diff --git a/container-selinux.tgz b/container-selinux.tgz
new file mode 100644
index 0000000..0c11cbc
Binary files /dev/null and b/container-selinux.tgz differ
diff --git a/docker-selinux.tgz b/docker-selinux.tgz
deleted file mode 100644
index 1d8b337..0000000
Binary files a/docker-selinux.tgz and /dev/null differ
diff --git a/make-rhat-patches.sh b/make-rhat-patches.sh
index 0221fdc..9b99001 100755
--- a/make-rhat-patches.sh
+++ b/make-rhat-patches.sh
@@ -12,7 +12,7 @@ POLICYSOURCES=`mktemp -d policysources.XXXXXX`
 pushd $POLICYSOURCES > /dev/null
 
 git clone git@github.com:fedora-selinux/selinux-policy.git -q
-git clone git@github.com:fedora-cloud/docker-selinux.git -q
+git clone git@github.com:projectatomic/container-selinux.git -q
 
 pushd selinux-policy > /dev/null
 # prepare policy patches against upstream commits matching the last upstream merge
@@ -20,18 +20,18 @@ git rev-parse --verify origin/${FEDORA_VERSION}-base; git diff eb4512f6eb13792c7
 git rev-parse --verify origin/${FEDORA_VERSION}-contrib; git diff 64302b790bf2b39d93610e1452c8361d56966ae0 origin/${FEDORA_VERSION}-contrib > policy-${FEDORA_VERSION}-contrib.patch
 popd > /dev/null
 
-pushd docker-selinux > /dev/null
-# Actual docker-selinux files are in master branch
+pushd container-selinux > /dev/null
+# Actual container-selinux files are in master branch
 #git checkout -b ${DOCKER_FEDORA_VERSION} -t origin/${DOCKER_FEDORA_VERSION} -q
-tar -czf docker-selinux.tgz docker.if docker.te docker.fc
+tar -czf container-selinux.tgz container.if container.te container.fc
 popd > /dev/null
 
 pushd $DISTGIT_PATH > /dev/null
 cp $POLICYSOURCES/selinux-policy/policy-${FEDORA_VERSION}-{base,contrib}.patch .
-cp $POLICYSOURCES/docker-selinux/docker-selinux.tgz .
+cp $POLICYSOURCES/container-selinux/container-selinux.tgz .
 popd > /dev/null
 
 popd > /dev/null
 rm -rf $POLICYSOURCES
 
-echo "policy-f24-{contrib,base}.patches and docker.tgz with docker policy files have been created."
+echo "policy-f24-{contrib,base}.patches and container.tgz with container policy files have been created."
diff --git a/policy-f24-contrib.patch b/policy-f24-contrib.patch
index 64194ae..36ca74b 100644
--- a/policy-f24-contrib.patch
+++ b/policy-f24-contrib.patch
@@ -589,7 +589,7 @@ index 058d908..ee0c559 100644
 +')
 +
 diff --git a/abrt.te b/abrt.te
-index eb50f07..ede7f7e 100644
+index eb50f07..0523e8e 100644
 --- a/abrt.te
 +++ b/abrt.te
 @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -805,7 +805,7 @@ index eb50f07..ede7f7e 100644
  
  domain_getattr_all_domains(abrt_t)
  domain_read_all_domains_state(abrt_t)
-@@ -176,29 +198,43 @@ files_getattr_all_files(abrt_t)
+@@ -176,29 +198,44 @@ files_getattr_all_files(abrt_t)
  files_read_config_files(abrt_t)
  files_read_etc_runtime_files(abrt_t)
  files_read_var_symlinks(abrt_t)
@@ -829,6 +829,7 @@ index eb50f07..ede7f7e 100644
  fs_read_nfs_files(abrt_t)
  fs_read_nfs_symlinks(abrt_t)
  fs_search_all(abrt_t)
++fs_getattr_nsfs_files(abrt_t)
  
 -auth_use_nsswitch(abrt_t)
 +storage_dontaudit_read_fixed_disk(abrt_t)
@@ -852,7 +853,7 @@ index eb50f07..ede7f7e 100644
  
  tunable_policy(`abrt_anon_write',`
  	miscfiles_manage_public_files(abrt_t)
-@@ -206,15 +242,11 @@ tunable_policy(`abrt_anon_write',`
+@@ -206,15 +243,11 @@ tunable_policy(`abrt_anon_write',`
  
  optional_policy(`
  	apache_list_modules(abrt_t)
@@ -869,7 +870,7 @@ index eb50f07..ede7f7e 100644
  ')
  
  optional_policy(`
-@@ -222,6 +254,32 @@ optional_policy(`
+@@ -222,6 +255,32 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -902,7 +903,7 @@ index eb50f07..ede7f7e 100644
  	policykit_domtrans_auth(abrt_t)
  	policykit_read_lib(abrt_t)
  	policykit_read_reload(abrt_t)
-@@ -234,15 +292,22 @@ optional_policy(`
+@@ -234,15 +293,22 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -925,7 +926,7 @@ index eb50f07..ede7f7e 100644
  optional_policy(`
  	sendmail_domtrans(abrt_t)
  ')
-@@ -253,9 +318,21 @@ optional_policy(`
+@@ -253,9 +319,21 @@ optional_policy(`
  	sosreport_delete_tmp_files(abrt_t)
  ')
  
@@ -948,7 +949,7 @@ index eb50f07..ede7f7e 100644
  #
  
  allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms;
-@@ -266,9 +343,13 @@ tunable_policy(`abrt_handle_event',`
+@@ -266,9 +344,13 @@ tunable_policy(`abrt_handle_event',`
  	can_exec(abrt_t, abrt_handle_event_exec_t)
  ')
  
@@ -963,7 +964,7 @@ index eb50f07..ede7f7e 100644
  #
  
  allow abrt_helper_t self:capability { chown setgid sys_nice };
-@@ -281,6 +362,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
+@@ -281,6 +363,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
  manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
  manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
  files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
@@ -971,7 +972,7 @@ index eb50f07..ede7f7e 100644
  
  read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
  read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
-@@ -289,15 +371,20 @@ corecmd_read_all_executables(abrt_helper_t)
+@@ -289,15 +372,20 @@ corecmd_read_all_executables(abrt_helper_t)
  
  domain_read_all_domains_state(abrt_helper_t)
  
@@ -992,7 +993,7 @@ index eb50f07..ede7f7e 100644
  	userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
  	userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
  	dev_dontaudit_read_all_blk_files(abrt_helper_t)
-@@ -305,11 +392,25 @@ ifdef(`hide_broken_symptoms',`
+@@ -305,11 +393,25 @@ ifdef(`hide_broken_symptoms',`
  	dev_dontaudit_write_all_chr_files(abrt_helper_t)
  	dev_dontaudit_write_all_blk_files(abrt_helper_t)
  	fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
@@ -1019,7 +1020,7 @@ index eb50f07..ede7f7e 100644
  #
  
  allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms;
-@@ -327,10 +428,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
+@@ -327,10 +429,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
  
  dev_read_urand(abrt_retrace_coredump_t)
  
@@ -1033,7 +1034,7 @@ index eb50f07..ede7f7e 100644
  optional_policy(`
  	rpm_exec(abrt_retrace_coredump_t)
  	rpm_dontaudit_manage_db(abrt_retrace_coredump_t)
-@@ -343,10 +446,11 @@ optional_policy(`
+@@ -343,10 +447,11 @@ optional_policy(`
  
  #######################################
  #
@@ -1047,7 +1048,7 @@ index eb50f07..ede7f7e 100644
  allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
  
  domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
-@@ -365,38 +469,79 @@ corecmd_exec_shell(abrt_retrace_worker_t)
+@@ -365,38 +470,79 @@ corecmd_exec_shell(abrt_retrace_worker_t)
  
  dev_read_urand(abrt_retrace_worker_t)
  
@@ -1131,7 +1132,7 @@ index eb50f07..ede7f7e 100644
  
  #######################################
  #
-@@ -404,25 +549,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +550,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
  #
  
  allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@@ -1194,7 +1195,7 @@ index eb50f07..ede7f7e 100644
  ')
  
  #######################################
-@@ -430,10 +610,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +611,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
  # Global local policy
  #
  
@@ -13375,7 +13376,7 @@ index 4e4143e..f03dba0 100644
  /var/run/chronyd\.pid	--	gen_context(system_u:object_r:chronyd_var_run_t,s0)
  /var/run/chronyd\.sock	-s	gen_context(system_u:object_r:chronyd_var_run_t,s0)
 diff --git a/chronyd.if b/chronyd.if
-index 32e8265..c5a2913 100644
+index 32e8265..ac74503 100644
 --- a/chronyd.if
 +++ b/chronyd.if
 @@ -57,6 +57,24 @@ interface(`chronyd_exec',`
@@ -13403,45 +13404,38 @@ index 32e8265..c5a2913 100644
  #####################################
  ## <summary>
  ##	Read chronyd log files.
-@@ -100,8 +118,7 @@ interface(`chronyd_rw_shm',`
+@@ -100,8 +118,25 @@ interface(`chronyd_rw_shm',`
  
  ########################################
  ## <summary>
 -##	Connect to chronyd using a unix
 -##	domain stream socket.
 +##	Read chronyd keys files.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -109,19 +126,17 @@ interface(`chronyd_rw_shm',`
- ##	</summary>
- ## </param>
- #
--interface(`chronyd_stream_connect',`
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`chronyd_read_keys',`
- 	gen_require(`
--		type chronyd_t, chronyd_var_run_t;
++	gen_require(`
 +		type chronyd_keys_t;
- 	')
- 
--	files_search_pids($1)
--	stream_connect_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
++	')
++
 +	read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
- ')
- 
- ########################################
- ## <summary>
--##	Send to chronyd using a unix domain
--##	datagram socket.
++')
++
++########################################
++## <summary>
 +##	Append chronyd keys files.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -129,18 +144,62 @@ interface(`chronyd_stream_connect',`
+@@ -109,6 +144,49 @@ interface(`chronyd_rw_shm',`
  ##	</summary>
  ## </param>
  #
--interface(`chronyd_dgram_send',`
 +interface(`chronyd_append_keys',`
 +	gen_require(`
 +		type chronyd_keys_t;
@@ -13485,43 +13479,38 @@ index 32e8265..c5a2913 100644
 +##  </summary>
 +## </param>
 +#
-+interface(`chronyd_stream_connect',`
+ interface(`chronyd_stream_connect',`
  	gen_require(`
  		type chronyd_t, chronyd_var_run_t;
- 	')
- 
- 	files_search_pids($1)
--	dgram_send_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
-+	stream_connect_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
- ')
+@@ -140,7 +218,7 @@ interface(`chronyd_dgram_send',`
  
  ########################################
  ## <summary>
 -##	Read chronyd key files.
-+##	Send to chronyd using a unix domain
-+##	datagram socket.
++##	Manage pid files used by chronyd
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -148,13 +207,13 @@ interface(`chronyd_dgram_send',`
+@@ -148,13 +226,14 @@ interface(`chronyd_dgram_send',`
  ##	</summary>
  ## </param>
  #
 -interface(`chronyd_read_key_files',`
-+interface(`chronyd_dgram_send',`
++interface(`chronyd_manage_pid',`
  	gen_require(`
 -		type chronyd_keys_t;
-+		type chronyd_t, chronyd_var_run_t;
++		type chronyd_var_run_t;
  	')
  
 -	files_search_etc($1)
 -	read_files_pattern($1, chronyd_keys_t, chronyd_keys_t)
 +	files_search_pids($1)
-+	dgram_send_pattern($1, chronyd_var_run_t, chronyd_var_run_t, chronyd_t)
++	manage_files_pattern($1, chronyd_var_run_t, chronyd_var_run_t)
++	manage_dirs_pattern($1, chronyd_var_run_t, chronyd_var_run_t)
  ')
  
  ####################################
-@@ -176,28 +235,38 @@ interface(`chronyd_read_key_files',`
+@@ -176,28 +255,38 @@ interface(`chronyd_read_key_files',`
  #
  interface(`chronyd_admin',`
  	gen_require(`
@@ -20907,7 +20896,7 @@ index 3023be7..4f0fe46 100644
 +	files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
  ')
 diff --git a/cups.te b/cups.te
-index c91813c..71b61c4 100644
+index c91813c..44633f7 100644
 --- a/cups.te
 +++ b/cups.te
 @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -21049,9 +21038,10 @@ index c91813c..71b61c4 100644
 -allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill setgid setuid fsetid fowner chown dac_override sys_rawio sys_resource sys_tty_config };
 +allow cupsd_t self:capability { ipc_lock sys_admin dac_override dac_read_search kill fsetid fowner chown dac_override sys_resource sys_tty_config };
  dontaudit cupsd_t self:capability { sys_tty_config net_admin };
- allow cupsd_t self:capability2 block_suspend;
+-allow cupsd_t self:capability2 block_suspend;
 -allow cupsd_t self:process { getpgid setpgid setsched signal_perms };
 -allow cupsd_t self:fifo_file rw_fifo_file_perms;
++allow cupsd_t self:capability2 { block_suspend wake_alarm };
 +allow cupsd_t self:process { getpgid setpgid setsched };
  allow cupsd_t self:unix_stream_socket { accept connectto listen };
  allow cupsd_t self:netlink_selinux_socket create_socket_perms;
@@ -46199,7 +46189,7 @@ index dd8e01a..9cd6b0b 100644
  ## <param name="domain">
  ##	<summary>
 diff --git a/logrotate.te b/logrotate.te
-index be0ab84..6f39336 100644
+index be0ab84..d46c5e7 100644
 --- a/logrotate.te
 +++ b/logrotate.te
 @@ -5,16 +5,29 @@ policy_module(logrotate, 1.15.0)
@@ -46427,16 +46417,17 @@ index be0ab84..6f39336 100644
  	fail2ban_stream_connect(logrotate_t)
  ')
  
-@@ -178,7 +247,7 @@ optional_policy(`
+@@ -178,7 +247,8 @@ optional_policy(`
  ')
  
  optional_policy(`
 -	chronyd_read_key_files(logrotate_t)
 +	chronyd_read_keys(logrotate_t)
++	chronyd_manage_pid(logrotate_t)
  ')
  
  optional_policy(`
-@@ -198,17 +267,18 @@ optional_policy(`
+@@ -198,17 +268,18 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -46458,7 +46449,7 @@ index be0ab84..6f39336 100644
  ')
  
  optional_policy(`
-@@ -216,6 +286,14 @@ optional_policy(`
+@@ -216,6 +287,14 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -46473,7 +46464,7 @@ index be0ab84..6f39336 100644
  	samba_exec_log(logrotate_t)
  ')
  
-@@ -228,26 +306,50 @@ optional_policy(`
+@@ -228,26 +307,50 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -52224,7 +52215,7 @@ index 6194b80..e27c53d 100644
  ')
 +
 diff --git a/mozilla.te b/mozilla.te
-index 11ac8e4..653ba10 100644
+index 11ac8e4..9336364 100644
 --- a/mozilla.te
 +++ b/mozilla.te
 @@ -6,17 +6,56 @@ policy_module(mozilla, 2.8.0)
@@ -52677,7 +52668,7 @@ index 11ac8e4..653ba10 100644
  ')
  
  optional_policy(`
-@@ -300,259 +339,254 @@ optional_policy(`
+@@ -300,259 +339,257 @@ optional_policy(`
  
  ########################################
  #
@@ -52692,6 +52683,8 @@ index 11ac8e4..653ba10 100644
 +dontaudit mozilla_plugin_t self:capability2 block_suspend;
 +dontaudit mozilla_plugin_t self:cap_userns {sys_ptrace };
 +
++
++allow mozilla_plugin_t self:cap_userns {sys_admin sys_chroot};
 +allow mozilla_plugin_t self:process { getsession setcap setpgid getsched setsched signal_perms execmem execstack setrlimit transition };
 +allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
 +allow mozilla_plugin_t self:netlink_socket create_socket_perms;
@@ -52751,21 +52744,23 @@ index 11ac8e4..653ba10 100644
 +can_exec(mozilla_plugin_t, mozilla_plugin_tmp_t)
  
  manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
++manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
  manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
  manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
  manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
- fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
+-fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
++fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file dir lnk_file sock_file fifo_file })
 +userdom_manage_home_texlive(mozilla_plugin_t)
  
  allow mozilla_plugin_t mozilla_plugin_rw_t:dir list_dir_perms;
 -allow mozilla_plugin_t mozilla_plugin_rw_t:file read_file_perms;
 -allow mozilla_plugin_t mozilla_plugin_rw_t:lnk_file read_lnk_file_perms;
+-
+-dgram_send_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
+-stream_connect_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
 +read_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
 +read_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
  
--dgram_send_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
--stream_connect_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_t)
--
 -can_exec(mozilla_plugin_t, { mozilla_exec_t mozilla_plugin_home_t mozilla_plugin_tmp_t })
 +can_exec(mozilla_plugin_t, mozilla_exec_t)
  
@@ -53077,7 +53072,7 @@ index 11ac8e4..653ba10 100644
  ')
  
  optional_policy(`
-@@ -560,7 +594,11 @@ optional_policy(`
+@@ -560,7 +597,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -53090,7 +53085,7 @@ index 11ac8e4..653ba10 100644
  ')
  
  optional_policy(`
-@@ -568,108 +606,144 @@ optional_policy(`
+@@ -568,108 +609,144 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -64246,10 +64241,18 @@ index e403097..45d387d 100644
 +userdom_stream_connect(oddjob_mkhomedir_t)
 +
 diff --git a/openct.te b/openct.te
-index 3b6920e..3e9b17f 100644
+index 3b6920e..577c90b 100644
 --- a/openct.te
 +++ b/openct.te
-@@ -29,12 +29,12 @@ manage_files_pattern(openct_t, openct_var_run_t, openct_var_run_t)
+@@ -21,6 +21,7 @@ files_pid_file(openct_var_run_t)
+ #
+ 
+ dontaudit openct_t self:capability sys_tty_config;
++allow openct_t self:capability2 wake_alarm;
+ allow openct_t self:process signal_perms;
+ allow openct_t self:netlink_kobject_uevent_socket create_socket_perms;
+ 
+@@ -29,12 +30,12 @@ manage_files_pattern(openct_t, openct_var_run_t, openct_var_run_t)
  manage_sock_files_pattern(openct_t, openct_var_run_t, openct_var_run_t)
  files_pid_filetrans(openct_t, openct_var_run_t, { dir file sock_file })
  
@@ -64264,7 +64267,7 @@ index 3b6920e..3e9b17f 100644
  dev_read_sysfs(openct_t)
  dev_rw_usbfs(openct_t)
  dev_rw_smartcard(openct_t)
-@@ -42,15 +42,12 @@ dev_rw_generic_usb_dev(openct_t)
+@@ -42,15 +43,12 @@ dev_rw_generic_usb_dev(openct_t)
  
  domain_use_interactive_fds(openct_t)
  
@@ -94800,7 +94803,7 @@ index 50d07fb..a34db48 100644
 +	allow $1 samba_unit_file_t:service all_service_perms;
  ')
 diff --git a/samba.te b/samba.te
-index 2b7c441..ca83568 100644
+index 2b7c441..02be6db 100644
 --- a/samba.te
 +++ b/samba.te
 @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3)
@@ -95433,7 +95436,7 @@ index 2b7c441..ca83568 100644
  	rpc_search_nfs_state_data(smbd_t)
  ')
  
-@@ -499,9 +549,48 @@ optional_policy(`
+@@ -499,12 +549,52 @@ optional_policy(`
  	udev_read_db(smbd_t)
  ')
  
@@ -95483,7 +95486,11 @@ index 2b7c441..ca83568 100644
  #
  
  dontaudit nmbd_t self:capability sys_tty_config;
-@@ -512,9 +601,11 @@ allow nmbd_t self:msg { send receive };
++allow nmbd_t self:capability {net_admin};
+ allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
+ allow nmbd_t self:fd use;
+ allow nmbd_t self:fifo_file rw_fifo_file_perms;
+@@ -512,9 +602,11 @@ allow nmbd_t self:msg { send receive };
  allow nmbd_t self:msgq create_msgq_perms;
  allow nmbd_t self:sem create_sem_perms;
  allow nmbd_t self:shm create_shm_perms;
@@ -95498,7 +95505,7 @@ index 2b7c441..ca83568 100644
  
  manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t)
  manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
-@@ -526,20 +617,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
+@@ -526,20 +618,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
  read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
  
  manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
@@ -95523,7 +95530,7 @@ index 2b7c441..ca83568 100644
  
  kernel_getattr_core_if(nmbd_t)
  kernel_getattr_message_if(nmbd_t)
-@@ -547,53 +634,44 @@ kernel_read_kernel_sysctls(nmbd_t)
+@@ -547,53 +635,44 @@ kernel_read_kernel_sysctls(nmbd_t)
  kernel_read_network_state(nmbd_t)
  kernel_read_software_raid_state(nmbd_t)
  kernel_read_system_state(nmbd_t)
@@ -95592,7 +95599,7 @@ index 2b7c441..ca83568 100644
  ')
  
  optional_policy(`
-@@ -606,18 +684,29 @@ optional_policy(`
+@@ -606,18 +685,29 @@ optional_policy(`
  
  ########################################
  #
@@ -95628,7 +95635,7 @@ index 2b7c441..ca83568 100644
  
  samba_read_config(smbcontrol_t)
  samba_search_var(smbcontrol_t)
-@@ -627,39 +716,38 @@ domain_use_interactive_fds(smbcontrol_t)
+@@ -627,39 +717,38 @@ domain_use_interactive_fds(smbcontrol_t)
  
  dev_read_urand(smbcontrol_t)
  
@@ -95680,7 +95687,7 @@ index 2b7c441..ca83568 100644
  
  allow smbmount_t samba_secrets_t:file manage_file_perms;
  
-@@ -668,26 +756,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
+@@ -668,26 +757,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
  manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
  files_var_filetrans(smbmount_t, samba_var_t, dir, "samba")
  
@@ -95716,7 +95723,7 @@ index 2b7c441..ca83568 100644
  
  fs_getattr_cifs(smbmount_t)
  fs_mount_cifs(smbmount_t)
-@@ -699,58 +783,77 @@ fs_read_cifs_files(smbmount_t)
+@@ -699,58 +784,77 @@ fs_read_cifs_files(smbmount_t)
  storage_raw_read_fixed_disk(smbmount_t)
  storage_raw_write_fixed_disk(smbmount_t)
  
@@ -95808,7 +95815,7 @@ index 2b7c441..ca83568 100644
  
  manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
  manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
-@@ -759,17 +862,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
+@@ -759,17 +863,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
  manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
  files_pid_filetrans(swat_t, swat_var_run_t, file)
  
@@ -95832,7 +95839,7 @@ index 2b7c441..ca83568 100644
  
  kernel_read_kernel_sysctls(swat_t)
  kernel_read_system_state(swat_t)
-@@ -777,36 +876,25 @@ kernel_read_network_state(swat_t)
+@@ -777,36 +877,25 @@ kernel_read_network_state(swat_t)
  
  corecmd_search_bin(swat_t)
  
@@ -95875,7 +95882,7 @@ index 2b7c441..ca83568 100644
  
  auth_domtrans_chk_passwd(swat_t)
  auth_use_nsswitch(swat_t)
-@@ -818,10 +906,11 @@ logging_send_syslog_msg(swat_t)
+@@ -818,10 +907,11 @@ logging_send_syslog_msg(swat_t)
  logging_send_audit_msgs(swat_t)
  logging_search_logs(swat_t)
  
@@ -95889,7 +95896,7 @@ index 2b7c441..ca83568 100644
  optional_policy(`
  	cups_read_rw_config(swat_t)
  	cups_stream_connect(swat_t)
-@@ -840,17 +929,20 @@ optional_policy(`
+@@ -840,17 +930,20 @@ optional_policy(`
  # Winbind local policy
  #
  
@@ -95915,7 +95922,7 @@ index 2b7c441..ca83568 100644
  
  allow winbind_t samba_etc_t:dir list_dir_perms;
  read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
-@@ -860,9 +952,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
+@@ -860,9 +953,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
  filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
  
  manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
@@ -95926,7 +95933,7 @@ index 2b7c441..ca83568 100644
  manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
  
  manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
-@@ -873,38 +963,42 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
+@@ -873,38 +964,42 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
  
  rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
  
@@ -95980,7 +95987,7 @@ index 2b7c441..ca83568 100644
  corenet_tcp_connect_smbd_port(winbind_t)
  corenet_tcp_connect_epmap_port(winbind_t)
  corenet_tcp_connect_all_unreserved_ports(winbind_t)
-@@ -912,38 +1006,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
+@@ -912,38 +1007,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
  dev_read_sysfs(winbind_t)
  dev_read_urand(winbind_t)
  
@@ -96039,7 +96046,7 @@ index 2b7c441..ca83568 100644
  ')
  
  optional_policy(`
-@@ -959,31 +1067,36 @@ optional_policy(`
+@@ -959,31 +1068,36 @@ optional_policy(`
  # Winbind helper local policy
  #
  
@@ -96083,7 +96090,7 @@ index 2b7c441..ca83568 100644
  
  optional_policy(`
  	apache_append_log(winbind_helper_t)
-@@ -997,25 +1110,38 @@ optional_policy(`
+@@ -997,25 +1111,38 @@ optional_policy(`
  
  ########################################
  #
@@ -98334,7 +98341,7 @@ index 98c9e0a..562666e 100644
  	files_search_pids($1)
  	admin_pattern($1, sblim_var_run_t)
 diff --git a/sblim.te b/sblim.te
-index 299756b..7d15afd 100644
+index 299756b..a256f80 100644
 --- a/sblim.te
 +++ b/sblim.te
 @@ -7,13 +7,11 @@ policy_module(sblim, 1.1.0)
@@ -98445,7 +98452,7 @@ index 299756b..7d15afd 100644
  ')
  
  optional_policy(`
-@@ -117,6 +136,59 @@ optional_policy(`
+@@ -117,6 +136,61 @@ optional_policy(`
  # Reposd local policy
  #
  
@@ -98457,6 +98464,8 @@ index 299756b..7d15afd 100644
 +
 +logging_send_syslog_msg(sblim_reposd_t)
 +
++miscfiles_read_certs(sblim_reposd_t)
++
 +#######################################
 +#
 +# Sfcbd local policy
diff --git a/selinux-policy.spec b/selinux-policy.spec
index dfc2e6f..a06ff24 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 191.20%{?dist}
+Release: 191.21%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -55,7 +55,7 @@ Source28: permissivedomains.cil
 Source29: serefpolicy-contrib-%{version}.tgz
 Source30: booleans.subs_dist
 
-Source35: docker-selinux.tgz
+Source35: container-selinux.tgz
 
 # Do a factory reset when there's no policy.kern file in a store
 # http://bugzilla.redhat.com/1290659
@@ -492,7 +492,7 @@ Obsoletes: mod_fcgid-selinux <= %{version}-%{release}
 Obsoletes: cachefilesd-selinux <= 0.10-1
 Conflicts:  seedit
 Conflicts:  389-ds-base < 1.2.7, 389-admin < 1.1.12
-Conflicts: docker-selinux <= 1.9.0-9
+Conflicts: container-selinux <= 1.9.0-9
 
 %description targeted
 SELinux Reference policy targeted base module.
@@ -672,6 +672,19 @@ exit 0
 %endif
 
 %changelog
+* Tue Nov 08 2016 Lukas Vrabec  <lvrabec@redhat.com> 3.13.1-191.21
+- Rename docker interfaces to container.
+- Allow watching netflix using Firefox
+- nmbd_t needs net_admin capability like smbd
+- Add interface chronyd_manage_pid() Allow logrotate to manage chrony pids
+- Add wake_alarm capability2 to openct_t domain
+- Allow abrt_t to getattr on nsfs_t files.
+- Add cupsd_t domain wake_alarm capability.
+- Allow sblim_reposd_t domain to read cert_f files.
+- Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
+- Revert "Allow abrt_dump_oops_t to drop capabilities. bz(1391040)"
+- Allow isnsd_t to accept tcp connections
+
 * Wed Nov 02 2016 Lukas Vrabec  <lvrabec@redhat.com> 3.13.1-191.20
 - Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
 - Add named_t domain net_raw capability bz(1389240)