* Thu Sep 15 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-191.16
    - Allow attach usb device to virtual machine BZ(1276873)
    - Dontaudit mozilla_plugin to sys_ptrace
    - Allow nut_upsdrvctl_t domain to read udev db BZ(1375636)
    - Fix typo
    - Allow geoclue to send msgs to syslog. BZ(1371818)
    - Allow abrt to read rpm_tmp_t dirs
    - Add interface rpm_read_tmp_files()
    - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
    - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
    - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
    - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
    - Allow mdadm_t to getattr all device nodes
    - Dontaudit gkeyringd_domain to connect to system_dbusd_t
    - Add interface dbus_dontaudit_stream_connect_system_dbusd()
    - Allow guest-set-user-passwd to set users password.
    - Allow domains using kerberos to read also kerberos config dirs
    - Add kdymp_t domain sys_admin capability BZ(1357949)
    - Allow dnssec_trigger to exec ldconfig
    - Allow svirt_sandbox_domains to r/w onload sockets
    - Fix typo bugs in rsync and inetd SELinux modules
    - Fixes for containers
    - Idenitfy these domains as init daemons
    - Allow samdbox domains to use msg class
    - Allow add new interface to new namespace BZ(1375124)
    - Dontaudit domain to create any file in /proc. This is kernel bug.
    - Add new interface fs_getattr_oracleasmfs_fs()
    - Add interface fs_manage_oracleasm()
    - Label /dev/kfd as hsa_device_t
    - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
    - Add transition rule that caller domain can create resolv.conf link file with correct label in sysnet_filetrans_named_content() interface
    - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.