Additional permissions for ip-vrf
9981
Allow ip an explicit domain transition to other domains
9981
5845
Allow system_mail_t manage exim spool files and dirs
14186

Label msmtp and msmtpd with sendmail_exec_t
1678
1099
Improve default file context(None) of /var/lib/authselect/backups
3539

Set default file context of /var/lib/authselect/backups to <<none>>
3539
Add file context specification for /usr/libexec/realmd
2147
Add numad the ipc_owner capability
2415

Allow ssh_agent_type manage generic cache home files
Add chromium_sandbox_t setcap capability

Allow cloud_init create dhclient var files and init_t manage net_conf_t 3

Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
Make insights_client_t an unconfined domain
Allow insights-client create all rpm logs with a correct label
Allow insights-client manage generic logs

Allow user_u and staff_u get attributes of non-security dirs
Allow unconfined user filetrans chrome_sandbox_home_t 1/2
Allow unconfined user filetrans chrome_sandbox_home_t 2/2
Allow insights-client execmem
Allow svnserve execute postdrop with a transition
Do not make postfix_postdrop_t type an MTA executable file
Allow samba-dcerpc service manage samba tmp files
Update samba-dcerpc policy for printing

Add the files_getattr_non_auth_dirs() interface
Update policy for the sblim-sfcb service
Dontaudit sfcbd sys_ptrace cap_userns
Label /usr/sbin/sos with sosreport_exec_t
Allow sa-update manage spamc home files
Allow sa-update connect to systemlog services
Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t

Label only /usr/sbin/ripd and ripngd with zebra_exec_t
Allow httpd tcp connect to redis port conditionally
Exclude container-selinux manpage from selinux-policy-doc

Update cyrus_stream_connect() to use sockets in /run
Allow insights-client map generic log files
Allow insights-client work with pipe and socket tmp files
Allow insights-client getsession process permission
Allow keepalived to manage its tmp files

Update pkcsslotd policy for sandboxing 2/2
Update pkcsslotd policy for sandboxing 1/2
Allow abrt_t read kernel persistent storage files
Add allow rules for lttng-sessiond domain
Allow rpcd_lsad setcap and use generic ptys
Allow samba-dcerpcd connect to systemd_machined over a unix socket
Dontaudit targetd search httpd config dirs

Allow unconfined service inherit signal state from init
Allow systemd-pstore delete kernel persistent storage files
Add fs_delete_pstore_files() interface
Allow certmonger manage cluster library files
Allow samba-rpcd work with passwords
Allow snmpd read raw disk data
Allow cluster_t dbus chat with various services

Add unconfined_server_read_semaphores() interface
Allow systemd-pstore read kernel persistent storage files
Add fs_read_pstore_files() interface
Allow insights-client work with teamdctl
Allow insights-client read unconfined service semaphores
Allow insights-client get quotas of all filesystems

Allow login_pgm setcap permission
Label /run/fsck with fsadm_var_run_t
Add boolean qemu-ga to run unconfined script
Allow dovecot-deliver write to the main process runtime fifo files
Allow certmonger dbus chat with the cron system domain
Allow insights-client read all sysctls

Fix opencryptoki file names in /dev/shm
Allow system_cronjob_t transition to rpm_script_t
Revert "Allow system_cronjob_t domtrans to rpm_script_t"
Allow httpd work with tokens in /dev/shm
Allow keepalived to set resource limits
Allow insights-client manage fsadm pid files

Allow sysadm_t run initrc_t script and sysadm_r role access
Allow insights-client manage fsadm pid files
Add journalctl the sys_resource capability