diff --git a/container-selinux.tgz b/container-selinux.tgz
index db7cd4b..ea5639d 100644
Binary files a/container-selinux.tgz and b/container-selinux.tgz differ
diff --git a/policy-f26-contrib.patch b/policy-f26-contrib.patch
index d6e17d0..2c97b12 100644
--- a/policy-f26-contrib.patch
+++ b/policy-f26-contrib.patch
@@ -21321,7 +21321,7 @@ index 3023be7f6..5afde8039 100644
 +	files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
  ')
 diff --git a/cups.te b/cups.te
-index c91813ccb..466ae9b70 100644
+index c91813ccb..92403b0ac 100644
 --- a/cups.te
 +++ b/cups.te
 @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -21598,7 +21598,7 @@ index c91813ccb..466ae9b70 100644
  
  selinux_compute_access_vector(cupsd_t)
  selinux_validate_context(cupsd_t)
-@@ -244,23 +289,31 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,23 +289,33 @@ auth_dontaudit_read_pam_pid(cupsd_t)
  auth_rw_faillog(cupsd_t)
  auth_use_nsswitch(cupsd_t)
  
@@ -21615,7 +21615,8 @@ index c91813ccb..466ae9b70 100644
 -miscfiles_read_localization(cupsd_t)
 -miscfiles_read_fonts(cupsd_t)
 -miscfiles_setattr_fonts_cache_dirs(cupsd_t)
--
++miscfiles_legacy_read_localization(cupsd_t)
+ 
  seutil_read_config(cupsd_t)
  
  sysnet_exec_ifconfig(cupsd_t)
@@ -21635,7 +21636,7 @@ index c91813ccb..466ae9b70 100644
  optional_policy(`
  	apm_domtrans_client(cupsd_t)
  ')
-@@ -272,6 +325,8 @@ optional_policy(`
+@@ -272,6 +327,8 @@ optional_policy(`
  optional_policy(`
  	dbus_system_bus_client(cupsd_t)
  
@@ -21644,7 +21645,7 @@ index c91813ccb..466ae9b70 100644
  	userdom_dbus_send_all_users(cupsd_t)
  
  	optional_policy(`
-@@ -279,11 +334,17 @@ optional_policy(`
+@@ -279,11 +336,17 @@ optional_policy(`
  	')
  
  	optional_policy(`
@@ -21662,7 +21663,7 @@ index c91813ccb..466ae9b70 100644
  	')
  ')
  
-@@ -296,8 +357,8 @@ optional_policy(`
+@@ -296,8 +359,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21672,7 +21673,7 @@ index c91813ccb..466ae9b70 100644
  ')
  
  optional_policy(`
-@@ -306,7 +367,6 @@ optional_policy(`
+@@ -306,7 +369,6 @@ optional_policy(`
  
  optional_policy(`
  	lpd_exec_lpr(cupsd_t)
@@ -21680,7 +21681,7 @@ index c91813ccb..466ae9b70 100644
  	lpd_read_config(cupsd_t)
  	lpd_relabel_spool(cupsd_t)
  ')
-@@ -316,6 +376,10 @@ optional_policy(`
+@@ -316,6 +378,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21691,7 +21692,7 @@ index c91813ccb..466ae9b70 100644
  	samba_read_config(cupsd_t)
  	samba_rw_var_files(cupsd_t)
  	samba_stream_connect_nmbd(cupsd_t)
-@@ -326,7 +390,7 @@ optional_policy(`
+@@ -326,7 +392,7 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21700,7 +21701,7 @@ index c91813ccb..466ae9b70 100644
  ')
  
  optional_policy(`
-@@ -334,7 +398,11 @@ optional_policy(`
+@@ -334,7 +400,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21713,7 +21714,7 @@ index c91813ccb..466ae9b70 100644
  ')
  
  ########################################
-@@ -342,12 +410,11 @@ optional_policy(`
+@@ -342,12 +412,11 @@ optional_policy(`
  # Configuration daemon local policy
  #
  
@@ -21729,7 +21730,7 @@ index c91813ccb..466ae9b70 100644
  allow cupsd_config_t cupsd_t:process signal;
  ps_process_pattern(cupsd_config_t, cupsd_t)
  
-@@ -367,23 +434,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
+@@ -367,23 +436,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
  files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
  
  allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@@ -21757,7 +21758,7 @@ index c91813ccb..466ae9b70 100644
  corenet_all_recvfrom_netlabel(cupsd_config_t)
  corenet_tcp_sendrecv_generic_if(cupsd_config_t)
  corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -392,20 +459,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -392,20 +461,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
  corenet_sendrecv_all_client_packets(cupsd_config_t)
  corenet_tcp_connect_all_ports(cupsd_config_t)
  
@@ -21778,7 +21779,7 @@ index c91813ccb..466ae9b70 100644
  fs_search_auto_mountpoints(cupsd_config_t)
  
  domain_use_interactive_fds(cupsd_config_t)
-@@ -417,17 +476,16 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,17 +478,16 @@ auth_use_nsswitch(cupsd_config_t)
  
  logging_send_syslog_msg(cupsd_config_t)
  
@@ -21800,7 +21801,7 @@ index c91813ccb..466ae9b70 100644
  optional_policy(`
  	term_use_generic_ptys(cupsd_config_t)
  ')
-@@ -449,9 +507,12 @@ optional_policy(`
+@@ -449,9 +509,12 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21814,7 +21815,7 @@ index c91813ccb..466ae9b70 100644
  ')
  
  optional_policy(`
-@@ -467,6 +528,10 @@ optional_policy(`
+@@ -467,6 +530,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -21825,7 +21826,7 @@ index c91813ccb..466ae9b70 100644
  	rpm_read_db(cupsd_config_t)
  ')
  
-@@ -487,10 +552,6 @@ optional_policy(`
+@@ -487,10 +554,6 @@ optional_policy(`
  # Lpd local policy
  #
  
@@ -21836,7 +21837,7 @@ index c91813ccb..466ae9b70 100644
  allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
  
  allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +569,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +571,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
  
  kernel_read_kernel_sysctls(cupsd_lpd_t)
  kernel_read_system_state(cupsd_lpd_t)
@@ -21854,7 +21855,7 @@ index c91813ccb..466ae9b70 100644
  corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
  
  corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +598,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +600,6 @@ auth_use_nsswitch(cupsd_lpd_t)
  
  logging_send_syslog_msg(cupsd_lpd_t)
  
@@ -21864,7 +21865,7 @@ index c91813ccb..466ae9b70 100644
  optional_policy(`
  	inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
  ')
-@@ -549,9 +607,9 @@ optional_policy(`
+@@ -549,9 +609,9 @@ optional_policy(`
  # Pdf local policy
  #
  
@@ -21876,7 +21877,7 @@ index c91813ccb..466ae9b70 100644
  
  append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
  create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +624,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +626,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
  
  kernel_read_system_state(cups_pdf_t)
  
@@ -21905,11 +21906,13 @@ index c91813ccb..466ae9b70 100644
 -	fs_manage_cifs_dirs(cups_pdf_t)
 -	fs_manage_cifs_files(cups_pdf_t)
 -')
--
--optional_policy(`
++userdom_home_manager(cups_pdf_t)
+ 
+ optional_policy(`
 -	lpd_manage_spool(cups_pdf_t)
--')
--
++	gnome_read_config(cups_pdf_t)
+ ')
+ 
 -########################################
 -#
 -# HPLIP local policy
@@ -22011,13 +22014,11 @@ index c91813ccb..466ae9b70 100644
 -	lpd_read_config(hplip_t)
 -	lpd_manage_spool(hplip_t)
 -')
-+userdom_home_manager(cups_pdf_t)
- 
- optional_policy(`
+-
+-optional_policy(`
 -	seutil_sigchld_newrole(hplip_t)
-+	gnome_read_config(cups_pdf_t)
- ')
- 
+-')
+-
 -optional_policy(`
 -	snmp_read_snmp_var_lib_files(hplip_t)
 -')
@@ -22028,7 +22029,7 @@ index c91813ccb..466ae9b70 100644
  
  ########################################
  #
-@@ -735,7 +668,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +670,6 @@ kernel_read_kernel_sysctls(ptal_t)
  kernel_list_proc(ptal_t)
  kernel_read_proc_symlinks(ptal_t)
  
@@ -22036,7 +22037,7 @@ index c91813ccb..466ae9b70 100644
  corenet_all_recvfrom_netlabel(ptal_t)
  corenet_tcp_sendrecv_generic_if(ptal_t)
  corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +677,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +679,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
  corenet_tcp_bind_ptal_port(ptal_t)
  corenet_tcp_sendrecv_ptal_port(ptal_t)
  
@@ -22050,7 +22051,7 @@ index c91813ccb..466ae9b70 100644
  files_read_etc_runtime_files(ptal_t)
  
  fs_getattr_all_fs(ptal_t)
-@@ -759,8 +689,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +691,6 @@ fs_search_auto_mountpoints(ptal_t)
  
  logging_send_syslog_msg(ptal_t)
  
@@ -22059,7 +22060,7 @@ index c91813ccb..466ae9b70 100644
  sysnet_read_config(ptal_t)
  
  userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +701,4 @@ optional_policy(`
+@@ -773,3 +703,4 @@ optional_policy(`
  optional_policy(`
  	udev_read_db(ptal_t)
  ')
@@ -49837,10 +49838,10 @@ index 327f3f726..4f6156138 100644
 +	')
  ')
 diff --git a/mandb.te b/mandb.te
-index e6136fd37..56fa2cfc1 100644
+index e6136fd37..21850a738 100644
 --- a/mandb.te
 +++ b/mandb.te
-@@ -10,19 +10,40 @@ roleattribute system_r mandb_roles;
+@@ -10,22 +10,45 @@ roleattribute system_r mandb_roles;
  
  type mandb_t;
  type mandb_exec_t;
@@ -49883,7 +49884,12 @@ index e6136fd37..56fa2cfc1 100644
  kernel_read_kernel_sysctls(mandb_t)
  kernel_read_system_state(mandb_t)
  
-@@ -33,11 +54,14 @@ dev_search_sysfs(mandb_t)
++auth_read_passwd(mandb_t)
++
+ corecmd_exec_bin(mandb_t)
+ corecmd_exec_shell(mandb_t)
+ 
+@@ -33,11 +56,14 @@ dev_search_sysfs(mandb_t)
  
  domain_use_interactive_fds(mandb_t)
  
@@ -55151,7 +55157,7 @@ index f42896cbf..fce39c1ce 100644
 +/var/spool/mail(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
 +/var/spool/smtpd(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
 diff --git a/mta.if b/mta.if
-index ed81cac5a..cd52baf59 100644
+index ed81cac5a..15a6c4636 100644
 --- a/mta.if
 +++ b/mta.if
 @@ -1,4 +1,4 @@
@@ -56107,7 +56113,7 @@ index ed81cac5a..cd52baf59 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1081,3 +1067,209 @@ interface(`mta_rw_user_mail_stream_sockets',`
+@@ -1081,3 +1067,210 @@ interface(`mta_rw_user_mail_stream_sockets',`
  
  	allow $1 user_mail_domain:unix_stream_socket rw_socket_perms;
  ')
@@ -56199,6 +56205,7 @@ index ed81cac5a..cd52baf59 100644
 +
 +        userdom_search_user_home_dirs($1)
 +        read_files_pattern($1, mail_home_rw_t, mail_home_rw_t)
++        list_dirs_pattern($1, mail_home_rw_t, mail_home_rw_t)
 +		read_lnk_files_pattern($1, mail_home_rw_t, mail_home_rw_t)
 +
 +        ifdef(`distro_redhat',`
@@ -105024,7 +105031,7 @@ index 1499b0bbf..e695a62f3 100644
 -	spamassassin_role($2, $1)
  ')
 diff --git a/spamassassin.te b/spamassassin.te
-index cc58e3578..85e9f5961 100644
+index cc58e3578..8533f3403 100644
 --- a/spamassassin.te
 +++ b/spamassassin.te
 @@ -7,50 +7,30 @@ policy_module(spamassassin, 2.6.1)
@@ -105468,7 +105475,7 @@ index cc58e3578..85e9f5961 100644
  	evolution_stream_connect(spamc_t)
  ')
  
-@@ -251,11 +361,18 @@ optional_policy(`
+@@ -251,11 +361,19 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -105485,10 +105492,11 @@ index cc58e3578..85e9f5961 100644
 -	sendmail_rw_pipes(spamc_t)
  	sendmail_stub(spamc_t)
 +	sendmail_rw_pipes(spamc_t)
++    mta_read_home_rw(spamc_t)
  ')
  
  optional_policy(`
-@@ -267,48 +384,54 @@ optional_policy(`
+@@ -267,48 +385,54 @@ optional_policy(`
  
  ########################################
  #
@@ -105563,7 +105571,7 @@ index cc58e3578..85e9f5961 100644
  manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
  manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
  
-@@ -317,12 +440,14 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
+@@ -317,12 +441,14 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
  manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
  files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir })
  
@@ -105580,7 +105588,7 @@ index cc58e3578..85e9f5961 100644
  corenet_all_recvfrom_netlabel(spamd_t)
  corenet_tcp_sendrecv_generic_if(spamd_t)
  corenet_udp_sendrecv_generic_if(spamd_t)
-@@ -331,78 +456,60 @@ corenet_udp_sendrecv_generic_node(spamd_t)
+@@ -331,78 +457,60 @@ corenet_udp_sendrecv_generic_node(spamd_t)
  corenet_tcp_sendrecv_all_ports(spamd_t)
  corenet_udp_sendrecv_all_ports(spamd_t)
  corenet_tcp_bind_generic_node(spamd_t)
@@ -105685,7 +105693,7 @@ index cc58e3578..85e9f5961 100644
  ')
  
  optional_policy(`
-@@ -421,21 +528,13 @@ optional_policy(`
+@@ -421,21 +529,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -105709,7 +105717,7 @@ index cc58e3578..85e9f5961 100644
  ')
  
  optional_policy(`
-@@ -443,8 +542,8 @@ optional_policy(`
+@@ -443,8 +543,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -105719,7 +105727,7 @@ index cc58e3578..85e9f5961 100644
  ')
  
  optional_policy(`
-@@ -455,7 +554,17 @@ optional_policy(`
+@@ -455,7 +555,17 @@ optional_policy(`
  optional_policy(`
  	razor_domtrans(spamd_t)
  	razor_read_lib_files(spamd_t)
@@ -105738,7 +105746,7 @@ index cc58e3578..85e9f5961 100644
  ')
  
  optional_policy(`
-@@ -463,9 +572,10 @@ optional_policy(`
+@@ -463,9 +573,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -105750,7 +105758,7 @@ index cc58e3578..85e9f5961 100644
  ')
  
  optional_policy(`
-@@ -474,32 +584,32 @@ optional_policy(`
+@@ -474,32 +585,32 @@ optional_policy(`
  
  ########################################
  #
@@ -105793,7 +105801,7 @@ index cc58e3578..85e9f5961 100644
  
  corecmd_exec_bin(spamd_update_t)
  corecmd_exec_shell(spamd_update_t)
-@@ -508,25 +618,26 @@ dev_read_urand(spamd_update_t)
+@@ -508,25 +619,26 @@ dev_read_urand(spamd_update_t)
  
  domain_use_interactive_fds(spamd_update_t)
  
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 56ec678..9de9e8a 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 260.16%{?dist}
+Release: 260.17%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -725,6 +725,11 @@ exit 0
 %endif
 
 %changelog
+* Tue Nov 21 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-260.17
+- Allow spamc_t domain to read home mail content BZ(1414366)
+- Allow cupsd_t domain to localization BZ(1514350)
+- Allow mandb_t to read /etc/passwd BZ(1514903)
+
 * Thu Nov 16 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-260.16
 - Allow pcp_pmlogger to send logs to journal BZ(1512367)
 - Allow services to use kerberos KCM BZ(1512128)