ksmtuned_t)
- dev_rw_sysfs(ksmtuned_t)
+@@ -40,9 +57,10 @@ kernel_read_system_state(ksmtuned_t)
+ corecmd_exec_bin(ksmtuned_t)
+ corecmd_exec_shell(ksmtuned_t)
+ 
+-dev_rw_sysfs(ksmtuned_t)
++dev_manage_sysfs(ksmtuned_t)
  
  domain_read_all_domains_state(ksmtuned_t)
 +domain_dontaudit_read_all_domains_state(ksmtuned_t)
@@ -62506,7 +62516,7 @@ index 8f2ab09f5..8ca8a6f26 100644
 +	allow $1 nscd_unit_file_t:service all_service_perms;
  ')
 diff --git a/nscd.te b/nscd.te
-index bcd7d0a7d..0188086f9 100644
+index bcd7d0a7d..9b397fdd7 100644
 --- a/nscd.te
 +++ b/nscd.te
 @@ -4,33 +4,34 @@ gen_require(`
@@ -62554,7 +62564,7 @@ index bcd7d0a7d..0188086f9 100644
  type nscd_log_t;
  logging_log_file(nscd_log_t)
  
-@@ -40,56 +41,58 @@ logging_log_file(nscd_log_t)
+@@ -40,56 +41,59 @@ logging_log_file(nscd_log_t)
  #
  
  allow nscd_t self:capability { kill setgid setuid };
@@ -62590,6 +62600,7 @@ index bcd7d0a7d..0188086f9 100644
 -kernel_read_kernel_sysctls(nscd_t)
  kernel_read_network_state(nscd_t)
 +kernel_read_kernel_sysctls(nscd_t)
++kernel_search_network_sysctl(nscd_t)
 +kernel_list_proc(nscd_t)
  kernel_read_proc_symlinks(nscd_t)
  
@@ -62631,7 +62642,7 @@ index bcd7d0a7d..0188086f9 100644
  corenet_rw_tun_tap_dev(nscd_t)
  
  selinux_get_fs_mount(nscd_t)
-@@ -98,16 +101,23 @@ selinux_compute_access_vector(nscd_t)
+@@ -98,16 +102,23 @@ selinux_compute_access_vector(nscd_t)
  selinux_compute_create_context(nscd_t)
  selinux_compute_relabel_context(nscd_t)
  selinux_compute_user_contexts(nscd_t)
@@ -62656,7 +62667,7 @@ index bcd7d0a7d..0188086f9 100644
  userdom_dontaudit_use_user_terminals(nscd_t)
  userdom_dontaudit_use_unpriv_user_fds(nscd_t)
  userdom_dontaudit_search_user_home_dirs(nscd_t)
-@@ -121,13 +131,11 @@ optional_policy(`
+@@ -121,13 +132,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -62674,7 +62685,7 @@ index bcd7d0a7d..0188086f9 100644
  ')
  
  optional_policy(`
-@@ -138,3 +146,20 @@ optional_policy(`
+@@ -138,3 +147,20 @@ optional_policy(`
  	xen_dontaudit_rw_unix_stream_sockets(nscd_t)
  	xen_append_log(nscd_t)
  ')
@@ -77578,7 +77589,7 @@ index b9e71b537..a7502cd0e 100644
  	domain_system_change_exemption($1)
  	role_transition $2 postgrey_initrc_exec_t system_r;
 diff --git a/postgrey.te b/postgrey.te
-index fd58805e5..2ff8a1e4c 100644
+index fd58805e5..248d22985 100644
 --- a/postgrey.te
 +++ b/postgrey.te
 @@ -16,7 +16,7 @@ type postgrey_initrc_exec_t;
@@ -77599,15 +77610,20 @@ index fd58805e5..2ff8a1e4c 100644
  dontaudit postgrey_t self:capability sys_tty_config;
  allow postgrey_t self:process signal_perms;
  allow postgrey_t self:fifo_file create_fifo_file_perms;
-@@ -57,7 +57,6 @@ kernel_read_kernel_sysctls(postgrey_t)
+@@ -55,9 +55,10 @@ files_pid_filetrans(postgrey_t, postgrey_var_run_t, { dir file sock_file })
+ kernel_read_system_state(postgrey_t)
+ kernel_read_kernel_sysctls(postgrey_t)
  
- corecmd_search_bin(postgrey_t)
+-corecmd_search_bin(postgrey_t)
++auth_use_nsswitch(postgrey_t)
++
++corecmd_exec_bin(postgrey_t)
  
 -corenet_all_recvfrom_unlabeled(postgrey_t)
  corenet_all_recvfrom_netlabel(postgrey_t)
  corenet_tcp_sendrecv_generic_if(postgrey_t)
  corenet_tcp_sendrecv_generic_node(postgrey_t)
-@@ -72,17 +71,15 @@ dev_read_sysfs(postgrey_t)
+@@ -72,17 +73,15 @@ dev_read_sysfs(postgrey_t)
  
  domain_use_interactive_fds(postgrey_t)
  
@@ -94704,7 +94720,7 @@ index 7ad29c046..2e87d76b4 100644
  	domtrans_pattern($1, rshd_exec_t, rshd_t)
  ')
 diff --git a/rshd.te b/rshd.te
-index 864e089a0..a28dccd64 100644
+index 864e089a0..f919bc537 100644
 --- a/rshd.te
 +++ b/rshd.te
 @@ -4,11 +4,12 @@ policy_module(rshd, 1.8.1)
@@ -94722,7 +94738,7 @@ index 864e089a0..a28dccd64 100644
  
  type rshd_keytab_t;
  files_type(rshd_keytab_t)
-@@ -17,9 +18,8 @@ files_type(rshd_keytab_t)
+@@ -17,51 +18,66 @@ files_type(rshd_keytab_t)
  #
  # Local policy
  #
@@ -94734,9 +94750,10 @@ index 864e089a0..a28dccd64 100644
  allow rshd_t self:fifo_file rw_fifo_file_perms;
  allow rshd_t self:tcp_socket create_stream_socket_perms;
  
-@@ -27,41 +27,56 @@ allow rshd_t rshd_keytab_t:file read_file_perms;
+ allow rshd_t rshd_keytab_t:file read_file_perms;
  
  kernel_read_kernel_sysctls(rshd_t)
++kernel_read_net_sysctls(rshd_t)
  
 -corenet_all_recvfrom_unlabeled(rshd_t)
  corenet_all_recvfrom_netlabel(rshd_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 73ff7051..03a9bd86 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 273%{?dist}
+Release: 274%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -681,6 +681,17 @@ exit 0
 %endif
 
 %changelog
+* Wed Aug 23 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-274
+- Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
+- Allow nscd_t domain to search network sysctls
+- Allow iscsid_t domain to read mount pid files
+- Allow ksmtuned_t domain manage sysfs_t files/dirs
+- Allow keepalived_t domain domtrans into iptables_t
+- Allow rshd_t domain reads net sysctls
+- Allow systemd to create syslog netlink audit socket
+- Allow ifconfig_t domain unmount fs_t
+- Label /dev/gpiochip* devices as gpio_device_t
+
 * Tue Aug 22 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-273
 - Allow dirsrv_t domain use mmap on files labeled as dirsrv_var_run_t BZ(1483170)
 - Allow just map permission insead of using mmap_file_pattern because mmap_files_pattern allows also executing objects.