++##
++## Allow cups execmem/execstack
++##
++##
++gen_tunable(cups_execmem, false)
++
+attribute cups_domain;
+
+type cupsd_config_t, cups_domain;
@@ -18618,7 +18641,7 @@ index 9f34c2e..f3aaaed 100644
files_config_file(cupsd_etc_t)
type cupsd_initrc_exec_t;
-@@ -33,13 +38,15 @@ type cupsd_lock_t;
+@@ -33,13 +45,15 @@ type cupsd_lock_t;
files_lock_file(cupsd_lock_t)
type cupsd_log_t;
@@ -18638,7 +18661,7 @@ index 9f34c2e..f3aaaed 100644
type cupsd_lpd_tmp_t;
files_tmp_file(cupsd_lpd_tmp_t)
-@@ -47,7 +54,7 @@ files_tmp_file(cupsd_lpd_tmp_t)
+@@ -47,7 +61,7 @@ files_tmp_file(cupsd_lpd_tmp_t)
type cupsd_lpd_var_run_t;
files_pid_file(cupsd_lpd_var_run_t)
@@ -18647,7 +18670,7 @@ index 9f34c2e..f3aaaed 100644
type cups_pdf_exec_t;
cups_backend(cups_pdf_t, cups_pdf_exec_t)
-@@ -55,29 +62,17 @@ type cups_pdf_tmp_t;
+@@ -55,29 +69,17 @@ type cups_pdf_tmp_t;
files_tmp_file(cups_pdf_tmp_t)
type cupsd_tmp_t;
@@ -18681,7 +18704,7 @@ index 9f34c2e..f3aaaed 100644
type ptal_t;
type ptal_exec_t;
-@@ -97,21 +92,49 @@ ifdef(`enable_mls',`
+@@ -97,21 +99,49 @@ ifdef(`enable_mls',`
init_ranged_daemon_domain(cupsd_t, cupsd_exec_t, mls_systemhigh)
')
@@ -18735,7 +18758,7 @@ index 9f34c2e..f3aaaed 100644
allow cupsd_t self:appletalk_socket create_socket_perms;
allow cupsd_t cupsd_etc_t:dir setattr_dir_perms;
-@@ -120,11 +143,13 @@ read_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
+@@ -120,11 +150,14 @@ read_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
read_lnk_files_pattern(cupsd_t, cupsd_etc_t, cupsd_etc_t)
manage_files_pattern(cupsd_t, cupsd_interface_t, cupsd_interface_t)
@@ -18746,10 +18769,11 @@ index 9f34c2e..f3aaaed 100644
filetrans_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
files_var_filetrans(cupsd_t, cupsd_rw_etc_t, { dir file })
+cups_filetrans_named_content(cupsd_t)
++can_exec(cupsd_t, cupsd_rw_etc_t)
allow cupsd_t cupsd_exec_t:dir search_dir_perms;
allow cupsd_t cupsd_exec_t:lnk_file read_lnk_file_perms;
-@@ -133,28 +158,26 @@ allow cupsd_t cupsd_lock_t:file manage_file_perms;
+@@ -133,28 +166,26 @@ allow cupsd_t cupsd_lock_t:file manage_file_perms;
files_lock_filetrans(cupsd_t, cupsd_lock_t, file)
manage_dirs_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
@@ -18784,7 +18808,7 @@ index 9f34c2e..f3aaaed 100644
stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
-@@ -162,11 +185,9 @@ allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
+@@ -162,11 +193,9 @@ allow cupsd_t ptal_var_run_t:sock_file setattr_sock_file_perms;
can_exec(cupsd_t, { cupsd_exec_t cupsd_interface_t })
kernel_read_system_state(cupsd_t)
@@ -18796,7 +18820,7 @@ index 9f34c2e..f3aaaed 100644
corenet_all_recvfrom_netlabel(cupsd_t)
corenet_tcp_sendrecv_generic_if(cupsd_t)
corenet_udp_sendrecv_generic_if(cupsd_t)
-@@ -189,12 +210,20 @@ corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
+@@ -189,12 +218,20 @@ corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
corenet_tcp_bind_all_rpc_ports(cupsd_t)
corenet_tcp_connect_all_ports(cupsd_t)
@@ -18821,7 +18845,7 @@ index 9f34c2e..f3aaaed 100644
dev_rw_input_dev(cupsd_t)
dev_rw_generic_usb_dev(cupsd_t)
dev_rw_usbfs(cupsd_t)
-@@ -206,7 +235,6 @@ domain_use_interactive_fds(cupsd_t)
+@@ -206,7 +243,6 @@ domain_use_interactive_fds(cupsd_t)
files_getattr_boot_dirs(cupsd_t)
files_list_spool(cupsd_t)
files_read_etc_runtime_files(cupsd_t)
@@ -18829,7 +18853,7 @@ index 9f34c2e..f3aaaed 100644
files_exec_usr_files(cupsd_t)
# for /var/lib/defoma
files_read_var_lib_files(cupsd_t)
-@@ -215,17 +243,19 @@ files_read_world_readable_files(cupsd_t)
+@@ -215,17 +251,19 @@ files_read_world_readable_files(cupsd_t)
files_read_world_readable_symlinks(cupsd_t)
files_read_var_files(cupsd_t)
files_read_var_symlinks(cupsd_t)
@@ -18851,7 +18875,7 @@ index 9f34c2e..f3aaaed 100644
mls_fd_use_all_levels(cupsd_t)
mls_file_downgrade(cupsd_t)
mls_file_write_all_levels(cupsd_t)
-@@ -235,6 +265,8 @@ mls_socket_write_all_levels(cupsd_t)
+@@ -235,6 +273,8 @@ mls_socket_write_all_levels(cupsd_t)
term_search_ptys(cupsd_t)
term_use_unallocated_ttys(cupsd_t)
@@ -18860,7 +18884,7 @@ index 9f34c2e..f3aaaed 100644
selinux_compute_access_vector(cupsd_t)
selinux_validate_context(cupsd_t)
-@@ -247,21 +279,21 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -247,23 +287,28 @@ auth_dontaudit_read_pam_pid(cupsd_t)
auth_rw_faillog(cupsd_t)
auth_use_nsswitch(cupsd_t)
@@ -18886,8 +18910,15 @@ index 9f34c2e..f3aaaed 100644
+userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
userdom_dontaudit_search_user_home_content(cupsd_t)
++tunable_policy(`cups_execmem',`
++ allow cupsd_t self:process { execmem execstack };
++')
++
++
optional_policy(`
-@@ -275,6 +307,8 @@ optional_policy(`
+ apm_domtrans_client(cupsd_t)
+ ')
+@@ -275,6 +320,8 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(cupsd_t)
@@ -18896,7 +18927,7 @@ index 9f34c2e..f3aaaed 100644
userdom_dbus_send_all_users(cupsd_t)
optional_policy(`
-@@ -285,8 +319,10 @@ optional_policy(`
+@@ -285,8 +332,10 @@ optional_policy(`
hal_dbus_chat(cupsd_t)
')
@@ -18907,7 +18938,7 @@ index 9f34c2e..f3aaaed 100644
')
')
-@@ -299,8 +335,8 @@ optional_policy(`
+@@ -299,8 +348,8 @@ optional_policy(`
')
optional_policy(`
@@ -18917,7 +18948,7 @@ index 9f34c2e..f3aaaed 100644
')
optional_policy(`
-@@ -309,7 +345,6 @@ optional_policy(`
+@@ -309,7 +358,6 @@ optional_policy(`
optional_policy(`
lpd_exec_lpr(cupsd_t)
@@ -18925,7 +18956,7 @@ index 9f34c2e..f3aaaed 100644
lpd_read_config(cupsd_t)
lpd_relabel_spool(cupsd_t)
')
-@@ -337,7 +372,11 @@ optional_policy(`
+@@ -337,7 +385,11 @@ optional_policy(`
')
optional_policy(`
@@ -18938,7 +18969,7 @@ index 9f34c2e..f3aaaed 100644
')
########################################
-@@ -345,12 +384,11 @@ optional_policy(`
+@@ -345,12 +397,11 @@ optional_policy(`
# Configuration daemon local policy
#
@@ -18954,7 +18985,7 @@ index 9f34c2e..f3aaaed 100644
allow cupsd_config_t cupsd_t:process signal;
ps_process_pattern(cupsd_config_t, cupsd_t)
-@@ -375,18 +413,16 @@ manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run
+@@ -375,18 +426,16 @@ manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run
manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file })
@@ -18975,7 +19006,7 @@ index 9f34c2e..f3aaaed 100644
corenet_all_recvfrom_netlabel(cupsd_config_t)
corenet_tcp_sendrecv_generic_if(cupsd_config_t)
corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -395,20 +431,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -395,20 +444,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
corenet_sendrecv_all_client_packets(cupsd_config_t)
corenet_tcp_connect_all_ports(cupsd_config_t)
@@ -18996,7 +19027,7 @@ index 9f34c2e..f3aaaed 100644
fs_search_auto_mountpoints(cupsd_config_t)
domain_use_interactive_fds(cupsd_config_t)
-@@ -420,11 +448,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -420,11 +461,6 @@ auth_use_nsswitch(cupsd_config_t)
logging_send_syslog_msg(cupsd_config_t)
@@ -19008,7 +19039,7 @@ index 9f34c2e..f3aaaed 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t)
-@@ -452,9 +475,12 @@ optional_policy(`
+@@ -452,9 +488,12 @@ optional_policy(`
')
optional_policy(`
@@ -19022,7 +19053,7 @@ index 9f34c2e..f3aaaed 100644
')
optional_policy(`
-@@ -490,10 +516,6 @@ optional_policy(`
+@@ -490,10 +529,6 @@ optional_policy(`
# Lpd local policy
#
@@ -19033,7 +19064,7 @@ index 9f34c2e..f3aaaed 100644
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -511,31 +533,23 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -511,31 +546,23 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
kernel_read_kernel_sysctls(cupsd_lpd_t)
kernel_read_system_state(cupsd_lpd_t)
@@ -19067,7 +19098,7 @@ index 9f34c2e..f3aaaed 100644
optional_policy(`
inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
')
-@@ -546,7 +560,6 @@ optional_policy(`
+@@ -546,7 +573,6 @@ optional_policy(`
#
allow cups_pdf_t self:capability { chown fowner fsetid setuid setgid dac_override };
@@ -19075,7 +19106,7 @@ index 9f34c2e..f3aaaed 100644
allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;
append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -562,148 +575,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -562,148 +588,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
kernel_read_system_state(cups_pdf_t)
@@ -19104,13 +19135,11 @@ index 9f34c2e..f3aaaed 100644
- fs_manage_cifs_dirs(cups_pdf_t)
- fs_manage_cifs_files(cups_pdf_t)
-')
-+userdom_home_manager(cups_pdf_t)
-
- optional_policy(`
+-
+-optional_policy(`
- lpd_manage_spool(cups_pdf_t)
-+ gnome_read_config(cups_pdf_t)
- ')
-
+-')
+-
-########################################
-#
-# HPLIP local policy
@@ -19199,15 +19228,17 @@ index 9f34c2e..f3aaaed 100644
-userdom_dontaudit_use_unpriv_user_fds(hplip_t)
-userdom_dontaudit_search_user_home_dirs(hplip_t)
-userdom_dontaudit_search_user_home_content(hplip_t)
--
--optional_policy(`
++userdom_home_manager(cups_pdf_t)
+
+ optional_policy(`
- dbus_system_bus_client(hplip_t)
-
- optional_policy(`
- userdom_dbus_send_all_users(hplip_t)
- ')
--')
--
++ gnome_read_config(cups_pdf_t)
+ ')
+
-optional_policy(`
- lpd_read_config(hplip_t)
- lpd_manage_spool(hplip_t)
@@ -19227,7 +19258,7 @@ index 9f34c2e..f3aaaed 100644
########################################
#
-@@ -731,7 +619,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -731,7 +632,6 @@ kernel_read_kernel_sysctls(ptal_t)
kernel_list_proc(ptal_t)
kernel_read_proc_symlinks(ptal_t)
@@ -19235,7 +19266,7 @@ index 9f34c2e..f3aaaed 100644
corenet_all_recvfrom_netlabel(ptal_t)
corenet_tcp_sendrecv_generic_if(ptal_t)
corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -741,13 +628,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -741,13 +641,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
corenet_tcp_bind_ptal_port(ptal_t)
corenet_tcp_sendrecv_ptal_port(ptal_t)
@@ -19249,7 +19280,7 @@ index 9f34c2e..f3aaaed 100644
files_read_etc_runtime_files(ptal_t)
fs_getattr_all_fs(ptal_t)
-@@ -755,8 +640,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -755,8 +653,6 @@ fs_search_auto_mountpoints(ptal_t)
logging_send_syslog_msg(ptal_t)
@@ -19258,7 +19289,7 @@ index 9f34c2e..f3aaaed 100644
sysnet_read_config(ptal_t)
userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -769,3 +652,4 @@ optional_policy(`
+@@ -769,3 +665,4 @@ optional_policy(`
optional_policy(`
udev_read_db(ptal_t)
')
@@ -23542,10 +23573,10 @@ index 0000000..1c4ac02
+/var/lib/docker/.*/config\.env gen_context(system_u:object_r:docker_share_t,s0)
diff --git a/docker.if b/docker.if
new file mode 100644
-index 0000000..66fe66d
+index 0000000..683dfdc
--- /dev/null
+++ b/docker.if
-@@ -0,0 +1,344 @@
+@@ -0,0 +1,363 @@
+
+##