- Allow collectd to talk to libvirt
    - Allow chrome_sandbox to use leaked unix_stream_sockets
    - Dontaudit leaks of sockets into chrome_sandbox_t
    - If you create a cups directory in /var/cache then it should be labeled cups_rw_e
    - Run vmtools as unconfined domains
    - Allow snort to manage its log files
    - Allow systemd_cronjob_t to be entered via bin_t
    - Allow procman to list doveconf_etc_t
    - allow keyring daemon to create content in tmpfs directories
    - Add proper labelling for icedtea-web
    - vpnc is creating content in networkmanager var run directory
    - Label sddm as xdm_exec_t to make KDE working again
    - Allow postgresql to read network state
    - Allow java running as pki_tomcat to read network sysctls
    - Fix cgroup.te to allow cgred to read cgconfig_etc_t
    - Allow beam.smp to use ephemeral ports
    - Allow winbind to use the nis to authenticate passwords