File fix_unconfinedprivs.patch of Package selinux-policy

Overview Repositories Revisions Requests Users Attributes Meta

File fix_unconfinedprivs.patch of Package selinux-policy (Revision 4008478ada5af4c165762e5241cc4083)

Currently displaying revision 4008478ada5af4c165762e5241cc4083 , Show latest

diff --git a/config/appconfig-mcs/default_contexts b/config/appconfig-mcs/default_contexts
index 698d54ce8..c415a541d 100644
--- a/config/appconfig-mcs/default_contexts
+++ b/config/appconfig-mcs/default_contexts
@@ -13,3 +13,6 @@ sysadm_r:sysadm_sudo_t:s0	sysadm_r:sysadm_t:s0
 
 user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
+
+unconfined_r:unconfined_su_t:s0		unconfined_r:unconfined_t:s0 system_r:sysadm_t:s0
+unconfined_r:unconfined_sudo_t:s0	system_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
diff --git a/config/appconfig-mls/default_contexts b/config/appconfig-mls/default_contexts
index 698d54ce8..c415a541d 100644
--- a/config/appconfig-mls/default_contexts
+++ b/config/appconfig-mls/default_contexts
@@ -13,3 +13,6 @@ sysadm_r:sysadm_sudo_t:s0	sysadm_r:sysadm_t:s0
 
 user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
+
+unconfined_r:unconfined_su_t:s0		unconfined_r:unconfined_t:s0 system_r:sysadm_t:s0
+unconfined_r:unconfined_sudo_t:s0	system_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
diff --git a/config/appconfig-standard/default_contexts b/config/appconfig-standard/default_contexts
index 25ee341c1..7ee18dd31 100644
--- a/config/appconfig-standard/default_contexts
+++ b/config/appconfig-standard/default_contexts
@@ -13,3 +13,6 @@ sysadm_r:sysadm_sudo_t	sysadm_r:sysadm_t
 
 user_r:user_su_t	user_r:user_t staff_r:staff_t sysadm_r:sysadm_t
 user_r:user_sudo_t	sysadm_r:sysadm_t user_r:user_t
+
+unconfined_r:unconfined_su_t	unconfined_r:unconfined_t system_r:sysadm_t
+unconfined_r:unconfined_sudo_t	system_r:sysadm_t unconfined_r:unconfined_t
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index 6bac5f062..97e6d234e 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -1102,3 +1102,8 @@ class io_uring
     sqpoll
     cmd
 }
+
+class user_namespace
+{
+    create
+}
diff --git a/policy/flask/flask_documentation.md b/policy/flask/flask_documentation.md
index b9c05f887..17cb0f125 100644
--- a/policy/flask/flask_documentation.md
+++ b/policy/flask/flask_documentation.md
@@ -1925,3 +1925,16 @@ Used to control the ability to use special io\_uring features by the process. Se
 **sqpoll** - Allow *source* to create an io\_uring kernel polling thread. *target* is always equal to *source*.
 
 **cmd** - Allow *source* to pass commands to special file *target* (`IORING_OP_URING_CMD`). The semantics of the commands are defined by the kernel subsystem/module implementing the special file's operations and may be subject to other access checks. See also kernel commits [2a5840124009](https://git.kernel.org/torvalds/c/2a5840124009) and [f4d653dcaa4e](https://git.kernel.org/torvalds/c/f4d653dcaa4e).
+
+---
+
+## class user\_namespace
+
+This class is used to control over the observability and access control over
+user namespace creation.
+
+See also kernel commits
+[7cd4c5c2101c](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7cd4c5c2101cb092db00f61f69d24380cf7a0ee8) and
+[ed5d44d42c95](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed5d44d42c95e8a13bb54e614d2269c8740667f9).
+
+**create** - Allow *source* to create a user namespace object
diff --git a/policy/flask/security_classes b/policy/flask/security_classes
index 6fa1218ce..88cb356f0 100644
--- a/policy/flask/security_classes
+++ b/policy/flask/security_classes
@@ -205,4 +205,6 @@ class lockdown
 
 class io_uring
 
+class user_namespace
+
 # FLASK
diff --git a/policy/mcs b/policy/mcs
index ba9e2ee16..befddb553 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -4,9 +4,10 @@ default_range dir_file_class_set target low;
 #
 # Define sensitivities 
 #
-# MCS is single-sensitivity.
+# Domination of sensitivities is in increasing
+# numerical order, with s0 being the lowest
 
-gen_sens(1)
+gen_sens(mls_num_sens)
 
 #
 # Define the categories
@@ -19,8 +20,10 @@ gen_cats(mcs_num_cats)
 # Each MCS level specifies a sensitivity and zero or more categories which may
 # be associated with that sensitivity.
 #
+# Generate levels from all sensitivities
+# with all categories
 
-gen_levels(1,mcs_num_cats)
+gen_levels(mls_num_sens,mcs_num_cats)
 
 #
 # Define the MCS policy
@@ -71,13 +74,13 @@ gen_levels(1,mcs_num_cats)
 #  - /proc/pid operations are not constrained.
 
 mlsconstrain file { read ioctl lock execute execute_no_trans }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain file { write setattr append unlink link rename }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { search read ioctl lock }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
@@ -86,7 +89,7 @@ mlsconstrain fifo_file { open }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
diff --git a/policy/modules/admin/sudo.fc b/policy/modules/admin/sudo.fc
index 6083c590e..21678ee7b 100644
--- a/policy/modules/admin/sudo.fc
+++ b/policy/modules/admin/sudo.fc
@@ -4,3 +4,4 @@
 /var/db/sudo(/.*)?		gen_context(system_u:object_r:sudo_db_t,s0)
 
 /var/log/sudo-io(/.*)?		gen_context(system_u:object_r:sudo_log_t,s0)
+/var/log/sudo\.log	--	gen_context(system_u:object_r:sudo_log_t,s0)
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index 333b46535..f5f156c2f 100644
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -25,6 +25,7 @@ manage_files_pattern(sudodomain, sudo_db_t, sudo_db_t)
 manage_dirs_pattern(sudodomain, sudo_log_t, sudo_log_t)
 manage_files_pattern(sudodomain, sudo_log_t, sudo_log_t)
 logging_log_filetrans(sudodomain, sudo_log_t, dir, "sudo-io")
+logging_log_filetrans(sudodomain, sudo_log_t, file, "sudo.log")
 
 ##############################
 #
diff --git a/policy/modules/contrib/anaconda.fc b/policy/modules/contrib/anaconda.fc
index 9e9a1a26c..f457159af 100644
--- a/policy/modules/contrib/anaconda.fc
+++ b/policy/modules/contrib/anaconda.fc
@@ -4,6 +4,7 @@
 /usr/sbin/anaconda      --  gen_context(system_u:object_r:install_exec_t,s0)
 
 /usr/bin/initial-setup  --  gen_context(system_u:object_r:install_exec_t,s0)
+/usr/bin/bootc          --  gen_context(system_u:object_r:install_exec_t,s0)
 /usr/bin/ostree         --  gen_context(system_u:object_r:install_exec_t,s0)
 /usr/bin/rpm-ostree     --  gen_context(system_u:object_r:install_exec_t,s0)
 /usr/libexec/rpm-ostreed --  gen_context(system_u:object_r:install_exec_t,s0)
diff --git a/policy/modules/contrib/apache.fc b/policy/modules/contrib/apache.fc
index 6cca094c5..785ea1950 100644
--- a/policy/modules/contrib/apache.fc
+++ b/policy/modules/contrib/apache.fc
@@ -122,6 +122,7 @@ ifdef(`distro_suse', `
 /var/lib/dokuwiki(/.*)?			gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
 /var/lib/drupal.*			gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
 /var/lib/htdig(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)
+/var/lib/httpd/md(/.*)?			gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
 /var/lib/httpd(/.*)?			gen_context(system_u:object_r:httpd_var_lib_t,s0)
 /var/lib/ipsilon(/.*)?          gen_context(system_u:object_r:httpd_var_lib_t,s0)
 /var/lib/lighttpd(/.*)?			gen_context(system_u:object_r:httpd_var_lib_t,s0)
diff --git a/policy/modules/contrib/certmonger.if b/policy/modules/contrib/certmonger.if
index 144c0740a..e0a7b2b10 100644
--- a/policy/modules/contrib/certmonger.if
+++ b/policy/modules/contrib/certmonger.if
@@ -78,6 +78,25 @@ interface(`certmonger_read_pid_files',`
 	allow $1 certmonger_var_run_t:file read_file_perms;
 ')
 
+########################################
+## <summary>
+##	Read inherited certmonger PID files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`certmonger_read_inherited_pid_files',`
+	gen_require(`
+		type certmonger_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 certmonger_var_run_t:file read_inherited_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Search certmonger lib directories.
diff --git a/policy/modules/contrib/cups.te b/policy/modules/contrib/cups.te
index 34618c2d5..f39300bfe 100644
--- a/policy/modules/contrib/cups.te
+++ b/policy/modules/contrib/cups.te
@@ -653,6 +653,8 @@ kernel_read_system_state(cups_pdf_t)
 
 auth_use_nsswitch(cups_pdf_t)
 
+logging_send_syslog_msg(cups_pdf_t)
+
 userdom_manage_user_home_content_dirs(cups_pdf_t)
 userdom_manage_user_home_content_files(cups_pdf_t)
 userdom_filetrans_home_content(cups_pdf_t)
diff --git a/policy/modules/contrib/dcc.te b/policy/modules/contrib/dcc.te
index a5e912fca..f41ae7623 100644
--- a/policy/modules/contrib/dcc.te
+++ b/policy/modules/contrib/dcc.te
@@ -88,7 +88,7 @@ manage_dirs_pattern(cdcc_t, cdcc_tmp_t, cdcc_tmp_t)
 manage_files_pattern(cdcc_t, cdcc_tmp_t, cdcc_tmp_t)
 files_tmp_filetrans(cdcc_t, cdcc_tmp_t, { file dir })
 
-allow cdcc_t dcc_client_map_t:file rw_file_perms;
+allow cdcc_t dcc_client_map_t:file mmap_rw_file_perms;
 
 allow cdcc_t dcc_var_t:dir list_dir_perms;
 read_files_pattern(cdcc_t, dcc_var_t, dcc_var_t)
diff --git a/policy/modules/contrib/fwupd.fc b/policy/modules/contrib/fwupd.fc
index 720e39f58..93fcb5627 100644
--- a/policy/modules/contrib/fwupd.fc
+++ b/policy/modules/contrib/fwupd.fc
@@ -1,9 +1,10 @@
-/usr/lib/systemd/system/fwupd-offline-update.*		--	gen_context(system_u:object_r:fwupd_unit_file_t,s0)
 /usr/lib/systemd/system/fwupd.*		--	gen_context(system_u:object_r:fwupd_unit_file_t,s0)
 
 /etc/pki/(fwupd|fwupd-metadata)(/.*)?		gen_context(system_u:object_r:fwupd_cert_t,s0)
 
 /usr/libexec/fwupd/fwupd		--	gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/libexec/fwupd/fwupdoffline		--	gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/libexec/fwupd/fwupd-detect-cet	--	gen_context(system_u:object_r:fwupd_exec_t,s0)
 
 /var/cache/app-info(/.*)?		gen_context(system_u:object_r:fwupd_cache_t,s0)
 /var/cache/fwupd(/.*)?			gen_context(system_u:object_r:fwupd_cache_t,s0)
diff --git a/policy/modules/contrib/gpg.te b/policy/modules/contrib/gpg.te
index 0cf318883..a8b90b212 100644
--- a/policy/modules/contrib/gpg.te
+++ b/policy/modules/contrib/gpg.te
@@ -188,6 +188,7 @@ optional_policy(`
 	insights_client_manage_lib_files(gpg_t)
 	insights_client_write_lib_sock_files(gpg_t)
 	insights_client_read_tmp(gpg_t)
+	insights_client_write_tmp(gpg_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/contrib/insights_client.te b/policy/modules/contrib/insights_client.te
index 5ddd3d576..ccec43413 100644
--- a/policy/modules/contrib/insights_client.te
+++ b/policy/modules/contrib/insights_client.te
@@ -43,7 +43,7 @@ systemd_unit_file(insights_client_unit_file_t)
 #
 # insights_client local policy
 #
-allow insights_client_t self:capability { dac_override dac_read_search fowner net_admin sys_admin sys_nice sys_ptrace sys_rawio sys_resource };
+allow insights_client_t self:capability { dac_override dac_read_search fowner ipc_owner kill net_admin setgid setuid sys_admin sys_nice sys_ptrace sys_rawio sys_resource };
 allow insights_client_t self:cap_userns sys_ptrace;
 allow insights_client_t self:fifo_file rw_fifo_file_perms;
 allow insights_client_t self:netlink_generic_socket create_socket_perms;
@@ -116,7 +116,11 @@ kernel_view_key(insights_client_t)
 corecmd_exec_all_executables(insights_client_t)
 corenet_tcp_bind_generic_node(insights_client_t)
 corenet_tcp_connect_generic_port(insights_client_t)
+corenet_tcp_connect_http_cache_port(insights_client_t)
 corenet_tcp_connect_http_port(insights_client_t)
+corenet_tcp_connect_netport_port(insights_client_t)
+corenet_tcp_connect_squid_port(insights_client_t)
+corenet_tcp_connect_websm_port(insights_client_t)
 corenet_udp_bind_generic_node(insights_client_t)
 
 dev_getattr_all(insights_client_t)
@@ -125,17 +129,19 @@ dev_getattr_all_chr_files(insights_client_t)
 dev_read_cpuid(insights_client_t)
 dev_read_kmsg(insights_client_t)
 dev_read_netcontrol(insights_client_t)
+dev_read_raw_memory(insights_client_t)
 dev_read_vsock(insights_client_t)
-dev_dontaudit_read_raw_memory(insights_client_t)
 dev_dontaudit_write_raw_memory(insights_client_t)
 dev_read_sysfs(insights_client_t)
 dev_rw_lvm_control(insights_client_t)
 
+domain_connect_all_stream_sockets(insights_client_t)
 domain_getattr_all_domains(insights_client_t)
 domain_getattr_all_sockets(insights_client_t)
 domain_getattr_all_pipes(insights_client_t)
 domain_manage_all_domains_keyrings(insights_client_t)
 domain_read_all_domains_state(insights_client_t)
+domain_signull_all_domains(insights_client_t)
 domain_unix_read_all_semaphores(insights_client_t)
 domain_use_interactive_fds(insights_client_t)
 
@@ -151,6 +157,7 @@ files_map_read_etc_files(insights_client_t)
 files_read_non_security_files(insights_client_t)
 files_read_all_symlinks(insights_client_t)
 files_status_etc(insights_client_t)
+files_write_generic_tmp_sock_files(insights_client_t)
 
 fs_getattr_all_fs(insights_client_t)
 fs_getattr_all_files(insights_client_t)
@@ -175,6 +182,10 @@ seutil_read_module_store(insights_client_t)
 
 storage_raw_read_fixed_disk(insights_client_t)
 
+optional_policy(`
+	abrt_dbus_chat(insights_client_t)
+')
+
 optional_policy(`
 	apache_exec_modules(insights_client_t)
 	apache_read_semaphores(insights_client_t)
@@ -239,14 +250,15 @@ optional_policy(`
 
 optional_policy(`
 	gen_require(`
-		type gluster_var_log_t;
+		type glusterd_log_t;
 	')
 
-	logging_log_filetrans(insights_client_t, gluster_var_log_t, dir, "gluster")
+	logging_log_filetrans(insights_client_t, glusterd_log_t, dir, "gluster")
 ')
 
 optional_policy(`
 	gnome_search_gconf(insights_client_t)
+	gnome_manage_generic_cache_files(insights_client_t)
 	gnome_manage_home_config(insights_client_t)
 	gnome_manage_home_config_dirs(insights_client_t)
 ')
@@ -280,6 +292,10 @@ optional_policy(`
 	logging_send_syslog_msg(insights_client_t)
 ')
 
+optional_policy(`
+	lpd_domtrans_lpr(insights_client_t)
+')
+
 optional_policy(`
 	lvm_domtrans(insights_client_t)
 	lvm_manage_metadata(insights_client_t)
@@ -289,6 +305,10 @@ optional_policy(`
 	mount_domtrans(insights_client_t)
 ')
 
+optional_policy(`
+	mysql_stream_connect(insights_client_t)
+')
+
 optional_policy(`
 	modutils_domtrans_kmod(insights_client_t)
 	modutils_read_module_deps_files(insights_client_t)
@@ -299,6 +319,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	openvswitch_stream_connect(insights_client_t)
+')
+
+optional_policy(`
+	pcp_filetrans_named_content(insights_client_t)
 	pcp_write_pid_sock_file(insights_client_t)
 ')
 
@@ -306,6 +331,10 @@ optional_policy(`
 	postgresql_stream_connect(insights_client_t)
 ')
 
+optional_policy(`
+	redis_stream_connect(insights_client_t)
+')
+
 optional_policy(`
 	rhnsd_read_config(insights_client_t)
 ')
@@ -347,17 +376,29 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_dbus_chat_logind(insights_client_t)
+	systemd_dbus_chat_timedated(insights_client_t)
 	systemd_start_all_unit_files(insights_client_t)
 	systemd_status_all_unit_files(insights_client_t)
 	systemd_machined_stream_connect(insights_client_t)
 	systemd_userdbd_stream_connect(insights_client_t)
 ')
 
+optional_policy(`
+	timedatex_dbus_chat(insights_client_t)
+')
+
 optional_policy(`
 	tuned_dbus_chat(insights_client_t)
 ')
 
 optional_policy(`
+	unconfined_server_create_shm(insights_client_t)
+')
+
+optional_policy(`
+	userdom_manage_admin_files(insights_client_t)
+	userdom_user_tmp_filetrans(insights_client_t, insights_client_tmp_t, { dir file })
 	userdom_view_all_users_keys(insights_client_t)
 ')
 
diff --git a/policy/modules/contrib/keepalived.te b/policy/modules/contrib/keepalived.te
index ff0b49818..02170721c 100644
--- a/policy/modules/contrib/keepalived.te
+++ b/policy/modules/contrib/keepalived.te
@@ -39,7 +39,7 @@ files_tmpfs_file(keepalived_tmpfs_t)
 
 allow keepalived_t self:capability { net_admin net_raw kill dac_read_search setuid setgid sys_admin sys_nice sys_ptrace };
 allow keepalived_t self:capability2 bpf;
-allow keepalived_t self:process { signal_perms getpgid setpgid setsched };
+allow keepalived_t self:process { signal_perms getpgid setpgid setsched setrlimit };
 allow keepalived_t self:icmp_socket create_socket_perms;
 allow keepalived_t self:netlink_socket create_socket_perms;
 allow keepalived_t self:netlink_generic_socket create_socket_perms;
diff --git a/policy/modules/contrib/lpd.te b/policy/modules/contrib/lpd.te
index 76835b574..b1758c526 100644
--- a/policy/modules/contrib/lpd.te
+++ b/policy/modules/contrib/lpd.te
@@ -13,7 +13,9 @@ policy_module(lpd, 1.14.0)
 gen_tunable(use_lpd_server, false)
 
 attribute_role checkpc_roles;
+
 attribute_role lpr_roles;
+roleattribute system_r lpr_roles;
 
 type checkpc_t;
 type checkpc_exec_t;
diff --git a/policy/modules/contrib/mptcpd.fc b/policy/modules/contrib/mptcpd.fc
new file mode 100644
index 000000000..dabcd4a09
--- /dev/null
+++ b/policy/modules/contrib/mptcpd.fc
@@ -0,0 +1,3 @@
+/etc/mptcpd(/.*)?			gen_context(system_u:object_r:mptcpd_etc_t,s0)
+
+/usr/libexec/mptcpd		--	gen_context(system_u:object_r:mptcpd_exec_t,s0)
diff --git a/policy/modules/contrib/mptcpd.if b/policy/modules/contrib/mptcpd.if
new file mode 100644
index 000000000..f50a30944
--- /dev/null
+++ b/policy/modules/contrib/mptcpd.if
@@ -0,0 +1,40 @@
+
+## <summary>policy for mptcpd</summary>
+
+########################################
+## <summary>
+##	Execute mptcpd_exec_t in the mptcpd domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`mptcpd_domtrans',`
+	gen_require(`
+		type mptcpd_t, mptcpd_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, mptcpd_exec_t, mptcpd_t)
+')
+
+######################################
+## <summary>
+##	Execute mptcpd in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mptcpd_exec',`
+	gen_require(`
+		type mptcpd_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, mptcpd_exec_t)
+')
diff --git a/policy/modules/contrib/mptcpd.te b/policy/modules/contrib/mptcpd.te
new file mode 100644
index 000000000..cabf749a6
--- /dev/null
+++ b/policy/modules/contrib/mptcpd.te
@@ -0,0 +1,42 @@
+policy_module(mptcpd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type mptcpd_t;
+type mptcpd_exec_t;
+init_daemon_domain(mptcpd_t, mptcpd_exec_t)
+init_nnp_daemon_domain(mptcpd_t)
+
+type mptcpd_etc_t;
+files_config_file(mptcpd_etc_t)
+
+permissive mptcpd_t;
+
+########################################
+#
+# mptcpd local policy
+#
+allow mptcpd_t self:fifo_file rw_fifo_file_perms;
+allow mptcpd_t self:netlink_generic_socket create_socket_perms;
+allow mptcpd_t self:netlink_route_socket r_netlink_socket_perms;
+allow mptcpd_t self:unix_dgram_socket create_socket_perms;
+allow mptcpd_t self:unix_stream_socket create_stream_socket_perms;
+
+allow mptcpd_t mptcpd_etc_t:file map;
+manage_dirs_pattern(mptcpd_t, mptcpd_etc_t, mptcpd_etc_t)
+read_files_pattern(mptcpd_t, mptcpd_etc_t, mptcpd_etc_t)
+
+kernel_dgram_send(mptcpd_t)
+kernel_read_net_sysctls(mptcpd_t)
+
+domain_use_interactive_fds(mptcpd_t)
+
+files_read_etc_files(mptcpd_t)
+
+logging_create_devlog_dev(mptcpd_t)
+logging_write_syslog_pid_socket(mptcpd_t)
+
+miscfiles_read_localization(mptcpd_t)
diff --git a/policy/modules/contrib/mta.te b/policy/modules/contrib/mta.te
index 72bfa1c98..ba68a37eb 100644
--- a/policy/modules/contrib/mta.te
+++ b/policy/modules/contrib/mta.te
@@ -256,6 +256,10 @@ optional_policy(`
 	bugzilla_dontaudit_rw_stream_sockets(system_mail_t)
 ')
 
+optional_policy(`
+	certmonger_read_inherited_pid_files(system_mail_t)
+')
+
 optional_policy(`
 	courier_stream_connect_authdaemon(system_mail_t)
 ')
diff --git a/policy/modules/contrib/networkmanager.te b/policy/modules/contrib/networkmanager.te
index 0c7b2cbac..676821da7 100644
--- a/policy/modules/contrib/networkmanager.te
+++ b/policy/modules/contrib/networkmanager.te
@@ -78,6 +78,7 @@ init_system_domain(wpa_cli_t, wpa_cli_exec_t)
 # and it receives a unexpected signal (rh bug #204161)
 allow NetworkManager_t self:capability { fowner chown fsetid kill setgid setuid sys_admin sys_nice dac_read_search dac_override net_admin net_raw net_bind_service ipc_lock sys_chroot };
 dontaudit NetworkManager_t self:capability sys_tty_config;
+allow NetworkManager_t self:capability2 bpf;
 
 allow NetworkManager_t self:bpf { map_create map_read map_write prog_load prog_run };
 
@@ -655,6 +656,11 @@ optional_policy(`
 	logging_send_syslog_msg(NetworkManager_dispatcher_tlp_t)
 ')
 
+optional_policy(`
+	nscd_read_pid(networkmanager_dispatcher_plugin)
+	nscd_socket_use(networkmanager_dispatcher_plugin)
+')
+
 optional_policy(`
 	samba_domtrans_smbcontrol(NetworkManager_dispatcher_winbind_t)
 	samba_read_config(NetworkManager_dispatcher_winbind_t)
diff --git a/policy/modules/contrib/nut.te b/policy/modules/contrib/nut.te
index 0dcc01943..a7a7fa7bd 100644
--- a/policy/modules/contrib/nut.te
+++ b/policy/modules/contrib/nut.te
@@ -1,4 +1,4 @@
-policy_module(nut, 1.3.0)
+policy_module(nut, 1.3.1)
 
 ########################################
 #
@@ -43,6 +43,7 @@ files_pid_filetrans(nut_domain, nut_var_run_t, { dir file sock_file })
 # Local policy for upsd
 #
 
+allow nut_upsd_t self:capability kill;
 allow nut_upsd_t self:unix_dgram_socket { create_socket_perms sendto };
 allow nut_upsd_t self:tcp_socket connected_stream_socket_perms;
 
diff --git a/policy/modules/contrib/pdns.te b/policy/modules/contrib/pdns.te
index d0006691b..ca540d4f3 100644
--- a/policy/modules/contrib/pdns.te
+++ b/policy/modules/contrib/pdns.te
@@ -54,6 +54,7 @@ corenet_tcp_bind_transproxy_port(pdns_t)
 manage_dirs_pattern(pdns_t, pdns_var_lib_t, pdns_var_lib_t)
 manage_files_pattern(pdns_t, pdns_var_lib_t, pdns_var_lib_t)
 files_var_lib_filetrans(pdns_t, pdns_var_lib_t, { dir file })
+allow pdns_t pdns_var_lib_t:file map;
 
 files_pid_filetrans(pdns_t, pdns_var_run_t, { file sock_file })
 manage_files_pattern(pdns_t, pdns_var_run_t, pdns_var_run_t)
@@ -61,6 +62,8 @@ manage_sock_files_pattern(pdns_t, pdns_var_run_t, pdns_var_run_t)
 
 auth_use_nsswitch(pdns_t)
 
+corenet_udp_bind_generic_port(pdns_t)
+
 logging_send_syslog_msg(pdns_t)
 
 
diff --git a/policy/modules/contrib/postfix.te b/policy/modules/contrib/postfix.te
index c236828d0..7b32a5ed2 100644
--- a/policy/modules/contrib/postfix.te
+++ b/policy/modules/contrib/postfix.te
@@ -699,10 +699,6 @@ optional_policy(`
 	dspam_stream_connect(postfix_smtp_t)
 ')
 
-optional_policy(`
-	kerberos_read_keytab(postfix_smtp_t)
-')
-
 optional_policy(`
 	milter_stream_connect_all(postfix_smtp_t)
 ')
@@ -741,6 +737,10 @@ optional_policy(`
 	dovecot_stream_connect(postfix_smtpd_t)
 ')
 
+optional_policy(`
+	kerberos_read_keytab(postfix_smtpd_t)
+')
+
 optional_policy(`
 	mailman_read_data_files(postfix_smtpd_t)
 ')
diff --git a/policy/modules/contrib/prosody.te b/policy/modules/contrib/prosody.te
index 06eb94871..f376c2795 100644
--- a/policy/modules/contrib/prosody.te
+++ b/policy/modules/contrib/prosody.te
@@ -48,6 +48,7 @@ files_var_lib_filetrans(prosody_t, prosody_var_lib_t, { dir file lnk_file })
 manage_dirs_pattern(prosody_t, prosody_var_run_t, prosody_var_run_t)
 manage_files_pattern(prosody_t, prosody_var_run_t, prosody_var_run_t)
 manage_lnk_files_pattern(prosody_t, prosody_var_run_t, prosody_var_run_t)
+manage_sock_files_pattern(prosody_t, prosody_var_run_t, prosody_var_run_t)
 files_pid_filetrans(prosody_t, prosody_var_run_t, { dir file lnk_file })
 
 manage_dirs_pattern(prosody_t, prosody_log_t, prosody_log_t)
diff --git a/policy/modules/contrib/pulseaudio.te b/policy/modules/contrib/pulseaudio.te
index bdc826368..bc97d1a1e 100644
--- a/policy/modules/contrib/pulseaudio.te
+++ b/policy/modules/contrib/pulseaudio.te
@@ -137,6 +137,7 @@ optional_policy(`
 	dbus_system_bus_client(pulseaudio_t)
 	dbus_session_bus_client(pulseaudio_t)
 	dbus_connect_session_bus(pulseaudio_t)
+	dbus_write_session_tmp_sock_files(pulseaudio_t)
 
 	optional_policy(`
 		consolekit_dbus_chat(pulseaudio_t)
diff --git a/policy/modules/contrib/redis.te b/policy/modules/contrib/redis.te
index 1465f6f12..80e703085 100644
--- a/policy/modules/contrib/redis.te
+++ b/policy/modules/contrib/redis.te
@@ -122,8 +122,9 @@ optional_policy(`
 ')
 
 optional_policy(`
-    sssd_read_public_files(redis_t)
-    sssd_search_lib(redis_t)
+	sssd_read_public_files(redis_t)
+	sssd_search_lib(redis_t)
+	sssd_stream_connect(redis_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/contrib/rshim.fc b/policy/modules/contrib/rshim.fc
new file mode 100644
index 000000000..35c791a4b
--- /dev/null
+++ b/policy/modules/contrib/rshim.fc
@@ -0,0 +1,3 @@
+/usr/sbin/rshim				--	gen_context(system_u:object_r:rshim_exec_t,s0)
+
+/usr/lib/systemd/system/rshim.*		--	gen_context(system_u:object_r:rshim_unit_file_t,s0)
diff --git a/policy/modules/contrib/rshim.if b/policy/modules/contrib/rshim.if
new file mode 100644
index 000000000..50226b0a4
--- /dev/null
+++ b/policy/modules/contrib/rshim.if
@@ -0,0 +1,39 @@
+## <summary>policy for rshim</summary>
+
+########################################
+## <summary>
+##	Execute rshim_exec_t in the rshim domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`rshim_domtrans',`
+	gen_require(`
+		type rshim_t, rshim_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, rshim_exec_t, rshim_t)
+')
+
+######################################
+## <summary>
+##	Execute rshim in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rshim_exec',`
+	gen_require(`
+		type rshim_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, rshim_exec_t)
+')
diff --git a/policy/modules/contrib/rshim.te b/policy/modules/contrib/rshim.te
new file mode 100644
index 000000000..d459d6478
--- /dev/null
+++ b/policy/modules/contrib/rshim.te
@@ -0,0 +1,49 @@
+policy_module(rshim, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type rshim_t;
+type rshim_exec_t;
+init_daemon_domain(rshim_t, rshim_exec_t)
+
+type rshim_unit_file_t;
+systemd_unit_file(rshim_unit_file_t)
+
+permissive rshim_t;
+
+########################################
+#
+# rshim local policy
+#
+allow rshim_t self:fifo_file rw_fifo_file_perms;
+allow rshim_t self:netlink_kobject_uevent_socket { bind create getattr setopt };
+allow rshim_t self:process { fork };
+allow rshim_t self:system module_load;
+allow rshim_t self:unix_stream_socket create_stream_socket_perms;
+
+kernel_read_proc_files(rshim_t)
+
+corecmd_exec_shell(rshim_t)
+
+auth_read_passwd_file(rshim_t)
+
+dev_read_sysfs(rshim_t)
+
+domain_use_interactive_fds(rshim_t)
+
+files_read_etc_files(rshim_t)
+files_read_kernel_modules(rshim_t)
+
+logging_send_syslog_msg(rshim_t)
+
+miscfiles_read_localization(rshim_t)
+
+modutils_exec_kmod(rshim_t)
+modutils_getattr_module_deps(rshim_t)
+modutils_read_module_config(rshim_t)
+modutils_read_module_deps_files(rshim_t)
+
+udev_read_pid_files(rshim_t)
diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te
index 1395047b3..6143ea262 100644
--- a/policy/modules/contrib/samba.te
+++ b/policy/modules/contrib/samba.te
@@ -1185,6 +1185,9 @@ manage_files_pattern(winbind_rpcd_t, winbind_rpcd_var_run_t, winbind_rpcd_var_ru
 files_pid_filetrans(winbind_rpcd_t, winbind_rpcd_var_run_t, { dir file })
 
 # access to files of other samba domains
+manage_dirs_pattern(winbind_rpcd_t, samba_share_t, samba_share_t)
+manage_files_pattern(winbind_rpcd_t, samba_share_t, samba_share_t)
+
 manage_dirs_pattern(winbind_rpcd_t, smbd_var_run_t, smbd_var_run_t)
 read_files_pattern(winbind_rpcd_t, smbd_var_run_t, smbd_var_run_t)
 manage_sock_files_pattern(winbind_rpcd_t, smbd_var_run_t, smbd_var_run_t)
@@ -1202,6 +1205,7 @@ kernel_read_network_state(winbind_rpcd_t)
 corecmd_exec_bin(winbind_rpcd_t)
 
 corenet_tcp_connect_ipp_port(winbind_rpcd_t)
+corenet_tcp_connect_ldap_port(winbind_rpcd_t)
 
 dev_getattr_fs(winbind_rpcd_t)
 
@@ -1225,6 +1229,10 @@ optional_policy(`
 	dirsrv_stream_connect(winbind_rpcd_t)
 ')
 
+optional_policy(`
+	init_stream_connectto(winbind_rpcd_t)
+')
+
 optional_policy(`
 	kerberos_read_keytab(winbind_rpcd_t)
 	kerberos_use(winbind_rpcd_t)
diff --git a/policy/modules/contrib/spamassassin.te b/policy/modules/contrib/spamassassin.te
index e2b8b67cb..2f86d1a1a 100644
--- a/policy/modules/contrib/spamassassin.te
+++ b/policy/modules/contrib/spamassassin.te
@@ -644,6 +644,8 @@ dev_read_urand(spamd_update_t)
 domain_use_interactive_fds(spamd_update_t)
 domain_read_all_domains_state(spamd_update_t)
 
+fs_getattr_xattr_fs(spamd_update_t)
+
 spamassassin_systemctl(spamd_update_t)
 
 optional_policy(`
diff --git a/policy/modules/contrib/wireguard.te b/policy/modules/contrib/wireguard.te
index 805345e2c..f30ddf88b 100644
--- a/policy/modules/contrib/wireguard.te
+++ b/policy/modules/contrib/wireguard.te
@@ -21,9 +21,11 @@ allow wireguard_t self:fifo_file rw_fifo_file_perms;
 allow wireguard_t self:netlink_generic_socket create_socket_perms;
 allow wireguard_t self:netlink_netfilter_socket create_socket_perms;
 allow wireguard_t self:netlink_route_socket create_netlink_socket_perms;
+allow wireguard_t self:udp_socket create_socket_perms;
 allow wireguard_t self:unix_dgram_socket create_socket_perms;
 allow wireguard_t self:unix_stream_socket create_stream_socket_perms;
 
+
 kernel_request_load_module(wireguard_t)
 
 corecmd_exec_bin(wireguard_t)
@@ -46,4 +48,5 @@ optional_policy(`
 
 optional_policy(`
 	sysnet_exec_ifconfig(wireguard_t)
+	sysnet_read_config(wireguard_t)
 ')
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index c01302eba..769864821 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -5237,6 +5237,24 @@ interface(`dev_map_sysfs',`
 	allow $1 sysfs_t:file map;
 ')
 
+########################################
+## <summary>
+##	Read the TPM device.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_read_tpm',`
+	gen_require(`
+		type device_t, tpm_device_t;
+	')
+
+	read_chr_files_pattern($1, device_t, tpm_device_t)
+')
+
 ########################################
 ## <summary>
 ##	Read and write the TPM device.
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 2fa439329..54208c409 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -345,6 +345,34 @@ interface(`domain_cron_exemption_target',`
 	typeattribute $1 cron_job_domain;
 ')
 
+########################################
+## <summary>
+##	Inherit and use file descriptors from
+##	all domains.
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to inherit and use file
+##	descriptors from all domains.  This does not allow
+##	access to the objects being referenced by the file
+##	descriptors.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="read" weight="1"/>
+#
+interface(`domain_use_all_fds',`
+	gen_require(`
+		attribute domain;
+	')
+
+	allow $1 domain:fd use;
+')
+
 ########################################
 ## <summary>
 ##	Inherit and use file descriptors from
@@ -1298,6 +1326,24 @@ interface(`domain_dontaudit_getattr_all_stream_sockets',`
 	dontaudit $1 domain:unix_stream_socket getattr;
 ')
 
+########################################
+## <summary>
+##	Connect to all domains unix stream sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`domain_connect_all_stream_sockets',`
+	gen_require(`
+		attribute domain;
+	')
+
+	allow $1 domain:unix_stream_socket connectto;
+')
+
 ########################################
 ## <summary>
 ##	Get the attributes of all domains
@@ -1711,8 +1757,6 @@ interface(`domain_unconfined',`
 	typeattribute $1 process_uncond_exempt;
 
 	mcs_process_set_categories($1)
-
-	userdom_filetrans_home_content($1)
 ')
 
 ########################################
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index 55b965ebd..ea68d7a66 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -257,6 +257,9 @@ allow unconfined_domain_type domain:io_uring override_creds;
 allow unconfined_domain_type self:io_uring sqpoll;
 files_io_uring_cmd_on_all_files(unconfined_domain_type)
 
+# allow using the user_namespace class
+allow unconfined_domain_type self:user_namespace create;
+
 # Use bpf tools
 allow unconfined_domain_type domain:bpf { map_create map_read map_write prog_load prog_run };
 
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 1a5707656..45f999048 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -2433,6 +2433,24 @@ interface(`files_dontaudit_write_all_mountpoints',`
 	dontaudit $1 mountpoint:dir write;
 ')
 
+########################################
+## <summary>
+##      Watch_sb all mount points
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`files_watch_sb_all_mountpoints', `
+	gen_require(`
+		attribute mountpoint;
+	')
+
+	watch_sb_dirs_pattern($1, mountpoint, mountpoint)
+')
+
 ########################################
 ## <summary>
 ##	Do not audit attempts to unmount all mount points.
@@ -2506,6 +2524,24 @@ interface(`files_rmdir_all_dirs',`
 	allow $1 file_type:dir rmdir;
 ')
 
+########################################
+## <summary>
+##	Watch_sb all file type directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_watch_sb_all_dirs', `
+	gen_require(`
+		attribute file_type;
+	')
+
+	watch_sb_dirs_pattern($1, file_type, file_type)
+')
+
 ########################################
 ## <summary>
 ##	Write all file type directories.
@@ -6316,6 +6352,24 @@ interface(`files_read_generic_tmp_files',`
 	read_files_pattern($1, tmp_t, tmp_t)
 ')
 
+########################################
+## <summary>
+##	Write socket files in the tmp directory (/tmp).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_write_generic_tmp_sock_files',`
+	gen_require(`
+		type tmp_t;
+	')
+
+	write_sock_files_pattern($1, tmp_t, tmp_t)
+')
+
 ########################################
 ## <summary>
 ##	Manage temporary directories in /tmp.
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 7cd451854..0b2eb009b 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -247,10 +247,10 @@ fs_associate_tmpfs(tmpfsfile)
 #
 
 # Create/access any file in a labeled filesystem;
-allow files_unconfined_type file_type:{ file chr_file } ~{ execmod entrypoint };
-allow files_unconfined_type file_type:dir ~map;
-allow files_unconfined_type file_type:{ lnk_file sock_file fifo_file blk_file } *;
-allow files_unconfined_type file_type:service *;
+allow files_unconfined_type non_auth_file_type:file execute_no_trans;
+allow files_unconfined_type non_auth_file_type:file_class_set { manage_file_perms execute };
+allow files_unconfined_type non_auth_file_type:dir manage_dir_perms;
+allow files_unconfined_type non_auth_file_type:service manage_service_perms;
 
 # Mount/unmount any filesystem with the context= option.
 allow files_unconfined_type file_type:filesystem all_filesystem_perms;
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 99a4c4561..7053ab080 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -2174,6 +2174,24 @@ interface(`fs_relabelfrom_dos_fs',`
 	allow $1 dosfs_t:filesystem relabelfrom;
 ')
 
+########################################
+## <summary>
+##	Watch dosfs filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_watch_dos_fs',`
+	gen_require(`
+		type dosfs_t;
+	')
+
+	allow $1 dosfs_t:filesystem watch;
+')
+
 ########################################
 ## <summary>
 ##	Search dosfs filesystem.
@@ -2229,6 +2247,24 @@ interface(`fs_manage_dos_dirs',`
 	manage_dirs_pattern($1, dosfs_t, dosfs_t)
 ')
 
+########################################
+## <summary>
+##	Watch_sb dirs on a DOS filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_watch_sb_dos_dirs', `
+	gen_require(`
+		type dosfs_t;
+	')
+
+	watch_sb_dirs_pattern($1, dosfs_t, dosfs_t)
+')
+
 ########################################
 ## <summary>
 ##	Watch_mount dirs on a DOS filesystem.
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 7e783399c..4f476e713 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -359,6 +359,5 @@ allow filesystem_unconfined_type filesystem_type:filesystem all_filesystem_perms
 # Create/access other files. fs_type is to pick up various
 # pseudo filesystem types that are applied to both the filesystem
 # and its files.
-allow filesystem_unconfined_type filesystem_type:{ file } ~entrypoint;
-allow filesystem_unconfined_type filesystem_type:dir ~map;
-allow filesystem_unconfined_type filesystem_type:{ lnk_file sock_file fifo_file chr_file blk_file } *;
+allow filesystem_unconfined_type filesystem_type:{ file dir lnk_file sock_file fifo_file chr_file blk_file } { getattr ioctl lock open read };
+allow filesystem_unconfined_type filesystem_type:{ dir } { search watch };
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index b86852812..37a31be77 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -257,13 +257,16 @@ sid tcp_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
 # kernel local policy
 #
 
-allow kernel_t self:capability2 mac_admin;
+allow kernel_t self:capability2 ~mac_override;
 allow kernel_t self:capability ~sys_module;
+allow kernel_t self:key manage_key_perms;
+allow kernel_t self:system { ipc_info module_request syslog_console syslog_mod syslog_read };
 allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow kernel_t self:shm create_shm_perms;
 allow kernel_t self:sem create_sem_perms;
 allow kernel_t self:msg { send receive };
 allow kernel_t self:msgq create_msgq_perms;
+allow kernel_t self:perf_event manage_perf_event_perms;
 allow kernel_t self:unix_dgram_socket create_socket_perms;
 allow kernel_t self:unix_stream_socket create_stream_socket_perms;
 allow kernel_t self:unix_dgram_socket sendto;
@@ -327,10 +330,8 @@ dev_search_usbfs(kernel_t)
 # devtmpfs handling:
 dev_create_generic_dirs(kernel_t)
 dev_delete_generic_dirs(kernel_t)
-dev_create_all_blk_files(kernel_t)
-dev_delete_all_blk_files(kernel_t)
-dev_create_all_chr_files(kernel_t)
-dev_delete_all_chr_files(kernel_t)
+dev_manage_all_blk_files(kernel_t)
+dev_manage_all_chr_files(kernel_t)
 dev_mounton(kernel_t)
 dev_filetrans_all_named_dev(kernel_t)
 term_filetrans_all_named_dev(kernel_t)
@@ -341,15 +342,23 @@ fs_mount_all_fs(kernel_t)
 fs_unmount_all_fs(kernel_t)
 
 selinux_load_policy(kernel_t)
+selinux_compute_create_context(kernel_t)
 
 term_use_all_terms(kernel_t)
 term_use_ptmx(kernel_t)
 
-corecmd_exec_shell(kernel_t)
 corecmd_list_bin(kernel_t)
-# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
-corecmd_exec_bin(kernel_t)
 
+# /proc/sys/kernel/modprobe is set to /bin/true if not using modules,
+# thus allow a transition into a minimal helper domain through generic bin
+# types.
+type kernel_generic_helper_t;
+domain_type(kernel_generic_helper_t)
+role system_r types kernel_generic_helper_t;
+corecmd_bin_entry_type(kernel_generic_helper_t)
+corecmd_bin_domtrans(kernel_t, kernel_generic_helper_t)
+
+domain_use_all_fds(kernel_t)
 domain_signal_all_domains(kernel_t)
 domain_search_all_domains_state(kernel_t)
 
@@ -487,10 +496,14 @@ optional_policy(`
 
 optional_policy(`
 	systemd_coredump_domtrans(kernel_t)
-')
 
-optional_policy(`
-	unconfined_domain_noaudit(kernel_t)
+	# Systemd symlinks /usr/sbin/{poweroff,reboot} (which are invoked by
+	# the kernel to perform an orderly poweroff/reboot) to
+	# /usr/bin/systemctl, so we need to allow the kernel to execute it
+	# and trigger the respective service unit.
+	systemd_systemctl_domain(kernel)
+	systemd_config_power_services(kernel_systemctl_t)
+	init_read_utmp(kernel_systemctl_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/kernel/selinux.te b/policy/modules/kernel/selinux.te
index 7d3e431ee..01dec0ff1 100644
--- a/policy/modules/kernel/selinux.te
+++ b/policy/modules/kernel/selinux.te
@@ -61,28 +61,28 @@ ifdef(`distro_rhel4',`
 ')
 
 if(!secure_mode_policyload) {
-	allow can_setenforce security_t:security setenforce;
-	dev_getattr_sysfs_fs(can_setenforce)
-	dev_search_sysfs(can_setenforce)
-	allow can_setenforce security_t:dir list_dir_perms;
-	allow can_setenforce security_t:file rw_file_perms;
+	allow { can_setenforce -selinux_unconfined_type } security_t:security setenforce;
+	dev_getattr_sysfs_fs({ can_setenforce -selinux_unconfined_type })
+	dev_search_sysfs({ can_setenforce -selinux_unconfined_type })
+	allow { can_setenforce -selinux_unconfined_type } security_t:dir list_dir_perms;
+	allow { can_setenforce -selinux_unconfined_type } security_t:file rw_file_perms;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_setenforce security_t:security setenforce;
+		auditallow { can_setenforce -selinux_unconfined_type } security_t:security setenforce;
 	')
 
-	allow can_load_policy security_t:security load_policy;
+	allow { can_load_policy -selinux_unconfined_type } security_t:security load_policy;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_load_policy security_t:security load_policy;
+		auditallow { can_load_policy -selinux_unconfined_type } security_t:security load_policy;
 	')
 
-	allow can_setbool boolean_type:security setbool;
+	allow { can_setbool -selinux_unconfined_type } boolean_type:security setbool;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_setbool boolean_type:security setbool;
+		auditallow { can_setbool -selinux_unconfined_type } boolean_type:security setbool;
 	')
 }
diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc
index cf2dcbd9b..f50225ee2 100644
--- a/policy/modules/kernel/storage.fc
+++ b/policy/modules/kernel/storage.fc
@@ -46,6 +46,9 @@
 /dev/pcd[0-3]		-b	gen_context(system_u:object_r:removable_device_t,s0)
 /dev/pd[a-d][^/]*	-b	gen_context(system_u:object_r:removable_device_t,s0)
 /dev/pg[0-3]		-c	gen_context(system_u:object_r:removable_device_t,s0)
+/dev/pktcdvd[0-7]	-b	gen_context(system_u:object_r:removable_device_t,s0)
+/dev/pktcdvd/control	-c	gen_context(system_u:object_r:pktcdvd_control_device_t,s0)
+/dev/pktcdvd/.+		-b	gen_context(system_u:object_r:removable_device_t,s0)
 /dev/ps3d.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/ram.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/(raw/)?rawctl	-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
diff --git a/policy/modules/kernel/storage.te b/policy/modules/kernel/storage.te
index fee12b9a6..0858b3d80 100644
--- a/policy/modules/kernel/storage.te
+++ b/policy/modules/kernel/storage.te
@@ -52,6 +52,12 @@ dev_node(removable_device_t)
 type tape_device_t;
 dev_node(tape_device_t)
 
+#
+# Type for /dev/pktcdvd/control
+#
+type pktcdvd_control_device_t;
+dev_node(pktcdvd_control_device_t)
+
 ########################################
 #
 # Unconfined access to this module
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index c40f1edb0..039cc7cb7 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -33,6 +33,7 @@ auth_manage_shadow(sysadm_t)
 corecmd_exec_shell(sysadm_t)
 
 dev_filetrans_all_named_dev(sysadm_t)
+dev_rw_ipmi_dev(sysadm_t)
 dev_rw_autofs(sysadm_t)
 dev_rw_lvm_control(sysadm_t)
 dev_rw_watchdog(sysadm_t)
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 6ab52d903..02037a61a 100644
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -97,7 +97,14 @@ ssh_dyntransition_to(unconfined_t)
 
 unconfined_domain_noaudit(unconfined_t)
 domain_named_filetrans(unconfined_t)
-domain_transition_all(unconfined_t)
+
+optional_policy(`
+	su_role_template(unconfined, unconfined_r, unconfined_t)
+')
+
+optional_policy(`
+	sudo_role_template(unconfined, unconfined_r, unconfined_t)
+')
 
 usermanage_run_passwd(unconfined_t, unconfined_r)
 
diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
index 76874e13d..873ee24c5 100644
--- a/policy/modules/system/fstools.fc
+++ b/policy/modules/system/fstools.fc
@@ -77,9 +77,12 @@
 /usr/sbin/mkfs.*	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/mkraid	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/mkreiserfs	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/mkudffs	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/parted	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/partprobe	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/partx		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/pktcdvd-check	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/pktsetup	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/raidautorun	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/raidstart	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/reiserfs(ck|tune)	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -91,6 +94,7 @@
 /usr/sbin/swapon.*	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/tune2fs	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/tune.exfat	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/udflabel	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/sbin/xfs_growfs    --  gen_context(system_u:object_r:fsadm_exec_t,s0)
 
 /var/log/fsck(/.*)?		gen_context(system_u:object_r:fsadm_log_t,s0)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 7abd3930c..afcb34c2f 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -464,11 +464,12 @@ interface(`init_ranged_system_domain',`
 ## </param>
 #
 interface(`init_dyntrans',`
-    gen_require(`
-        type init_t;
-    ')
+	gen_require(`
+		type init_t;
+	')
 
-    dyntrans_pattern($1, init_t)
+	dyntrans_pattern($1, init_t)
+	domain_dyntrans_type($1)
 ')
 
 ########################################
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index bb9f208b9..6ee067196 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -191,6 +191,7 @@ allow init_t self:file mounton;
 allow init_t self:fifo_file rw_fifo_file_perms;
 
 allow init_t self:service manage_service_perms;
+allow init_t self:user_namespace create;
 
 # Re-exec itself
 can_exec(init_t, init_exec_t)
@@ -1941,6 +1942,7 @@ role system_r types daemon;
 #')
 
 allow initrc_domain daemon:process transition;
+allow initrc_domain daemon:process2 { nnp_transition nosuid_transition };
 allow daemon initrc_domain:fd use;
 allow daemon initrc_domain:fifo_file rw_inherited_fifo_file_perms;
 allow daemon initrc_domain:process sigchld;
diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index e9eb66566..12807f72f 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -180,8 +180,8 @@ corenet_rw_tun_tap_dev(ipsec_t)
 
 dev_read_sysfs(ipsec_t)
 dev_read_rand(ipsec_t)
+dev_read_tpm(ipsec_t)
 dev_read_urand(ipsec_t)
-dev_rw_tpm(ipsec_t)
 
 domain_use_interactive_fds(ipsec_t)
 
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index a1fdfb23d..85b997c35 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -754,6 +754,24 @@ interface(`logging_relabel_syslog_pid_socket',`
 	allow $1 syslogd_var_run_t:sock_file relabel_sock_file_perms;
 ')
 
+########################################
+## <summary>
+##      Allow domain to write the syslog pid sock_file.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`logging_write_syslog_pid_socket',`
+	gen_require(`
+		type syslogd_var_run_t;
+	')
+
+	write_sock_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
+')
+
 ########################################
 ## <summary>
 ##	Connect to the syslog control unix stream socket.
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 34dd6aabe..8bfaf5354 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -479,7 +479,7 @@ optional_policy(`
 # sys_admin for the integrated klog of syslog-ng and metalog
 # sys_nice for rsyslog
 # cjp: why net_admin!
-allow syslogd_t self:capability { sys_ptrace dac_read_search dac_override sys_resource sys_tty_config ipc_lock net_admin setgid setuid sys_admin sys_nice chown fsetid setuid setgid net_raw };
+allow syslogd_t self:capability { sys_ptrace dac_read_search dac_override sys_resource sys_tty_config ipc_lock net_admin setgid setuid sys_admin sys_nice chown fsetid setuid setgid setpcap net_raw };
 dontaudit syslogd_t self:capability sys_tty_config;
 dontaudit syslogd_t self:cap_userns { kill sys_ptrace };
 allow syslogd_t self:capability2 { syslog block_suspend };
@@ -644,7 +644,7 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
 fs_getattr_all_fs(syslogd_t)
 fs_read_efivarfs_files(syslogd_t)
 fs_search_auto_mountpoints(syslogd_t)
-fs_search_cgroup_dirs(syslogd_t)
+fs_list_cgroup_dirs(syslogd_t)
 
 miscfiles_manage_generic_cert_files(syslogd_t)
 
diff --git a/policy/modules/system/modutils.fc b/policy/modules/system/modutils.fc
index fe436a783..6cc71b758 100644
--- a/policy/modules/system/modutils.fc
+++ b/policy/modules/system/modutils.fc
@@ -34,4 +34,4 @@ ifdef(`distro_gentoo',`
 
 /usr/lib/modules/modprobe\.conf -- 	gen_context(system_u:object_r:modules_conf_t,s0)
 
-/var/run/tmpfiles.d/kmod.conf --	gen_context(system_u:object_r:kmod_var_run_t,s0)
+/var/run/tmpfiles.d/*\.conf --	gen_context(system_u:object_r:kmod_var_run_t,s0)
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index f944dd462..66bd4f523 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -209,6 +209,7 @@ selinux_set_all_booleans(load_policy_t)
 
 term_use_console(load_policy_t)
 term_list_ptys(load_policy_t)
+term_write_unallocated_ttys(load_policy_t)
 
 init_use_script_fds(load_policy_t)
 init_use_script_ptys(load_policy_t)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index c559cbf39..98d179efe 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -44,6 +44,31 @@ interface(`systemd_stub_unit_file',`
         ')
 ')
 
+########################################
+## <summary>
+##      Common permissions for domains executing systemctl. (INTERNAL)
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`systemd_systemctl_common',`
+	fs_list_cgroup_dirs($1)
+	fs_read_cgroup_files($1)
+	fs_read_efivarfs_files($1)
+	systemd_list_unit_dirs($1)
+	init_list_pid_dirs($1)
+	init_read_state($1)
+	init_stream_send($1)
+	init_stream_connect($1)
+
+	# systemctl tries to adjust its RLIMIT_NOFILE right when it is started
+	dontaudit $1 self:process setrlimit;
+	dontaudit $1 self:capability sys_resource;
+')
+
 #######################################
 ## <summary>
 ##      Create a domain for processes which are started 
@@ -55,7 +80,7 @@ interface(`systemd_stub_unit_file',`
 ##      </summary>
 ## </param>
 #
-interface(`systemd_systemctl_domain',`
+template(`systemd_systemctl_domain',`
         gen_require(`
                 type systemd_systemctl_exec_t;
                 role system_r;
@@ -69,6 +94,8 @@ interface(`systemd_systemctl_domain',`
 	role system_r types $1_systemctl_t;
 
 	domtrans_pattern($1_t, systemd_systemctl_exec_t , $1_systemctl_t)
+
+	systemd_systemctl_common($1_systemctl_t)
 ')
 
 ########################################
@@ -89,22 +116,13 @@ interface(`systemd_exec_systemctl',`
 	corecmd_search_bin($1)
 	can_exec($1, systemd_systemctl_exec_t)
 
-	fs_list_cgroup_dirs($1)
-	fs_read_cgroup_files($1)
-    fs_read_efivarfs_files($1)
-	systemd_list_unit_dirs($1)
-	init_list_pid_dirs($1)
-	init_read_state($1)
-	init_stream_send($1)
-	init_stream_connect($1)
+	systemd_systemctl_common($1)
 
 	systemd_login_list_pid_dirs($1)
 	systemd_login_read_pid_files($1)
 	systemd_passwd_agent_exec($1)
 
 	dontaudit $1 self:capability { net_admin sys_ptrace };
-	# systemctl tries to adjust its RLIMIT_NOFILE right when it is started
-	dontaudit $1 self:process setrlimit;
 ')
 #
 ########################################
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 10b1b2d9b..70ec9b514 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1122,6 +1122,7 @@ allow systemd_coredump_t self:cap_userns { dac_read_search dac_override sys_admi
 allow systemd_coredump_t self:process setcap;
 
 allow systemd_coredump_t self:unix_stream_socket connectto;
+allow systemd_coredump_t self:user_namespace create;
 
 manage_files_pattern(systemd_coredump_t, systemd_coredump_tmpfs_t, systemd_coredump_tmpfs_t)
 fs_tmpfs_filetrans(systemd_coredump_t, systemd_coredump_tmpfs_t, file )
@@ -1321,6 +1322,7 @@ allow systemd_modules_load_t self:system module_load;
 kernel_dgram_send(systemd_modules_load_t)
 kernel_load_unsigned_module(systemd_modules_load_t)
 kernel_ib_access_unlabeled_pkeys(systemd_modules_load_t)
+kernel_request_load_module(systemd_modules_load_t)
 
 corecmd_exec_bin(systemd_modules_load_t)
 corecmd_exec_shell(systemd_modules_load_t)
@@ -1461,7 +1463,7 @@ optional_policy(`
 #
 # systemd_userdbd local policy
 #
-allow systemd_userdbd_t self:capability dac_read_search;
+allow systemd_userdbd_t self:capability { dac_read_search sys_resource };
 
 manage_dirs_pattern(systemd_userdbd_t, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
 manage_files_pattern(systemd_userdbd_t, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
index 1f8843b0b..8059f0e1b 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -25,6 +25,7 @@ interface(`unconfined_domain_noaudit',`
 
 	# Transition to myself, to make get_ordered_context_list happy.
 	allow $1 self:process { dyntransition transition };
+	allow $1 self:process2 { nnp_transition nosuid_transition };
 
 	# Write access is for setting attributes under /proc/self/attr.
 	allow $1 self:file manage_file_perms;
@@ -39,6 +40,9 @@ interface(`unconfined_domain_noaudit',`
 	allow $1 self:association all_association_perms;
 	allow $1 self:socket_class_set create_socket_perms;
 
+	mls_rangetrans_target($1)
+	mcs_constrained($1)
+
 	kernel_unconfined($1)
 	corenet_unconfined($1)
 	dev_unconfined($1)
@@ -375,3 +379,21 @@ interface(`unconfined_server_dontaudit_rw_pipes',`
 
 	dontaudit $1 unconfined_service_t:fifo_file rw_file_perms;
 ')
+
+########################################
+## <summary>
+##	Create and use unconfined service shared memory
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`unconfined_server_create_shm',`
+	gen_require(`
+		type unconfined_service_t;
+	')
+
+	allow $1 unconfined_service_t:shm create_shm_perms;
+')
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 62bc19c65..c8fa71c4a 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1681,16 +1681,18 @@ template(`userdom_admin_user_template',`
 	# Manipulate other users crontab.
 	allow $1_t self:passwd crontab;
 
-    allow $1_t self:bpf { map_create map_read map_write prog_load prog_run };
+	allow $1_t self:bpf { map_create map_read map_write prog_load prog_run };
 
-    allow $1_t self:alg_socket create_stream_socket_perms;
-    allow $1_t self:dccp_socket create_stream_socket_perms;
+	allow $1_t self:alg_socket create_stream_socket_perms;
+	allow $1_t self:dccp_socket create_stream_socket_perms;
 
-    allow $1_t self:cap_userns sys_ptrace;
+	allow $1_t self:cap_userns sys_ptrace;
 
-    tunable_policy(`deny_bluetooth',`',`
-        allow $1_t self:bluetooth_socket create_stream_socket_perms;
-    ')
+	allow $1_t self:user_namespace create;
+
+	tunable_policy(`deny_bluetooth',`',`
+		allow $1_t self:bluetooth_socket create_stream_socket_perms;
+	')
 
 	auth_use_nsswitch($1_t)
 
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 4f63e6f66..2da17a0d7 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -464,6 +464,7 @@ optional_policy(`
 	systemd_login_watch_pid_dirs(login_userdomain)
 	systemd_login_watch_session_dirs(login_userdomain)
 	systemd_machined_watch_pid_dirs(login_userdomain)
+	systemd_passwd_watch_pid_dirs(login_userdomain)
 	systemd_resolved_watch_pid_dirs(login_userdomain)
 ')
 
diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt
index d9d898bb5..d2369e17f 100644
--- a/policy/support/misc_patterns.spt
+++ b/policy/support/misc_patterns.spt
@@ -2,7 +2,7 @@
 # Specified domain transition patterns
 #
 define(`domain_transition_pattern',`
-	allow $1 $2:file exec_file_perms;
+	allow $1 $2:file mmap_exec_file_perms;
 	allow $1 $3:process transition;
 #	dontaudit $1 $3:process { noatsecure siginh rlimitinh };
 ')

Places

File fix_unconfinedprivs.patch of Package selinux-policy (Revision 4008478ada5af4c165762e5241cc4083)

Places