Allow nmap create and use rdma socket
Label /.k5identity file allow read of this file to rpc.gssd
Label /var/lib/kdump with kdump_var_lib_t
Label /run/libvirt/common with virt_common_var_run_t

Allow using opencryptoki for ipsec
Remove all kernel_getattr_proc() interface calls
Allow domain stat /proc filesystem
Allow pkcs-slotd create and use netlink_kobject_uevent_socket
Allow using opencryptoki for certmonger
install_t: Allow NoNewPriv transition from systemd
Remove all kernel_getattr_proc() interface calls
Allow httpd_sys_script_t read, write, and map hugetlbfs files

Add /var/usrlocal equivalency rule
Label /dev/trng with random_device_t
Allow systemd-sleep transition to sysstat_t
Allow systemd-sleep transition to tlp_t
Allow systemd-sleep transition to unconfined_service_t on bin_t executables
Allow systemd-sleep execute generic programs
Allow systemd-sleep execute shell
Allow nsswitch_domain read init pid lnk_files
Introduce logging_syslogd_list_non_security_dirs tunable
Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
Change param description in cron interfaces to userdomain_prefix
Add missing declaration in rpm_named_filetrans()

Allow pluto IKEv2 / ESP over TCP
Label SDC(scini) Dell Driver
Add file context specification for /var/tmp/tmp-inst
Allow virtlogd_t to create virt_var_lockd_t dir
Allow cups-lpd read its private runtime socket files

Allow systemd the audit_control capability conditionally

Disallow user_t run su/sudo and staff_t run su

Relabel /usr/sbin/charon-systemd as ipsec_exec_t

Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
Allow rhsmcertd bind tcp sockets to a generic node
Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
Allow strongswan start using swanctl method
Allow systemd-importd manage machines.lock file

Allow rtkit_daemon_t domain set process nice value in user namespaces
Allow gpsd read and write ptp4l_t shared memory.
Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
Allow Certmonger to use opencryptoki services
Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
Allow rhsmcertd_t read kpatch lib files
Allow ipsec_t connectto ipsec_mgmt_t
Allow IPsec to use opencryptoki services
Allow systemd-importd create /run/systemd/machines.lock file

Allow rhsmcertd_t domain transition to kpatch_t
Revert "Add kpatch_exec() interface"
Revert "Allow rhsmcertd execute kpatch"
Dontaudit NetworkManager_t domain to write to kdump temp pipies
Allow NetworkManager_t domain to get status of samba services
Allow openvswitch create and use xfrm netlink sockets
Allow openvswitch_t perf_event write permission
Add write_perf_event_perms object permission set

Add kpatch_exec() interface
Allow rhsmcertd execute kpatch
Allow openvswitch_t perf_event open permission
Allow openvswitch fowner capability and create netlink sockets
Add net_broadcast capability to openvswitch_t domain
Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
Allow machinectl to run pull-tar

Allow wireshark create and use rdma socket
Allow to use nnp_transition in pulseaudio_role
Allow certmonger fsetid capability
Add rsync_sys_admin tunable to allow rsync sys_admin capability
Allow sysadm read and write /dev/rfkill
Allow staff_u run pam_console_apply
Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t

Add cron_dbus_chat_system_job() interface
Dontaudit firewalld dac_override capability
Allow tcsd the setgid capability
Allow timedatex dbus chat with cron system domain
Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
Allow pcp-pmcd manage perf_events
Label /dev/isst_interface as cpu_device_t
Allow ipsec set the context of a SPD entry to the default context
Allow sysadm_u user and unconfined_domain_type manage perf_events
Add manage_perf_event_perms object permissions set
Add perf_event access vectors.
Remove "ipa = module" from modules-targeted-contrib.conf

Allow kexec manage generic tmp files
Update systemd-sleep policy
Add groupadd_t fowner capability

Allow dovecot bind to smtp ports
Change fetchmail temporary files path to /var/spool/mail
Set file context for symlinks in /etc/httpd to etc_t
Allow dnsmasq read public files
Fix range for unreserved ports
Introduce logging_syslogd_append_public_content tunable
Add files_search_non_security_dirs() interface
Add miscfiles_append_public_files() interface

Let keepalived bind a raw socket
Add fetchmail_uidl_cache_t type for /var/mail/.fetchmail.pid
Allow arpwatch create and use rdma socket
Allow systemd-logind manage efivarfs files
Allow systemd_resolved_t to read efivarfs
Allow systemd_modules_load_t to read efivarfs
Allow read efivarfs_t files by domains executing systemctl file
Introduce systemd_read_efivarfs_type attribute