Allow login_userdomain read and map /var/lib/systemd files
Allow sysadm acces to kernel module resources
Allow sysadm to read/write scsi files and manage shadow
Allow sysadm access to files_unconfined and bind rpc ports
Allow sysadm read and view kernel keyrings
Allow bootloader to read tuned etc files
Update the policy for systemd-journal-upload
Allow journal mmap and read var lib files
Allow tuned to read rhsmcertd config files
Allow bootloader to read tuned etc files
Confine rhsm service and rhsm-facts service as rhsmcertd_t
Allow virtlogd_t read process state of user domains
Allow cockpit_ws_t get attributes of fs_t filesystems

Add the unconfined_dgram_send() interface
Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
Add checkpoint_restore cap2 capability
Allow fcoemon talk with unconfined user over unix domain datagram socket
Allow hostapd bind UDP sockets to the dhcpd port
Allow NetworkManager read and write z90crypt device
Allow abrt_domain read and write z90crypt device
Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
Allow mdadm read iscsi pid files

Allow dyntransition from sshd_t to unconfined_t

Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
Allow transition from xdm domain to unconfined_t domain.
Allow nftables read NetworkManager unnamed pipes
Create a policy for systemd-journal-upload
Add dev_getattr_infiniband_dev() interface.
Allow tcpdump and nmap get attributes of infiniband_device_t
Allow fcoemon create sysfs files
Allow nftables read NetworkManager unnamed pipes
Allow radius map its library files
Allow arpwatch get attributes of infiniband_device_t devices

Allow systemd-sleep get attributes of fixed disk device nodes
Allow systemd-sleep create hardware state information files
virtiofs supports Xattrs and SELinux
Label 4460/tcp port as ntske_port_t
Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
Allow chronyd_t to accept and make NTS-KE connections
Dontaudit NetworkManager write to initrc_tmp_t pipes
Allow logrotate rotate container log files
Allow rhsmd read process state of all domains and kernel threads

Allow nmap create and use rdma socket
Label /.k5identity file allow read of this file to rpc.gssd
Label /var/lib/kdump with kdump_var_lib_t
Label /run/libvirt/common with virt_common_var_run_t

Allow using opencryptoki for ipsec
Remove all kernel_getattr_proc() interface calls
Allow domain stat /proc filesystem
Allow pkcs-slotd create and use netlink_kobject_uevent_socket
Allow using opencryptoki for certmonger
install_t: Allow NoNewPriv transition from systemd
Remove all kernel_getattr_proc() interface calls
Allow httpd_sys_script_t read, write, and map hugetlbfs files

Add /var/usrlocal equivalency rule
Label /dev/trng with random_device_t
Allow systemd-sleep transition to sysstat_t
Allow systemd-sleep transition to tlp_t
Allow systemd-sleep transition to unconfined_service_t on bin_t executables
Allow systemd-sleep execute generic programs
Allow systemd-sleep execute shell
Allow nsswitch_domain read init pid lnk_files
Introduce logging_syslogd_list_non_security_dirs tunable
Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
Change param description in cron interfaces to userdomain_prefix
Add missing declaration in rpm_named_filetrans()

Allow pluto IKEv2 / ESP over TCP
Label SDC(scini) Dell Driver
Add file context specification for /var/tmp/tmp-inst
Allow virtlogd_t to create virt_var_lockd_t dir
Allow cups-lpd read its private runtime socket files

Allow systemd the audit_control capability conditionally

Disallow user_t run su/sudo and staff_t run su

Relabel /usr/sbin/charon-systemd as ipsec_exec_t

Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
Allow rhsmcertd bind tcp sockets to a generic node
Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
Allow strongswan start using swanctl method
Allow systemd-importd manage machines.lock file

Allow rtkit_daemon_t domain set process nice value in user namespaces
Allow gpsd read and write ptp4l_t shared memory.
Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
Allow Certmonger to use opencryptoki services
Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
Allow rhsmcertd_t read kpatch lib files
Allow ipsec_t connectto ipsec_mgmt_t
Allow IPsec to use opencryptoki services
Allow systemd-importd create /run/systemd/machines.lock file

Allow rhsmcertd_t domain transition to kpatch_t
Revert "Add kpatch_exec() interface"
Revert "Allow rhsmcertd execute kpatch"
Dontaudit NetworkManager_t domain to write to kdump temp pipies
Allow NetworkManager_t domain to get status of samba services
Allow openvswitch create and use xfrm netlink sockets
Allow openvswitch_t perf_event write permission
Add write_perf_event_perms object permission set

Add kpatch_exec() interface
Allow rhsmcertd execute kpatch
Allow openvswitch_t perf_event open permission
Allow openvswitch fowner capability and create netlink sockets
Add net_broadcast capability to openvswitch_t domain
Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
Allow machinectl to run pull-tar