Allow qemu-kvm create and use netlink rdma sockets
Label corosync-cfgtool with cluster_exec_t

Allow logrotate a domain transition to cluster administrative domain
Change the selinuxuser_execstack boolean value to true

Allow ModemManager connect to the unconfined user domain
Label /dev/wwan.+ with modem_manager_t
Allow systemd-coredump userns capabilities and root mounton
Allow systemd-coredump read and write usermodehelper state
Allow sysadm_passwd_t to relabel passwd and group files
Allow systemd-sysctl read the security state information
Remove unnecessary /etc file transitions for insights-client
Label all content in /var/lib/insights with insights_client_var_lib_t
Update insights-client policy
Update insights-client: fc pattern, motd, writing to etc
Update specfile to buildrequire policycoreutils-devel >= 3.3-5
Add modules_checksum to %files

Remove permissive domain for insights_client_t
New policy for insight-client
Allow confined sysadmin to use tool vipw
Allow chage domtrans to sssd
Remove label for /usr/sbin/bgpd
Dontaudit pkcsslotd sys_admin capability
Do not change selinuxuser_execmod and selinuxuser_execstack
Allow tuned to read rhsmcertd config files

Allow systemd watch unallocated ttys
Allow alsa bind mixer controls to led triggers
Allow alsactl set group Process ID of a process
Allow unconfined to run virtd bpf

Allow tumblerd write to session_dbusd tmp socket files
Allow login_userdomain write to session_dbusd tmp socket files
Allow login_userdomain create session_dbusd tmp socket files
Allow gkeyringd_domain write to session_dbusd tmp socket files
Allow systemd-logind delete session_dbusd tmp socket files
Allow gdm-x-session write to session dbus tmp sock files
Allow sysadm_t nnp_domtrans to systemd_tmpfiles_t
Label exFAT utilities at /usr/sbin

Allow systemd nnp_transition to login_userdomain
Label /var/run/user/%{USERID}/dbus with session_dbusd_tmp_t
Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling
Allow scripts to enter LUKS password
Allow system_mail_t read inherited apache system content rw files
Add apache_read_inherited_sys_content_rw_files() interface
Allow sanlock get attributes of filesystems with extended attributes
Associate stratisd_data_t with device filesystem
Allow init read stratis data symlinks
Label /run/stratisd with stratisd_var_run_t
Allow domtrans to sssd_t and role access to sssd
Creating interface sssd_run_sssd()
Fix badly indented used interfaces
Allow domain transition to sssd_t
Label /dev/nvme-fabrics with fixed_disk_device_t
Allow local_login_t nnp_transition to login_userdomain
Allow xdm_t nnp_transition to login_userdomain
Make cupsd_lpd_t a daemon
Label utilities for exFAT filesystems with fsadm_exec_t
Dontaudit sfcbd sys_ptrace cap_userns

Allow sshd read filesystem sysctl files
Revert "Allow sshd read sysctl files"

Remove the lockdown class from the policy
Revert "define lockdown class and access"
Allow gssproxy access to various system files.
Allow gssproxy read, write, and map ica tmpfs files
Allow gssproxy read and write z90crypt device
Allow sssd_kcm read and write z90crypt device
Allow abrt_domain read and write z90crypt device
Allow NetworkManager read and write z90crypt device
Allow smbcontrol read the network state information
Allow virt_domain map vhost devices
Allow fcoemon request the kernel to load a module
Allow lldpd connect to snmpd with a unix domain stream socket
Allow ModemManager create a qipcrtr socket
Allow ModemManager request to load a kernel module
Allow sshd read sysctl files

Allow dnsmasq watch /etc/dnsmasq.d directories
Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
Allow lldpd use an snmp subagent over a tcp socket
Allow smbcontrol use additional socket types
Add write permisson to userfaultfd_anon_inode_perms
Allow xdm_t watch generic directories in /lib
Allow xdm_t watch fonts directories
Label /dev/ngXnY and /dev/nvme-subsysX with fixed_disk_device_t
Add hwtracing_device_t type for hardware-level tracing and debugging
Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
Allow arpwatch get attributes of infiniband_device_t devices
Allow tcpdump and nmap get attributes of infiniband_device_t

Allow redis get attributes of filesystems with extended attributes
Allow dirsrv read slapd tmpfs files
Revert "Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label"
Allow login_userdomain open/read/map system journal
Allow login_userdomain read and map /var/lib/systemd files
Allow nftables read NetworkManager unnamed pipes
Allow xdm watch generic directories in /var/lib
Allow xdm_t watch generic pid directories

Allow fetchmail search cgroup directories
Add the auth_read_passwd_file() interface
Allow redis-sentinel execute a notification script
Support new PING_CHECK health checker in keepalived

Label /usr/sbin/virtproxyd as virtd_exec_t
Allow at-spi-bus-launcher read and map xdm pid files
Remove references to init_watch_path_type attribute
Remove all redundant watch permissions for systemd
Allow systemd watch non_security_file_type dirs, files, lnk_files
Allow systemd-resolved watch /run/systemd
Allow sssd watch /run/systemd

Allow fprintd install a sleep delay inhibitor
Update mount_manage_pid_files() to use manage_files_pattern
Allow gnome at-spi processes create and use stream sockets
Allow haproxy list the sysfs directories content
Allow virtlogd_t read process state of user domains
Support hitless reloads feature in haproxy
Allow firewalld load kernel modules
Allow communication between at-spi and gdm processes
Remove "ipa = module" from modules-targeted-contrib.conf

Update ica_filetrans_named_content() with create_file_perms
Allow various domains work with ICA crypto accelerator
Add ica module
Revert "Support using ICA crypto accelerator on s390x arch"
Fix the gnome_atspi_domtrans() interface summary
Add support for at-spi
Add permissions for system dbus processes
Allow /tmp file transition for dbus-daemon also for sock_file

Support using ICA crypto accelerator on s390x arch
Allow systemd delete /run/systemd/default-hostname
Label /usr/bin/Xwayland with xserver_exec_t
Label /usr/libexec/gdm-runtime-config with xdm_exec_t
Allow tcpdump read system state information in /proc
Allow firewalld drop capabilities