Allow rhsmd read process state of all domains and kernel threads
Allow ipa-adtrust-install restart sssd and dirsrv services
Allow nagios_plugin_domain execute programs in bin directories
selinux policy: add the right context for org.freeipa.server.trust-enable-agent

Allow chronyd_t domain to exec shell
Allow pmie daemon to send signal pcmd daemon
Allow auditd poweroff or switch to single mode

Dontaudit tmpreaper_t getting attributes from sysctl_type files

Allow tmpreaper_t domain to getattr files labeled as mtrr_device_t

Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command

Update tmpreaper_t policy due to fuser command

Allow tmpreaper_t domain to read all domains state

Update sudo_role_template() to allow caller domain to read syslog pid files

Allow sbd_t domain to check presence of processes labeled as cluster_t

Allow ganesha_t domain to read system network state and connect to cyphesis_port_t
Label /var/log/collectd.log as collectd_log_t
Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
Update sbd policy to allow manage cgroups
Allow sudo userdomain to run rpm related commands
Update rpm_run() interface to avoid duplicate role transition in sudo_role_template

Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label

Update sbd policy to allow manage cgroups

Allow cupsd_t domain to manage cupsd_tmp_t temp link files
Allow svnserve_t domain to read /dev/random
Update sudodomains to make working confined users run sudo/su

Allow virtlockd process read virtlockd.conf file

Rebuild selinux-policy build because of broken RHEL-7.8 buildrood
policy-3.13.1-253

Label user cron spool file with user_cron_spool_t
Allow svnserve_t domain to read system state
Update svnserve_t policy to make working svnserve hooks
Update gnome_role_template() template to allow sysadm_t confined user to login to xsession
Update gnome_role_template() to allow _gkeyringd_t domains to chat with systemd_logind over dbus
Allow userdomain gkeyringd domain to create stream socket with userdomain
Allow cupsd_t to create lnk_files in /tmp. BZ(1401634)
Allow mysqld_t domain to manage cluster pid files
Relabel /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t.
Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
Allow rhsmcertd_t domain to send signull to all domains
Allow cloud_init_t domain to ccreate iptables files with correct SELinux label
Allow dnsmasq_t domain to manage NetworkManager_var_lib_t files
Allow certmonger to geattr of filesystems BZ(1578755)
Update tomcat_can_network_connect_db boolean to allow tomcat domains also connect to redis ports Resolves: rhbz#1687497
Allow lograte_t domain to manage collect_rw_content files and dirs
Add interface collectd_manage_rw_content()
Allow glusterd_t domain to setpgid
Allow sysadm_sudo_t to use SELinux tooling.
Allow sysadm_t domain to create netlink selinux sockets
Allow systemd_resolved_t to dbusd chat with NetworkManager_t
Allow crack_t domain read /et/passwd files
Allow sysadm_t domain to dbus chat with rtkit daemon
Allow x_userdomains to nnp domain transition to thumb_t domain
Dontaudit writing to user home dirs by gnome-keyring-daemon
Update logging_send_audit_msgs(sudodomain() to control TTY auditing for netlink socket for audit service
Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files
Add interface kernel_relabelfrom_usermodehelper()