Differentiate between staff and sysadm when executing crontab with sudo
1388
Allow su domains write login records
2606
Revert "Allow su domains write login records"
2606
Add crontab_admin_domtrans interface
1388
Allow gpg manage rpm cache
11249

Transition from sudodomains to crontab_t when executing crontab_exec_t
1388
Fix label of pseudoterminals created from sudodomain
1388
Allow login_userdomain to manage session_dbusd_tmp_t dirs/files
22500
Label /dev/ngXnY and /dev/nvme-subsysX with nvme_device_t
23442
Allow admin user read/write on fixed_disk_device_t
23434
Only allow confined user domains to login locally without unconfined_login
1628
Add userdom_spec_domtrans_confined_admin_users interface
1628
Only allow admindomain to execute shell via ssh with ssh_sysadm_login
1628
Add userdom_spec_domtrans_admin_users interface
1628
Move ssh dyntrans to unconfined inside unconfined_login tunable policy
1628
Allow utempter_t use ptmx
25002
Dontaudit subscription manager setfscreate and read file contexts
21639
Don't audit crontab_domain write attempts to user home
1388
Add crontab_domtrans interface
1388
Add dbus_manage_session_tmp_files interface
22500
Allow httpd read network sysctls
22748
Allow keepalived_unconfined_script_t dbus chat with init
22843

11249
Allow su domains write login records
2606
Allow gpg read rpm cache
11249
Allow unix dgram sendto between exim processes
21903
Allow hypervkvp_t write access to NetworkManager_etc_rw_t
17687
Add interface for write-only access to NetworkManager rw conf
17687
Allow conntrackd_t to use sys_admin capability
22276

Allow syslog to run unconfined scripts conditionally
10087
Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
10087
Allow collectd connect to statsd port
19482
Allow collectd_t read network state symlinks
19482
Allow collectd_t domain to create netlink_generic_socket sockets
19482
Allow opafm search nfs directories
19426
Allow mdadm list stratisd data directories
21374

Label /dev/acpi_thermal_rel char device with acpi_device_t
18027
Allow sysadm execute traceroute in sysadm_t domain using sudo
9947
Allow sysadm execute tcpdump in sysadm_t domain using sudo
15398
Add support for syslogd unconfined scripts
10087
Label /dev/wmi/dell-smbios as acpi_device_t
18027
Make named_zone_t and named_var_run_t a part of the mountpoint attribute
1954
Dontaudit rhsmcertd write memory device
17721

Allow sudodomain read var auth files
16567
Update cifs interfaces to include fs_search_auto_mountpoints()
14072
Allow systemd-localed create Xserver config dirs
16715
Label /var/run/auditd.state as auditd_var_run_t
14376
Allow auditd read all domains process state
14471
Allow sudo userdomain to run rpm related commands
1679
Remove insights_client_watch_lib_dirs() interface
16185

Additional permissions for ip-vrf
9981
Allow ip an explicit domain transition to other domains
9981
5845
Allow system_mail_t manage exim spool files and dirs
14186

Label msmtp and msmtpd with sendmail_exec_t
1678
1099
Improve default file context(None) of /var/lib/authselect/backups
3539

Set default file context of /var/lib/authselect/backups to <<none>>
3539
Add file context specification for /usr/libexec/realmd
2147
Add numad the ipc_owner capability
2415

Allow ssh_agent_type manage generic cache home files
Add chromium_sandbox_t setcap capability

Allow cloud_init create dhclient var files and init_t manage net_conf_t 3

Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
Make insights_client_t an unconfined domain
Allow insights-client create all rpm logs with a correct label
Allow insights-client manage generic logs

Allow user_u and staff_u get attributes of non-security dirs
Allow unconfined user filetrans chrome_sandbox_home_t 1/2
Allow unconfined user filetrans chrome_sandbox_home_t 2/2
Allow insights-client execmem
Allow svnserve execute postdrop with a transition
Do not make postfix_postdrop_t type an MTA executable file
Allow samba-dcerpc service manage samba tmp files
Update samba-dcerpc policy for printing

Add the files_getattr_non_auth_dirs() interface
Update policy for the sblim-sfcb service
Dontaudit sfcbd sys_ptrace cap_userns
Label /usr/sbin/sos with sosreport_exec_t
Allow sa-update manage spamc home files
Allow sa-update connect to systemlog services
Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t

Label only /usr/sbin/ripd and ripngd with zebra_exec_t
Allow httpd tcp connect to redis port conditionally
Exclude container-selinux manpage from selinux-policy-doc

Update cyrus_stream_connect() to use sockets in /run
Allow insights-client map generic log files
Allow insights-client work with pipe and socket tmp files
Allow insights-client getsession process permission
Allow keepalived to manage its tmp files