Allow cups-pdf connect to the system log service
Update policy for qatlib

Allow qatlib to modify hardware state information.
Update policy for fdo
Allow gpsd, oddjob and oddjob_mkhomedir_t write user_tty_device_t chr_file
Allow svirt to rw /dev/udmabuf
Allow keepalived watch var_run dirs

Allow logrotate_t to map generic files in /etc
Allow insights-client manage user temporary files
Make insights_client_t an unconfined domain

Allow user_u and staff_u get attributes of non-security dirs
Allow cloud_init create dhclient var files and init_t manage net_conf_t
Allow samba-dcerpc service manage samba tmp files
Update samba-dcerpc policy for printing
Allow sysadm_t run kernel bpf programs
allow mon_procd_t self:cap_userns sys_ptrace
Remove nsplugin_role from mozilla.if
Allow unconfined user filetrans chrome_sandbox_home_t
Allow pdns name_bind and name_connect all ports
Allow insights-client read and write cluster tmpfs files
Allow ipsec read nsfs files
Allow upsmon execute upsmon via a helper script
Fix labeling for no-stub-resolv.conf
Add use_nfs_home_dirs boolean for mozilla_plugin
Change wording in /etc/selinux/config

Allow qatlib to read sssd public files
Fix location for /run/nsd
Allow samba-rpcd work with passwords
Allow rpcd_lsad setcap and use generic ptys
Allow gpsd,oddjob,oddjob_mkhomedir rw user domain pty
Allow keepalived to manage its tmp files
Allow nscd watch system db dirs

Boolean: Allow virt_qemu_ga create ssh directory
Allow virt_qemu_ga_t create .ssh dir with correct label
Set default ports for keylime policy
594
Allow unconfined service inherit signal state from init
Allow sa-update connect to systemlog services
Allow sa-update manage spamc home files
Label only /usr/sbin/ripd and ripngd with zebra_exec_t
Add the files_getattr_non_auth_dirs() interface
Update policy for the sblim-sfcb service
Define equivalency for /run/systemd/generator.early

Add the qatlib module
Add the fdo module
Add the booth module to modules.conf

Remove permissive from fdo
Add the qatlib module
Add the fdo module
Add the booth module to modules.conf
Add policy for FIDO Device Onboard
Create policy for qatlib
Add policy for boothd
Add list_dir_perms to kerberos_read_keytab
Allow nsd_crond_t write nsd_var_run_t & connectto nsd_t
Allow collectd_t read network state symlinks
Revert "Allow collectd_t read proc_net link files"
Allow insights-client execmem
Label udf tools with fsadm_exec_t

Add fs_delete_pstore_files() interface
Add fs_read_pstore_files() interface
Allow insights-client getsession process permission
Allow insights-client work with pipe and socket tmp files
Allow insights-client map generic log files
Allow insights-client read unconfined service semaphores
Allow insights-client get quotas of all filesystems
Allow haproxy read hardware state information
Allow cupsd dbus chat with xdm
Allow dovecot_deliver_t create/map dovecot_spool_t dir/file
Add none file context for polyinstantiated tmp dirs
Add support for the systemd-pstore service
Label /dev/userfaultfd with userfaultfd_t
Allow collectd_t read proc_net link files
Label smtpd with sendmail_exec_t
Label msmtp and msmtpd with sendmail_exec_t
Allow dovecot-deliver write to the main process runtime fifo files
Allow subscription-manager execute ip
Allow ftpd read network sysctls

Allow firewalld rw ica_tmpfs_t files
Add chromium_sandbox_t setcap capability
Allow certmonger manage cluster library files
Allow wireguard to rw network sysctls
Allow plymouthd_t bpf capability to run bpf programs
Update pkcsslotd policy for sandboxing
Allow unconfined_service_t to create .gnupg labeled as gpg_secret_t

Allow insights-client work with teamdctl
Allow virsh name_connect virt_port_t
Allow cupsd to create samba_var_t files
Allow dovecot to map files in /var/spool/dovecot
Add tunable to allow squid bind snmp port
Allow rhsmcert request the kernel to load a module
Allow snmpd read raw disk data

Allow cloud-init domain transition to insights-client domain
Allow chronyd send a message to cloud-init over a datagram socket
Allow dmidecode write to cloud-init tmp files
Allow login_pgm setcap permission
Allow tshark the setsched capability
Allow chronyc read network sysctls
Allow systemd-timedated watch init runtime dir
Add journalctl the sys_resource capability
Allow system_cronjob_t transition to rpm_script_t
Revert "Allow system_cronjob_t domtrans to rpm_script_t"
Allow insights-client tcp connect to all ports
Allow insights-client work with su and lpstat
Allow insights-client manage fsadm pid files
Allow insights-client read all sysctls
Allow rabbitmq to read network sysctls

rebuilt

Allow passt manage qemu pid sock files
Exclude passt.if from selinux-policy-devel

Add support for the passt_t domain
Allow virtd_t and svirt_t work with passt
Add new interfaces in the virt module
Add passt interfaces defined conditionally

Boolean: allow qemu-ga manage ssh home directory
Allow wg load kernel modules, search debugfs dir