Allow systemd the audit_control capability conditionally

Disallow user_t run su/sudo and staff_t run su

Relabel /usr/sbin/charon-systemd as ipsec_exec_t

Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
Allow rhsmcertd bind tcp sockets to a generic node
Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
Allow strongswan start using swanctl method
Allow systemd-importd manage machines.lock file

Allow rtkit_daemon_t domain set process nice value in user namespaces
Allow gpsd read and write ptp4l_t shared memory.
Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
Allow Certmonger to use opencryptoki services
Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
Allow rhsmcertd_t read kpatch lib files
Allow ipsec_t connectto ipsec_mgmt_t
Allow IPsec to use opencryptoki services
Allow systemd-importd create /run/systemd/machines.lock file

Allow rhsmcertd_t domain transition to kpatch_t
Revert "Add kpatch_exec() interface"
Revert "Allow rhsmcertd execute kpatch"
Dontaudit NetworkManager_t domain to write to kdump temp pipies
Allow NetworkManager_t domain to get status of samba services
Allow openvswitch create and use xfrm netlink sockets
Allow openvswitch_t perf_event write permission
Add write_perf_event_perms object permission set

Add kpatch_exec() interface
Allow rhsmcertd execute kpatch
Allow openvswitch_t perf_event open permission
Allow openvswitch fowner capability and create netlink sockets
Add net_broadcast capability to openvswitch_t domain
Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
Allow machinectl to run pull-tar

Allow wireshark create and use rdma socket
Allow to use nnp_transition in pulseaudio_role
Allow certmonger fsetid capability
Add rsync_sys_admin tunable to allow rsync sys_admin capability
Allow sysadm read and write /dev/rfkill
Allow staff_u run pam_console_apply
Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t

Add cron_dbus_chat_system_job() interface
Dontaudit firewalld dac_override capability
Allow tcsd the setgid capability
Allow timedatex dbus chat with cron system domain
Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
Allow pcp-pmcd manage perf_events
Label /dev/isst_interface as cpu_device_t
Allow ipsec set the context of a SPD entry to the default context
Allow sysadm_u user and unconfined_domain_type manage perf_events
Add manage_perf_event_perms object permissions set
Add perf_event access vectors.
Remove "ipa = module" from modules-targeted-contrib.conf

Allow kexec manage generic tmp files
Update systemd-sleep policy
Add groupadd_t fowner capability

Allow dovecot bind to smtp ports
Change fetchmail temporary files path to /var/spool/mail
Set file context for symlinks in /etc/httpd to etc_t
Allow dnsmasq read public files
Fix range for unreserved ports
Introduce logging_syslogd_append_public_content tunable
Add files_search_non_security_dirs() interface
Add miscfiles_append_public_files() interface

Let keepalived bind a raw socket
Add fetchmail_uidl_cache_t type for /var/mail/.fetchmail.pid
Allow arpwatch create and use rdma socket
Allow systemd-logind manage efivarfs files
Allow systemd_resolved_t to read efivarfs
Allow systemd_modules_load_t to read efivarfs
Allow read efivarfs_t files by domains executing systemctl file
Introduce systemd_read_efivarfs_type attribute

Allow init dbus chat with kernel
Confine systemd-sleep service
Allow rtkit_daemon_t to uise sys_ptrace usernamespace capability
Add fstools_rw_swap_files() interface

Allow plymouth sys_chroot capability

Allow certmonger fowner capability
Define named file transition for saslauthd on /tmp/krb5_0.rcache2
Label /usr/libexec/qemu-pr-helper with virtd_exec_t

Add ipa_helper_noatsecure() interface unconditionally
Conditionally allow nagios_plugin_domain dbus chat with init
Revert "Update allow rules set for nrpe_t domain"
Add ipa_helper_noatsecure() interface to ipa.if
Allow tomcat map user temporary files
Allow tomcat manage user temporary files
Add file context for /sys/kernel/tracing
Define named file transition for sshd on /tmp/krb5_0.rcache2