Index: refpolicy-2.20260906/policy/modules/apps/gpg.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/gpg.te
+++ refpolicy-2.20260906/policy/modules/apps/gpg.te
@@ -142,6 +142,7 @@ miscfiles_read_localization(gpg_t)
 miscfiles_read_generic_certs(gpg_t)
 
 userdom_use_user_terminals(gpg_t)
+userdom_user_home_dir_filetrans_user_home_content(gpg_t, file)
 
 userdom_manage_user_tmp_dirs(gpg_t)
 userdom_manage_user_tmp_files(gpg_t)
@@ -228,7 +229,7 @@ tunable_policy(`use_samba_home_dirs',`
 # Agent local policy
 #
 
-allow gpg_agent_t self:process { setrlimit signal_perms };
+allow gpg_agent_t self:process { setrlimit signal_perms getsched setsched };
 allow gpg_agent_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow gpg_agent_t self:fifo_file rw_fifo_file_perms;
 
@@ -310,6 +311,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gnome_dbus_chat_all_gkeyringd(gpg_agent_t)
+')
+
+optional_policy(`
 	mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
 ')
 
Index: refpolicy-2.20260906/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20260906/policy/modules/roles/sysadm.te
@@ -49,6 +49,8 @@ allow sysadm_t self:netlink_route_socket
 # for debugging BPF programs
 allow sysadm_t self:capability2 bpf;
 
+kernel_request_load_module(sysadm_t)
+
 corecmd_exec_shell(sysadm_t)
 
 corenet_ib_access_unlabeled_pkeys(sysadm_t)
@@ -73,6 +75,7 @@ ubac_fd_exempt(sysadm_t)
 
 init_exec(sysadm_t)
 init_admin(sysadm_t)
+init_rw_stream_sockets(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)
@@ -915,6 +918,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	qemu_role(sysadm_r, sysadm_t)
+')
+
+optional_policy(`
 	qpidd_admin(sysadm_t, sysadm_r)
 ')
 
Index: refpolicy-2.20260906/policy/modules/system/init.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/init.if
+++ refpolicy-2.20260906/policy/modules/system/init.if
@@ -2841,6 +2841,42 @@ interface(`init_dontaudit_read_script_st
 
 ######################################
 ## <summary>
+##	dontaudit stat of /run/systemd/inaccessible/chr
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`init_dontaudit_getattr_runtime_chr_file',`
+	gen_require(`
+		type init_runtime_t;
+	')
+
+	dontaudit $1 init_runtime_t:chr_file getattr;
+')
+
+######################################
+## <summary>
+##	dontaudit stat of /run/systemd/inaccessible/reg
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`init_dontaudit_getattr_runtime_file',`
+	gen_require(`
+		type init_runtime_t;
+	')
+
+	dontaudit $1 init_runtime_t:file getattr;
+')
+
+######################################
+## <summary>
 ##	Search the /run/systemd directory.
 ## </summary>
 ## <param name="domain">
@@ -3796,6 +3832,24 @@ interface(`init_reload_all_units',`
 	allow $1 { init_script_file_type systemdunit }:service reload;
 ')
 
+#######################################
+## <summary>
+##	getattr all systemd unit files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_getattr_all_units',`
+	gen_require(`
+		attribute systemdunit;
+	')
+
+	allow $1 systemdunit:file getattr;
+')
+
 ########################################
 ## <summary>
 ##	List systemd unit dirs and the files in them
Index: refpolicy-2.20260906/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/init.te
+++ refpolicy-2.20260906/policy/modules/system/init.te
@@ -296,7 +296,6 @@ ifdef(`init_systemd',`
 	allow init_t self:udp_socket create_socket_perms;
 	allow init_t self:netlink_route_socket create_netlink_socket_perms;
 	allow init_t initrc_t:unix_dgram_socket create_socket_perms;
-	allow init_t self:capability2 audit_read;
 	allow init_t self:key { search setattr write };
 	allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
 	allow init_t self:user_namespace create;
Index: refpolicy-2.20260906/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/logging.te
+++ refpolicy-2.20260906/policy/modules/system/logging.te
@@ -510,6 +510,7 @@ seutil_read_config(syslogd_t)
 
 userdom_dontaudit_use_unpriv_user_fds(syslogd_t)
 userdom_dontaudit_search_user_home_dirs(syslogd_t)
+userdom_search_user_runtime_root(syslogd_t)
 
 ifdef(`init_systemd',`
 	# for systemd-journal
@@ -570,6 +571,8 @@ ifdef(`init_systemd',`
 	systemd_relabelto_journal_files(syslogd_t)
 
 	udev_read_runtime_files(syslogd_t)
+	userdom_list_user_tmp(syslogd_t)
+	userdom_read_user_tmp_symlinks(syslogd_t)
 
 	# journald traverses /run/user/UID (which is mode 0700) to read symlinks in /run/user/UID/systemd/units/
 	allow syslogd_t self:capability dac_read_search;
Index: refpolicy-2.20260906/policy/modules/system/modutils.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/modutils.te
+++ refpolicy-2.20260906/policy/modules/system/modutils.te
@@ -116,6 +116,7 @@ miscfiles_read_localization(kmod_t)
 
 seutil_read_file_contexts(kmod_t)
 
+term_use_unallocated_ttys(kmod_t)
 userdom_use_user_terminals(kmod_t)
 
 userdom_dontaudit_search_user_home_dirs(kmod_t)
Index: refpolicy-2.20260906/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20260906/policy/modules/system/unconfined.te
@@ -39,6 +39,7 @@ logging_send_syslog_msg(unconfined_t)
 logging_run_auditctl(unconfined_t, unconfined_r)
 
 mount_run_unconfined(unconfined_t, unconfined_r)
+mount_watch_runtime_files_reads(unconfined_t)
 
 seutil_run_setfiles(unconfined_t, unconfined_r)
 seutil_run_semanage(unconfined_t, unconfined_r)
Index: refpolicy-2.20260906/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20260906/policy/modules/kernel/kernel.te
@@ -269,6 +269,7 @@ allow kernel_t self:unix_stream_socket c
 allow kernel_t self:fifo_file rw_fifo_file_perms;
 allow kernel_t self:sock_file read_sock_file_perms;
 allow kernel_t self:fd use;
+allow kernel_t self:perf_event cpu;
 
 allow kernel_t debugfs_t:dir search_dir_perms;
 
Index: refpolicy-2.20260906/policy/modules/admin/usermanage.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/admin/usermanage.te
+++ refpolicy-2.20260906/policy/modules/admin/usermanage.te
@@ -105,6 +105,7 @@ dev_read_urand(chfn_t)
 auth_run_chk_passwd(chfn_t, chfn_roles)
 auth_dontaudit_read_shadow(chfn_t)
 auth_use_nsswitch(chfn_t)
+auth_rw_shadow_lock(chfn_t)
 
 # allow checking if a shell is executable
 corecmd_check_exec_shell(chfn_t)
@@ -415,6 +416,7 @@ files_tmp_filetrans(sysadm_passwd_t, sys
 files_search_var(sysadm_passwd_t)
 files_dontaudit_search_home(sysadm_passwd_t)
 
+kernel_getattr_proc(sysadm_passwd_t)
 kernel_read_kernel_sysctls(sysadm_passwd_t)
 # for /proc/meminfo
 kernel_read_system_state(sysadm_passwd_t)
@@ -453,6 +455,9 @@ files_read_etc_runtime_files(sysadm_pass
 # for nscd lookups
 files_dontaudit_search_runtime(sysadm_passwd_t)
 
+files_etc_filetrans_etc(sysadm_passwd_t, file, "passwd.edit")
+files_etc_filetrans_etc(sysadm_passwd_t, file, "group.edit")
+
 # /usr/bin/passwd asks for w access to utmp, but it will operate
 # correctly without it.  Do not audit write denials to utmp.
 init_dontaudit_rw_utmp(sysadm_passwd_t)
Index: refpolicy-2.20260906/policy/modules/kernel/files.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/files.if
+++ refpolicy-2.20260906/policy/modules/kernel/files.if
@@ -3703,6 +3703,35 @@ interface(`files_etc_filetrans',`
 
 ########################################
 ## <summary>
+##	Create objects in /etc with type etc_t with specified
+##	name to overide default transition
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Object classes to be created.
+##	</summary>
+## </param>
+## <param name="name">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`files_etc_filetrans_etc',`
+	gen_require(`
+		type etc_t;
+	')
+
+	filetrans_pattern($1, etc_t, etc_t, $2, $3)
+')
+
+########################################
+## <summary>
 ##	Create a boot flag.
 ## </summary>
 ## <desc>
Index: refpolicy-2.20260906/policy/modules/system/unconfined.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/unconfined.if
+++ refpolicy-2.20260906/policy/modules/system/unconfined.if
@@ -37,7 +37,7 @@ interface(`unconfined_domain_noaudit',`
 
 	# Use most Linux capabilities
 	allow $1 self:{ capability cap_userns } { audit_control audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
-	allow $1 self:{ capability2 cap2_userns } { bpf perfmon syslog wake_alarm };
+	allow $1 self:{ capability2 cap2_userns } { bpf perfmon syslog wake_alarm checkpoint_restore };
 	allow $1 self:fifo_file manage_fifo_file_perms;
 	allow $1 self:system status;
 
@@ -49,6 +49,8 @@ interface(`unconfined_domain_noaudit',`
 	# Transition to myself, to make get_ordered_context_list happy.
 	allow $1 self:process transition;
 
+	allow $1 self:perf_event { open read kernel cpu };
+
 	# Write access is for setting attributes under /proc/self/attr.
 	allow $1 self:file rw_file_perms;
 
@@ -388,6 +390,24 @@ interface(`unconfined_signal',`
 ')
 
 ########################################
+## <summary>
+##	rw unconfined domain semaphores
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unconfined_rw_sem',`
+	gen_require(`
+		type unconfined_t;
+	')
+
+	allow $1 unconfined_t:sem rw_sem_perms;
+')
+
+########################################
 ## <summary>
 ##	Read unconfined domain unnamed pipes.
 ## </summary>
Index: refpolicy-2.20260906/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260906/policy/modules/apps/wm.if
@@ -61,11 +61,15 @@ template(`wm_role_template',`
 	allow $3 $1_wm_t:unix_stream_socket { connectto read write getopt shutdown };
 	allow $3 $1_wm_t:fifo_file read_fifo_file_perms;
 
+	allow $1_wm_t self:capability sys_nice;
+
 	# ptrace here would allow messing with keyboard
 	allow $3 $1_wm_t:process { signal_perms };
 	ps_process_pattern($3, $1_wm_t)
 
+	kernel_read_device_sysctls($1_wm_t)
 	kernel_read_kernel_sysctls($1_wm_t)
+	kernel_read_vm_overcommit_sysctl($1_wm_t)
 
 	allow $1_wm_t $3:process { sigkill signull signal };
 	ps_process_pattern($1_wm_t, $3)
@@ -83,6 +87,9 @@ template(`wm_role_template',`
 	files_watch_usr_dirs($1_wm_t)
 	files_watch_var_lib_dirs($1_wm_t)
 
+	fs_read_cgroup_symlinks($1_wm_t)
+	fs_create_cgroup_dirs($1_wm_t)
+
 	mls_file_read_all_levels($1_wm_t)
 	mls_file_write_all_levels($1_wm_t)
 	mls_xwin_read_all_levels($1_wm_t)
@@ -92,13 +99,28 @@ template(`wm_role_template',`
 	auth_domtrans_chk_passwd($1_wm_t)
 	auth_use_nsswitch($1_wm_t)
 
+	init_read_state($1_wm_t)
+
+	libs_read_lib_files($1_wm_t)
+	logging_send_syslog_msg($1_wm_t)
+
 	miscfiles_manage_fonts_cache($1_wm_t)
 
+	udev_list_runtime($1_wm_t)
+	userdom_manage_user_runtime_dirs($1_wm_t)
+	userdom_write_user_runtime_sockets($1_wm_t)
+
 	userdom_rw_user_tmpfs_files($1_wm_t)
 	userdom_map_user_tmpfs_files($1_wm_t)
 	userdom_manage_user_tmp_files($1_wm_t)
 	userdom_map_user_tmp_files($1_wm_t)
 
+	xdg_manage_data($1_wm_t)
+	xdg_watch_cache_dirs($1_wm_t)
+	xdg_watch_cache_files($1_wm_t)
+	xdg_watch_config_dirs($1_wm_t)
+	xdg_watch_data_dirs($1_wm_t)
+
 	xserver_read_xdm_state($1_wm_t)
 	xserver_role($1, $1_wm_t, $3, $4)
 	xserver_user_runtime_dir_filetrans_user_xauth($1_wm_t)
@@ -111,6 +133,10 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		apt_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
 		dbus_connect_spec_session_bus($1, $1_wm_t)
 		dbus_getattr_session_runtime_socket($1_wm_t)
 		dbus_read_lib_files($1_wm_t)
@@ -137,6 +163,10 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		iiosensorproxy_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
 		modemmanager_dbus_chat($1_wm_t)
 	')
 
@@ -162,6 +192,7 @@ template(`wm_role_template',`
 		systemd_list_userdb_runtime_dirs($1_wm_t)
 		systemd_read_logind_runtime_files($1_wm_t)
 		systemd_read_logind_state($1_wm_t)
+		systemd_read_logind_sessions_files($1_wm_t)
 		systemd_search_user_runtime($1_wm_t)
 		systemd_use_logind_fds($1_wm_t)
 		systemd_user_app_status($1, $1_wm_t)
@@ -186,6 +217,10 @@ template(`wm_role_template',`
 		xdg_manage_config($1_wm_t)
 		xdg_watch_data_files($1_wm_t)
 	')
+
+	optional_policy(`
+		xdg_watch_config_files($1_wm_t)
+	')
 ')
 
 ########################################
Index: refpolicy-2.20260906/policy/modules/apps/wm.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/wm.te
+++ refpolicy-2.20260906/policy/modules/apps/wm.te
@@ -51,6 +51,7 @@ files_tmp_filetrans(wm_domain, wm_tmp_t,
 manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
 manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
 mmap_read_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+allow wm_domain wm_tmpfs_t:file { execute execmod };
 manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
 fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
 
Index: refpolicy-2.20260906/policy/modules/system/lvm.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/lvm.if
+++ refpolicy-2.20260906/policy/modules/system/lvm.if
@@ -269,3 +269,22 @@ interface(`lvm_admin',`
 	files_search_tmp($1)
 	admin_pattern($1, lvm_tmp_t)
 ')
+
+######################################
+## <summary>
+##	Manage LVM metadata
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lvm_manage_metadata',`
+	gen_require(`
+		type lvm_metadata_t;
+	')
+
+	allow $1 lvm_metadata_t:dir manage_dir_perms;
+	allow $1 lvm_metadata_t:file manage_file_perms;
+')
Index: refpolicy-2.20260906/policy/modules/system/udev.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/udev.if
+++ refpolicy-2.20260906/policy/modules/system/udev.if
@@ -244,6 +244,26 @@ interface(`udev_relabel_rules_files',`
 
 ########################################
 ## <summary>
+##      read udev rules files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`udev_read_rules_files',`
+	gen_require(`
+		type udev_rules_t;
+	')
+
+	allow $1 udev_rules_t:dir list_dir_perms;
+	allow $1 udev_rules_t:file read_file_perms;
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
 ##	Search through udev runtime dirs.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260906/policy/modules/apps/xscreensaver.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/xscreensaver.fc
+++ refpolicy-2.20260906/policy/modules/apps/xscreensaver.fc
@@ -6,3 +6,4 @@ HOME_DIR/XScreenSaver		--	gen_context(sy
 /usr/bin/xscreensaver-gl-helper	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
 
 /usr/libexec/xscreensaver(/.*)?	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
+/usr/lib/[^/]*-linux-gnu/libexec/kscreenlocker_greet	--	gen_context(system_u:object_r:xscreensaver_exec_t,s0)
Index: refpolicy-2.20260906/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260906/policy/modules/system/userdomain.if
@@ -1,5 +1,18 @@
 ## <summary>Policy for user domains</summary>
 
+# userdom_login_user_template() -> userdom_base_user_template()
+#   userdom_restricted_user_template() -> userdom_login_user_template()
+#     userdom_restricted_xwindows_user_template() -> userdom_restricted_user_template()
+#       userdom_restricted_xwindows_user_template(xguest)
+#     userdom_unpriv_user_template() -> userdom_restricted_user_template()
+#       userdom_unpriv_user_template(user/staff/secadm/auditadm)
+#   userdom_admin_user_template() -> userdom_login_user_template()
+#     userdom_admin_user_template(sysadm)
+
+# userdom_common_user_template() -> userdom_basic_networking_template()
+#   userdom_unpriv_user_template() -> userdom_common_user_template()
+#   userdom_admin_user_template() -> userdom_common_user_template()
+#
 #######################################
 ## <summary>
 ##	The template containing the most basic rules common to all users.
@@ -789,6 +802,7 @@ template(`userdom_common_user_template',
 
 	tunable_policy(`user_rw_noexattrfile',`
 		fs_manage_noxattr_fs_dirs($1_t)
+		fs_watch_noxattr_fs_dirs($1_t)
 		fs_manage_noxattr_fs_files($1_t)
 		fs_manage_noxattr_fs_symlinks($1_t)
 	',`
@@ -856,6 +870,7 @@ template(`userdom_common_user_template',
 		optional_policy(`
 			devicekit_dbus_chat_disk($1_t)
 			devicekit_dbus_chat_power($1_t)
+			devicekit_list_runtime($1_t)
 		')
 
 		optional_policy(`
@@ -4073,6 +4088,24 @@ interface(`userdom_delete_all_user_runti
 ')
 
 ########################################
+## <summary>
+##	watch user runtime directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_watch_all_user_runtime_dirs',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	allow $1 user_runtime_content_type:dir watch;
+')
+
+########################################
 ## <summary>
 ##	delete user runtime files
 ## </summary>
Index: refpolicy-2.20260906/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20260906/policy/modules/services/devicekit.te
@@ -90,6 +90,7 @@ files_runtime_filetrans(devicekit_disk_t
 fs_tmpfs_filetrans(devicekit_disk_t, devicekit_runtime_t, file)
 
 kernel_getattr_message_if(devicekit_disk_t)
+kernel_get_sysvipc_info(devicekit_disk_t)
 kernel_list_unlabeled(devicekit_disk_t)
 kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t)
 kernel_read_fs_sysctls(devicekit_disk_t)
@@ -157,6 +158,7 @@ auth_use_nsswitch(devicekit_disk_t)
 logging_send_syslog_msg(devicekit_disk_t)
 
 miscfiles_read_localization(devicekit_disk_t)
+miscfiles_read_generic_certs(devicekit_disk_t)
 
 userdom_read_all_users_state(devicekit_disk_t)
 userdom_search_user_home_dirs(devicekit_disk_t)
Index: refpolicy-2.20260906/policy/modules/system/locallogin.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/locallogin.te
+++ refpolicy-2.20260906/policy/modules/system/locallogin.te
@@ -200,6 +200,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	# for motd
+	apt_read_db(local_login_t)
+')
+
+optional_policy(`
 	dbus_system_bus_client(local_login_t)
 ')
 
@@ -223,6 +228,7 @@ optional_policy(`
 
 optional_policy(`
 	systemd_dbus_chat_logind(local_login_t)
+	systemd_use_logind_fds(local_login_t)
 	systemd_write_inherited_logind_sessions_pipes(local_login_t)
 ')
 
Index: refpolicy-2.20260906/policy/modules/services/switcheroo.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/switcheroo.te
+++ refpolicy-2.20260906/policy/modules/services/switcheroo.te
@@ -17,6 +17,7 @@ init_daemon_domain(switcheroo_t, switche
 #
 
 allow switcheroo_t self:netlink_kobject_uevent_socket create_socket_perms;
+dontaudit switcheroo_t self:capability net_admin;
 
 kernel_read_system_state(switcheroo_t)
 
Index: refpolicy-2.20260906/policy/modules/services/cron.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/cron.te
+++ refpolicy-2.20260906/policy/modules/services/cron.te
@@ -339,6 +339,7 @@ optional_policy(`
 optional_policy(`
 	systemd_dbus_chat_logind(crond_t)
 	systemd_write_inherited_logind_sessions_pipes(crond_t)
+	systemd_connect_machined(crond_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260906/policy/modules/apps/xscreensaver.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/xscreensaver.te
+++ refpolicy-2.20260906/policy/modules/apps/xscreensaver.te
@@ -37,7 +37,7 @@ userdom_user_tmpfs_file(xscreensaver_tmp
 #
 
 allow xscreensaver_t self:capability { setgid setuid };
-allow xscreensaver_t self:process { setpgid setsched signal sigstop };
+allow xscreensaver_t self:process { setpgid setsched getsched getcap signal sigstop };
 allow xscreensaver_t self:fifo_file rw_fifo_file_perms;
 allow xscreensaver_t self:netlink_kobject_uevent_socket { bind create getattr setopt getopt read };
 
@@ -48,12 +48,22 @@ allow xscreensaver_t xscreensaver_config
 allow xscreensaver_t xscreensaver_tmpfs_t:file rw_file_perms;
 fs_tmpfs_filetrans(xscreensaver_t, xscreensaver_tmpfs_t, file)
 
+dev_read_sysfs(xscreensaver_t)
+dev_rw_dma_dev(xscreensaver_t)
+dev_rw_dri(xscreensaver_t)
+
+kernel_getattr_proc(xscreensaver_t)
+kernel_read_device_sysctls(xscreensaver_t)
+kernel_read_kernel_sysctls(xscreensaver_t)
 kernel_read_system_state(xscreensaver_t)
 
 files_read_usr_files(xscreensaver_t)
+files_map_usr_files(xscreensaver_t)
+files_watch_runtime_dirs(xscreensaver_t)
 
 fs_dontaudit_getattr_xattr_fs(xscreensaver_t)
 
+accountsd_search_lib(xscreensaver_t)
 auth_dontaudit_read_shadow(xscreensaver_t)
 auth_use_nsswitch(xscreensaver_t)
 auth_domtrans_chk_passwd(xscreensaver_t)
@@ -67,11 +77,21 @@ logging_send_syslog_msg(xscreensaver_t)
 
 miscfiles_read_localization(xscreensaver_t)
 
+selinux_getattr_fs(xscreensaver_t)
+seutil_search_default_contexts(xscreensaver_t)
+
 userdom_use_user_terminals(xscreensaver_t)
+userdom_write_user_tmp_sockets(xscreensaver_t)
 
 xdg_read_pictures(xscreensaver_t)
+xdg_manage_cache(xscreensaver_t)
+xdg_manage_config(xscreensaver_t)
+xdg_manage_data(xscreensaver_t)
+xdg_watch_config_files(xscreensaver_t)
 
+xserver_manage_mesa_shader_cache(xscreensaver_t)
 xserver_read_xkb_libs(xscreensaver_t)
+xserver_rw_mesa_shader_cache(xscreensaver_t)
 xserver_rw_xsession_log(xscreensaver_t)
 xserver_user_x_domain_template(xscreensaver, xscreensaver_t, xscreensaver_tmpfs_t)
 
@@ -96,6 +116,28 @@ tunable_policy(`xscreensaver_read_generi
 ')
 
 optional_policy(`
+	dbus_all_session_bus_client(xscreensaver_t)
+	dbus_list_system_bus_runtime(xscreensaver_t)
+	dbus_write_session_runtime_socket(xscreensaver_t)
+	dbus_send_all_session_bus(xscreensaver_t)
+	dbus_system_bus_client(xscreensaver_t)
+	userdom_dbus_send_all_users(xscreensaver_t)
+')
+
+optional_policy(`
+	devicekit_dbus_chat_disk(xscreensaver_t)
+	devicekit_dbus_chat_power(xscreensaver_t)
+')
+
+optional_policy(`
+	systemd_dbus_chat_logind(xscreensaver_t)
+')
+
+optional_policy(`
+	udev_search_runtime(xscreensaver_t)
+')
+
+optional_policy(`
 	wm_application_domain(xscreensaver_t, xscreensaver_exec_t)
 	wm_dbus_chat_applications(xscreensaver_t)
 ')
@@ -125,6 +167,7 @@ files_dontaudit_search_home(xscreensaver
 # /etc/drirc
 files_read_etc_files(xscreensaver_helper_t)
 
+files_map_usr_files(xscreensaver_helper_t)
 files_read_usr_files(xscreensaver_helper_t)
 
 fs_dontaudit_getattr_xattr_fs(xscreensaver_helper_t)
Index: refpolicy-2.20260906/policy/modules/services/dbus.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/dbus.if
+++ refpolicy-2.20260906/policy/modules/services/dbus.if
@@ -126,6 +126,9 @@ template(`dbus_role_template',`
 
 	kernel_getattr_proc($1_dbusd_t)
 
+	# for /sys/module/apparmor/parameters/enabled
+	dev_read_sysfs($1_dbusd_t)
+
 	corecmd_bin_domtrans($1_dbusd_t, $3)
 	corecmd_shell_domtrans($1_dbusd_t, $3)
 
Index: refpolicy-2.20260906/policy/modules/apps/gnome.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/gnome.te
+++ refpolicy-2.20260906/policy/modules/apps/gnome.te
@@ -35,6 +35,7 @@ userdom_user_home_content(gnome_keyring_
 type gnome_keyring_tmp_t;
 userdom_user_tmp_file(gnome_keyring_tmp_t)
 userdom_user_runtime_content(gnome_keyring_tmp_t)
+systemd_user_activated_sock_file(gnome_keyring_tmp_t)
 
 type gnome_xdg_cache_t;
 xdg_cache_content(gnome_xdg_cache_t)
Index: refpolicy-2.20260906/policy/modules/apps/bubblewrap.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/bubblewrap.if
+++ refpolicy-2.20260906/policy/modules/apps/bubblewrap.if
@@ -48,7 +48,7 @@ template(`bubblewrap_role',`
 	allow $2 $1_bubblewrap_t:process signal_perms;
 	ps_process_pattern($1_bubblewrap_t, $2)
 
-	allow $1_bubblewrap_t self:process { sigkill setpgid getcap setcap };
+	allow $1_bubblewrap_t self:process { sigkill setpgid getcap setcap noatsecure };
 	allow $1_bubblewrap_t self:user_namespace create;
 	allow $1_bubblewrap_t self:cap_userns { dac_override sys_admin sys_ptrace setpcap net_admin };
 	allow $1_bubblewrap_t self:netlink_route_socket create_netlink_socket_perms;
@@ -61,10 +61,9 @@ template(`bubblewrap_role',`
 	kernel_read_kernel_sysctls($1_bubblewrap_t)
 	kernel_read_system_state($1_bubblewrap_t)
 
-	application_domain($1_bubblewrap_t, bubblewrap_exec_t)
-
 	dev_getattr_i2c($1_bubblewrap_t)
 	dev_read_rand($1_bubblewrap_t)
+	dev_read_urand($1_bubblewrap_t)
 	dev_remount_fs($1_bubblewrap_t)
 	dev_remount_sysfs($1_bubblewrap_t)
 
@@ -74,6 +73,7 @@ template(`bubblewrap_role',`
 	files_list_non_security($1_bubblewrap_t)
 	files_mounton_non_security($1_bubblewrap_t)
 	files_read_etc_files($1_bubblewrap_t)
+	files_read_usr_files($1_bubblewrap_t)
 	files_search_mnt($1_bubblewrap_t)
 
 	fs_getattr_nsfs_files($1_bubblewrap_t)
@@ -88,6 +88,8 @@ template(`bubblewrap_role',`
 	fs_unmount_tmpfs($1_bubblewrap_t)
 	fs_unmount_xattr_fs($1_bubblewrap_t)
 
+	logging_send_syslog_msg($1_bubblewrap_t)
+
 	miscfiles_read_localization($1_bubblewrap_t)
 
 	selinux_get_fs_mount($1_bubblewrap_t)
@@ -99,9 +101,12 @@ template(`bubblewrap_role',`
 	userdom_manage_tmpfs_role($1_r, $1_bubblewrap_t)
 	userdom_read_user_tmp_symlinks($1_bubblewrap_t)
 	userdom_read_user_home_content_symlinks($1_bubblewrap_t)
+	userdom_rw_user_tmp_files($1_bubblewrap_t)
 	userdom_manage_user_home_content_files($1_bubblewrap_t)
 	userdom_use_user_ptys($1_bubblewrap_t)
 	userdom_use_user_ttys($1_bubblewrap_t)
+	userdom_user_home_domtrans($1_bubblewrap_t, $2)
+	userdom_write_user_tmp_sockets($1_bubblewrap_t)
 
 	ifndef(`enable_mls',`
 		fs_search_removable($1_bubblewrap_t)
Index: refpolicy-2.20260906/policy/modules/kernel/corenetwork.te.in
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/corenetwork.te.in
+++ refpolicy-2.20260906/policy/modules/kernel/corenetwork.te.in
@@ -171,7 +171,7 @@ network_port(isakmp, udp,500,s0)
 network_port(iscsi, tcp,3260,s0)
 network_port(isns, tcp,3205,s0, udp,3205,s0)
 network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
-network_port(jabber_interserver, tcp,5269,s0)
+network_port(jabber_interserver, tcp,5269,s0, tcp,5270,s0)
 network_port(jboss_iiop, tcp,3528,s0, udp,3528,s0)
 network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)
 network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0)
Index: refpolicy-2.20260906/policy/modules/apps/chromium.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/chromium.te
+++ refpolicy-2.20260906/policy/modules/apps/chromium.te
@@ -110,9 +110,10 @@ allow chromium_t self:file create;
 allow chromium_t self:fifo_file rw_fifo_file_perms;
 allow chromium_t self:sem create_sem_perms;
 allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms;
+allow chromium_t self:netlink_route_socket nlmsg_write;
 allow chromium_t self:user_namespace create;
 # cap_userns sys_admin for the sandbox
-allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
+allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace setpcap };
 
 allow chromium_t chromium_exec_t:file execute_no_trans;
 
@@ -179,6 +180,7 @@ dev_read_sound(chromium_t)
 dev_write_sound(chromium_t)
 dev_read_urand(chromium_t)
 dev_read_rand(chromium_t)
+dev_read_sysfs(chromium_t)
 dev_rw_xserver_misc(chromium_t)
 dev_map_xserver_misc(chromium_t)
 
@@ -197,10 +199,12 @@ files_watch_runtime_dirs(chromium_t)
 # During find for /etc/whatever-release we get lots of output otherwise
 files_dontaudit_getattr_all_dirs(chromium_t)
 
-fs_dontaudit_getattr_xattr_fs(chromium_t)
+fs_getattr_xattr_fs(chromium_t)
 fs_getattr_tmpfs(chromium_t)
 fs_search_cgroup_dirs(chromium_t)
 
+logging_send_syslog_msg(chromium_t)
+
 miscfiles_read_all_certs(chromium_t)
 miscfiles_read_localization(chromium_t)
 
@@ -222,9 +226,14 @@ xdg_create_cache_dirs(chromium_t)
 xdg_create_config_dirs(chromium_t)
 xdg_create_data_dirs(chromium_t)
 xdg_manage_downloads(chromium_t)
+xdg_read_cache_files(chromium_t)
 xdg_read_config_files(chromium_t)
 xdg_read_data_files(chromium_t)
 
+# chrome wants to write to ~/.config/kwinrc and ~/.config/kcminputrc
+xdg_dontaudit_config_file_write(chromium_t)
+
+xserver_read_xkb_libs(chromium_t)
 xserver_user_x_domain_template(chromium, chromium_t, chromium_tmpfs_t)
 xserver_stream_connect_xdm(chromium_t)
 xserver_manage_mesa_shader_cache(chromium_t)
@@ -236,6 +245,7 @@ tunable_policy(`chromium_bind_tcp_unrese
 ')
 
 tunable_policy(`chromium_dri', `
+	dev_rw_dma_dev(chromium_t)
 	dev_rw_dri(chromium_t)
 ')
 
@@ -276,6 +286,7 @@ tunable_policy(`chromium_read_system_inf
 
 optional_policy(`
 	alsa_read_config(chromium_t)
+	alsa_read_lib(chromium_t)
 ')
 
 optional_policy(`
@@ -284,6 +295,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	colord_dbus_chat(chromium_t)
+')
+
+optional_policy(`
 	dbus_all_session_bus_client(chromium_t)
 	dbus_send_fifo_file_all_session_bus(chromium_t)
 	dbus_system_bus_client(chromium_t)
@@ -323,6 +338,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gnome_mmap_read_xdg_config_files(chromium_t)
+')
+
+optional_policy(`
 	networkmanager_dbus_chat(chromium_t)
 	networkmanager_watch_runtime_dirs(chromium_t)
 ')
Index: refpolicy-2.20260906/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20260906/policy/modules/system/systemd.te
@@ -52,6 +52,13 @@ gen_tunable(systemd_socket_proxyd_bind_a
 ## </desc>
 gen_tunable(systemd_socket_proxyd_connect_any, false)
 
+## <desc>
+## <p>
+## Allow systemd-nspawn to be run by sysadmin directly
+## </p>
+## </desc>
+gen_tunable(systemd_nspawn_direct_admin, false)
+
 attribute systemd_log_parse_env_type;
 attribute systemd_tmpfiles_conf_type;
 attribute systemd_user_session_type;
@@ -1638,6 +1645,7 @@ files_getattr_default_dirs(systemd_nspaw
 files_getattr_tmp_dirs(systemd_nspawn_t)
 files_manage_etc_files(systemd_nspawn_t)
 files_manage_mnt_dirs(systemd_nspawn_t)
+files_manage_mnt_files(systemd_nspawn_t)
 files_mounton_mnt(systemd_nspawn_t)
 files_mounton_root(systemd_nspawn_t)
 files_mounton_tmp(systemd_nspawn_t)
@@ -1694,6 +1702,11 @@ userdom_manage_user_home_dirs(systemd_ns
 
 systemd_write_notify_socket(systemd_nspawn_t)
 
+tunable_policy(`systemd_nspawn_direct_admin',`
+	domain_use_interactive_fds(systemd_nspawn_t)
+	userdom_use_user_ptys(systemd_nspawn_t)
+')
+
 tunable_policy(`systemd_nspawn_labeled_namespace',`
 	allow systemd_nspawn_t systemd_nspawn_runtime_t:fifo_file manage_fifo_file_perms;
 	files_tmp_filetrans(systemd_nspawn_t, systemd_nspawn_runtime_t, fifo_file)
@@ -1848,9 +1861,11 @@ miscfiles_read_localization(systemd_pass
 
 seutil_search_default_contexts(systemd_passwd_agent_t)
 
+userdom_list_user_tmp(systemd_passwd_agent_t)
 userdom_use_user_terminals(systemd_passwd_agent_t)
 userdom_search_user_runtime(systemd_passwd_agent_t)
 systemd_search_user_runtime(systemd_passwd_agent_t)
+userdom_watch_all_user_runtime_dirs(systemd_passwd_agent_t)
 
 optional_policy(`
 	getty_use_fds(systemd_passwd_agent_t)
Index: refpolicy-2.20260906/policy/modules/system/sysnetwork.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/sysnetwork.te
+++ refpolicy-2.20260906/policy/modules/system/sysnetwork.te
@@ -161,8 +161,12 @@ term_dontaudit_use_all_ptys(dhcpc_t)
 term_dontaudit_use_unallocated_ttys(dhcpc_t)
 term_dontaudit_use_generic_ptys(dhcpc_t)
 
+# for /run/systemd/resolve/netif
+init_create_runtime_dirs(dhcpc_t)
+
 init_rw_utmp(dhcpc_t)
 init_get_system_status(dhcpc_t)
+init_start_generic_units(dhcpc_t)
 
 logging_send_syslog_msg(dhcpc_t)
 
@@ -250,6 +254,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	ntp_domtrans(dhcpc_t)
 	ntp_initrc_domtrans(dhcpc_t)
 	ntp_read_drift_files(dhcpc_t)
 	ntp_read_conf_files(dhcpc_t)
Index: refpolicy-2.20260906/policy/modules/services/container.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/container.te
+++ refpolicy-2.20260906/policy/modules/services/container.te
@@ -387,7 +387,9 @@ kernel_list_all_proc(container_domain)
 kernel_associate_proc(container_domain)
 kernel_read_kernel_sysctls(container_domain)
 kernel_rw_net_sysctls(container_domain)
+kernel_read_rpc_sysctls(container_t)
 kernel_read_system_state(container_domain)
+kernel_read_vm_sysctls(container_t)
 kernel_dontaudit_search_kernel_sysctl(container_domain)
 
 corecmd_exec_all_executables(container_domain)
@@ -947,7 +949,7 @@ manage_dirs_pattern(container_engine_dom
 manage_files_pattern(container_engine_domain, container_engine_lock_t, container_engine_lock_t)
 files_lock_filetrans(container_engine_domain, container_engine_lock_t, { dir file })
 
-allow container_engine_domain container_file_t:dir { manage_dir_perms relabel_dir_perms };
+allow container_engine_domain container_file_t:dir { manage_dir_perms relabel_dir_perms map };
 allow container_engine_domain container_file_t:file { exec_file_perms manage_file_perms relabel_file_perms };
 allow container_engine_domain container_file_t:blk_file { manage_blk_file_perms relabel_blk_file_perms };
 allow container_engine_domain container_file_t:chr_file { manage_chr_file_perms relabel_chr_file_perms };
Index: refpolicy-2.20260906/policy/modules/services/container.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/container.fc
+++ refpolicy-2.20260906/policy/modules/services/container.fc
@@ -24,6 +24,7 @@ HOME_DIR/\.docker(/.*)?		gen_context(sys
 /usr/bin/crun	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 /usr/bin/runc	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 
+/usr/libexec/lxc/lxc-monitord		--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 /usr/lib/systemd/system/docker.*	--	gen_context(system_u:object_r:container_engine_unit_t,s0)
 /usr/lib/systemd/system/containerd.*	--	gen_context(system_u:object_r:container_engine_unit_t,s0)
 /usr/lib/systemd/system/container-.*	--	gen_context(system_u:object_r:container_unit_t,s0)
Index: refpolicy-2.20260906/policy/modules/kernel/devices.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/devices.if
+++ refpolicy-2.20260906/policy/modules/kernel/devices.if
@@ -2371,6 +2371,24 @@ interface(`dev_ioctl_input_dev',`
 
 ########################################
 ## <summary>
+##	dontaudit writing the input event devices (/dev/input).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_dontaudit_write_input_dev',`
+	gen_require(`
+		type event_device_t;
+	')
+
+	dontaudit $1 event_device_t:chr_file write;
+')
+
+########################################
+## <summary>
 ##	Read and write ipmi devices (/dev/ipmi*).
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260906/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/authlogin.te
+++ refpolicy-2.20260906/policy/modules/system/authlogin.te
@@ -129,6 +129,7 @@ kernel_dontaudit_search_kernel_sysctl(ch
 kernel_dontaudit_read_kernel_sysctl(chkpwd_t)
 kernel_dontaudit_getattr_proc(chkpwd_t)
 kernel_getattr_proc(chkpwd_t)
+kernel_read_kernel_sysctls(chkpwd_t)
 
 domain_dontaudit_use_interactive_fds(chkpwd_t)
 
Index: refpolicy-2.20260906/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260906/policy/modules/kernel/corecommands.fc
@@ -183,9 +183,11 @@ ifdef(`distro_gentoo',`
 /usr/lib/(.*/)?bin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/(.*/)?glib-2\.0(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/postfix/configure-instance\.sh -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/libreoffice/program(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 
 /usr/(.*/)?sbin(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/(.*/)?sbin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/.*linux-gnu/webkitgtk.*/WebKitWebProcess -- gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib/atril/atrild		--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/at-spi2-core(/.*)?		gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20260906/policy/modules/system/lvm.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/lvm.te
+++ refpolicy-2.20260906/policy/modules/system/lvm.te
@@ -284,6 +284,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	unconfined_rw_sem(lvm_t)
+')
+
+optional_policy(`
 	usermanage_read_crack_db(lvm_t)
 ')
 
Index: refpolicy-2.20260906/policy/modules/services/ssh.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/ssh.te
+++ refpolicy-2.20260906/policy/modules/services/ssh.te
@@ -33,6 +33,13 @@ gen_tunable(ssh_use_gpg_agent, false)
 ## </desc>
 gen_tunable(ssh_connect_any_port, false)
 
+## <desc>
+## <p>
+## Allow ssh to connect to X11 port
+## </p>
+## </desc>
+gen_tunable(ssh_connect_x11_port, false)
+
 attribute ssh_server;
 attribute ssh_agent_type;
 
@@ -168,6 +175,7 @@ logging_send_syslog_msg(ssh_t)
 logging_read_generic_logs(ssh_t)
 
 auth_use_nsswitch(ssh_t)
+auth_manage_login_records(sshd_t)
 
 miscfiles_read_generic_certs(ssh_t)
 miscfiles_read_localization(ssh_t)
@@ -188,6 +196,10 @@ tunable_policy(`ssh_connect_any_port',`
 	corenet_tcp_connect_all_ports(ssh_t)
 ')
 
+tunable_policy(`ssh_connect_x11_port',`
+	corenet_tcp_connect_xserver_port(ssh_t)
+')
+
 tunable_policy(`allow_ssh_keysign',`
 	domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
 ')
Index: refpolicy-2.20260906/policy/modules/kernel/devices.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/devices.fc
+++ refpolicy-2.20260906/policy/modules/kernel/devices.fc
@@ -64,6 +64,7 @@
 /dev/isst_interface	-c	gen_context(system_u:object_r:cpu_device_t,s0)
 /dev/jbm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/js.*		-c	gen_context(system_u:object_r:mouse_device_t,s0)
+/dev/kfd		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
 /dev/kmem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
 /dev/kmsg		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
 /dev/kqemu		-c	gen_context(system_u:object_r:qemu_device_t,s0)
Index: refpolicy-2.20260906/policy/modules/system/needrestart.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/needrestart.te
+++ refpolicy-2.20260906/policy/modules/system/needrestart.te
@@ -75,6 +75,7 @@ files_read_usr_files(needrestart_t)
 files_search_var_lib(needrestart_t)
 
 fs_getattr_cgroup(needrestart_t)
+fs_getattr_tmpfs_dirs(needrestart_t)
 fs_getattr_nsfs_files(needrestart_t)
 
 init_admin(needrestart_t)
Index: refpolicy-2.20260906/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/selinuxutil.te
+++ refpolicy-2.20260906/policy/modules/system/selinuxutil.te
@@ -537,6 +537,8 @@ allow semanage_t policy_config_t:file rw
 allow semanage_t policy_src_t:dir search;
 
 filetrans_pattern(semanage_t, selinux_config_t, semanage_store_t, dir, "modules")
+allow semanage_t semanage_store_t:dir relabelfrom;
+allow semanage_t semanage_store_t:file { relabelfrom relabelto };
 
 allow semanage_t semanage_tmp_t:dir manage_dir_perms;
 allow semanage_t semanage_tmp_t:file { manage_file_perms mmap_exec_file_perms };
@@ -551,6 +553,7 @@ corecmd_exec_bin(semanage_t)
 corecmd_exec_shell(semanage_t)
 
 dev_read_urand(semanage_t)
+dev_getattr_fs(semanage_t)
 
 domain_use_interactive_fds(semanage_t)
 
@@ -570,6 +573,7 @@ selinux_read_policy(semanage_t)
 # for setsebool:
 selinux_set_all_booleans(semanage_t)
 
+term_getattr_pty_fs(semanage_t)
 term_use_all_terms(semanage_t)
 
 # Running genhomedircon requires this for finding all users
Index: refpolicy-2.20260906/policy/modules/apps/gnome.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/gnome.if
+++ refpolicy-2.20260906/policy/modules/apps/gnome.if
@@ -50,6 +50,7 @@ template(`gnome_role_template',`
 	type $1_gkeyringd_t, gnomedomain, gkeyringd_domain;
 	userdom_user_application_domain($1_gkeyringd_t, gkeyringd_exec_t)
 	domain_user_exemption_target($1_gkeyringd_t)
+	allow $1_gkeyringd_t self:process setsched;
 
 	role $4 types $1_gkeyringd_t;
 
Index: refpolicy-2.20260906/policy/modules/system/selinuxutil.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/selinuxutil.if
+++ refpolicy-2.20260906/policy/modules/system/selinuxutil.if
@@ -89,6 +89,27 @@ interface(`seutil_exec_checkpolicy',`
 	can_exec($1, checkpolicy_exec_t)
 ')
 
+########################################
+## <summary>
+##	Execute restorecond in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`seutil_exec_restorecond',`
+	gen_require(`
+		type restorecond_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	can_exec($1, restorecond_exec_t)
+')
+
 #######################################
 ## <summary>
 ##	Execute load_policy in the load_policy domain.
Index: refpolicy-2.20260906/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20260906/policy/modules/system/systemd.if
@@ -178,6 +178,7 @@ template(`systemd_role_template',`
 	mount_watch_runtime_files($1_systemd_t)
 	mount_watch_reads_runtime_files($1_systemd_t)
 
+	seutil_exec_restorecond($1_systemd_t)
 	seutil_search_default_contexts($1_systemd_t)
 	seutil_read_file_contexts($1_systemd_t)
 
@@ -297,10 +298,15 @@ template(`systemd_role_template',`
 	')
 
 	optional_policy(`
+		dirmngr_create_tmp_named_sockets($1_systemd_t)
+		dirmngr_delete_tmp_named_sockets($1_systemd_t)
+		dirmngr_stream_connect($1_systemd_t)
 		dirmngr_tmp_dir_search($1_systemd_t)
 	')
 
 	optional_policy(`
+		gpg_create_agent_named_sockets($1_systemd_t)
+		gpg_delete_agent_named_sockets($1_systemd_t)
 		gpg_stream_connect_agent($1_systemd_t)
 	')
 
@@ -310,6 +316,7 @@ template(`systemd_role_template',`
 
 	optional_policy(`
 		obex_role_template($1, $1_r, $1_systemd_t)
+		obex_domtrans($1_systemd_t)
 	')
 
 	optional_policy(`
@@ -344,6 +351,7 @@ template(`systemd_role_template',`
 		xserver_watch_xdm_lib_dirs($1_systemd_t)
 		xserver_read_xdm_state($1_systemd_t)
 		xserver_use_user_fonts($1_systemd_t)
+		xserver_write_inherited_xsession_log($1_systemd_t)
 	')
 ')
 
Index: refpolicy-2.20260906/policy/modules/services/obex.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/obex.te
+++ refpolicy-2.20260906/policy/modules/services/obex.te
@@ -19,16 +19,26 @@ role obex_roles types obex_t;
 
 allow obex_t self:fifo_file rw_fifo_file_perms;
 allow obex_t self:socket create_stream_socket_perms;
+allow obex_t self:process signal;
+
+kernel_read_system_state(obex_t)
 
 dev_read_urand(obex_t)
 
+corecmd_search_bin(obex_t)
+
 files_read_etc_files(obex_t)
+files_read_usr_files(obex_t)
+files_map_usr_files(obex_t)
 
 logging_send_syslog_msg(obex_t)
 
 miscfiles_read_localization(obex_t)
 
 userdom_search_user_home_content(obex_t)
+userdom_search_user_runtime(obex_t)
+userdom_rw_user_tmp_files(obex_t)
+userdom_map_user_tmp_files(obex_t)
 
 optional_policy(`
 	bluetooth_use(obex_t)
@@ -36,8 +46,20 @@ optional_policy(`
 
 optional_policy(`
 	dbus_system_bus_client(obex_t)
+	dbus_write_session_runtime_socket(obex_t)
+	dbus_getattr_session_runtime_socket(obex_t)
 
 	optional_policy(`
 		bluetooth_dbus_chat(obex_t)
 	')
 ')
+
+optional_policy(`
+	gnome_mmap_read_xdg_config_files(obex_t)
+')
+
+optional_policy(`
+	xdg_search_cache_dirs(obex_t)
+	xdg_search_config_dirs(obex_t)
+	xdg_search_data_dirs(obex_t)
+')
Index: refpolicy-2.20260906/policy/modules/admin/logrotate.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/admin/logrotate.te
+++ refpolicy-2.20260906/policy/modules/admin/logrotate.te
@@ -65,6 +65,7 @@ files_var_lib_filetrans(logrotate_t, log
 
 can_exec(logrotate_t, { logrotate_exec_t logrotate_tmp_t })
 
+kernel_getattr_proc(logrotate_t)
 kernel_read_system_state(logrotate_t)
 kernel_read_kernel_sysctls(logrotate_t)
 
Index: refpolicy-2.20260906/policy/modules/apps/wireshark.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/wireshark.te
+++ refpolicy-2.20260906/policy/modules/apps/wireshark.te
@@ -56,6 +56,7 @@ fs_tmpfs_filetrans(wireshark_t, wireshar
 can_exec(wireshark_t, wireshark_exec_t)
 
 kernel_read_crypto_sysctls(wireshark_t)
+kernel_read_device_sysctls(wireshark_t)
 kernel_read_kernel_sysctls(wireshark_t)
 kernel_read_network_state(wireshark_t)
 kernel_read_system_state(wireshark_t)
@@ -111,6 +112,10 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`
+	dbus_write_session_runtime_socket(wireshark_t)
+')
+
+optional_policy(`
 	seutil_use_newrole_fds(wireshark_t)
 ')
 
@@ -128,6 +133,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	xserver_read_xkb_libs(wireshark_t)
 	xserver_user_x_domain_template(wireshark, wireshark_t, wireshark_tmpfs_t)
 	xserver_create_xdm_tmp_sockets(wireshark_t)
 	xserver_rw_mesa_shader_cache(wireshark_t)
Index: refpolicy-2.20260906/policy/modules/system/opensnitch.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/opensnitch.te
+++ refpolicy-2.20260906/policy/modules/system/opensnitch.te
@@ -39,7 +39,8 @@ allow opensnitchd_t self:process { getsc
 allow opensnitchd_t self:perf_event { open kernel tracepoint cpu read write };
 allow opensnitchd_t self:netlink_tcpdiag_socket { create getattr bind setopt write read nlmsg_read };
 
-allow opensnitchd_t opensnitchd_log_t:file { open append };
+logging_log_filetrans(opensnitchd_t, opensnitchd_log_t, file)
+allow opensnitchd_t opensnitchd_log_t:file manage_file_perms;
 
 kernel_getattr_core_if(opensnitchd_t)
 kernel_getattr_message_if(opensnitchd_t)
@@ -68,6 +69,7 @@ domain_read_all_domains_state(opensnitch
 
 files_read_etc_symlinks(opensnitchd_t)
 files_read_kernel_symbol_table(opensnitchd_t)
+files_getattr_usr_files(opensnitchd_t)
 
 fs_rw_tracefs_files(opensnitchd_t)
 fs_search_tracefs(opensnitchd_t)
Index: refpolicy-2.20260906/policy/modules/services/ssh.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/ssh.if
+++ refpolicy-2.20260906/policy/modules/services/ssh.if
@@ -220,6 +220,7 @@ template(`ssh_server_template', `
 	# Access key files
 	allow $1_t sshd_key_t:file read_file_perms;
 
+	kernel_getattr_proc($1_t)
 	kernel_read_kernel_sysctls($1_t)
 	kernel_read_network_state($1_t)
 
@@ -369,6 +370,8 @@ template(`ssh_role_template',`
 	userdom_search_user_home_dirs($1_t)
 
 	read_files_pattern($1_ssh_agent_t, ssh_home_t, ssh_home_t)
+	manage_sock_files_pattern($1_ssh_agent_t, ssh_home_t, ssh_home_t)
+	allow $1_ssh_agent_t ssh_home_t:dir list_dir_perms;
 
 	optional_policy(`
 		systemd_user_app_status($1, ssh_t)
Index: refpolicy-2.20260906/policy/modules/services/dirmngr.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/dirmngr.if
+++ refpolicy-2.20260906/policy/modules/services/dirmngr.if
@@ -52,6 +52,24 @@ template(`dirmngr_role',`
 
 ############################################################
 ## <summary>
+##	create dirmngr_tmp_t sock_file
+## </summary>
+## <param name="domain">
+##	<summary>
+##	domain allowed access
+##	</summary>
+## </param>
+#
+interface(`dirmngr_create_tmp_named_sockets',`
+	gen_require(`
+		type dirmngr_tmp_t;
+	')
+
+	create_sock_files_pattern($1, dirmngr_tmp_t, dirmngr_tmp_t)
+')
+
+############################################################
+## <summary>
 ##	unlink dirmngr_tmp_t sock_file
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260906/policy/modules/apps/gpg.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/gpg.if
+++ refpolicy-2.20260906/policy/modules/apps/gpg.if
@@ -348,6 +348,24 @@ interface(`gpg_agent_tmp_filetrans',`
 
 ########################################
 ## <summary>
+##	create gpg_agent_tmp_t sock_file
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gpg_create_agent_named_sockets',`
+	gen_require(`
+		type gpg_agent_tmp_t;
+	')
+
+	create_sock_files_pattern($1, gpg_agent_tmp_t, gpg_agent_tmp_t)
+')
+
+########################################
+## <summary>
 ##	unlink gpg_agent_tmp_t sock_file
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260906/policy/modules/system/fstools.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/fstools.fc
+++ refpolicy-2.20260906/policy/modules/system/fstools.fc
@@ -62,6 +62,7 @@ ifdef(`distro_gentoo',`
 /var/swap			--	gen_context(system_u:object_r:swapfile_t,s0)
 
 /var/log/fsck(/.*)?		gen_context(system_u:object_r:fsadm_log_t,s0)
+/var/lib/btrfs(/.*)?		gen_context(system_u:object_r:fsadm_var_lib_t,s0)
 
 /run/blkid(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)
 /run/fsck(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)
Index: refpolicy-2.20260906/policy/modules/services/powerprofiles.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/powerprofiles.te
+++ refpolicy-2.20260906/policy/modules/services/powerprofiles.te
@@ -26,6 +26,7 @@ kernel_read_system_state(power_profilesd
 dev_create_sysfs_files(power_profilesd_t)
 dev_read_sysfs(power_profilesd_t)
 dev_write_sysfs(power_profilesd_t)
+dev_watch_sysfs_dirs(power_profilesd_t)
 
 files_read_etc_files(power_profilesd_t)
 files_search_var_lib(power_profilesd_t)
Index: refpolicy-2.20260906/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20260906/policy/modules/services/xserver.if
@@ -138,6 +138,7 @@ template(`xserver_restricted_role',`
 
 	tunable_policy(`xserver_allow_dri',`
 		dev_rw_dri($2)
+		dev_rw_dma_dev($2)
 	')
 
 	optional_policy(`
@@ -145,6 +146,10 @@ template(`xserver_restricted_role',`
 		systemd_user_app_status($1, xauth_t)
 		systemd_user_app_status($1, xserver_t)
 	')
+
+	optional_policy(`
+		xfs_stream_connect($2)
+	')
 ')
 
 ########################################
Index: refpolicy-2.20260906/policy/modules/apps/mozilla.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/mozilla.te
+++ refpolicy-2.20260906/policy/modules/apps/mozilla.te
@@ -75,13 +75,15 @@ xdg_cache_content(mozilla_xdg_cache_t)
 
 allow mozilla_t self:capability { setgid setuid sys_nice };
 allow mozilla_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
-allow mozilla_t self:process { getsched setcap setrlimit setsched sigkill signal };
+allow mozilla_t self:process { getsched setcap getcap ptrace setrlimit setsched sigkill signal };
 allow mozilla_t self:user_namespace create;
 allow mozilla_t self:fifo_file rw_fifo_file_perms;
 allow mozilla_t self:shm create_shm_perms;
 allow mozilla_t self:sem create_sem_perms;
 allow mozilla_t self:socket create_socket_perms;
 allow mozilla_t self:unix_stream_socket { accept listen };
+allow mozilla_t self:netlink_route_socket nlmsg_write;
+allow mozilla_t self:netlink_kobject_uevent_socket { create getattr getopt setopt };
 
 allow mozilla_t mozilla_plugin_t:unix_stream_socket rw_socket_perms;
 allow mozilla_t mozilla_plugin_t:fd use;
@@ -106,6 +108,7 @@ manage_files_pattern(mozilla_t, mozilla_
 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
+userdom_user_runtime_filetrans(mozilla_t, mozilla_tmpfs_t, sock_file)
 fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
 allow mozilla_t mozilla_plugin_tmpfs_t:file map;
 
@@ -174,11 +177,13 @@ files_map_usr_files(mozilla_t)
 files_read_usr_files(mozilla_t)
 files_watch_usr_dirs(mozilla_t)
 files_read_var_files(mozilla_t)
+files_map_var_lib_files(mozilla_t)
 files_read_var_lib_files(mozilla_t)
 files_read_var_symlinks(mozilla_t)
 files_dontaudit_getattr_boot_dirs(mozilla_t)
 
 fs_getattr_all_fs(mozilla_t)
+fs_getattr_nsfs_files(mozilla_t)
 fs_search_auto_mountpoints(mozilla_t)
 fs_list_inotifyfs(mozilla_t)
 fs_rw_tmpfs_files(mozilla_t)
@@ -187,6 +192,8 @@ term_dontaudit_getattr_pty_dirs(mozilla_
 
 auth_use_nsswitch(mozilla_t)
 
+libs_exec_lib_files(mozilla_t)
+
 logging_send_syslog_msg(mozilla_t)
 
 miscfiles_read_fonts(mozilla_t)
@@ -212,7 +219,12 @@ mozilla_run_plugin_config(mozilla_t, moz
 xdg_read_config_files(mozilla_t)
 xdg_read_data_files(mozilla_t)
 xdg_manage_downloads(mozilla_t)
+xdg_watch_cache_dirs(mozilla_t)
+xdg_watch_config_dirs(mozilla_t)
+xdg_watch_data_dirs(mozilla_t)
 
+xserver_manage_mesa_shader_cache(mozilla_t)
+xserver_read_xkb_libs(mozilla_t)
 xserver_rw_mesa_shader_cache(mozilla_t)
 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
@@ -269,6 +281,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	chromium_domtrans(mozilla_t)
+')
+
+optional_policy(`
 	dbus_all_session_bus_client(mozilla_t)
 	dbus_connect_all_session_bus(mozilla_t)
 	dbus_write_session_runtime_socket(mozilla_t)
@@ -291,6 +307,10 @@ optional_policy(`
 	')
 
 	optional_policy(`
+		rtkit_daemon_dbus_chat(mozilla_t)
+	')
+
+	optional_policy(`
 		systemd_dbus_chat_logind(mozilla_t)
 	')
 ')
@@ -308,6 +328,8 @@ optional_policy(`
 	gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome")
 	gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome2")
 	gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome2_private")
+	gnome_mmap_read_xdg_config_files(mozilla_t)
+	gnome_watch_xdg_config_dirs(mozilla_t)
 ')
 
 optional_policy(`
@@ -341,6 +363,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	rtkit_scheduled(mozilla_t)
+')
+
+optional_policy(`
 	thunderbird_domtrans(mozilla_t)
 ')
 
Index: refpolicy-2.20260906/policy/modules/apps/qemu.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/qemu.if
+++ refpolicy-2.20260906/policy/modules/apps/qemu.if
@@ -187,6 +187,25 @@ interface(`qemu_run',`
 
 ########################################
 ## <summary>
+##	Allow a domain to be in the qemu role
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed in the role
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`qemu_domain',`
+	gen_require(`
+		attribute_role qemu_roles;
+	')
+
+	role qemu_roles types $1;
+')
+
+########################################
+## <summary>
 ##	Read qemu process state files.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260906/policy/modules/apps/qemu.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/qemu.te
+++ refpolicy-2.20260906/policy/modules/apps/qemu.te
@@ -43,9 +43,15 @@ init_unit_file(qemu_unit_t)
 
 dev_read_sysfs(qemu_t)
 
+allow qemu_t self:anon_inode { create map read write };
+allow qemu_t self:io_uring allowed;
 allow qemu_t qemu_runtime_t:sock_file create_sock_file_perms;
 files_runtime_filetrans(qemu_t, qemu_runtime_t, sock_file)
 
+kernel_read_vm_sysctls(qemu_t)
+
+files_mmap_read_boot_files(qemu_t)
+
 tunable_policy(`qemu_full_network',`
 	corenet_udp_sendrecv_generic_if(qemu_t)
 	corenet_udp_sendrecv_generic_node(qemu_t)
Index: refpolicy-2.20260906/policy/modules/services/virt.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/virt.if
+++ refpolicy-2.20260906/policy/modules/services/virt.if
@@ -163,6 +163,8 @@ interface(`virt_domtrans_bridgehelper',`
 
 	corecmd_search_bin($1)
 	domtrans_pattern($1, virt_bridgehelper_exec_t, virt_bridgehelper_t)
+	allow $1 virt_bridgehelper_t:fd use;
+	allow virt_bridgehelper_t $1:unix_stream_socket { read write };
 ')
 
 ########################################
Index: refpolicy-2.20260906/policy/modules/services/virt.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/virt.te
+++ refpolicy-2.20260906/policy/modules/services/virt.te
@@ -1125,7 +1125,7 @@ optional_policy(`
 # Bridgehelper local policy
 #
 
-allow virt_bridgehelper_t self:process { getcap setcap };
+allow virt_bridgehelper_t self:process { getcap setcap getsched };
 allow virt_bridgehelper_t self:capability { net_admin setgid setpcap setuid };
 allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
 allow virt_bridgehelper_t self:tun_socket create_socket_perms;
@@ -1136,13 +1136,24 @@ allow virt_bridgehelper_t virt_etc_t:fil
 
 manage_files_pattern(virt_bridgehelper_t, svirt_home_t, svirt_home_t)
 
+kernel_getattr_proc(virt_bridgehelper_t)
+kernel_read_kernel_sysctls(virt_bridgehelper_t)
 kernel_read_network_state(virt_bridgehelper_t)
+kernel_read_system_state(virt_bridgehelper_t)
+
+dev_read_sysfs(virt_bridgehelper_t)
 
 corenet_rw_tun_tap_dev(virt_bridgehelper_t)
 
+domain_use_interactive_fds(virt_bridgehelper_t)
+
 userdom_search_user_home_dirs(virt_bridgehelper_t)
 userdom_use_user_ptys(virt_bridgehelper_t)
 
+optional_policy(`
+	qemu_domain(virt_bridgehelper_t)
+')
+
 ########################################
 #
 # Leaseshelper local policy
Index: refpolicy-2.20260906/policy/modules/apps/mplayer.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/mplayer.fc
+++ refpolicy-2.20260906/policy/modules/apps/mplayer.fc
@@ -1,3 +1,4 @@
+HOME_DIR/\.cache/mpv(/.*)?			gen_context(system_u:object_r:mplayer_xdg_cache_t,s0)
 HOME_DIR/\.cache/vlc(/.*)?			gen_context(system_u:object_r:mplayer_xdg_cache_t,s0)
 HOME_DIR/\.config/vlc(/.*)?			gen_context(system_u:object_r:mplayer_xdg_config_t,s0)
 HOME_DIR/\.local/share/vlc(/.*)?		gen_context(system_u:object_r:mplayer_xdg_data_t,s0)
@@ -6,7 +7,8 @@ HOME_DIR/\.mplayer(/.*)?	gen_context(sys
 
 /etc/mplayer(/.*)?	gen_context(system_u:object_r:mplayer_etc_t,s0)
 
-/usr/bin/mplayer	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
 /usr/bin/mencoder	--	gen_context(system_u:object_r:mencoder_exec_t,s0)
+/usr/bin/mplayer	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
+/usr/bin/mpv	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
 /usr/bin/vlc	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
 /usr/bin/xine	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
Index: refpolicy-2.20260906/policy/modules/apps/mplayer.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/mplayer.te
+++ refpolicy-2.20260906/policy/modules/apps/mplayer.te
@@ -129,6 +129,7 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 tunable_policy(`xserver_allow_dri',`
+	dev_rw_dma_dev(mplayer_t)
 	dev_rw_dri(mplayer_t)
 ')
 
@@ -137,7 +138,7 @@ tunable_policy(`xserver_allow_dri',`
 # Mplayer local policy
 #
 
-allow mplayer_t self:process { getsched setsched signal_perms };
+allow mplayer_t self:process { getsched setsched signal_perms setrlimit };
 allow mplayer_t self:fifo_file rw_fifo_file_perms;
 allow mplayer_t self:sem create_sem_perms;
 allow mplayer_t self:udp_socket create_socket_perms;
@@ -155,11 +156,13 @@ manage_files_pattern(mplayer_t, mplayer_
 manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 manage_fifo_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 manage_sock_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
+allow mplayer_t mplayer_tmpfs_t:dir manage_dir_perms;
 fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
 
 manage_dirs_pattern(mplayer_t, mplayer_xdg_cache_t, mplayer_xdg_cache_t)
 manage_files_pattern(mplayer_t, mplayer_xdg_cache_t, mplayer_xdg_cache_t)
 xdg_cache_filetrans(mplayer_t, mplayer_xdg_cache_t, dir, "vlc")
+xdg_cache_filetrans(mplayer_t, mplayer_xdg_cache_t, dir, "mpv")
 
 manage_dirs_pattern(mplayer_t, mplayer_xdg_config_t, mplayer_xdg_config_t)
 manage_files_pattern(mplayer_t, mplayer_xdg_config_t, mplayer_xdg_config_t)
@@ -233,7 +236,7 @@ xdg_read_music(mplayer_t)
 xdg_read_videos(mplayer_t)
 
 xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
-xserver_rw_mesa_shader_cache(mplayer_t)
+xserver_manage_mesa_shader_cache(mplayer_t)
 
 ifndef(`enable_mls',`
 	fs_list_dos(mplayer_t)
@@ -278,9 +281,13 @@ optional_policy(`
 	alsa_read_config(mplayer_t)
 ')
 
-# needed by vlc
+# needed by vlc and mplayer
 optional_policy(`
+	dbus_getattr_session_runtime_socket(mplayer_t)
+	dbus_write_session_runtime_socket(mplayer_t)
+	dbus_connect_all_session_bus(mplayer_t)
 	dbus_all_session_bus_client(mplayer_t)
+	dbus_system_bus_client(mplayer_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260906/policy/modules/services/iiosensorproxy.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/iiosensorproxy.if
+++ refpolicy-2.20260906/policy/modules/services/iiosensorproxy.if
@@ -19,3 +19,24 @@
 ##  * PLLs (Phase Locked Loops)
 ##  * Variable/Programmable Gain Amplifiers (VGA, PGA)
 ## </desc>
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      iiosensorproxy over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`iiosensorproxy_dbus_chat',`
+	gen_require(`
+		type iiosensorproxy_t;
+		class dbus send_msg;
+	')
+
+	allow $1 iiosensorproxy_t:dbus send_msg;
+	allow iiosensorproxy_t $1:dbus send_msg;
+')
Index: refpolicy-2.20260906/policy/modules/services/iiosensorproxy.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/iiosensorproxy.te
+++ refpolicy-2.20260906/policy/modules/services/iiosensorproxy.te
@@ -42,6 +42,8 @@ allow iiosensorproxy_t self:netlink_kobj
 allow iiosensorproxy_t self:process { getsched setsched };
 allow iiosensorproxy_t self:unix_dgram_socket { create write };
 
+dev_create_sysfs_files(iiosensorproxy_t)
+dev_manage_sysfs_dirs(iiosensorproxy_t)
 kernel_read_system_state(iiosensorproxy_t)
 
 dev_read_iio(iiosensorproxy_t)
Index: refpolicy-2.20260906/policy/modules/apps/games.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/games.te
+++ refpolicy-2.20260906/policy/modules/apps/games.te
@@ -89,7 +89,7 @@ optional_policy(`
 # Client local policy
 #
 
-allow games_t self:process getsched;
+allow games_t self:process { setrlimit getsched };
 allow games_t self:fifo_file rw_fifo_file_perms;
 allow games_t self:sem create_sem_perms;
 allow games_t self:tcp_socket { accept listen };
@@ -116,6 +116,7 @@ can_exec(games_t, games_exec_t)
 
 kernel_read_kernel_sysctls(games_t)
 kernel_read_system_state(games_t)
+kernel_read_device_sysctls(games_t)
 
 corecmd_exec_bin(games_t)
 corecmd_exec_shell(games_t)
@@ -137,6 +138,7 @@ dev_read_mouse(games_t)
 dev_read_urand(games_t)
 dev_rw_dri(games_t)
 dev_write_sound(games_t)
+dev_watch_dev_dirs(games_t)
 
 files_list_var(games_t)
 files_search_mnt(games_t)
@@ -181,6 +183,7 @@ optional_policy(`
 	dbus_connect_all_session_bus(games_t)
 	dbus_read_lib_files(games_t)
 	dbus_system_bus_client(games_t)
+	dbus_write_session_runtime_socket(games_t)
 ')
 
 optional_policy(`
@@ -196,6 +199,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	rtkit_daemon_dbus_chat(games_t)
+')
+
+optional_policy(`
 	xdg_read_config_files(games_t)
 	xdg_read_data_files(games_t)
 ')
Index: refpolicy-2.20260906/policy/modules/system/libraries.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/system/libraries.fc
+++ refpolicy-2.20260906/policy/modules/system/libraries.fc
@@ -133,6 +133,7 @@ ifdef(`distro_debian',`
 /usr/lib/catalyst/libGL\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/libADM5.*\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/libatiadlxx\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/libreoffice/program/[^/]+\.so	--	gen_context(system_u:object_r:lib_t,s0)
 /usr/lib/win32/.*\.so(\.[^/]*)*		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 
 /usr/lib/ADM_plugins/videoFilter/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
Index: refpolicy-2.20260906/policy/modules/services/dirmngr.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/dirmngr.te
+++ refpolicy-2.20260906/policy/modules/services/dirmngr.te
@@ -43,7 +43,7 @@ allow dirmngr_t dirmngr_conf_t:dir list_
 allow dirmngr_t dirmngr_conf_t:file read_file_perms;
 allow dirmngr_t dirmngr_conf_t:lnk_file read_lnk_file_perms;
 
-manage_files_pattern(dirmngr_t, dirmngr_home_t, dirmngr_home_t)
+mmap_manage_files_pattern(dirmngr_t, dirmngr_home_t, dirmngr_home_t)
 allow dirmngr_t dirmngr_home_t:dir { add_entry_dir_perms create_dir_perms list_dir_perms };
 
 manage_dirs_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
@@ -69,6 +69,8 @@ dev_read_urand(dirmngr_t)
 
 sysnet_dns_name_resolve(dirmngr_t)
 
+corecmd_search_bin(dirmngr_t)
+
 corenet_tcp_connect_http_port(dirmngr_t)
 corenet_tcp_connect_pgpkeyserver_port(dirmngr_t)
 corenet_tcp_connect_tor_port(dirmngr_t)
@@ -82,6 +84,7 @@ miscfiles_read_generic_certs(dirmngr_t)
 
 userdom_search_user_home_dirs(dirmngr_t)
 userdom_search_user_runtime(dirmngr_t)
+userdom_use_user_ptys(dirmngr_t)
 userdom_user_runtime_filetrans(dirmngr_t, dirmngr_tmp_t, dir)
 allow dirmngr_t dirmngr_tmp_t:dir manage_dir_perms;
 
Index: refpolicy-2.20260906/policy/modules/apps/chromium.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/chromium.if
+++ refpolicy-2.20260906/policy/modules/apps/chromium.if
@@ -48,12 +48,10 @@ template(`chromium_role',`
 	allow $3 chromium_sandbox_t:process signal_perms;
 	allow $3 chromium_naclhelper_t:process signal_perms;
 	allow chromium_t $3:process { signal signull };
-	allow chromium_t $3:unix_stream_socket { read write };
+	allow chromium_t $3:unix_stream_socket { connectto getopt read write };
 
 	allow $2 chromium_t:fifo_file write;
 
-	allow $3 chromium_t:unix_stream_socket connectto;
-
 	# for /tmp/.ICE-unix/* sockets
 	allow chromium_t $3:unix_stream_socket connectto;
 
Index: refpolicy-2.20260906/policy/modules/services/mon.te
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/mon.te
+++ refpolicy-2.20260906/policy/modules/services/mon.te
@@ -194,6 +194,7 @@ allow mon_local_test_t self:capability {
 allow mon_local_test_t self:fifo_file rw_fifo_file_perms;
 allow mon_local_test_t self:process { getsched sigkill signal sigstop };
 allow mon_local_test_t self:cap_userns sys_ptrace;
+allow mon_local_test_t self:netlink_generic_socket { create bind setopt getattr read write };
 
 tunable_policy(`mon_local_sys_admin', `
 	allow mon_local_test_t self:capability sys_admin;
@@ -201,6 +202,9 @@ tunable_policy(`mon_local_sys_admin', `
 
 can_exec(mon_local_test_t, mon_local_test_exec_t)
 
+allow mon_local_test_t mon_runtime_t:dir list_dir_perms;
+allow mon_local_test_t mon_runtime_t:file read_file_perms;
+
 manage_files_pattern(mon_local_test_t, mon_var_lib_t, mon_var_lib_t)
 
 kernel_dontaudit_getattr_core_if(mon_local_test_t)
@@ -255,6 +259,9 @@ application_exec_all(mon_local_test_t)
 auth_use_nsswitch(mon_local_test_t)
 
 fsdaemon_read_lib(mon_local_test_t)
+
+init_dontaudit_getattr_runtime_chr_file(mon_local_test_t)
+init_dontaudit_getattr_runtime_file(mon_local_test_t)
 init_getattr_initctl(mon_local_test_t)
 
 logging_send_syslog_msg(mon_local_test_t)
Index: refpolicy-2.20260906/policy/modules/apps/docportal.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/docportal.if
+++ refpolicy-2.20260906/policy/modules/apps/docportal.if
@@ -45,7 +45,10 @@ template(`docportal_role',`
 
 	allow $1_docportal_t self:process signal;
 	allow $1_docportal_t self:fifo_file rw_fifo_file_perms;
-	allow $1_docportal_t $3:unix_stream_socket { read write };
+	allow $1_docportal_t $3:unix_stream_socket { read write ioctl };
+
+	userdom_manage_user_runtime_dirs($1_docportal_t)
+	userdom_mounton_user_runtime_dirs($1_docportal_t)
 
 	optional_policy(`
 		gen_require(`
Index: refpolicy-2.20260906/policy/modules/services/plymouthd.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/plymouthd.fc
+++ refpolicy-2.20260906/policy/modules/services/plymouthd.fc
@@ -7,7 +7,7 @@
 
 /var/lib/plymouth(/.*)?	gen_context(system_u:object_r:plymouthd_var_lib_t,s0)
 
-/var/log/boot\.log.*	--	gen_context(system_u:object_r:plymouthd_var_log_t,mls_systemhigh)
+/var/log/boot\.log(.*)?	--	gen_context(system_u:object_r:plymouthd_var_log_t,mls_systemhigh)
 
 /run/plymouth(/.*)?	gen_context(system_u:object_r:plymouthd_runtime_t,s0)
 
Index: refpolicy-2.20260906/policy/modules/kernel/filesystem.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/kernel/filesystem.if
+++ refpolicy-2.20260906/policy/modules/kernel/filesystem.if
@@ -1832,6 +1832,24 @@ interface(`fs_manage_noxattr_fs_dirs',`
 
 ########################################
 ## <summary>
+##	watch all noxattrfs directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_watch_noxattr_fs_dirs',`
+	gen_require(`
+		attribute noxattrfs;
+	')
+
+	allow $1 noxattrfs:dir watch;
+')
+
+########################################
+## <summary>
 ##	Read all noxattrfs files.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260906/policy/modules/services/devicekit.if
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/devicekit.if
+++ refpolicy-2.20260906/policy/modules/services/devicekit.if
@@ -41,6 +41,24 @@ interface(`devicekit_dgram_send',`
 
 ########################################
 ## <summary>
+##	List devicekit runtime dirs
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`devicekit_list_runtime',`
+	gen_require(`
+		type devicekit_runtime_t;
+	')
+
+	allow $1 devicekit_runtime_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
 ##	Send and receive messages from
 ##	devicekit over dbus.
 ## </summary>
Index: refpolicy-2.20260906/policy/modules/services/gnomeclock.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/gnomeclock.fc
+++ refpolicy-2.20260906/policy/modules/services/gnomeclock.fc
@@ -2,6 +2,4 @@
 
 /usr/libexec/gsd-datetime-mechanism	--	gen_context(system_u:object_r:gnomeclock_exec_t,s0)
 
-/usr/libexec/kde(3|4)/kcmdatetimehelper	--	gen_context(system_u:object_r:gnomeclock_exec_t,s0)
-
 /usr/lib/gnome-settings-daemon/gsd-datetime-mechanism	--	gen_context(system_u:object_r:gnomeclock_exec_t,s0)
Index: refpolicy-2.20260906/policy/modules/services/comsat.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/comsat.fc
+++ refpolicy-2.20260906/policy/modules/services/comsat.fc
@@ -1,2 +1,2 @@
-/usr/bin/in\.comsat	--	gen_context(system_u:object_r:comsat_exec_t,s0)
+/usr/bin/comsatd	--	gen_context(system_u:object_r:comsat_exec_t,s0)
 
Index: refpolicy-2.20260906/policy/modules/apps/gnome.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/apps/gnome.fc
+++ refpolicy-2.20260906/policy/modules/apps/gnome.fc
@@ -17,7 +17,6 @@ HOME_DIR/orcexec\..*	gen_context(system_
 /tmp/gconfd-%{USERNAME}/.*	--	gen_context(system_u:object_r:gconf_tmp_t,s0)
 
 /usr/bin/gnome-keyring-daemon	--	gen_context(system_u:object_r:gkeyringd_exec_t,s0)
-/usr/bin/mate-keyring-daemon	--	gen_context(system_u:object_r:gkeyringd_exec_t,s0)
 
 /usr/lib/[^/]*/gconf/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
 /usr/libexec/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
Index: refpolicy-2.20260906/policy/modules/services/icecast.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/icecast.fc
+++ refpolicy-2.20260906/policy/modules/services/icecast.fc
@@ -1,6 +1,6 @@
 /etc/rc\.d/init\.d/icecast	--	gen_context(system_u:object_r:icecast_initrc_exec_t,s0)
 
-/usr/bin/icecast	--	gen_context(system_u:object_r:icecast_exec_t,s0)
+/usr/bin/icecast(2)?	--	gen_context(system_u:object_r:icecast_exec_t,s0)
 
 /var/log/icecast(/.*)?	gen_context(system_u:object_r:icecast_log_t,s0)
 
Index: refpolicy-2.20260906/policy/modules/services/ntop.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/ntop.fc
+++ refpolicy-2.20260906/policy/modules/services/ntop.fc
@@ -3,7 +3,7 @@
 /etc/rc\.d/init\.d/ntop	--	gen_context(system_u:object_r:ntop_initrc_exec_t,s0)
 
 /usr/bin/ntop	--	gen_context(system_u:object_r:ntop_exec_t,s0)
-
+/usr/bin/sntop	--	gen_context(system_u:object_r:ntop_exec_t,s0)
 
 /var/lib/ntop(/.*)?	gen_context(system_u:object_r:ntop_var_lib_t,s0)
 
Index: refpolicy-2.20260906/policy/modules/services/postfixpolicyd.fc
===================================================================
--- refpolicy-2.20260906.orig/policy/modules/services/postfixpolicyd.fc
+++ refpolicy-2.20260906/policy/modules/services/postfixpolicyd.fc
@@ -3,6 +3,7 @@
 /etc/rc\.d/init\.d/postfixpolicyd	--	gen_context(system_u:object_r:postfix_policyd_initrc_exec_t,s0)
 
 /usr/bin/policyd	--	gen_context(system_u:object_r:postfix_policyd_exec_t,s0)
-
+/usr/bin/policyd-spf	--	gen_context(system_u:object_r:postfix_policyd_exec_t,s0)
+/usr/bin/postfix-policyd-spf-perl	--	gen_context(system_u:object_r:postfix_policyd_exec_t,s0)
 
 /run/policyd\.pid	--	gen_context(system_u:object_r:postfix_policyd_runtime_t,s0)
