diff --git a/docker-selinux.tgz b/docker-selinux.tgz
index 091c700..1d8b337 100644
Binary files a/docker-selinux.tgz and b/docker-selinux.tgz differ
diff --git a/policy-f24-base.patch b/policy-f24-base.patch
index d1f9a53..f8ba6d1 100644
--- a/policy-f24-base.patch
+++ b/policy-f24-base.patch
@@ -10978,7 +10978,7 @@ index b876c48..03f9342 100644
 +/nsr(/.*)?			gen_context(system_u:object_r:var_t,s0)
 +/nsr/logs(/.*)?			gen_context(system_u:object_r:var_log_t,s0)
 diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index f962f76..50b1f05 100644
+index f962f76..fb58c1d 100644
 --- a/policy/modules/kernel/files.if
 +++ b/policy/modules/kernel/files.if
 @@ -19,6 +19,136 @@
@@ -12825,20 +12825,39 @@ index f962f76..50b1f05 100644
  ')
  
  ########################################
-@@ -3503,10 +4341,10 @@ interface(`files_manage_isid_type_blk_files',`
+@@ -3503,10 +4341,29 @@ interface(`files_manage_isid_type_blk_files',`
  #
  interface(`files_manage_isid_type_chr_files',`
  	gen_require(`
 -		type file_t;
 +		type unlabeled_t;
++	')
++
++	allow $1 unlabeled_t:chr_file manage_chr_file_perms;
++')
++
++########################################
++## <summary>
++##	Dontaudit Moundon directories on new filesystems
++##	that have not yet been labeled.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`files_dontaudit_mounton_isid',`
++	gen_require(`
++		type unlabeled_t;
  	')
  
 -	allow $1 file_t:chr_file manage_chr_file_perms;
-+	allow $1 unlabeled_t:chr_file manage_chr_file_perms;
++	dontaudit $1 unlabeled_t:dir mounton;
  ')
  
  ########################################
-@@ -3552,6 +4390,27 @@ interface(`files_dontaudit_getattr_home_dir',`
+@@ -3552,6 +4409,27 @@ interface(`files_dontaudit_getattr_home_dir',`
  
  ########################################
  ## <summary>
@@ -12866,7 +12885,7 @@ index f962f76..50b1f05 100644
  ##	Search home directories root (/home).
  ## </summary>
  ## <param name="domain">
-@@ -3814,20 +4673,38 @@ interface(`files_list_mnt',`
+@@ -3814,20 +4692,38 @@ interface(`files_list_mnt',`
  
  ######################################
  ## <summary>
@@ -12910,7 +12929,7 @@ index f962f76..50b1f05 100644
  ')
  
  ########################################
-@@ -4012,6 +4889,12 @@ interface(`files_read_kernel_modules',`
+@@ -4012,6 +4908,12 @@ interface(`files_read_kernel_modules',`
  	allow $1 modules_object_t:dir list_dir_perms;
  	read_files_pattern($1, modules_object_t, modules_object_t)
  	read_lnk_files_pattern($1, modules_object_t, modules_object_t)
@@ -12923,7 +12942,7 @@ index f962f76..50b1f05 100644
  ')
  
  ########################################
-@@ -4217,174 +5100,218 @@ interface(`files_read_world_readable_sockets',`
+@@ -4217,174 +5119,218 @@ interface(`files_read_world_readable_sockets',`
  	allow $1 readable_t:sock_file read_sock_file_perms;
  ')
  
@@ -13228,7 +13247,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4392,53 +5319,56 @@ interface(`files_read_generic_tmp_files',`
+@@ -4392,53 +5338,56 @@ interface(`files_read_generic_tmp_files',`
  ##	</summary>
  ## </param>
  #
@@ -13297,7 +13316,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4446,35 +5376,37 @@ interface(`files_read_generic_tmp_symlinks',`
+@@ -4446,35 +5395,37 @@ interface(`files_read_generic_tmp_symlinks',`
  ##	</summary>
  ## </param>
  #
@@ -13343,7 +13362,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4482,59 +5414,55 @@ interface(`files_setattr_all_tmp_dirs',`
+@@ -4482,59 +5433,55 @@ interface(`files_setattr_all_tmp_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -13424,7 +13443,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4542,110 +5470,98 @@ interface(`files_dontaudit_getattr_all_tmp_files',`
+@@ -4542,110 +5489,98 @@ interface(`files_dontaudit_getattr_all_tmp_files',`
  ##	</summary>
  ## </param>
  #
@@ -13563,7 +13582,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4653,22 +5569,17 @@ interface(`files_tmp_filetrans',`
+@@ -4653,22 +5588,17 @@ interface(`files_tmp_filetrans',`
  ##	</summary>
  ## </param>
  #
@@ -13590,7 +13609,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4676,17 +5587,17 @@ interface(`files_purge_tmp',`
+@@ -4676,17 +5606,17 @@ interface(`files_purge_tmp',`
  ##	</summary>
  ## </param>
  #
@@ -13612,7 +13631,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4694,18 +5605,17 @@ interface(`files_setattr_usr_dirs',`
+@@ -4694,18 +5624,17 @@ interface(`files_setattr_usr_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -13635,7 +13654,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4713,35 +5623,35 @@ interface(`files_search_usr',`
+@@ -4713,35 +5642,35 @@ interface(`files_search_usr',`
  ##	</summary>
  ## </param>
  #
@@ -13680,7 +13699,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4749,36 +5659,35 @@ interface(`files_dontaudit_write_usr_dirs',`
+@@ -4749,36 +5678,35 @@ interface(`files_dontaudit_write_usr_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -13726,7 +13745,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4786,17 +5695,17 @@ interface(`files_dontaudit_rw_usr_dirs',`
+@@ -4786,17 +5714,17 @@ interface(`files_dontaudit_rw_usr_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -13748,7 +13767,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4804,73 +5713,59 @@ interface(`files_delete_usr_dirs',`
+@@ -4804,73 +5732,59 @@ interface(`files_delete_usr_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -13841,7 +13860,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4878,55 +5773,58 @@ interface(`files_read_usr_files',`
+@@ -4878,55 +5792,58 @@ interface(`files_read_usr_files',`
  ##	</summary>
  ## </param>
  #
@@ -13916,7 +13935,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4934,67 +5832,70 @@ interface(`files_manage_usr_files',`
+@@ -4934,67 +5851,70 @@ interface(`files_manage_usr_files',`
  ##	</summary>
  ## </param>
  #
@@ -14005,7 +14024,7 @@ index f962f76..50b1f05 100644
  ##	</summary>
  ## </param>
  ## <param name="name" optional="true">
-@@ -5003,35 +5904,50 @@ interface(`files_read_usr_symlinks',`
+@@ -5003,35 +5923,50 @@ interface(`files_read_usr_symlinks',`
  ##	</summary>
  ## </param>
  #
@@ -14065,7 +14084,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5039,20 +5955,17 @@ interface(`files_dontaudit_search_src',`
+@@ -5039,20 +5974,17 @@ interface(`files_dontaudit_search_src',`
  ##	</summary>
  ## </param>
  #
@@ -14090,7 +14109,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5060,20 +5973,18 @@ interface(`files_getattr_usr_src_files',`
+@@ -5060,20 +5992,18 @@ interface(`files_getattr_usr_src_files',`
  ##	</summary>
  ## </param>
  #
@@ -14115,7 +14134,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5081,38 +5992,35 @@ interface(`files_read_usr_src_files',`
+@@ -5081,38 +6011,35 @@ interface(`files_read_usr_src_files',`
  ##	</summary>
  ## </param>
  #
@@ -14163,7 +14182,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5120,37 +6028,36 @@ interface(`files_create_kernel_symbol_table',`
+@@ -5120,37 +6047,36 @@ interface(`files_create_kernel_symbol_table',`
  ##	</summary>
  ## </param>
  #
@@ -14211,7 +14230,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5158,35 +6065,35 @@ interface(`files_delete_kernel_symbol_table',`
+@@ -5158,35 +6084,35 @@ interface(`files_delete_kernel_symbol_table',`
  ##	</summary>
  ## </param>
  #
@@ -14256,7 +14275,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5194,36 +6101,55 @@ interface(`files_dontaudit_write_var_dirs',`
+@@ -5194,36 +6120,55 @@ interface(`files_dontaudit_write_var_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -14322,7 +14341,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5231,36 +6157,37 @@ interface(`files_dontaudit_search_var',`
+@@ -5231,36 +6176,37 @@ interface(`files_dontaudit_search_var',`
  ##	</summary>
  ## </param>
  #
@@ -14370,7 +14389,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5268,17 +6195,17 @@ interface(`files_manage_var_dirs',`
+@@ -5268,17 +6214,17 @@ interface(`files_manage_var_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -14392,7 +14411,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5286,17 +6213,17 @@ interface(`files_read_var_files',`
+@@ -5286,17 +6232,17 @@ interface(`files_read_var_files',`
  ##	</summary>
  ## </param>
  #
@@ -14414,7 +14433,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5304,73 +6231,86 @@ interface(`files_append_var_files',`
+@@ -5304,73 +6250,86 @@ interface(`files_append_var_files',`
  ##	</summary>
  ## </param>
  #
@@ -14521,7 +14540,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5378,50 +6318,41 @@ interface(`files_read_var_symlinks',`
+@@ -5378,50 +6337,41 @@ interface(`files_read_var_symlinks',`
  ##	</summary>
  ## </param>
  #
@@ -14586,7 +14605,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5429,69 +6360,56 @@ interface(`files_var_filetrans',`
+@@ -5429,69 +6379,56 @@ interface(`files_var_filetrans',`
  ##	</summary>
  ## </param>
  #
@@ -14671,7 +14690,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5499,17 +6417,18 @@ interface(`files_dontaudit_search_var_lib',`
+@@ -5499,17 +6436,18 @@ interface(`files_dontaudit_search_var_lib',`
  ##	</summary>
  ## </param>
  #
@@ -14695,7 +14714,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5517,70 +6436,54 @@ interface(`files_list_var_lib',`
+@@ -5517,70 +6455,54 @@ interface(`files_list_var_lib',`
  ##	</summary>
  ## </param>
  #
@@ -14779,7 +14798,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5588,41 +6491,36 @@ interface(`files_read_var_lib_files',`
+@@ -5588,41 +6510,36 @@ interface(`files_read_var_lib_files',`
  ##	</summary>
  ## </param>
  #
@@ -14831,7 +14850,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5630,36 +6528,36 @@ interface(`files_manage_urandom_seed',`
+@@ -5630,36 +6547,36 @@ interface(`files_manage_urandom_seed',`
  ##	</summary>
  ## </param>
  #
@@ -14878,7 +14897,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5667,38 +6565,35 @@ interface(`files_setattr_lock_dirs',`
+@@ -5667,38 +6584,35 @@ interface(`files_setattr_lock_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -14926,7 +14945,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5706,19 +6601,17 @@ interface(`files_dontaudit_search_locks',`
+@@ -5706,19 +6620,17 @@ interface(`files_dontaudit_search_locks',`
  ##	</summary>
  ## </param>
  #
@@ -14950,7 +14969,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5726,60 +6619,54 @@ interface(`files_list_locks',`
+@@ -5726,60 +6638,54 @@ interface(`files_list_locks',`
  ##	</summary>
  ## </param>
  #
@@ -15026,7 +15045,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5787,20 +6674,18 @@ interface(`files_relabel_all_lock_dirs',`
+@@ -5787,20 +6693,18 @@ interface(`files_relabel_all_lock_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -15052,7 +15071,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5808,63 +6693,68 @@ interface(`files_getattr_generic_locks',`
+@@ -5808,63 +6712,68 @@ interface(`files_getattr_generic_locks',`
  ##	</summary>
  ## </param>
  #
@@ -15144,7 +15163,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5872,101 +6762,87 @@ interface(`files_delete_all_locks',`
+@@ -5872,101 +6781,87 @@ interface(`files_delete_all_locks',`
  ##	</summary>
  ## </param>
  #
@@ -15281,7 +15300,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5974,19 +6850,17 @@ interface(`files_dontaudit_getattr_pid_dirs',`
+@@ -5974,19 +6869,17 @@ interface(`files_dontaudit_getattr_pid_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -15305,7 +15324,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -5994,39 +6868,52 @@ interface(`files_setattr_pid_dirs',`
+@@ -5994,39 +6887,52 @@ interface(`files_setattr_pid_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -15371,44 +15390,35 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6034,18 +6921,18 @@ interface(`files_dontaudit_search_pids',`
+@@ -6034,18 +6940,1302 @@ interface(`files_dontaudit_search_pids',`
  ##	</summary>
  ## </param>
  #
 -interface(`files_list_pids',`
 +interface(`files_read_var_lib_files',`
  	gen_require(`
--		type var_t, var_run_t;
 +		type var_t, var_lib_t;
- 	')
- 
--	allow $1 var_run_t:lnk_file read_lnk_file_perms;
--	list_dirs_pattern($1, var_t, var_run_t)
++	')
++
 +	allow $1 var_lib_t:dir list_dir_perms;
 +	read_files_pattern($1, { var_t var_lib_t }, var_lib_t)
- ')
- 
- ########################################
- ## <summary>
--##	Read generic process ID files.
++')
++
++########################################
++## <summary>
 +##	Read generic symbolic links in /var/lib
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -6053,19 +6940,1283 @@ interface(`files_list_pids',`
- ##	</summary>
- ## </param>
- #
--interface(`files_read_generic_pids',`
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`files_read_var_lib_symlinks',`
- 	gen_require(`
--		type var_t, var_run_t;
++	gen_require(`
 +		type var_t, var_lib_t;
- 	')
- 
--	allow $1 var_run_t:lnk_file read_lnk_file_perms;
--	list_dirs_pattern($1, var_t, var_run_t)
--	read_files_pattern($1, var_run_t, var_run_t)
++	')
++
 +	read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
 +')
 +
@@ -16507,9 +16517,11 @@ index f962f76..50b1f05 100644
 +interface(`files_delete_all_pid_dirs',`
 +	gen_require(`
 +		attribute pidfile;
-+		type var_t, var_run_t;
-+	')
-+
+ 		type var_t, var_run_t;
+ 	')
+ 
+-	allow $1 var_run_t:lnk_file read_lnk_file_perms;
+-	list_dirs_pattern($1, var_t, var_run_t)
 +	files_search_pids($1)
 +	allow $1 var_t:dir search_dir_perms;
 +	delete_dirs_pattern($1, pidfile, pidfile)
@@ -16679,51 +16691,57 @@ index f962f76..50b1f05 100644
  
  ########################################
  ## <summary>
--##	Write named generic process ID pipes
+-##	Read generic process ID files.
 +##	Create, read, write, and delete generic
 +##	spool directories (/var/spool).
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6073,43 +8224,170 @@ interface(`files_read_generic_pids',`
+@@ -6053,19 +8243,18 @@ interface(`files_list_pids',`
  ##	</summary>
  ## </param>
  #
--interface(`files_write_generic_pid_pipes',`
+-interface(`files_read_generic_pids',`
 +interface(`files_manage_generic_spool_dirs',`
  	gen_require(`
--		type var_run_t;
+-		type var_t, var_run_t;
 +		type var_t, var_spool_t;
  	')
  
 -	allow $1 var_run_t:lnk_file read_lnk_file_perms;
--	allow $1 var_run_t:fifo_file write;
+-	list_dirs_pattern($1, var_t, var_run_t)
+-	read_files_pattern($1, var_run_t, var_run_t)
 +	allow $1 var_t:dir search_dir_perms;
 +	manage_dirs_pattern($1, var_spool_t, var_spool_t)
  ')
  
  ########################################
  ## <summary>
--##	Create an object in the process ID directory, with a private type.
+-##	Write named generic process ID pipes
 +##	Read generic spool files.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -6073,43 +8262,151 @@ interface(`files_read_generic_pids',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`files_write_generic_pid_pipes',`
 +interface(`files_read_generic_spool',`
-+	gen_require(`
+ 	gen_require(`
+-		type var_run_t;
 +		type var_t, var_spool_t;
-+	')
-+
+ 	')
+ 
+-	allow $1 var_run_t:lnk_file read_lnk_file_perms;
+-	allow $1 var_run_t:fifo_file write;
 +	list_dirs_pattern($1, var_t, var_spool_t)
 +	read_files_pattern($1, var_spool_t, var_spool_t)
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Create an object in the process ID directory, with a private type.
 +##	Create, read, write, and delete generic
 +##	spool files.
 +## </summary>
@@ -16883,7 +16901,7 @@ index f962f76..50b1f05 100644
  ##	</p>
  ## </desc>
  ## <param name="domain">
-@@ -6117,80 +8395,157 @@ interface(`files_write_generic_pid_pipes',`
+@@ -6117,80 +8414,157 @@ interface(`files_write_generic_pid_pipes',`
  ##	Domain allowed access.
  ##	</summary>
  ## </param>
@@ -17070,7 +17088,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6198,19 +8553,17 @@ interface(`files_rw_generic_pids',`
+@@ -6198,19 +8572,17 @@ interface(`files_rw_generic_pids',`
  ##	</summary>
  ## </param>
  #
@@ -17094,7 +17112,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6218,18 +8571,17 @@ interface(`files_dontaudit_getattr_all_pids',`
+@@ -6218,18 +8590,17 @@ interface(`files_dontaudit_getattr_all_pids',`
  ##	</summary>
  ## </param>
  #
@@ -17117,7 +17135,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6237,129 +8589,118 @@ interface(`files_dontaudit_write_all_pids',`
+@@ -6237,129 +8608,118 @@ interface(`files_dontaudit_write_all_pids',`
  ##	</summary>
  ## </param>
  #
@@ -17286,7 +17304,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6367,18 +8708,19 @@ interface(`files_mounton_all_poly_members',`
+@@ -6367,18 +8727,19 @@ interface(`files_mounton_all_poly_members',`
  ##	</summary>
  ## </param>
  #
@@ -17311,7 +17329,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6386,132 +8728,227 @@ interface(`files_search_spool',`
+@@ -6386,132 +8747,227 @@ interface(`files_search_spool',`
  ##	</summary>
  ## </param>
  #
@@ -17585,7 +17603,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6519,53 +8956,17 @@ interface(`files_spool_filetrans',`
+@@ -6519,53 +8975,17 @@ interface(`files_spool_filetrans',`
  ##	</summary>
  ## </param>
  #
@@ -17643,7 +17661,7 @@ index f962f76..50b1f05 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -6573,10 +8974,10 @@ interface(`files_polyinstantiate_all',`
+@@ -6573,10 +8993,10 @@ interface(`files_polyinstantiate_all',`
  ##	</summary>
  ## </param>
  #
@@ -37321,7 +37339,7 @@ index 79a45f6..d4f6066 100644
 +    allow $1 init_var_lib_t:dir search_dir_perms;
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda24..71aec04 100644
+index 17eda24..d1770c8 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -37622,7 +37640,7 @@ index 17eda24..71aec04 100644
  
  ifdef(`distro_gentoo',`
  	allow init_t self:process { getcap setcap };
-@@ -186,29 +328,264 @@ ifdef(`distro_gentoo',`
+@@ -186,29 +328,265 @@ ifdef(`distro_gentoo',`
  ')
  
  ifdef(`distro_redhat',`
@@ -37765,6 +37783,7 @@ index 17eda24..71aec04 100644
 +files_relabel_var_dirs(init_t)
 +files_relabel_var_lib_dirs(init_t)
 +files_read_kernel_modules(init_t)
++files_dontaudit_mounton_isid(init_t)
 +fs_getattr_all_fs(init_t)
 +fs_manage_cgroup_dirs(init_t)
 +fs_manage_cgroup_files(init_t)
@@ -37896,7 +37915,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -216,7 +593,30 @@ optional_policy(`
+@@ -216,7 +594,30 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -37928,7 +37947,7 @@ index 17eda24..71aec04 100644
  ')
  
  ########################################
-@@ -225,9 +625,9 @@ optional_policy(`
+@@ -225,9 +626,9 @@ optional_policy(`
  #
  
  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -37940,7 +37959,7 @@ index 17eda24..71aec04 100644
  allow initrc_t self:passwd rootok;
  allow initrc_t self:key manage_key_perms;
  
-@@ -258,12 +658,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
+@@ -258,12 +659,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
  
  allow initrc_t initrc_var_run_t:file manage_file_perms;
  files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -37957,7 +37976,7 @@ index 17eda24..71aec04 100644
  
  manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
  manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
-@@ -279,23 +683,36 @@ kernel_change_ring_buffer_level(initrc_t)
+@@ -279,23 +684,36 @@ kernel_change_ring_buffer_level(initrc_t)
  kernel_clear_ring_buffer(initrc_t)
  kernel_get_sysvipc_info(initrc_t)
  kernel_read_all_sysctls(initrc_t)
@@ -38000,7 +38019,7 @@ index 17eda24..71aec04 100644
  corenet_tcp_sendrecv_all_ports(initrc_t)
  corenet_udp_sendrecv_all_ports(initrc_t)
  corenet_tcp_connect_all_ports(initrc_t)
-@@ -303,9 +720,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
+@@ -303,9 +721,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
  
  dev_read_rand(initrc_t)
  dev_read_urand(initrc_t)
@@ -38012,7 +38031,7 @@ index 17eda24..71aec04 100644
  dev_rw_sysfs(initrc_t)
  dev_list_usbfs(initrc_t)
  dev_read_framebuffer(initrc_t)
-@@ -313,8 +732,10 @@ dev_write_framebuffer(initrc_t)
+@@ -313,8 +733,10 @@ dev_write_framebuffer(initrc_t)
  dev_read_realtime_clock(initrc_t)
  dev_read_sound_mixer(initrc_t)
  dev_write_sound_mixer(initrc_t)
@@ -38023,7 +38042,7 @@ index 17eda24..71aec04 100644
  dev_delete_lvm_control_dev(initrc_t)
  dev_manage_generic_symlinks(initrc_t)
  dev_manage_generic_files(initrc_t)
-@@ -322,8 +743,7 @@ dev_manage_generic_files(initrc_t)
+@@ -322,8 +744,7 @@ dev_manage_generic_files(initrc_t)
  dev_delete_generic_symlinks(initrc_t)
  dev_getattr_all_blk_files(initrc_t)
  dev_getattr_all_chr_files(initrc_t)
@@ -38033,7 +38052,7 @@ index 17eda24..71aec04 100644
  
  domain_kill_all_domains(initrc_t)
  domain_signal_all_domains(initrc_t)
-@@ -332,7 +752,6 @@ domain_sigstop_all_domains(initrc_t)
+@@ -332,7 +753,6 @@ domain_sigstop_all_domains(initrc_t)
  domain_sigchld_all_domains(initrc_t)
  domain_read_all_domains_state(initrc_t)
  domain_getattr_all_domains(initrc_t)
@@ -38041,7 +38060,7 @@ index 17eda24..71aec04 100644
  domain_getsession_all_domains(initrc_t)
  domain_use_interactive_fds(initrc_t)
  # for lsof which is used by alsa shutdown:
-@@ -340,6 +759,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
+@@ -340,6 +760,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
  domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
  domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
  domain_dontaudit_getattr_all_pipes(initrc_t)
@@ -38049,7 +38068,7 @@ index 17eda24..71aec04 100644
  
  files_getattr_all_dirs(initrc_t)
  files_getattr_all_files(initrc_t)
-@@ -347,14 +767,15 @@ files_getattr_all_symlinks(initrc_t)
+@@ -347,14 +768,15 @@ files_getattr_all_symlinks(initrc_t)
  files_getattr_all_pipes(initrc_t)
  files_getattr_all_sockets(initrc_t)
  files_purge_tmp(initrc_t)
@@ -38067,7 +38086,7 @@ index 17eda24..71aec04 100644
  files_read_usr_files(initrc_t)
  files_manage_urandom_seed(initrc_t)
  files_manage_generic_spool(initrc_t)
-@@ -364,8 +785,12 @@ files_list_isid_type_dirs(initrc_t)
+@@ -364,8 +786,12 @@ files_list_isid_type_dirs(initrc_t)
  files_mounton_isid_type_dirs(initrc_t)
  files_list_default(initrc_t)
  files_mounton_default(initrc_t)
@@ -38081,7 +38100,7 @@ index 17eda24..71aec04 100644
  fs_list_inotifyfs(initrc_t)
  fs_register_binary_executable_type(initrc_t)
  # rhgb-console writes to ramfs
-@@ -375,10 +800,11 @@ fs_mount_all_fs(initrc_t)
+@@ -375,10 +801,11 @@ fs_mount_all_fs(initrc_t)
  fs_unmount_all_fs(initrc_t)
  fs_remount_all_fs(initrc_t)
  fs_getattr_all_fs(initrc_t)
@@ -38095,7 +38114,7 @@ index 17eda24..71aec04 100644
  mcs_process_set_categories(initrc_t)
  
  mls_file_read_all_levels(initrc_t)
-@@ -387,8 +813,10 @@ mls_process_read_up(initrc_t)
+@@ -387,8 +814,10 @@ mls_process_read_up(initrc_t)
  mls_process_write_down(initrc_t)
  mls_rangetrans_source(initrc_t)
  mls_fd_share_all_levels(initrc_t)
@@ -38106,7 +38125,7 @@ index 17eda24..71aec04 100644
  
  storage_getattr_fixed_disk_dev(initrc_t)
  storage_setattr_fixed_disk_dev(initrc_t)
-@@ -398,6 +826,7 @@ term_use_all_terms(initrc_t)
+@@ -398,6 +827,7 @@ term_use_all_terms(initrc_t)
  term_reset_tty_labels(initrc_t)
  
  auth_rw_login_records(initrc_t)
@@ -38114,7 +38133,7 @@ index 17eda24..71aec04 100644
  auth_setattr_login_records(initrc_t)
  auth_rw_lastlog(initrc_t)
  auth_read_pam_pid(initrc_t)
-@@ -416,20 +845,18 @@ logging_read_all_logs(initrc_t)
+@@ -416,20 +846,18 @@ logging_read_all_logs(initrc_t)
  logging_append_all_logs(initrc_t)
  logging_read_audit_config(initrc_t)
  
@@ -38138,7 +38157,7 @@ index 17eda24..71aec04 100644
  
  ifdef(`distro_debian',`
  	dev_setattr_generic_dirs(initrc_t)
-@@ -451,7 +878,6 @@ ifdef(`distro_gentoo',`
+@@ -451,7 +879,6 @@ ifdef(`distro_gentoo',`
  	allow initrc_t self:process setfscreate;
  	dev_create_null_dev(initrc_t)
  	dev_create_zero_dev(initrc_t)
@@ -38146,7 +38165,7 @@ index 17eda24..71aec04 100644
  	term_create_console_dev(initrc_t)
  
  	# unfortunately /sbin/rc does stupid tricks
-@@ -486,6 +912,10 @@ ifdef(`distro_gentoo',`
+@@ -486,6 +913,10 @@ ifdef(`distro_gentoo',`
  	sysnet_setattr_config(initrc_t)
  
  	optional_policy(`
@@ -38157,7 +38176,7 @@ index 17eda24..71aec04 100644
  		alsa_read_lib(initrc_t)
  	')
  
-@@ -506,7 +936,7 @@ ifdef(`distro_redhat',`
+@@ -506,7 +937,7 @@ ifdef(`distro_redhat',`
  
  	# Red Hat systems seem to have a stray
  	# fd open from the initrd
@@ -38166,7 +38185,7 @@ index 17eda24..71aec04 100644
  	files_dontaudit_read_root_files(initrc_t)
  
  	# These seem to be from the initrd
-@@ -521,6 +951,7 @@ ifdef(`distro_redhat',`
+@@ -521,6 +952,7 @@ ifdef(`distro_redhat',`
  	files_create_boot_dirs(initrc_t)
  	files_create_boot_flag(initrc_t)
  	files_rw_boot_symlinks(initrc_t)
@@ -38174,7 +38193,7 @@ index 17eda24..71aec04 100644
  	# wants to read /.fonts directory
  	files_read_default_files(initrc_t)
  	files_mountpoint(initrc_tmp_t)
-@@ -541,6 +972,7 @@ ifdef(`distro_redhat',`
+@@ -541,6 +973,7 @@ ifdef(`distro_redhat',`
  	miscfiles_rw_localization(initrc_t)
  	miscfiles_setattr_localization(initrc_t)
  	miscfiles_relabel_localization(initrc_t)
@@ -38182,7 +38201,7 @@ index 17eda24..71aec04 100644
  
  	miscfiles_read_fonts(initrc_t)
  	miscfiles_read_hwdata(initrc_t)
-@@ -550,8 +982,44 @@ ifdef(`distro_redhat',`
+@@ -550,8 +983,44 @@ ifdef(`distro_redhat',`
  	')
  
  	optional_policy(`
@@ -38227,7 +38246,7 @@ index 17eda24..71aec04 100644
  	')
  
  	optional_policy(`
-@@ -559,14 +1027,31 @@ ifdef(`distro_redhat',`
+@@ -559,14 +1028,31 @@ ifdef(`distro_redhat',`
  		rpc_write_exports(initrc_t)
  		rpc_manage_nfs_state_data(initrc_t)
  	')
@@ -38259,7 +38278,7 @@ index 17eda24..71aec04 100644
  	')
  ')
  
-@@ -577,6 +1062,39 @@ ifdef(`distro_suse',`
+@@ -577,6 +1063,39 @@ ifdef(`distro_suse',`
  	')
  ')
  
@@ -38299,7 +38318,7 @@ index 17eda24..71aec04 100644
  optional_policy(`
  	amavis_search_lib(initrc_t)
  	amavis_setattr_pid_files(initrc_t)
-@@ -589,6 +1107,8 @@ optional_policy(`
+@@ -589,6 +1108,8 @@ optional_policy(`
  optional_policy(`
  	apache_read_config(initrc_t)
  	apache_list_modules(initrc_t)
@@ -38308,7 +38327,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -610,6 +1130,7 @@ optional_policy(`
+@@ -610,6 +1131,7 @@ optional_policy(`
  
  optional_policy(`
  	cgroup_stream_connect_cgred(initrc_t)
@@ -38316,7 +38335,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -626,6 +1147,17 @@ optional_policy(`
+@@ -626,6 +1148,17 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38334,7 +38353,7 @@ index 17eda24..71aec04 100644
  	dev_getattr_printer_dev(initrc_t)
  
  	cups_read_log(initrc_t)
-@@ -642,9 +1174,13 @@ optional_policy(`
+@@ -642,9 +1175,13 @@ optional_policy(`
  	dbus_connect_system_bus(initrc_t)
  	dbus_system_bus_client(initrc_t)
  	dbus_read_config(initrc_t)
@@ -38348,7 +38367,7 @@ index 17eda24..71aec04 100644
  	')
  
  	optional_policy(`
-@@ -657,15 +1193,11 @@ optional_policy(`
+@@ -657,15 +1194,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38366,7 +38385,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -686,6 +1218,15 @@ optional_policy(`
+@@ -686,6 +1219,15 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38382,7 +38401,7 @@ index 17eda24..71aec04 100644
  	inn_exec_config(initrc_t)
  ')
  
-@@ -726,6 +1267,7 @@ optional_policy(`
+@@ -726,6 +1268,7 @@ optional_policy(`
  	lpd_list_spool(initrc_t)
  
  	lpd_read_config(initrc_t)
@@ -38390,7 +38409,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -743,7 +1285,13 @@ optional_policy(`
+@@ -743,7 +1286,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38405,7 +38424,7 @@ index 17eda24..71aec04 100644
  	mta_dontaudit_read_spool_symlinks(initrc_t)
  ')
  
-@@ -766,6 +1314,10 @@ optional_policy(`
+@@ -766,6 +1315,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38416,7 +38435,7 @@ index 17eda24..71aec04 100644
  	postgresql_manage_db(initrc_t)
  	postgresql_read_config(initrc_t)
  ')
-@@ -775,10 +1327,20 @@ optional_policy(`
+@@ -775,10 +1328,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38437,7 +38456,7 @@ index 17eda24..71aec04 100644
  	quota_manage_flags(initrc_t)
  ')
  
-@@ -787,6 +1349,10 @@ optional_policy(`
+@@ -787,6 +1350,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38448,7 +38467,7 @@ index 17eda24..71aec04 100644
  	fs_write_ramfs_sockets(initrc_t)
  	fs_search_ramfs(initrc_t)
  
-@@ -808,8 +1374,6 @@ optional_policy(`
+@@ -808,8 +1375,6 @@ optional_policy(`
  	# bash tries ioctl for some reason
  	files_dontaudit_ioctl_all_pids(initrc_t)
  
@@ -38457,7 +38476,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -818,6 +1382,10 @@ optional_policy(`
+@@ -818,6 +1383,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38468,7 +38487,7 @@ index 17eda24..71aec04 100644
  	# shorewall-init script run /var/lib/shorewall/firewall
  	shorewall_lib_domtrans(initrc_t)
  ')
-@@ -827,10 +1395,12 @@ optional_policy(`
+@@ -827,10 +1396,12 @@ optional_policy(`
  	squid_manage_logs(initrc_t)
  ')
  
@@ -38481,7 +38500,7 @@ index 17eda24..71aec04 100644
  
  optional_policy(`
  	ssh_dontaudit_read_server_keys(initrc_t)
-@@ -857,21 +1427,60 @@ optional_policy(`
+@@ -857,21 +1428,60 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38543,7 +38562,7 @@ index 17eda24..71aec04 100644
  ')
  
  optional_policy(`
-@@ -887,6 +1496,10 @@ optional_policy(`
+@@ -887,6 +1497,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -38554,7 +38573,7 @@ index 17eda24..71aec04 100644
  	# Set device ownerships/modes.
  	xserver_setattr_console_pipes(initrc_t)
  
-@@ -897,3 +1510,218 @@ optional_policy(`
+@@ -897,3 +1511,218 @@ optional_policy(`
  optional_policy(`
  	zebra_read_config(initrc_t)
  ')
diff --git a/policy-f24-contrib.patch b/policy-f24-contrib.patch
index 78350e7..cf53652 100644
--- a/policy-f24-contrib.patch
+++ b/policy-f24-contrib.patch
@@ -589,7 +589,7 @@ index 058d908..ee0c559 100644
 +')
 +
 diff --git a/abrt.te b/abrt.te
-index eb50f07..22e6c69 100644
+index eb50f07..5f57515 100644
 --- a/abrt.te
 +++ b/abrt.te
 @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -1047,7 +1047,7 @@ index eb50f07..22e6c69 100644
  allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
  
  domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
-@@ -365,38 +469,78 @@ corecmd_exec_shell(abrt_retrace_worker_t)
+@@ -365,38 +469,79 @@ corecmd_exec_shell(abrt_retrace_worker_t)
  
  dev_read_urand(abrt_retrace_worker_t)
  
@@ -1070,6 +1070,7 @@ index eb50f07..22e6c69 100644
  
 -allow abrt_dump_oops_t self:capability dac_override;
 +allow abrt_dump_oops_t self:capability { kill net_admin sys_ptrace ipc_lock fowner chown fsetid dac_override setuid setgid };
++allow abrt_dump_oops_t self:cap_userns { kill };
 +allow abrt_dump_oops_t self:process setfscreate;
  allow abrt_dump_oops_t self:fifo_file rw_fifo_file_perms;
 -allow abrt_dump_oops_t self:unix_stream_socket { accept listen };
@@ -1130,7 +1131,7 @@ index eb50f07..22e6c69 100644
  
  #######################################
  #
-@@ -404,25 +548,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +549,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
  #
  
  allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@@ -1193,7 +1194,7 @@ index eb50f07..22e6c69 100644
  ')
  
  #######################################
-@@ -430,10 +609,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +610,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
  # Global local policy
  #
  
@@ -3838,7 +3839,7 @@ index 7caefc3..2029082 100644
 +/var/run/dirsrv/admin-serv.*	gen_context(system_u:object_r:httpd_var_run_t,s0)
 +/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)?       gen_context(system_u:object_r:httpd_var_run_t,s0)
 diff --git a/apache.if b/apache.if
-index f6eb485..ce5dba7 100644
+index f6eb485..757b864 100644
 --- a/apache.if
 +++ b/apache.if
 @@ -1,9 +1,9 @@
@@ -4283,16 +4284,36 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -224,7 +351,7 @@ interface(`apache_read_user_content',`
+@@ -224,7 +351,27 @@ interface(`apache_read_user_content',`
  
  ########################################
  ## <summary>
 -##	Execute httpd with a domain transition.
++##	Manage user web content.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`apache_manage_user_content',`
++	gen_require(`
++		type httpd_user_content_t;
++	')
++
++	allow $1 httpd_user_content_t:dir manage_dir_perms;
++	manage_files_pattern($1, httpd_user_content_t, httpd_user_content_t)
++	manage_lnk_files_pattern($1, httpd_user_content_t, httpd_user_content_t)
++')
++
++########################################
++## <summary>
 +##	Transition to apache.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -241,27 +368,47 @@ interface(`apache_domtrans',`
+@@ -241,27 +388,47 @@ interface(`apache_domtrans',`
  	domtrans_pattern($1, httpd_exec_t, httpd_t)
  ')
  
@@ -4347,7 +4368,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -279,7 +426,7 @@ interface(`apache_signal',`
+@@ -279,7 +446,7 @@ interface(`apache_signal',`
  
  ########################################
  ## <summary>
@@ -4356,7 +4377,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -297,7 +444,7 @@ interface(`apache_signull',`
+@@ -297,7 +464,7 @@ interface(`apache_signull',`
  
  ########################################
  ## <summary>
@@ -4365,7 +4386,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -315,8 +462,7 @@ interface(`apache_sigchld',`
+@@ -315,8 +482,7 @@ interface(`apache_sigchld',`
  
  ########################################
  ## <summary>
@@ -4375,7 +4396,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -334,8 +480,8 @@ interface(`apache_use_fds',`
+@@ -334,8 +500,8 @@ interface(`apache_use_fds',`
  
  ########################################
  ## <summary>
@@ -4386,7 +4407,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -348,13 +494,32 @@ interface(`apache_dontaudit_rw_fifo_file',`
+@@ -348,13 +514,32 @@ interface(`apache_dontaudit_rw_fifo_file',`
  		type httpd_t;
  	')
  
@@ -4422,7 +4443,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -367,13 +532,13 @@ interface(`apache_dontaudit_rw_stream_sockets',`
+@@ -367,13 +552,13 @@ interface(`apache_dontaudit_rw_stream_sockets',`
  		type httpd_t;
  	')
  
@@ -4439,7 +4460,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -391,8 +556,7 @@ interface(`apache_dontaudit_rw_tcp_sockets',`
+@@ -391,8 +576,7 @@ interface(`apache_dontaudit_rw_tcp_sockets',`
  
  ########################################
  ## <summary>
@@ -4449,7 +4470,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -417,7 +581,8 @@ interface(`apache_manage_all_content',`
+@@ -417,7 +601,8 @@ interface(`apache_manage_all_content',`
  
  ########################################
  ## <summary>
@@ -4459,7 +4480,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -435,7 +600,8 @@ interface(`apache_setattr_cache_dirs',`
+@@ -435,7 +620,8 @@ interface(`apache_setattr_cache_dirs',`
  
  ########################################
  ## <summary>
@@ -4469,7 +4490,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -453,7 +619,8 @@ interface(`apache_list_cache',`
+@@ -453,7 +639,8 @@ interface(`apache_list_cache',`
  
  ########################################
  ## <summary>
@@ -4479,7 +4500,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -471,7 +638,8 @@ interface(`apache_rw_cache_files',`
+@@ -471,7 +658,8 @@ interface(`apache_rw_cache_files',`
  
  ########################################
  ## <summary>
@@ -4489,7 +4510,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -489,7 +657,8 @@ interface(`apache_delete_cache_dirs',`
+@@ -489,7 +677,8 @@ interface(`apache_delete_cache_dirs',`
  
  ########################################
  ## <summary>
@@ -4499,7 +4520,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -507,49 +676,51 @@ interface(`apache_delete_cache_files',`
+@@ -507,49 +696,51 @@ interface(`apache_delete_cache_files',`
  
  ########################################
  ## <summary>
@@ -4562,7 +4583,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -570,8 +741,8 @@ interface(`apache_manage_config',`
+@@ -570,8 +761,8 @@ interface(`apache_manage_config',`
  
  ########################################
  ## <summary>
@@ -4573,7 +4594,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -608,16 +779,38 @@ interface(`apache_domtrans_helper',`
+@@ -608,16 +799,38 @@ interface(`apache_domtrans_helper',`
  #
  interface(`apache_run_helper',`
  	gen_require(`
@@ -4584,11 +4605,10 @@ index f6eb485..ce5dba7 100644
  	apache_domtrans_helper($1)
 -	roleattribute $2 httpd_helper_roles;
 +	role $2 types httpd_helper_t;
- ')
- 
- ########################################
- ## <summary>
--##	Read httpd log files.
++')
++
++########################################
++## <summary>
 +##	dontaudit attempts to read
 +##	apache log files.
 +## </summary>
@@ -4606,16 +4626,17 @@ index f6eb485..ce5dba7 100644
 +
 +	dontaudit $1 httpd_log_t:file read_file_perms;
 +	dontaudit $1 httpd_log_t:lnk_file read_lnk_file_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Read httpd log files.
 +##	Allow the specified domain to read
 +##	apache log files.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -639,7 +832,8 @@ interface(`apache_read_log',`
+@@ -639,7 +852,8 @@ interface(`apache_read_log',`
  
  ########################################
  ## <summary>
@@ -4625,7 +4646,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -657,10 +851,29 @@ interface(`apache_append_log',`
+@@ -657,10 +871,29 @@ interface(`apache_append_log',`
  	append_files_pattern($1, httpd_log_t, httpd_log_t)
  ')
  
@@ -4657,7 +4678,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -678,8 +891,8 @@ interface(`apache_dontaudit_append_log',`
+@@ -678,8 +911,8 @@ interface(`apache_dontaudit_append_log',`
  
  ########################################
  ## <summary>
@@ -4668,7 +4689,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -687,20 +900,21 @@ interface(`apache_dontaudit_append_log',`
+@@ -687,20 +920,21 @@ interface(`apache_dontaudit_append_log',`
  ##	</summary>
  ## </param>
  #
@@ -4698,7 +4719,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -708,19 +922,21 @@ interface(`apache_manage_log',`
+@@ -708,19 +942,21 @@ interface(`apache_manage_log',`
  ##	</summary>
  ## </param>
  #
@@ -4724,7 +4745,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -738,7 +954,8 @@ interface(`apache_dontaudit_search_modules',`
+@@ -738,7 +974,8 @@ interface(`apache_dontaudit_search_modules',`
  
  ########################################
  ## <summary>
@@ -4734,7 +4755,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -746,17 +963,19 @@ interface(`apache_dontaudit_search_modules',`
+@@ -746,17 +983,19 @@ interface(`apache_dontaudit_search_modules',`
  ##	</summary>
  ## </param>
  #
@@ -4757,7 +4778,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -764,19 +983,19 @@ interface(`apache_list_modules',`
+@@ -764,19 +1003,19 @@ interface(`apache_list_modules',`
  ##	</summary>
  ## </param>
  #
@@ -4781,7 +4802,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -784,19 +1003,19 @@ interface(`apache_exec_modules',`
+@@ -784,19 +1023,19 @@ interface(`apache_exec_modules',`
  ##	</summary>
  ## </param>
  #
@@ -4806,7 +4827,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -809,13 +1028,50 @@ interface(`apache_domtrans_rotatelogs',`
+@@ -809,13 +1048,50 @@ interface(`apache_domtrans_rotatelogs',`
  		type httpd_rotatelogs_t, httpd_rotatelogs_exec_t;
  	')
  
@@ -4859,7 +4880,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -829,13 +1085,14 @@ interface(`apache_list_sys_content',`
+@@ -829,13 +1105,14 @@ interface(`apache_list_sys_content',`
  	')
  
  	list_dirs_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
@@ -4876,7 +4897,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -844,6 +1101,7 @@ interface(`apache_list_sys_content',`
+@@ -844,6 +1121,7 @@ interface(`apache_list_sys_content',`
  ## </param>
  ## <rolecap/>
  #
@@ -4884,32 +4905,28 @@ index f6eb485..ce5dba7 100644
  interface(`apache_manage_sys_content',`
  	gen_require(`
  		type httpd_sys_content_t;
-@@ -855,32 +1113,98 @@ interface(`apache_manage_sys_content',`
+@@ -855,32 +1133,98 @@ interface(`apache_manage_sys_content',`
  	manage_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
  ')
  
 -########################################
 +######################################
- ## <summary>
--##	Create, read, write, and delete
--##	httpd system rw content.
++## <summary>
 +##	Allow the specified domain to read
 +##	apache system content rw files.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
- ##	Domain allowed access.
- ##	</summary>
- ## </param>
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
 +## <rolecap/>
- #
--interface(`apache_manage_sys_rw_content',`
++#
 +interface(`apache_read_sys_content_rw_files',`
- 	gen_require(`
- 		type httpd_sys_rw_content_t;
- 	')
- 
--	apache_search_sys_content($1)
++	gen_require(`
++		type httpd_sys_rw_content_t;
++	')
++
 +	read_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
 +')
 +
@@ -4934,22 +4951,26 @@ index f6eb485..ce5dba7 100644
 +')
 +
 +######################################
-+## <summary>
+ ## <summary>
+-##	Create, read, write, and delete
+-##	httpd system rw content.
 +##	Allow the specified domain to manage
 +##	apache system content rw files.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+ ##	Domain allowed access.
+ ##	</summary>
+ ## </param>
 +## <rolecap/>
-+#
+ #
+-interface(`apache_manage_sys_rw_content',`
 +interface(`apache_manage_sys_content_rw',`
-+	gen_require(`
-+		type httpd_sys_rw_content_t;
-+	')
-+
+ 	gen_require(`
+ 		type httpd_sys_rw_content_t;
+ 	')
+ 
+-	apache_search_sys_content($1)
 +	files_search_var($1)
  	manage_dirs_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t)
 -	manage_files_pattern($1,httpd_sys_rw_content_t, httpd_sys_rw_content_t)
@@ -4991,7 +5012,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -888,10 +1212,17 @@ interface(`apache_manage_sys_rw_content',`
+@@ -888,10 +1232,17 @@ interface(`apache_manage_sys_rw_content',`
  ##	</summary>
  ## </param>
  #
@@ -5010,7 +5031,7 @@ index f6eb485..ce5dba7 100644
  	')
  
  	tunable_policy(`httpd_enable_cgi && httpd_unified',`
-@@ -901,9 +1232,8 @@ interface(`apache_domtrans_sys_script',`
+@@ -901,9 +1252,8 @@ interface(`apache_domtrans_sys_script',`
  
  ########################################
  ## <summary>
@@ -5022,7 +5043,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -916,7 +1246,7 @@ interface(`apache_dontaudit_rw_sys_script_stream_sockets',`
+@@ -916,7 +1266,7 @@ interface(`apache_dontaudit_rw_sys_script_stream_sockets',`
  		type httpd_sys_script_t;
  	')
  
@@ -5031,7 +5052,7 @@ index f6eb485..ce5dba7 100644
  ')
  
  ########################################
-@@ -941,7 +1271,7 @@ interface(`apache_domtrans_all_scripts',`
+@@ -941,7 +1291,7 @@ interface(`apache_domtrans_all_scripts',`
  ########################################
  ## <summary>
  ##	Execute all user scripts in the user
@@ -5040,7 +5061,7 @@ index f6eb485..ce5dba7 100644
  ##	to the specified role.
  ## </summary>
  ## <param name="domain">
-@@ -954,6 +1284,7 @@ interface(`apache_domtrans_all_scripts',`
+@@ -954,6 +1304,7 @@ interface(`apache_domtrans_all_scripts',`
  ##	Role allowed access.
  ##	</summary>
  ## </param>
@@ -5048,7 +5069,7 @@ index f6eb485..ce5dba7 100644
  #
  interface(`apache_run_all_scripts',`
  	gen_require(`
-@@ -966,7 +1297,8 @@ interface(`apache_run_all_scripts',`
+@@ -966,7 +1317,8 @@ interface(`apache_run_all_scripts',`
  
  ########################################
  ## <summary>
@@ -5058,7 +5079,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -979,12 +1311,13 @@ interface(`apache_read_squirrelmail_data',`
+@@ -979,12 +1331,13 @@ interface(`apache_read_squirrelmail_data',`
  		type httpd_squirrelmail_t;
  	')
  
@@ -5074,7 +5095,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1002,7 +1335,7 @@ interface(`apache_append_squirrelmail_data',`
+@@ -1002,7 +1355,7 @@ interface(`apache_append_squirrelmail_data',`
  
  ########################################
  ## <summary>
@@ -5083,7 +5104,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1015,13 +1348,12 @@ interface(`apache_search_sys_content',`
+@@ -1015,13 +1368,12 @@ interface(`apache_search_sys_content',`
  		type httpd_sys_content_t;
  	')
  
@@ -5098,7 +5119,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1041,7 +1373,7 @@ interface(`apache_read_sys_content',`
+@@ -1041,7 +1393,7 @@ interface(`apache_read_sys_content',`
  
  ########################################
  ## <summary>
@@ -5107,7 +5128,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1059,8 +1391,7 @@ interface(`apache_search_sys_scripts',`
+@@ -1059,8 +1411,7 @@ interface(`apache_search_sys_scripts',`
  
  ########################################
  ## <summary>
@@ -5117,7 +5138,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1071,18 +1402,21 @@ interface(`apache_search_sys_scripts',`
+@@ -1071,18 +1422,21 @@ interface(`apache_search_sys_scripts',`
  #
  interface(`apache_manage_all_user_content',`
  	gen_require(`
@@ -5145,7 +5166,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1100,7 +1434,8 @@ interface(`apache_search_sys_script_state',`
+@@ -1100,7 +1454,8 @@ interface(`apache_search_sys_script_state',`
  
  ########################################
  ## <summary>
@@ -5155,7 +5176,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1117,10 +1452,29 @@ interface(`apache_read_tmp_files',`
+@@ -1117,10 +1472,29 @@ interface(`apache_read_tmp_files',`
  	read_files_pattern($1, httpd_tmp_t, httpd_tmp_t)
  ')
  
@@ -5187,7 +5208,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1133,7 +1487,7 @@ interface(`apache_dontaudit_write_tmp_files',`
+@@ -1133,7 +1507,7 @@ interface(`apache_dontaudit_write_tmp_files',`
  		type httpd_tmp_t;
  	')
  
@@ -5196,7 +5217,7 @@ index f6eb485..ce5dba7 100644
  ')
  
  ########################################
-@@ -1142,6 +1496,9 @@ interface(`apache_dontaudit_write_tmp_files',`
+@@ -1142,6 +1516,9 @@ interface(`apache_dontaudit_write_tmp_files',`
  ## </summary>
  ##	<desc>
  ##	<p>
@@ -5206,7 +5227,7 @@ index f6eb485..ce5dba7 100644
  ##	This is an interface to support third party modules
  ##	and its use is not allowed in upstream reference
  ##	policy.
-@@ -1171,8 +1528,31 @@ interface(`apache_cgi_domain',`
+@@ -1171,8 +1548,31 @@ interface(`apache_cgi_domain',`
  
  ########################################
  ## <summary>
@@ -5240,7 +5261,7 @@ index f6eb485..ce5dba7 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -1189,18 +1569,19 @@ interface(`apache_cgi_domain',`
+@@ -1189,18 +1589,19 @@ interface(`apache_cgi_domain',`
  interface(`apache_admin',`
  	gen_require(`
  		attribute httpdcontent, httpd_script_exec_type;
@@ -5269,7 +5290,7 @@ index f6eb485..ce5dba7 100644
  
  	init_labeled_script_domtrans($1, httpd_initrc_exec_t)
  	domain_system_change_exemption($1)
-@@ -1210,10 +1591,10 @@ interface(`apache_admin',`
+@@ -1210,10 +1611,10 @@ interface(`apache_admin',`
  	apache_manage_all_content($1)
  	miscfiles_manage_public_files($1)
  
@@ -5283,7 +5304,7 @@ index f6eb485..ce5dba7 100644
  	admin_pattern($1, httpd_log_t)
  
  	admin_pattern($1, httpd_modules_t)
-@@ -1224,9 +1605,182 @@ interface(`apache_admin',`
+@@ -1224,9 +1625,182 @@ interface(`apache_admin',`
  	admin_pattern($1, httpd_var_run_t)
  	files_pid_filetrans($1, httpd_var_run_t, file)
  
@@ -5427,9 +5448,7 @@ index f6eb485..ce5dba7 100644
 +	filetrans_pattern($1, httpd_user_content_t, httpd_user_content_ra_t, dir, "logs")
 +	filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t }, httpd_user_htaccess_t, file, ".htaccess")
 +')
- 
--	apache_run_all_scripts($1, $2)
--	apache_run_helper($1, $2)
++
 +########################################
 +## <summary>
 +##	Read apache pid files.
@@ -5448,7 +5467,9 @@ index f6eb485..ce5dba7 100644
 +	files_search_pids($1)
 +	read_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
 +')
-+
+ 
+-	apache_run_all_scripts($1, $2)
+-	apache_run_helper($1, $2)
 +########################################
 +## <summary>
 +##      Send and receive messages from
@@ -15252,10 +15273,10 @@ index 0000000..d5920c0
 +')
 diff --git a/cockpit.te b/cockpit.te
 new file mode 100644
-index 0000000..77cdd5e
+index 0000000..23ebc59
 --- /dev/null
 +++ b/cockpit.te
-@@ -0,0 +1,111 @@
+@@ -0,0 +1,115 @@
 +policy_module(cockpit, 1.0.0)
 +
 +########################################
@@ -15355,10 +15376,14 @@ index 0000000..77cdd5e
 +
 +# cockpit-session runs a full pam stack, including pam_selinux.so
 +auth_login_pgm_domain(cockpit_session_t)
++# cockpit-session resseting expired passwords
++auth_manage_passwd(cockpit_session_t)
++auth_manage_shadow(cockpit_session_t)
 +auth_write_login_records(cockpit_session_t)
 +
 +# cockpit-session can execute cockpit-agent as the user
 +userdom_spec_domtrans_all_users(cockpit_session_t)
++usermanage_read_crack_db(cockpit_session_t)
 +
 +optional_policy(`
 +    userdom_signal_all_users(cockpit_session_t)
@@ -15570,7 +15595,7 @@ index 954309e..6780142 100644
  ')
 +
 diff --git a/collectd.te b/collectd.te
-index 6471fa8..b82bae6 100644
+index 6471fa8..cb6a356 100644
 --- a/collectd.te
 +++ b/collectd.te
 @@ -26,43 +26,61 @@ files_type(collectd_var_lib_t)
@@ -15596,8 +15621,9 @@ index 6471fa8..b82bae6 100644
  allow collectd_t self:process { getsched setsched signal };
  allow collectd_t self:fifo_file rw_fifo_file_perms;
  allow collectd_t self:packet_socket create_socket_perms;
+-allow collectd_t self:unix_stream_socket { accept listen };
 +allow collectd_t self:rawip_socket create_socket_perms;
- allow collectd_t self:unix_stream_socket { accept listen };
++allow collectd_t self:unix_stream_socket { accept listen connectto };
 +allow collectd_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
 +allow collectd_t self:udp_socket create_socket_perms;
 +allow collectd_t self:rawip_socket create_socket_perms;
@@ -29835,7 +29861,7 @@ index 4498143..84a4858 100644
  	ftp_run_ftpdctl($1, $2)
  ')
 diff --git a/ftp.te b/ftp.te
-index 36838c2..21cc5ed 100644
+index 36838c2..34a9ced 100644
 --- a/ftp.te
 +++ b/ftp.te
 @@ -13,7 +13,7 @@ policy_module(ftp, 1.15.1)
@@ -30009,9 +30035,9 @@ index 36838c2..21cc5ed 100644
 +userdom_manage_user_home_content_files(ftpd_t)
 +userdom_manage_user_tmp_dirs(ftpd_t)
 +userdom_manage_user_tmp_files(ftpd_t)
-+
  
 -tunable_policy(`allow_ftpd_anon_write',`
++
 +tunable_policy(`ftpd_anon_write',`
  	miscfiles_manage_public_files(ftpd_t)
  ')
@@ -30070,8 +30096,11 @@ index 36838c2..21cc5ed 100644
 -	corenet_sendrecv_oracledb_client_packets(ftpd_t)
 -	corenet_tcp_connect_oracledb_port(ftpd_t)
 -	corenet_tcp_sendrecv_oracledb_port(ftpd_t)
--')
--
++	corenet_sendrecv_oracle_client_packets(ftpd_t)
++	corenet_tcp_connect_oracle_port(ftpd_t)
++	corenet_tcp_sendrecv_oracle_port(ftpd_t)
+ ')
+ 
 -tunable_policy(`ftp_home_dir',`
 -	allow ftpd_t self:capability { dac_override dac_read_search };
 -
@@ -30084,11 +30113,8 @@ index 36838c2..21cc5ed 100644
 -',`
 -	userdom_user_home_dir_filetrans_user_home_content(ftpd_t, { dir file })
 -	userdom_tmp_filetrans_user_tmp(ftpd_t, { dir file })
-+	corenet_sendrecv_oracle_client_packets(ftpd_t)
-+	corenet_tcp_connect_oracle_port(ftpd_t)
-+	corenet_tcp_sendrecv_oracle_port(ftpd_t)
- ')
- 
+-')
+-
 -tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
 +tunable_policy(`use_nfs_home_dirs',`
  	fs_manage_nfs_dirs(ftpd_t)
@@ -30124,7 +30150,17 @@ index 36838c2..21cc5ed 100644
  	kerberos_use(ftpd_t)
  ')
  
-@@ -416,86 +387,39 @@ optional_policy(`
+@@ -410,92 +381,49 @@ optional_policy(`
+ 	udev_read_db(ftpd_t)
+ ')
+ 
++optional_policy(`
++	apache_manage_user_content(ftpd_t)
++')
++
+ ########################################
+ #
+ # Ctl local policy
  #
  
  stream_connect_pattern(ftpdctl_t, ftpd_var_run_t, ftpd_var_run_t, ftpd_t)
@@ -30184,14 +30220,13 @@ index 36838c2..21cc5ed 100644
 -	fs_manage_nfs_files(sftpd_t)
 -	fs_manage_nfs_symlinks(sftpd_t)
 -')
- 
+-
 -tunable_policy(`sftpd_enable_homedirs && use_samba_home_dirs',`
 -	fs_manage_cifs_dirs(sftpd_t)
 -	fs_manage_cifs_files(sftpd_t)
 -	fs_manage_cifs_symlinks(sftpd_t)
 -')
-+userdom_home_reader(sftpd_t)
- 
+-
 -tunable_policy(`sftpd_anon_write',`
 -	miscfiles_manage_public_files(sftpd_t)
 -')
@@ -30205,13 +30240,14 @@ index 36838c2..21cc5ed 100644
 -tunable_policy(`sftpd_write_ssh_home',`
 -	ssh_manage_home_files(sftpd_t)
 -')
--
+ 
 -tunable_policy(`use_samba_home_dirs',`
 -	fs_list_cifs(sftpd_t)
 -	fs_read_cifs_files(sftpd_t)
 -	fs_read_cifs_symlinks(sftpd_t)
 -')
--
++userdom_home_reader(sftpd_t)
+ 
 -tunable_policy(`use_nfs_home_dirs',`
 -	fs_list_nfs(sftpd_t)
 -	fs_read_nfs_files(sftpd_t)
@@ -67639,13 +67675,15 @@ index 0000000..3bcd32c
 +
 diff --git a/oracleasm.fc b/oracleasm.fc
 new file mode 100644
-index 0000000..c416596
+index 0000000..5655fac
 --- /dev/null
 +++ b/oracleasm.fc
-@@ -0,0 +1,6 @@
+@@ -0,0 +1,8 @@
 +
 +/etc/rc\.d/init\.d/oracleasm	--	gen_context(system_u:object_r:oracleasm_initrc_exec_t,s0)
 +
++/etc/sysconfig/oracleasm(/.*)?	gen_context(system_u:object_r:oracleasm_conf_t,s0)
++
 +/etc/sysconfig/oracleasm-_dev_oracleasm		--	gen_context(system_u:object_r:oracleasm_conf_t,s0)
 +
 +/usr/sbin/oracleasm		--	gen_context(system_u:object_r:oracleasm_exec_t,s0)
@@ -67732,10 +67770,10 @@ index 0000000..6ae382c
 +
 diff --git a/oracleasm.te b/oracleasm.te
 new file mode 100644
-index 0000000..48fdbd5
+index 0000000..c4b5ddb
 --- /dev/null
 +++ b/oracleasm.te
-@@ -0,0 +1,64 @@
+@@ -0,0 +1,66 @@
 +policy_module(oracleasm, 1.0.0)
 +
 +########################################
@@ -67766,6 +67804,7 @@ index 0000000..48fdbd5
 +allow oracleasm_t self:unix_stream_socket create_stream_socket_perms;
 +
 +allow oracleasm_t oracleasm_conf_t:file manage_file_perms;
++allow oracleasm_t oracleasm_conf_t:dir manage_dir_perms;
 +
 +manage_dirs_pattern(oracleasm_t, oracleasm_tmp_t, oracleasm_tmp_t)
 +manage_files_pattern(oracleasm_t, oracleasm_tmp_t, oracleasm_tmp_t)
@@ -67792,6 +67831,7 @@ index 0000000..48fdbd5
 +
 +storage_raw_read_fixed_disk(oracleasm_t)
 +storage_raw_read_removable_device(oracleasm_t)
++storage_rw_inherited_fixed_disk_dev(oracleasm_t)
 +
 +optional_policy(`
 +    mount_domtrans(oracleasm_t)
@@ -109465,7 +109505,7 @@ index 61c2e07..3b86095 100644
 +	')
  ')
 diff --git a/tor.te b/tor.te
-index 5ceacde..9353adb 100644
+index 5ceacde..f24416b 100644
 --- a/tor.te
 +++ b/tor.te
 @@ -13,6 +13,13 @@ policy_module(tor, 1.9.0)
@@ -109482,17 +109522,18 @@ index 5ceacde..9353adb 100644
  type tor_t;
  type tor_exec_t;
  init_daemon_domain(tor_t, tor_exec_t)
-@@ -33,6 +40,9 @@ type tor_var_run_t;
+@@ -32,6 +39,10 @@ logging_log_file(tor_var_log_t)
+ type tor_var_run_t;
  files_pid_file(tor_var_run_t)
  init_daemon_run_dir(tor_var_run_t, "tor")
- 
++files_mountpoint(tor_var_run_t)
++
 +type tor_unit_file_t;
 +systemd_unit_file(tor_unit_file_t)
-+
+ 
  ########################################
  #
- # Local policy
-@@ -48,6 +58,8 @@ allow tor_t tor_etc_t:dir list_dir_perms;
+@@ -48,6 +59,8 @@ allow tor_t tor_etc_t:dir list_dir_perms;
  allow tor_t tor_etc_t:file read_file_perms;
  allow tor_t tor_etc_t:lnk_file read_lnk_file_perms;
  
@@ -109501,7 +109542,7 @@ index 5ceacde..9353adb 100644
  manage_dirs_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
  manage_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
  manage_sock_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
-@@ -77,7 +89,6 @@ corenet_tcp_sendrecv_generic_node(tor_t)
+@@ -77,7 +90,6 @@ corenet_tcp_sendrecv_generic_node(tor_t)
  corenet_udp_sendrecv_generic_node(tor_t)
  corenet_tcp_bind_generic_node(tor_t)
  corenet_udp_bind_generic_node(tor_t)
@@ -109509,7 +109550,7 @@ index 5ceacde..9353adb 100644
  corenet_sendrecv_dns_server_packets(tor_t)
  corenet_udp_bind_dns_port(tor_t)
  corenet_udp_sendrecv_dns_port(tor_t)
-@@ -85,6 +96,7 @@ corenet_udp_sendrecv_dns_port(tor_t)
+@@ -85,6 +97,7 @@ corenet_udp_sendrecv_dns_port(tor_t)
  corenet_sendrecv_tor_server_packets(tor_t)
  corenet_tcp_bind_tor_port(tor_t)
  corenet_tcp_sendrecv_tor_port(tor_t)
@@ -109517,7 +109558,7 @@ index 5ceacde..9353adb 100644
  
  corenet_sendrecv_all_client_packets(tor_t)
  corenet_tcp_connect_all_ports(tor_t)
-@@ -98,19 +110,22 @@ dev_read_urand(tor_t)
+@@ -98,19 +111,22 @@ dev_read_urand(tor_t)
  domain_use_interactive_fds(tor_t)
  
  files_read_etc_runtime_files(tor_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index dd50564..f0a6308 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 191.16%{?dist}
+Release: 191.17%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -672,6 +672,18 @@ exit 0
 %endif
 
 %changelog
+* Fri Sep 23 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-191.17
+- Make tor_var_run_t as mountpoint. BZ(1368621)
+- Fix typo in ftpd SELinux module.
+- Allow cockpit-session to reset expired passwords BZ(1374262)
+- Allow ftp daemon to manage apache_user_content
+- Label /etc/sysconfig/oracleasm as oracleasm_conf_t
+- Allow oracleasm to rw inherited fixed disk device
+- Allow collectd to connect on unix_stream_socket
+- Add abrt_dump_oops_t kill user namespace capability. BZ(1376868)
+- Dontaudit systemd is mounting unlabeled dirs BZ(1367292)
+- Add interface files_dontaudit_mounton_isid()
+
 * Thu Sep 15 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-191.16
 - Allow attach usb device to virtual machine BZ(1276873)
 - Dontaudit mozilla_plugin to sys_ptrace