From c1300100ed07f8f804713fb85f0bc701a634f861 Mon Sep 17 00:00:00 2001
From: Lukas Vrabec <lvrabec@redhat.com>
Date: Fri, 1 Apr 2016 18:15:00 +0200
Subject: [PATCH] * Fri Apr 01 2016 Lukas Vrabec <lvrabec@redhat.com>
 3.13.1-181 - Label /usr/libexec/rpm-ostreed as rpm_exec_t. BZ(1309075) -
 /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on
 execution.  If /usr/sbin/sendmail does not have its own domain to transition
 to, and is not one of several products whose behavior is allowed by the
 sendmail_t policy, execution will fail. In this case we need to label
 /bin/mailx as bin_t. BZ(1323224) - Label all run tgtd files, not just socket
 files. - Allow prosody to stream connect to sasl. This will allow using cyrus
 authentication in prosody. - Allow prosody to listen on port 5000 for
 mod_proxy65. BZ(1322815) - Allow targetd to read/write to /dev/mapper/control
 device. BZ(1241415) - Label /etc/selinux/(minimum|mls|targeted)/active/ as
 semanage_store_t. - Allow systemd_resolved to read systemd_networkd run
 files. BZ(1322921) - New cgroup2 file system in Rawhide

---
 docker-selinux.tgz           | Bin 4316 -> 4316 bytes
 policy-rawhide-base.patch    |  41 ++++++++++++++++++++---------------
 policy-rawhide-contrib.patch |  31 +++++++++++++++-----------
 selinux-policy.spec          |  13 ++++++++++-
 4 files changed, 54 insertions(+), 31 deletions(-)

diff --git a/docker-selinux.tgz b/docker-selinux.tgz
index 07d72384b4842da52d1552b9b6cad807bb294d90..9c9c4d47815a65f8713442c5e82940cddf6951a0 100644
GIT binary patch
literal 4316
zcmV<25F_s&iwFS2o&Ht;1MOVvkJ~m9&sY1e5RwAfJtX@|lK@HE!=b$o_u+uz+K&ZP
zS)y%q^*WJSuP?~|elvWDqDVc~-eh}c0f}vK=0|ck8qN$yo0Rb_sV~y?v&Xxx;ClD&
zTl~C!|MtrKgzM(*n>TNsUEjQW|NiauyZ2Xbo?TtvyuH4D7F<2znDo_97S%!UEW4|t
z6^XrcW9@&^Yx&|u@EvXPJgWCU{JJGUS&`y3Et@(fK~z;)8b>TGiy$rw7NrHL15#|@
z^WwWp#kK^HX;-H=__6r=J&7Aef`qGKkQM>k>R(BjLys4n>C)f|zN?}-%7Y@x$@k9%
z)$<>E*gx@xAj-0GN0NY*0jr~erZ^oJ=p{#m@5{7cq+UlcIs07<C4^2m^UGJiFBcn9
zgf;nhlh#16TrAkWQezI;EA@@Q)I#=gxp;ZLTrT3WCUKsGltgvB4OeM#_RaPAa-o33
zDq_$n-n9_)Pj<dUs3Xfd2KhWKS>v=v<vdNgaa3^1zElsC<uAM=CCV&a1qqBYW@Vic
zIzx(!At^?2OejZN%n+ZH0gP!>h<8zqbgdkD&%rm>J%SG~y+9(v*RUdWPJwHkW`wFP
zB{diQF*Wr`iI=O-ml3W@do|O6BK{YN5>vi>A-}F<YZwxr8z0Mj`FeG6!I4F?!^~=+
zM-?*NMm2ddV&<cnC}=@DLCjf787i<-$`Zx?J-Rw0d|7e(0N&}V+FR4V@uwJfPFj&T
zU8f|Gn<wsiq-(i&hlyBqWIk}ueJpc!fHt^n)C0uq5cEHzBHEBAW}|XGsK>EV68m9x
zN^uW9507W*`iu2sHf&?b&^A57iup|5<B9u6uzg@<%GDnrV~VbPq+}0WbmYHB`d!Ml
zK?GC{1Cg>c4)}~)A02EL(nW?*tLpR)J3-1XxPlh497TwuaNuLa%BNDUxn&g+K}#HS
z5zXmJ@P=^~QR?Z6xAps45!qcbr$7AvImFv2|0w(ZIjbAr6p_^Gc16-+GpSq0GokF)
zw3ycUM0lfCL+ih}fq!q{-?v9}q<;R#PfuYd;NC}-CNuVdx+y$X1#sw8SCymm?;JPe
zqNKh%JRdVC_Fj%)R*<`=jN~!P#uG9hts6~|GA`kEEd*L3ogoD+79>UTnq(z<%^;N&
zl!dnh@>0xl<<_MDufS655?mXBV@H3+Fh1Z%pjTeUe?u&CD1qF9<WI%ATvVVxb%~1Y
z(xamUHc^oTyE^T8yE(~W+xf~*=MF@YPf`wNY>ooX1A(H1IzwW%z=FV%nDJCqY(IC8
z4J>f4$bva}w}yiLusyeBsMuY>DRno+myo-PQIsOKpnUMtmZhTl5O3>HsQNC1&W|Hl
zyhKdaMqy%CR077#H7VE}@#59*W<boGVY;Z>4HP?1LODc~{6x_kd$OxpM`_s5QTeRg
zaJ6><$_>f|xGi&HFSOjI<Q~Z9<JqjR{Z;T>G+Y43^YfVq6z+sw7`!zb2i#(f@H);?
zkh;VG!EC^#;sSD_aLFlz>^|=Ft=7ZazX}A5{tbXB-jtoxkkSC%S*M!|QrsN}Z(CAE
zj|auQ+@qk?gqGRe1<v<CK(Pq8vr8Z_eKi<>FiP^Y5W0?uSm$DjCqaQ+=%qX?peu_)
z1{2b1mFRy(0qptr0cBv&a{deu_LWZ;_)ySb;do~phfQ^WyB*AQf{*6l80+!N&p)<@
zpY+MDOBGLE8>B^(3LjHfMcn4TO9%tyrdCXwTJ9|e|A69A;}LX$92P5QZTQXvtO|we
z21XUg`SFN?Kfoz;4EsM%XcX#s0{fWOWs%SF1Ri0b_z34mE$&>BTDpM%$J+d17j@j-
z^lyr7WynL8@kQ_nT-X|>7|?W6M49mFg3li(1R(&+Ev}<g^*@|}^RgS6Hm_0-GRvUa
zVnzXuaSI_Mt8ytc^Jbh^PT7ugNBE32ABi<p;D}FgFKSfDsIV%tG~RQyRPn70Xd&7x
zm`eGd8|@?U@5`emD8i^=TX~e<%~J4|r&P|sM>@HFgj2T<xiQT{DoG5O?!Cj#!W?UI
zXj#c)SX?#vX~KVaWr@LljQk3UQQ26^c)ov)+pFP?e07&Y946!7M%)c0PtTUXX^!nf
z3x#~54jWgNnclQz9IC8=?d6D`wGBAlFyDwc7Os<C=2?eT*%S%oMg&hej$_TmL5+r=
zYscGhO;0Ntb5TvOEg$Xx!|omxdxa^tK`}q@cwvLC_f-i~5RP(6r3Am6!o&Bv%t#zn
zm!7%<J;qt3em&PlG>Qy*i^(PYwM%RN6qn4UG4hCgjMRU>zj4%m-+X(j|Nat}aP-5x
zOdys%6WZ`9xW2f$xSD07mM?;zNSwjrk3KRuCQEJv5<+8nVo}Mn3WBMB@Lq!5mVk>>
z>ok4D?UTwA@Ms=F{a=6lIjG8->GO<Ani>I(hJ!Ulw9=#38yr~3SHU{UD1n(+=GkRm
z_(@+9k-RKIVG0$ZUDSQP6zw5xR)2(P62{x8*br>Zc?6{yH6>cZA+n|EDoGx^btXL{
z<d;W{Va+!&s;HNJ7vW?7-uNv2p@%s<!`tX)-OoC$mdK6c3c<za=7`l@XAUYmi=X1A
zJTE!x5L(=A0z>pDfAgXCa}2I5iQvoB$-`NvxyQr1vJVl?%w}5+^U9D1{4g1KW1nG7
zJ1p?iVnPCk?A<HoNOzcwegD$UZ_`;YoqUwa7U-L2eJYE;J!KS!hHQUkwO9=L@T;$C
zx-@Z~X_F=jRzAuCVKU)<B##}XV@FB0{s10Nv`Vv-?SoH2ye)S{aGQb|Tf;X%SX08%
zB*<@zG6@R8L^_avgV0h}81Nf)v;$1G21v}Nxq1W3r_!r6$zXrVFum%cY?E~x0^u5~
zyV*MEr_RzmWxPi!4^Tb5>Ld>y<Qf?tkwtQGxYEJAi|)-K2o_flWo?ok>nKmVjyJ)I
zKk>Ao6)6(1xBdvuH0aK9&fbQiPm{Wq%vD)9leb?9Iu&5_G|UfVorz7Ghcd&C-0w6Y
z4gd&F!s4Of8~okl*=ge!8$vJtJ8kS9W^3>93|ujP!h!SS(BQK^oSr)Pjs0u-(EY3v
zw9m=zK85%38uL~i2A|LE2ioNMpfp+3d4j=ZfFh0Ox-Rq9kfQmUCPThicYjTl;SlQt
z89Ld!9)(AOlG7u>$@4~k!~Q*E?t|>p=07q5xjP+zp~{vHfLLV@pNU(UWix+u%+TJC
zOP!eZ^#J-|`i_3}5W_J|%h+IafmdEO1uKiG&yV*#ooRYB#y&xhyb$gQ%jUVp#J@JW
zzZdd`r$Wr(U<`|P@EwHd3O)s9f|5^xIReCl1s{ZQFM8*F%^Az?D-atR(?Mo=uu6Qo
zl*b@+N#21t6IaU%<0}3eLU74e&xK3bz5e|=R%_9B`blb|Dh##k+n;45D}xaupl!!%
zgtqXrAelUB6B!_W;%3+alLSJ?U0L4_((uFoJ&jpL9TYpn@VCRPXuKuK05(ROrm2z%
zEvzu+M*&gH(mPPX#Dteb37&2?39q`BaH56wrnFS2vph|;G7@&@-6pyvS!OfhBr&Sw
zf%gV})@d9<Tuv+$MMoj}1I#;3o35u)&Oyawr-zo0l*<<rq8=iZ{@gNF4S^}TxXkk^
zBljVfzK4N_(39rxr1Z?cLpwAtB%HELn$86#4F%UKBN=Ft2#Qt%Wv)ahA=uoBq&6&i
zT%y}eT{cy}TiGo9D7w$Hw79hh<Z*7)(POyZ>9^A<Wo3=_wT^ZnPt@FlACaW=)+FLd
z416vNN_Q!Xw??C^T(M^ezDiQ=Oc42wj4A~%ns^J|Y&t`03!`wYIC@SuCP{|^Oc4fe
zK+^GlQW_ge%9C^He<C}v&V5l`fYT8WX;><)RzlWMlQH3E-FNiHBolhm0oha3yhM6x
zp{P<eWgscIAxhVM1V_<TUFBUz@m$;!LtWXoEz*~6&^0JTnNgQ0JRE7o@L**Q3;y|_
zJE2Mb+!#OpUcLyj`&iU);&IVvHZ_Uj5Q{nLG$FXPZqfulD$I|<XM;cYRAyB1+o~)X
z{{s83`YKBm(HkF4lS*LufkNi}$$t4B*sFPTqQdgy6CJ|Cual2~*k<|tPCC+^k5r`M
zVd-WwoiP49Y_h4_H0&o=N;JTyPB^a<v$>xJlCo{(uS-BK=ems_$B6q8r$5FrkC~*y
z(i%6vQ?n7i&|O-=<6Eptm)rC2hENvrcLX~psRof8V3>n?fmL?+Rf@vlKshM9?pafC
zmlSM0uZQTIBKAmn54JAFT7m~^ZZ4*yX0*UCFp)s5W^Sk&Ku%l@*&VkEtS)U>eB%xg
z`?s^Qto%%FM7c?;v8EJa1QdsRFPGuSTq?H@(Ia#1>TXIMj*pY-kh@1Jb{neRPwqoW
zRYDSPV*&ptiJLk#LKGK5ci@)iBR1fke*!H{;cu&nuWfMrT1e8>ve(dVce-LarVH=6
z;`GPXQgEMbrZ30;P|mgiz06i!pN+?b=#J@VfbC5J-CnW$-oCH&9C*4z=B;wjo>nE#
zra+S$;~y0WS-0;cnl|u+T6X~KA%&ZkJH*d-h0n)VPoL~|oT`?tW}*J2Ua&S0)oGO1
zo6rQpL-tk)7^FI~#2fv%vLzEDYa#7vI4M=;eG;Lipe~<kQ?+Xg-|=mLQ9mqMHB@B_
z@T+*$(R3U|Aqa2VM*SACFrw@oEB<j6&2bLCE1+TV&?W6`0xqIFinnRe*?dL)q^pm0
zT9X~DUE&`6ORq>8z5jGPXdiXKJ@rCtl2IqOU^ccTp5vHzY0W%wglMyUety%d_^#%V
z!k)V-@14-9v8SDaMCJ7ciIf6&sQ8MSq%VSXS)+e1x!Tt!LMldW4fB;QZqlQX7Rl_$
z=;DQ-f`=l)P(u=7K}5<6O^w0WKCC$axwwu>3UQpW=n%IRrY-)0uePi~(~B*ejaoGI
zTD>a=<4RYUwB0006!Z7)+@zhHk_&fU?J-1Y_{xE^@`Zbf7?@f9wRNZweD0U$4wbX@
zUS#Qc^7^z!`l{m`MrvL1*h;})TWrHWZ-D1`fuZL+JF#U*<Tx^bz{t!a%Oiv7GqR;3
ziWo3d&Z7Nuw<#Jh!p6H8zKw-5w7bg)OV5;oW67hg5x!x|q26NEW@ENuOS$p4M21Sc
zL}BFY+9#83W&xCrOI=t-QbbpfwN**(-9o*mF?4`5@^*>0VfakxU{wDx)4|Z*lc$Fx
z4;)5~f{q_dji00Fg}&_`3EBAqP3KJjYYHRBs_LlvFcXronsy{*s_4FUY5f1iC1ifF
ze#{pehTs3VdUNyUUGM#mtJB~A|035VX2vgnlO>z{JuG<yawd1y=7aphi1i2gfXZr5
zif@QqHnhH6rNyNLSS((@o`xb{M@AG2<aJTrm06RM*TP0l$28w_*1+H;NnjuTL*ZL|
z=}yT{+0TVcXG|ZzQ3T%|zZ2h{hwks8-7PP{z)SG6%ZtC9|8+49NEgrw6xh=Ysn0@c
z-C90>g>>6MaK(;+BsJk~O(oheST|Vg$O;i*=YHrc#ip;v)*}6ee;{kR&WvE80|8+4
z2w?K>WgTy(mqKspEX1DQWau1FTxR$2EIe65ZK7-*0OHgBOU$Ot!cuXZOKsa%{{ium
z|EaD=K}Emp2*7|QOv7*Z_sQnteeK=xbe*o#b-GU1={jAf>vWy2({;K|*XjD-xc&=(
KGIbUJcmM$I(RkDV

literal 4316
zcmV<25F_s&iwFSgulrU21MOVhkJ~m9&#V1c2uXqL9+KV7rb&QJ+ry!~hkH1nxc0Gt
zDoeDjuD(vB*6R!MzuyeML{X$Z*4|`$X90<Aapp&II2z6jN1K%KEvYZk^|QyjuHbtA
z{#*Qf^Woi<`3cwcySH!OK6`Wh{=@qZ*B?H-yMA`{=K9_B)wAI05yzyjhO(#*f@j%X
z9j!?0r5kJilU~agFM{uAljl*r|KZmy3CfBTuW8xTF$too%F;MuX;}nuS+FQANF9)3
z1D_Y)T`IOEfK0nOy}^&g-|tD>FcKtO4TH1@*jE2a${c#U;7peWSMXgG)lnW4QBJ;p
zE~uXW(8K<THw00Zl{=CItPEHk6*R@^xIiyCDtuq21tax3ipkmUVkjYW!kJ&b`hB_B
zkRq(fznioMg5_et_LUlQ$X=;$1f~|UkITi&^W}08mo<s=B%~y&<88P~i?eUuoG%v&
zIIJQDo#I^!LH}guON2VItYeVR(~>n#dsNQTq#H*Cr|e7hKw196J5r*|(p8YaC}URE
zDWNl@xEPXR6vu>ew8aeZNg2SHMum76)kxRMk@p;Y^QK2|1Jes6GJFjyQs)%7)@eql
z>QYj3(H~P&pOkpH`g|GTy0lj_9Vp^|kti|c%NO$NO16d}@wxG_%$KiM7Z)5^G&{_!
z26|K>(`{6fCnIJ)nu&rIv=hXfrIeupJEbg9?BAoSGs2e@w-4Z*zN)=7{TqLZap$BJ
ziPLpT61jQeu1C6-i+7laRY&Fn_uR)aX9sA5%SJsw%nm{SGb*ADd15vy=Yx72D<!cX
zW~UVQ;Pdc!mae~8PiDh5mJDsvBdnOu<UO9ae+1hHR;FD20WzlO%127}&_zf7d!*l`
zY#T&C)i4k#OXGmgxb@M&b|GD47`3WS@30f3{DLcJA<I#OI0^?oMyz})<(gYoArZ91
zF&ELCt^{uwXAz~Iu6SF&uN9HqC3E`2|DQv=jq;DO@1L`}@l6p)t!`H&EjE+7bvzTw
zeoc#Molk@}YBjX}n``*@7XE#EL`Ul9fBf_mb^`8wRB19}AE=wcV^si$PIXl|O8?Gr
zLoQ0{yTkJ_gJSRH2xbMjd&)>2vur#e^U=D|6e;5pZr4JfCDIvE&|*PSB(F(UqSp*k
zNkLh7OCT@BELUz_3h)Xn#V*0M5jb}AXAI*8KLWk-I{q7CkwXdO79@Wv*5#rC{i#b-
zY?mG#C9sK#B-qty&)dyO4%^OGemZv`l6;bKIAe1Za2^O0CDa)bvjr9emc)#ws$%=O
zdu(8Vdqoz^$-6Za^oQ-aEknib3QnoJDZYf<Rg9t(u?6LWpSCO&)lIyuL!s)s5IR4O
zVDS<$SsR6kT~P@bGuNbGbHs~RzncLubB5`nZZ}ZuJPG9xQSuW-Z|upgW*wzrLr3Ma
za>Lc$1t>Qt7vQ$ciM`Nro05AVpO0s=!uD6ebJ1`C9M8{ZB2c&!c46?=Y#eZlHNxvS
zOF`-q0|c`Hmx>F>iNYnP5VHHY)3;g=Z~rO~F#0zDrg&3!QbS4ubZ4DzE=X~A9K3Bw
z89g2p_i~SdRufugcNaL{0|CV%;La|A!1UE%0KzEA(?aMvCSsk7DV_uca-o;<uz;>C
z3K>jDt5u@^6$P;8-v^X|LCg6wK-gD4UEo7OgN5UraU3?)0q%A%(+NJBgJZ16FF*g-
z9)8j%yDn8cd2NsuO)7j$T@`Vg`z|32l$%;HZECr<9Q+2wqsAlX0y!*J&f4&u30M^h
z*A0v+kn`ga1%H53=ot2Yp3o@N^91%Wt;-^x<q15(Lh%vKk6PThB(-z{0gko#!!GK$
zyXoH)+scrKEaQvd6S%N7OfjJ8rie1()dinFP6$E(mRnp$tLlF^1LtKoGHqU^9%Pn5
zwZ)7A9OD*3MporgXy(m0ubi?S=Z^3hYd#Wds=yJS;$GCKl2Kt*W@)_VYN_H|8PGzs
zSumCIKR4P(;@_7?O;ChU!?yA$zni7tEl;VOfsb@@{RpRSA97=whg6anFx`8HorO8p
z<j}H`$FR6+^3#O>@X8W{{TTTb6r-}Sl<|E38n;)&8~N%khd4~e!Hu{ZN}irAfzuq@
zhZYL?L>)G+EHk}n%Q#e71KZ0HJ!>0qykWi(aV%UXz09)?tFkE)%8dw~avaB+i-Q^s
zKi7`8<C>mUH0Gk3U|T-i0fyZ@D)tIfZi8Ze;PJu+UGJ+BrXU>Ulu8MHIfaMsb(xVk
zsxCcs2YQUNO8t7Sjc61Z^cIs#_-mKe{wXe*OJn2_`xvSJ{&4N6|At$q`tL7r2}eK7
z%LHQSGocNyf;Sge7gw`v)bd5}6Nxi;{Lx1S$7IQkKtgCNPb?~VRzWcJ58g|#+Y)eb
zYMrK!xP4N20v^pnsQ>GaKL=G=Gku;>NmC=B(QvS)h*o;^dV>QC`6^gP86_|i%RIa6
z3qR>gB9fOyC`_S3w2QjWm!dtS&FYUZO~QB^6&r%BIgg+;qozb_I7GHIT_wqbx6Y(z
zg#7ZTF|7F}Miuq4?;?Ec-y5H$KlCt%XLuXktovD~)e^aJTp_sl+#IpG>&!uAXYo_q
zl;<U99YTw{O<;%~<!?UJevZMFB@uj?I(azjH1~LTSN0*onb~ZsVO|;XfFC9UZ|pOy
zX@>=VT1-gbkiC1w9O({|vF~5H`E5E2rjw6S*#dp@tWRa}x2KHa(2(uVtQLzwAAa>!
zO_wIlGi}mD!OBNjAWSCQkL0nVbnGa});HksM5{DQ**^Fb#M^RL1h*-eu{C@Hgf%5B
zO@jQkD3hQdOr!((HwZ0tg#o`&M?1h|Yk<UTnyWXkd@8+KlMME!4AZMF$~IZIArP*y
zx|^+oe(EgEQ^tFw@&MJ-t4{LZL9UVU5m_V`hbtY-yXf8=f?#p=P}U~tv5xYz>v$ck
z_!CbXT9G0Fd+U$jOoQ$$=j?4L`ZTF)$y}9%GkN=!pi==xPs98`)|uF}c_=gN$o)<e
z;sAi)BrF~pzQNx;o}D&+u_5&GzthI<VYc=j&%hP)Cmc9G4h=r*!|ADm-`KyV58cl?
zLHnHS?o)UluQ6}cVet9fexOaB8>Pvj&JzqS0~BdI*L9h<h7`@;G#T>Ey8COY42M`J
z$k55&^(Z_Nl$;(3PM$aV8}{!Rb01`%Hvf?k$ld7x3{|#t0K_VL_)Of&ESveOV}|yA
zT<XNMuLsZ%(|7c%hZv4&TE+&W3%v5ODOg!deSW;}=}gn3G4=_1<b`lgST@f!CjPb2
z{k@PkJQZRN2V+>YgYO_rSMVt?6O?=k%n=|aEchUdd(k`ZYtC49UxC=rm<}?_gH__w
zr91|qOY#oHnYdbB7+3M%5Q0m#dM;eb?)C52v0971(@#<xRbi-Q-~KEkSs9EN0c|^8
zBeaE|1<B-5o5%q16F0*am?RK7?#lXhkcJ=r?`h03>Y&&mhQA$VMdK|=2Cy;OG)<LE
zXkmphKMIIqmfnF9CMLWjO7L{ENqE)0gcB{aH>IUIo#kn&m65PJ?>5mb$ugS}Cy7xd
z54<<<vrgj>;&Ni4C^`z!A7I{T+H^gYat<mcJ3X{~q+Gt35cLqL^yikbY6wix#busX
z8MzO+^gRqbgq}2iC#7fp9onIJA>ou|(sV8`X(+f>8OcDCL{PLED03x33Bl%0B(-7D
z;}YF&>awZ&-O6U+N6~$rrNym9AdhpSjvmAPPQRT_DJyHVuXVHwd7|bX{D>r_w<Zx!
zV&HRGP`XQ5yfqqS<%&H+@Kus>XM)IgWK=1D(ZpNuX44s3TNs6F#nE%RF-bZUV2Ut!
z1CoyalhW8&Ql6Yk{}b7Xb?%Gm0-TP3NW)TTwGy(9nv4lQ>%OBmCYjKi4#=LO<|Wco
z3q_T(DFaEt4N<!8BRGn#>MHL#is#~<80yNtZIQlogRVg#%8a^1;o(Rth6gKiSn$sW
z-3d+d=f?Q)_wq%M-N&Ma6OW5Vv#CiGhgi%}rwPHWb(1FeQDJ@*J{$bGr!u38-&SSG
z_!roJ)mK@nh~D^Unp6VI4-_)*Pxj0Az+TOx6BU*ppXd-Cew};_#5T+CchZsWe54{3
z4@)<j>4fp;VUtbWreQz1QlbGqb;5a_n9cn(kd$pJe_aA{IoECcI7Zx$IQ=n}dCVjo
zme#oWotlmCh3?V{9^YbJy4;?BH-xf~za!W=Ni~S%0K**A3#_ukuTm5a2g*U=b<diD
zyQE<2c|Anu6tPFrd$4sW))G8Wb8|5rHKPTFfr$iaHFHDN0CM7L$nLmRV0CH3;v08}
z*uR~XW#wmbBg#!$jWwkZBcM3kd$|lp=2E$Rh#r}1S9eqDaD1Fphul3<vD;AfesUj5
zsuGfT8w>bHN!-+_5u&&dx&ya7AF%=V{1a$t3V&Nod~Ji{*Fuu6mc52{yVDiZF<p4i
z6{kP8mV*0iGkrP!hjO+J=w-I*`fNNdM0ZR_18i>+==O@`_x63I=fKk)GH;cG_OvQ_
zHU*m882_k1$hv(m(X@dl)Vc#;4=LQV+#!CxD||k_dirFy<5abDH4F7G^@6p5s7|B2
z-h?I)9<sMez#!F;CEn=Al`WYNSqo`T!%3+!?~@2E1$FsUo2p$~_>OM_jQU~8s-Y@d
zfM3O{j;7-%3PE_=HtM&Cg%M@%Sn-dmXpVF6T>%Y?hc0Pn6L1mbQM^ry&gLuXCtZE4
z)0*sH?GpFkUwTE-=>4bTLHno+?x`1IlZ-mK1+%d&@f^pzOKawdBSf3+^Yfct#dkG_
z6!zRzdGCZ)jXmuYBr2~rNTd|FL&aCrBz+OA%NqTA$<@9-5mGT~YnZQeag!d6v`A)0
zMi(yx6+9FXh8mIx3nEfpXle|`_F>Hd$i;P3Qi$V}MTfYpFm3S{e6?i_nqF+#Y}BHu
z*Xmt47+1Q&r0ph2qL{yT=O*pslw7#;YL6jG!&eTRl`q^=#K6q*udPFk;B&t`cc`4L
z_aaNrlh>y;(pMelFjDK1$5smd+F~32c>_Gh3k*Hq*@-PfBFB*d1V&~aSsocopOGyU
zQN)0uau)5MyG_x65jNh%@NF!dq1|0ZSbC-u97`T`jqnXy4)qqRHXE}QTgr{UB{Edn
zB?=>F*FKqSGYg<}T<XFyk|Mf-tgT9N?-uGkjiCdik+(~{4Z~+j2c!CrnGS~bo;*Dq
zdEhW=6m<MxYWy5UFZ6BqNXX6?XgY5KSW_4|R#ivUhnbL!)wCliQ$_c+OXL49E+O-a
z^<%!+F#P_<)!Xa0?|bimygB{-|1WY~VrKmEH(9dD-@}qeAZK!CZEoZrMyzk-11hUM
zDZU|c+0goOl@^y0V6k}pdK!v+9T`z9kk>_dS7uF4UJDyJ9n*ZzSp$QYB!PYS4~1{>
zr8^}*Wj_}(oiTm<MiG2>{7!s(9=gAWcDK9)124hPE-(Ia{@2AcAYDK!P+(6pq&^F&
zb!++j71C`3!4*3OlGKE|HI-<?VBKJ`BP&FNo%^A)6q~*tTZ{A?{(-FNIx~WW4g`SF
zBY?@jmvy|EUJAXXvk-fJlc94!ahcu6v+!gMwTZHM0EkcfFEN`o3roduF12l6{RhNL
z{-?Sg1r`0WBLD-MFb%)q-zS@o_qBJ&({;K|*XcT4r|Wc`uG4k8PS@!=U8n1R<N7c5
K@OIq*cmM$RaZRrP

diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 0a4879b2..5e5ccccc 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -20639,7 +20639,7 @@ index 8416beb..99002ca 100644
 +        read_files_pattern($1, efivarfs_t, efivarfs_t)
 +')
 diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
-index e7d1738..b00be59 100644
+index e7d1738..7e37941 100644
 --- a/policy/modules/kernel/filesystem.te
 +++ b/policy/modules/kernel/filesystem.te
 @@ -26,14 +26,19 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
@@ -20670,7 +20670,7 @@ index e7d1738..b00be59 100644
  
  type bdev_t;
  fs_type(bdev_t)
-@@ -63,12 +69,18 @@ fs_type(binfmt_misc_fs_t)
+@@ -63,16 +69,23 @@ fs_type(binfmt_misc_fs_t)
  files_mountpoint(binfmt_misc_fs_t)
  genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)
  
@@ -20690,7 +20690,12 @@ index e7d1738..b00be59 100644
  fs_type(cgroup_t)
  files_mountpoint(cgroup_t)
  dev_associate_sysfs(cgroup_t)
-@@ -88,6 +100,11 @@ fs_noxattr_type(ecryptfs_t)
+ genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
++genfscon cgroup2 / gen_context(system_u:object_r:cgroup_t,s0)
+ 
+ type configfs_t;
+ fs_type(configfs_t)
+@@ -88,6 +101,11 @@ fs_noxattr_type(ecryptfs_t)
  files_mountpoint(ecryptfs_t)
  genfscon ecryptfs / gen_context(system_u:object_r:ecryptfs_t,s0)
  
@@ -20702,7 +20707,7 @@ index e7d1738..b00be59 100644
  type futexfs_t;
  fs_type(futexfs_t)
  genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
-@@ -96,6 +113,7 @@ type hugetlbfs_t;
+@@ -96,6 +114,7 @@ type hugetlbfs_t;
  fs_type(hugetlbfs_t)
  files_mountpoint(hugetlbfs_t)
  fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
@@ -20710,7 +20715,7 @@ index e7d1738..b00be59 100644
  
  type ibmasmfs_t;
  fs_type(ibmasmfs_t)
-@@ -111,6 +129,12 @@ type inotifyfs_t;
+@@ -111,6 +130,12 @@ type inotifyfs_t;
  fs_type(inotifyfs_t)
  genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)
  
@@ -20723,7 +20728,7 @@ index e7d1738..b00be59 100644
  type mvfs_t;
  fs_noxattr_type(mvfs_t)
  allow mvfs_t self:filesystem associate;
-@@ -118,13 +142,18 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
+@@ -118,13 +143,18 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
  
  type nfsd_fs_t;
  fs_type(nfsd_fs_t)
@@ -20743,7 +20748,7 @@ index e7d1738..b00be59 100644
  fs_type(pstore_t)
  files_mountpoint(pstore_t)
  dev_associate_sysfs(pstore_t)
-@@ -150,17 +179,16 @@ fs_type(spufs_t)
+@@ -150,17 +180,16 @@ fs_type(spufs_t)
  genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
  files_mountpoint(spufs_t)
  
@@ -20765,7 +20770,7 @@ index e7d1738..b00be59 100644
  type vmblock_t;
  fs_noxattr_type(vmblock_t)
  files_mountpoint(vmblock_t)
-@@ -172,6 +200,8 @@ type vxfs_t;
+@@ -172,6 +201,8 @@ type vxfs_t;
  fs_noxattr_type(vxfs_t)
  files_mountpoint(vxfs_t)
  genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0)
@@ -20774,7 +20779,7 @@ index e7d1738..b00be59 100644
  
  #
  # tmpfs_t is the type for tmpfs filesystems
-@@ -182,6 +212,8 @@ fs_type(tmpfs_t)
+@@ -182,6 +213,8 @@ fs_type(tmpfs_t)
  files_type(tmpfs_t)
  files_mountpoint(tmpfs_t)
  files_poly_parent(tmpfs_t)
@@ -20783,7 +20788,7 @@ index e7d1738..b00be59 100644
  
  # Use a transition SID based on the allocating task SID and the
  # filesystem SID to label inodes in the following filesystem types,
-@@ -261,6 +293,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
+@@ -261,6 +294,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
  type removable_t;
  allow removable_t noxattrfs:filesystem associate;
  fs_noxattr_type(removable_t)
@@ -20792,7 +20797,7 @@ index e7d1738..b00be59 100644
  files_mountpoint(removable_t)
  
  #
-@@ -280,6 +314,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
+@@ -280,6 +315,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
  genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
  genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
  genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0)
@@ -20800,7 +20805,7 @@ index e7d1738..b00be59 100644
  
  ########################################
  #
-@@ -301,9 +336,10 @@ fs_associate_noxattr(noxattrfs)
+@@ -301,9 +337,10 @@ fs_associate_noxattr(noxattrfs)
  # Unconfined access to this module
  #
  
@@ -43490,10 +43495,10 @@ index cbbda4a..d7c67bc 100644
 +userdom_use_inherited_user_terminals(netlabel_mgmt_t)
 +
 diff --git a/policy/modules/system/selinuxutil.fc b/policy/modules/system/selinuxutil.fc
-index d43f3b1..04743dc 100644
+index d43f3b1..c5053db 100644
 --- a/policy/modules/system/selinuxutil.fc
 +++ b/policy/modules/system/selinuxutil.fc
-@@ -6,13 +6,14 @@
+@@ -6,13 +6,15 @@
  /etc/selinux(/.*)?			gen_context(system_u:object_r:selinux_config_t,s0)
  /etc/selinux/([^/]*/)?contexts(/.*)?	gen_context(system_u:object_r:default_context_t,s0)
  /etc/selinux/([^/]*/)?contexts/files(/.*)? gen_context(system_u:object_r:file_context_t,s0)
@@ -43504,6 +43509,7 @@ index d43f3b1..04743dc 100644
 -/etc/selinux/([^/]*/)?seusers	--	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
 +/etc/selinux/([^/]*/)?seusers	--	gen_context(system_u:object_r:selinux_config_t,s0)
  /etc/selinux/([^/]*/)?modules/(active|tmp|previous)(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
++/etc/selinux/(minimum|mls|targeted)/active(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
  /etc/selinux/([^/]*/)?modules/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
  /etc/selinux/([^/]*/)?modules/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
 -/etc/selinux/([^/]*/)?users(/.*)? --	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
@@ -43511,7 +43517,7 @@ index d43f3b1..04743dc 100644
  
  #
  # /root
-@@ -35,19 +36,30 @@
+@@ -35,19 +37,30 @@
  /usr/lib/selinux(/.*)?			gen_context(system_u:object_r:policy_src_t,s0)
  
  /usr/sbin/load_policy		--	gen_context(system_u:object_r:load_policy_exec_t,s0)
@@ -48017,10 +48023,10 @@ index 0000000..3380372
 +')
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
 new file mode 100644
-index 0000000..45fcf4c
+index 0000000..d8fdd7b
 --- /dev/null
 +++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,919 @@
+@@ -0,0 +1,920 @@
 +policy_module(systemd, 1.0.0)
 +
 +#######################################
@@ -48889,6 +48895,7 @@ index 0000000..45fcf4c
 +init_pid_filetrans(systemd_resolved_t, systemd_resolved_var_run_t, dir)
 +
 +list_dirs_pattern(systemd_resolved_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t)
++read_files_pattern(systemd_resolved_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t)
 +
 +kernel_dgram_send(systemd_resolved_t)
 +
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 60084695..31b767e3 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -2540,10 +2540,10 @@ index 16d0d66..60abfd0 100644
  optional_policy(`
  	nscd_dontaudit_search_pid(amtu_t)
 diff --git a/anaconda.fc b/anaconda.fc
-index b098089..37d428c 100644
+index b098089..fe35beb 100644
 --- a/anaconda.fc
 +++ b/anaconda.fc
-@@ -1 +1,12 @@
+@@ -1 +1,13 @@
  # No file context specifications.
 +
 +/usr/libexec/anaconda/anaconda-yum  --  gen_context(system_u:object_r:install_exec_t,s0)
@@ -2552,6 +2552,7 @@ index b098089..37d428c 100644
 +/usr/bin/initial-setup  --  gen_context(system_u:object_r:install_exec_t,s0)
 +/usr/bin/ostree         --  gen_context(system_u:object_r:install_exec_t,s0)
 +/usr/bin/rpm-ostree     --  gen_context(system_u:object_r:install_exec_t,s0)
++/usr/libexec/rpm-ostreed --  gen_context(system_u:object_r:install_exec_t,s0)
 +
 +/usr/bin/preupg.*   --  gen_context(system_u:object_r:preupgrade_exec_t,s0)
 +/var/lib/preupgrade(/.*)?   gen_context(system_u:object_r:preupgrade_data_t,s0)
@@ -52603,10 +52604,10 @@ index 65a246a..fa86320 100644
  netutils_domtrans_ping(mrtg_t)
  
 diff --git a/mta.fc b/mta.fc
-index f42896c..bd1eb52 100644
+index f42896c..2cf0c23 100644
 --- a/mta.fc
 +++ b/mta.fc
-@@ -1,34 +1,44 @@
+@@ -1,34 +1,41 @@
 -HOME_DIR/\.esmtp_queue	--	gen_context(system_u:object_r:mail_home_t,s0)
  HOME_DIR/\.forward[^/]*	--	gen_context(system_u:object_r:mail_home_t,s0)
  HOME_DIR/dead\.letter	--	gen_context(system_u:object_r:mail_home_t,s0)
@@ -52618,10 +52619,8 @@ index f42896c..bd1eb52 100644
 +HOME_DIR/.maildir(/.*)?		gen_context(system_u:object_r:mail_home_rw_t,s0)
  
 -/bin/mail(x)?	--	gen_context(system_u:object_r:sendmail_exec_t,s0)
- 
+-
 -/etc/aliases	--	gen_context(system_u:object_r:etc_aliases_t,s0)
-+/bin/mail(x)?		--	gen_context(system_u:object_r:sendmail_exec_t,s0)
-+
 +/etc/aliases		--	gen_context(system_u:object_r:etc_aliases_t,s0)
  /etc/aliases\.db	--	gen_context(system_u:object_r:etc_aliases_t,s0)
 -/etc/mail(/.*)?	gen_context(system_u:object_r:etc_mail_t,s0)
@@ -76605,10 +76604,10 @@ index 0000000..8231f4f
 +')
 diff --git a/prosody.te b/prosody.te
 new file mode 100644
-index 0000000..d531fa5
+index 0000000..3ef4a99
 --- /dev/null
 +++ b/prosody.te
-@@ -0,0 +1,92 @@
+@@ -0,0 +1,97 @@
 +policy_module(prosody, 1.0.0)
 +
 +########################################
@@ -76684,6 +76683,7 @@ index 0000000..d531fa5
 +corenet_tcp_bind_jabber_client_port(prosody_t)
 +corenet_tcp_bind_jabber_interserver_port(prosody_t)
 +corenet_tcp_bind_jabber_router_port(prosody_t)
++corenet_tcp_bind_commplex_main_port(prosody_t)
 +
 +tunable_policy(`prosody_bind_http_port',`
 +    corenet_tcp_bind_http_port(prosody_t)
@@ -76701,6 +76701,10 @@ index 0000000..d531fa5
 +logging_send_syslog_msg(prosody_t)
 +
 +miscfiles_read_localization(prosody_t)
++
++optional_policy(`
++	sasl_connect(prosody_t)
++')
 diff --git a/psad.if b/psad.if
 index d4dcf78..3cce82e 100644
 --- a/psad.if
@@ -104430,10 +104434,10 @@ index 0000000..a6e216c
 +
 diff --git a/targetd.te b/targetd.te
 new file mode 100644
-index 0000000..6768bda
+index 0000000..e372bd7
 --- /dev/null
 +++ b/targetd.te
-@@ -0,0 +1,62 @@
+@@ -0,0 +1,63 @@
 +policy_module(targetd, 1.0.0)
 +
 +########################################
@@ -104477,6 +104481,7 @@ index 0000000..6768bda
 +
 +dev_read_sysfs(targetd_t)
 +dev_read_urand(targetd_t)
++dev_rw_lvm_control(targetd_t)
 +
 +libs_exec_ldconfig(targetd_t)
 +
@@ -106127,7 +106132,7 @@ index cfaa2a1..a9bc6f1 100644
  
  optional_policy(`
 diff --git a/tgtd.fc b/tgtd.fc
-index 38389e6..4847b43 100644
+index 38389e6..ae0f9ab 100644
 --- a/tgtd.fc
 +++ b/tgtd.fc
 @@ -1,7 +1,4 @@
@@ -106141,7 +106146,7 @@ index 38389e6..4847b43 100644
 +/etc/rc\.d/init\.d/tgtd		--	gen_context(system_u:object_r:tgtd_initrc_exec_t,s0)
 +/usr/sbin/tgtd			--	gen_context(system_u:object_r:tgtd_exec_t,s0)
 +/var/lib/tgtd(/.*)?			gen_context(system_u:object_r:tgtd_var_lib_t,s0)
-+/var/run/tgtd.*			-s	gen_context(system_u:object_r:tgtd_var_run_t,s0)
++/var/run/tgtd.*			gen_context(system_u:object_r:tgtd_var_run_t,s0)
 diff --git a/tgtd.if b/tgtd.if
 index 5406b6e..dc5b46e 100644
 --- a/tgtd.if
diff --git a/selinux-policy.spec b/selinux-policy.spec
index e698fb2f..833b2640 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 180%{?dist}
+Release: 181%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -653,6 +653,17 @@ exit 0
 %endif
 
 %changelog
+* Fri Apr 01 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-181
+- Label /usr/libexec/rpm-ostreed as rpm_exec_t. BZ(1309075)
+- /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. BZ(1323224)
+- Label all run tgtd files, not just socket files.
+- Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
+- Allow prosody to listen on port 5000 for mod_proxy65. BZ(1322815)
+- Allow targetd to read/write to /dev/mapper/control device. BZ(1241415)
+- Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t.
+- Allow systemd_resolved to read systemd_networkd run files. BZ(1322921)
+- New cgroup2 file system in Rawhide
+
 * Wed Mar 30 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-180
 - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)
 - Allow colord to read /etc/udev/hwdb.bin. rhzb#1316514