diff --git a/container-selinux.tgz b/container-selinux.tgz
index 2013164..b4f108a 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/make-rhat-patches.sh b/make-rhat-patches.sh
index 005deeb..e9ce1b8 100755
--- a/make-rhat-patches.sh
+++ b/make-rhat-patches.sh
@@ -2,7 +2,7 @@
DISTGIT_PATH=$(pwd)
-FEDORA_VERSION=rawhide
+FEDORA_VERSION=f25
DOCKER_FEDORA_VERSION=master
DISTGIT_BRANCH=f25
diff --git a/policy-f25-base.patch b/policy-f25-base.patch
index 7a93d33..e4bcf7d 100644
--- a/policy-f25-base.patch
+++ b/policy-f25-base.patch
@@ -49142,10 +49142,10 @@ index 0000000..86e3d01
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..2800431
+index 0000000..373d526
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,973 @@
+@@ -0,0 +1,974 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -49431,6 +49431,7 @@ index 0000000..2800431
+optional_policy(`
+ devicekit_dbus_chat_power(systemd_logind_t)
+ devicekit_dbus_chat_disk(systemd_logind_t)
++ devicekit_dbus_chat(systemd_logind_t)
+')
+
+optional_policy(`
diff --git a/policy-f25-contrib.patch b/policy-f25-contrib.patch
index 7f21e55..811c8b8 100644
--- a/policy-f25-contrib.patch
+++ b/policy-f25-contrib.patch
@@ -589,7 +589,7 @@ index 058d908..ee0c559 100644
+')
+
diff --git a/abrt.te b/abrt.te
-index eb50f07..3a70d84 100644
+index eb50f07..d53d1e0 100644
--- a/abrt.te
+++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -805,7 +805,7 @@ index eb50f07..3a70d84 100644
domain_getattr_all_domains(abrt_t)
domain_read_all_domains_state(abrt_t)
-@@ -176,29 +198,43 @@ files_getattr_all_files(abrt_t)
+@@ -176,29 +198,44 @@ files_getattr_all_files(abrt_t)
files_read_config_files(abrt_t)
files_read_etc_runtime_files(abrt_t)
files_read_var_symlinks(abrt_t)
@@ -829,6 +829,7 @@ index eb50f07..3a70d84 100644
fs_read_nfs_files(abrt_t)
fs_read_nfs_symlinks(abrt_t)
fs_search_all(abrt_t)
++fs_getattr_nsfs_files(abrt_t)
-auth_use_nsswitch(abrt_t)
+storage_dontaudit_read_fixed_disk(abrt_t)
@@ -852,7 +853,7 @@ index eb50f07..3a70d84 100644
tunable_policy(`abrt_anon_write',`
miscfiles_manage_public_files(abrt_t)
-@@ -206,15 +242,11 @@ tunable_policy(`abrt_anon_write',`
+@@ -206,15 +243,11 @@ tunable_policy(`abrt_anon_write',`
optional_policy(`
apache_list_modules(abrt_t)
@@ -869,7 +870,7 @@ index eb50f07..3a70d84 100644
')
optional_policy(`
-@@ -222,6 +254,32 @@ optional_policy(`
+@@ -222,6 +255,32 @@ optional_policy(`
')
optional_policy(`
@@ -902,7 +903,7 @@ index eb50f07..3a70d84 100644
policykit_domtrans_auth(abrt_t)
policykit_read_lib(abrt_t)
policykit_read_reload(abrt_t)
-@@ -234,15 +292,22 @@ optional_policy(`
+@@ -234,15 +293,22 @@ optional_policy(`
')
optional_policy(`
@@ -925,7 +926,7 @@ index eb50f07..3a70d84 100644
optional_policy(`
sendmail_domtrans(abrt_t)
')
-@@ -253,9 +318,21 @@ optional_policy(`
+@@ -253,9 +319,21 @@ optional_policy(`
sosreport_delete_tmp_files(abrt_t)
')
@@ -948,7 +949,7 @@ index eb50f07..3a70d84 100644
#
allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms;
-@@ -266,9 +343,13 @@ tunable_policy(`abrt_handle_event',`
+@@ -266,9 +344,13 @@ tunable_policy(`abrt_handle_event',`
can_exec(abrt_t, abrt_handle_event_exec_t)
')
@@ -963,7 +964,7 @@ index eb50f07..3a70d84 100644
#
allow abrt_helper_t self:capability { chown setgid sys_nice };
-@@ -281,6 +362,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
+@@ -281,6 +363,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
@@ -971,7 +972,7 @@ index eb50f07..3a70d84 100644
read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
-@@ -289,15 +371,20 @@ corecmd_read_all_executables(abrt_helper_t)
+@@ -289,15 +372,20 @@ corecmd_read_all_executables(abrt_helper_t)
domain_read_all_domains_state(abrt_helper_t)
@@ -992,7 +993,7 @@ index eb50f07..3a70d84 100644
userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
dev_dontaudit_read_all_blk_files(abrt_helper_t)
-@@ -305,11 +392,25 @@ ifdef(`hide_broken_symptoms',`
+@@ -305,11 +393,25 @@ ifdef(`hide_broken_symptoms',`
dev_dontaudit_write_all_chr_files(abrt_helper_t)
dev_dontaudit_write_all_blk_files(abrt_helper_t)
fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
@@ -1019,7 +1020,7 @@ index eb50f07..3a70d84 100644
#
allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms;
-@@ -327,10 +428,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
+@@ -327,10 +429,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
dev_read_urand(abrt_retrace_coredump_t)
@@ -1033,7 +1034,7 @@ index eb50f07..3a70d84 100644
optional_policy(`
rpm_exec(abrt_retrace_coredump_t)
rpm_dontaudit_manage_db(abrt_retrace_coredump_t)
-@@ -343,10 +446,11 @@ optional_policy(`
+@@ -343,10 +447,11 @@ optional_policy(`
#######################################
#
@@ -1047,7 +1048,7 @@ index eb50f07..3a70d84 100644
allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
-@@ -365,38 +469,79 @@ corecmd_exec_shell(abrt_retrace_worker_t)
+@@ -365,38 +470,79 @@ corecmd_exec_shell(abrt_retrace_worker_t)
dev_read_urand(abrt_retrace_worker_t)
@@ -1131,7 +1132,7 @@ index eb50f07..3a70d84 100644
#######################################
#
-@@ -404,25 +549,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +550,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
#
allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@@ -1194,7 +1195,7 @@ index eb50f07..3a70d84 100644
')
#######################################
-@@ -430,10 +610,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +611,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
# Global local policy
#
@@ -13375,7 +13376,7 @@ index 4e4143e..f03dba0 100644
/var/run/chronyd\.pid -- gen_context(system_u:object_r:chronyd_var_run_t,s0)
/var/run/chronyd\.sock -s gen_context(system_u:object_r:chronyd_var_run_t,s0)
diff --git a/chronyd.if b/chronyd.if
-index 32e8265..c5a2913 100644
+index 32e8265..ac74503 100644
--- a/chronyd.if
+++ b/chronyd.if
@@ -57,6 +57,24 @@ interface(`chronyd_exec',`
@@ -13403,45 +13404,38 @@ index 32e8265..c5a2913 100644
#####################################
##
## Read chronyd log files.
-@@ -100,8 +118,7 @@ interface(`chronyd_rw_shm',`
+@@ -100,8 +118,25 @@ interface(`chronyd_rw_shm',`
########################################
##
-## Connect to chronyd using a unix
-## domain stream socket.
+## Read chronyd keys files.
- ##
- ##
- ##
-@@ -109,19 +126,17 @@ interface(`chronyd_rw_shm',`
- ##
- ##
- #
--interface(`chronyd_stream_connect',`
++##
++##
++##
++## Domain allowed access.
++##
++##
++#
+interface(`chronyd_read_keys',`
- gen_require(`
-- type chronyd_t, chronyd_var_run_t;
++ gen_require(`
+ type chronyd_keys_t;
- ')
-
-- files_search_pids($1)
-- stream_connect_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
++ ')
++
+ read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
- ')
-
- ########################################
- ##
--## Send to chronyd using a unix domain
--## datagram socket.
++')
++
++########################################
++##
+## Append chronyd keys files.
##
##
##
-@@ -129,18 +144,62 @@ interface(`chronyd_stream_connect',`
+@@ -109,6 +144,49 @@ interface(`chronyd_rw_shm',`
##
##
#
--interface(`chronyd_dgram_send',`
+interface(`chronyd_append_keys',`
+ gen_require(`
+ type chronyd_keys_t;
@@ -13485,43 +13479,38 @@ index 32e8265..c5a2913 100644
+##
+##
+#
-+interface(`chronyd_stream_connect',`
+ interface(`chronyd_stream_connect',`
gen_require(`
type chronyd_t, chronyd_var_run_t;
- ')
-
- files_search_pids($1)
-- dgram_send_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
-+ stream_connect_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
- ')
+@@ -140,7 +218,7 @@ interface(`chronyd_dgram_send',`
########################################
##
-## Read chronyd key files.
-+## Send to chronyd using a unix domain
-+## datagram socket.
++## Manage pid files used by chronyd
##
##
##
-@@ -148,13 +207,13 @@ interface(`chronyd_dgram_send',`
+@@ -148,13 +226,14 @@ interface(`chronyd_dgram_send',`
##
##
#
-interface(`chronyd_read_key_files',`
-+interface(`chronyd_dgram_send',`
++interface(`chronyd_manage_pid',`
gen_require(`
- type chronyd_keys_t;
-+ type chronyd_t, chronyd_var_run_t;
++ type chronyd_var_run_t;
')
- files_search_etc($1)
- read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
+ files_search_pids($1)
-+ dgram_send_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
++ manage_files_pattern($1, chronyd_var_run_t, chronyd_var_run_t)
++ manage_dirs_pattern($1, chronyd_var_run_t, chronyd_var_run_t)
')
####################################
-@@ -176,28 +235,38 @@ interface(`chronyd_read_key_files',`
+@@ -176,28 +255,38 @@ interface(`chronyd_read_key_files',`
#
interface(`chronyd_admin',`
gen_require(`
@@ -20915,7 +20904,7 @@ index 3023be7..5afde80 100644
+ files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
')
diff --git a/cups.te b/cups.te
-index c91813c..474a13f 100644
+index c91813c..c3820a5 100644
--- a/cups.te
+++ b/cups.te
@@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -21057,9 +21046,10 @@ index c91813c..474a13f 100644
-allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill setgid setuid fsetid fowner chown dac_override sys_rawio sys_resource sys_tty_config };
+allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill fsetid fowner chown dac_override sys_resource sys_tty_config };
dontaudit cupsd_t self:capability { sys_tty_config net_admin };
- allow cupsd_t self:capability2 block_suspend;
+-allow cupsd_t self:capability2 block_suspend;
-allow cupsd_t self:process { getpgid setpgid setsched signal_perms };
-allow cupsd_t self:fifo_file rw_fifo_file_perms;
++allow cupsd_t self:capability2 { block_suspend wake_alarm };
+allow cupsd_t self:process { getpgid setpgid setsched };
allow cupsd_t self:unix_stream_socket { accept connectto listen };
allow cupsd_t self:netlink_selinux_socket create_socket_perms;
@@ -46294,7 +46284,7 @@ index dd8e01a..9cd6b0b 100644
##
##
diff --git a/logrotate.te b/logrotate.te
-index be0ab84..6f39336 100644
+index be0ab84..d46c5e7 100644
--- a/logrotate.te
+++ b/logrotate.te
@@ -5,16 +5,29 @@ policy_module(logrotate, 1.15.0)
@@ -46522,16 +46512,17 @@ index be0ab84..6f39336 100644
fail2ban_stream_connect(logrotate_t)
')
-@@ -178,7 +247,7 @@ optional_policy(`
+@@ -178,7 +247,8 @@ optional_policy(`
')
optional_policy(`
- chronyd_read_key_files(logrotate_t)
+ chronyd_read_keys(logrotate_t)
++ chronyd_manage_pid(logrotate_t)
')
optional_policy(`
-@@ -198,17 +267,18 @@ optional_policy(`
+@@ -198,17 +268,18 @@ optional_policy(`
')
optional_policy(`
@@ -46553,7 +46544,7 @@ index be0ab84..6f39336 100644
')
optional_policy(`
-@@ -216,6 +286,14 @@ optional_policy(`
+@@ -216,6 +287,14 @@ optional_policy(`
')
optional_policy(`
@@ -46568,7 +46559,7 @@ index be0ab84..6f39336 100644
samba_exec_log(logrotate_t)
')
-@@ -228,26 +306,50 @@ optional_policy(`
+@@ -228,26 +307,50 @@ optional_policy(`
')
optional_policy(`
@@ -52318,7 +52309,7 @@ index 6194b80..e27c53d 100644
')
+
diff --git a/mozilla.te b/mozilla.te
-index 11ac8e4..653ba10 100644
+index 11ac8e4..9336364 100644
--- a/mozilla.te
+++ b/mozilla.te
@@ -6,17 +6,56 @@ policy_module(mozilla, 2.8.0)
@@ -52771,7 +52762,7 @@ index 11ac8e4..653ba10 100644
')
optional_policy(`
-@@ -300,259 +339,254 @@ optional_policy(`
+@@ -300,259 +339,257 @@ optional_policy(`
########################################
#
@@ -52786,6 +52777,8 @@ index 11ac8e4..653ba10 100644
+dontaudit mozilla_plugin_t self:capability2 block_suspend;
+dontaudit mozilla_plugin_t self:cap_userns {sys_ptrace };
+
++
++allow mozilla_plugin_t self:cap_userns {sys_admin sys_chroot};
+allow mozilla_plugin_t self:process { getsession setcap setpgid getsched setsched signal_perms execmem execstack setrlimit transition };
+allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
+allow mozilla_plugin_t self:netlink_socket create_socket_perms;
@@ -52845,21 +52838,23 @@ index 11ac8e4..653ba10 100644
+can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t)
manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
++manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
- fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
+-fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
++fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file dir lnk_file sock_file fifo_file })
+userdom_manage_home_texlive(mozilla_plugin_t)
allow mozilla_plugin_t mozilla_plugin_rw_t:dir list_dir_perms;
-allow mozilla_plugin_t mozilla_plugin_rw_t:file read_file_perms;
-allow mozilla_plugin_t mozilla_plugin_rw_t:lnk_file read_lnk_file_perms;
+-
+-dgram_send_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
+-stream_connect_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
+read_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+read_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
--dgram_send_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
--stream_connect_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
--
-can_exec(mozilla_plugin_t, { mozilla_exec_t mozilla_plugin_home_t mozilla_plugin_tmp_t })
+can_exec(mozilla_plugin_t, mozilla_exec_t)
@@ -53171,7 +53166,7 @@ index 11ac8e4..653ba10 100644
')
optional_policy(`
-@@ -560,7 +594,11 @@ optional_policy(`
+@@ -560,7 +597,11 @@ optional_policy(`
')
optional_policy(`
@@ -53184,7 +53179,7 @@ index 11ac8e4..653ba10 100644
')
optional_policy(`
-@@ -568,108 +606,144 @@ optional_policy(`
+@@ -568,108 +609,144 @@ optional_policy(`
')
optional_policy(`
@@ -64341,10 +64336,18 @@ index e403097..45d387d 100644
+userdom_stream_connect(oddjob_mkhomedir_t)
+
diff --git a/openct.te b/openct.te
-index 3b6920e..3e9b17f 100644
+index 3b6920e..577c90b 100644
--- a/openct.te
+++ b/openct.te
-@@ -29,12 +29,12 @@ manage_files_pattern(openct_t, openct_var_run_t, openct_var_run_t)
+@@ -21,6 +21,7 @@ files_pid_file(openct_var_run_t)
+ #
+
+ dontaudit openct_t self:capability sys_tty_config;
++allow openct_t self:capability2 wake_alarm;
+ allow openct_t self:process signal_perms;
+ allow openct_t self:netlink_kobject_uevent_socket create_socket_perms;
+
+@@ -29,12 +30,12 @@ manage_files_pattern(openct_t, openct_var_run_t, openct_var_run_t)
manage_sock_files_pattern(openct_t, openct_var_run_t, openct_var_run_t)
files_pid_filetrans(openct_t, openct_var_run_t, { dir file sock_file })
@@ -64359,7 +64362,7 @@ index 3b6920e..3e9b17f 100644
dev_read_sysfs(openct_t)
dev_rw_usbfs(openct_t)
dev_rw_smartcard(openct_t)
-@@ -42,15 +42,12 @@ dev_rw_generic_usb_dev(openct_t)
+@@ -42,15 +43,12 @@ dev_rw_generic_usb_dev(openct_t)
domain_use_interactive_fds(openct_t)
@@ -94896,7 +94899,7 @@ index 50d07fb..a34db48 100644
+ allow $1 samba_unit_file_t:service all_service_perms;
')
diff --git a/samba.te b/samba.te
-index 2b7c441..ca83568 100644
+index 2b7c441..02be6db 100644
--- a/samba.te
+++ b/samba.te
@@ -6,99 +6,86 @@ policy_module(samba, 1.16.3)
@@ -95529,7 +95532,7 @@ index 2b7c441..ca83568 100644
rpc_search_nfs_state_data(smbd_t)
')
-@@ -499,9 +549,48 @@ optional_policy(`
+@@ -499,12 +549,52 @@ optional_policy(`
udev_read_db(smbd_t)
')
@@ -95579,7 +95582,11 @@ index 2b7c441..ca83568 100644
#
dontaudit nmbd_t self:capability sys_tty_config;
-@@ -512,9 +601,11 @@ allow nmbd_t self:msg { send receive };
++allow nmbd_t self:capability {net_admin};
+ allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+ allow nmbd_t self:fd use;
+ allow nmbd_t self:fifo_file rw_fifo_file_perms;
+@@ -512,9 +602,11 @@ allow nmbd_t self:msg { send receive };
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -95594,7 +95601,7 @@ index 2b7c441..ca83568 100644
manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t)
manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
-@@ -526,20 +617,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
+@@ -526,20 +618,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
@@ -95619,7 +95626,7 @@ index 2b7c441..ca83568 100644
kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t)
-@@ -547,53 +634,44 @@ kernel_read_kernel_sysctls(nmbd_t)
+@@ -547,53 +635,44 @@ kernel_read_kernel_sysctls(nmbd_t)
kernel_read_network_state(nmbd_t)
kernel_read_software_raid_state(nmbd_t)
kernel_read_system_state(nmbd_t)
@@ -95688,7 +95695,7 @@ index 2b7c441..ca83568 100644
')
optional_policy(`
-@@ -606,18 +684,29 @@ optional_policy(`
+@@ -606,18 +685,29 @@ optional_policy(`
########################################
#
@@ -95724,7 +95731,7 @@ index 2b7c441..ca83568 100644
samba_read_config(smbcontrol_t)
samba_search_var(smbcontrol_t)
-@@ -627,39 +716,38 @@ domain_use_interactive_fds(smbcontrol_t)
+@@ -627,39 +717,38 @@ domain_use_interactive_fds(smbcontrol_t)
dev_read_urand(smbcontrol_t)
@@ -95776,7 +95783,7 @@ index 2b7c441..ca83568 100644
allow smbmount_t samba_secrets_t:file manage_file_perms;
-@@ -668,26 +756,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
+@@ -668,26 +757,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
files_var_filetrans(smbmount_t, samba_var_t, dir, "samba")
@@ -95812,7 +95819,7 @@ index 2b7c441..ca83568 100644
fs_getattr_cifs(smbmount_t)
fs_mount_cifs(smbmount_t)
-@@ -699,58 +783,77 @@ fs_read_cifs_files(smbmount_t)
+@@ -699,58 +784,77 @@ fs_read_cifs_files(smbmount_t)
storage_raw_read_fixed_disk(smbmount_t)
storage_raw_write_fixed_disk(smbmount_t)
@@ -95904,7 +95911,7 @@ index 2b7c441..ca83568 100644
manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
-@@ -759,17 +862,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
+@@ -759,17 +863,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
files_pid_filetrans(swat_t, swat_var_run_t, file)
@@ -95928,7 +95935,7 @@ index 2b7c441..ca83568 100644
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -777,36 +876,25 @@ kernel_read_network_state(swat_t)
+@@ -777,36 +877,25 @@ kernel_read_network_state(swat_t)
corecmd_search_bin(swat_t)
@@ -95971,7 +95978,7 @@ index 2b7c441..ca83568 100644
auth_domtrans_chk_passwd(swat_t)
auth_use_nsswitch(swat_t)
-@@ -818,10 +906,11 @@ logging_send_syslog_msg(swat_t)
+@@ -818,10 +907,11 @@ logging_send_syslog_msg(swat_t)
logging_send_audit_msgs(swat_t)
logging_search_logs(swat_t)
@@ -95985,7 +95992,7 @@ index 2b7c441..ca83568 100644
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
-@@ -840,17 +929,20 @@ optional_policy(`
+@@ -840,17 +930,20 @@ optional_policy(`
# Winbind local policy
#
@@ -96011,7 +96018,7 @@ index 2b7c441..ca83568 100644
allow winbind_t samba_etc_t:dir list_dir_perms;
read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
-@@ -860,9 +952,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
+@@ -860,9 +953,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
@@ -96022,7 +96029,7 @@ index 2b7c441..ca83568 100644
manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
-@@ -873,38 +963,42 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
+@@ -873,38 +964,42 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
@@ -96076,7 +96083,7 @@ index 2b7c441..ca83568 100644
corenet_tcp_connect_smbd_port(winbind_t)
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
-@@ -912,38 +1006,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
+@@ -912,38 +1007,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
dev_read_sysfs(winbind_t)
dev_read_urand(winbind_t)
@@ -96135,7 +96142,7 @@ index 2b7c441..ca83568 100644
')
optional_policy(`
-@@ -959,31 +1067,36 @@ optional_policy(`
+@@ -959,31 +1068,36 @@ optional_policy(`
# Winbind helper local policy
#
@@ -96179,7 +96186,7 @@ index 2b7c441..ca83568 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -997,25 +1110,38 @@ optional_policy(`
+@@ -997,25 +1111,38 @@ optional_policy(`
########################################
#
@@ -98440,7 +98447,7 @@ index 98c9e0a..562666e 100644
files_search_pids($1)
admin_pattern($1, sblim_var_run_t)
diff --git a/sblim.te b/sblim.te
-index 299756b..7d15afd 100644
+index 299756b..a256f80 100644
--- a/sblim.te
+++ b/sblim.te
@@ -7,13 +7,11 @@ policy_module(sblim, 1.1.0)
@@ -98551,7 +98558,7 @@ index 299756b..7d15afd 100644
')
optional_policy(`
-@@ -117,6 +136,59 @@ optional_policy(`
+@@ -117,6 +136,61 @@ optional_policy(`
# Reposd local policy
#
@@ -98563,6 +98570,8 @@ index 299756b..7d15afd 100644
+
+logging_send_syslog_msg(sblim_reposd_t)
+
++miscfiles_read_certs(sblim_reposd_t)
++
+#######################################
+#
+# Sfcbd local policy
diff --git a/selinux-policy.spec b/selinux-policy.spec
index fc1beb9..9ec3e31 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 223%{?dist}
+Release: 224%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -675,6 +675,9 @@ exit 0
%endif
%changelog
+* Wed Nov 09 2016 Lukas Vrabec - 3.13.1-224
+- Allow systemd_logind_t domain to communicate with devicekit_t domain via dbus bz(1393373)
+
* Tue Nov 08 2016 Lukas Vrabec - 3.13.1-223
- Allow watching netflix using Firefox
- nmbd_t needs net_admin capability like smbd