Allow unconfined_t to node_bind icmp_sockets in node_t domain
Allow rhsmcertd get attributes of tmpfs_t filesystems
The nfsdcld service is now confined by SELinux
Allow smbcontrol use additional socket types
Allow lldpd use an snmp subagent over a tcp socket

Allow sysadm_t read/write pkcs shared memory segments
Allow sysadm_t connect to sanlock over a unix stream socket
Allow sysadm_t dbus chat with sssd
Allow sysadm_t set attributes on character device nodes
Allow sysadm_t read and write watchdog devices
Allow sysadm_t connect to cluster domains over a unix stream socket
Allow sysadm_t dbus chat with tuned 2/2
Update userdom_exec_user_tmp_files() with an entrypoint rule
Allow sudodomain send a null signal to sshd processes
Allow sysadm_t dbus chat with tuned 1/2
Allow cloud-init dbus chat with systemd-logind
Allow svnserve send mail from the system
Allow svnserve_t domain to read system state

VQP: Include IANA-assigned TCP/1589
Label port 3785/udp with bfd_echo
Allow sysadm_t dbus chat with realmd_t
Support sanlock VG automated recovery on storage access loss 1/2
Revert "Support sanlock VG automated recovery on storage access loss"
Support sanlock VG automated recovery on storage access loss
radius: Lexical sort of service-specific corenet rules by service name
radius: Allow binding to the BDF Control and Echo ports
radius: Allow binding to the DHCP client port
radius: Allow net_raw; allow binding to the DHCP server ports
Support hitless reloads feature in haproxy
Allow redis get attributes of filesystems with extended attributes
Support sanlock VG automated recovery on storage access loss 2/2
Revert "Support sanlock VG automated recovery on storage access loss"

Support sanlock VG automated recovery on storage access loss
Allow proper function sosreport in sysadmin role
Allow systemd execute user bin files
Label /dev/crypto/nx-gzip with accelerator_device_t
Allow ipsec_t and login_userdomain named file transition in tmpfs
Support sanlock VG automated recovery on storage access loss
Allow proper function sosreport via iotop
Call pkcs_tmpfs_named_filetrans for certmonger
Allow ibacm the net_raw and sys_rawio capabilities
Support new PING_CHECK health checker in keepalived
Update spamassasin policy to make working /usr/share/spamassassin/sa-update.cron script

Allow unconfined domains to bpf all other domains
Allow vmtools_unconfined_t domain transition to rpm_script_t
Allow unbound connectto unix_stream_socket
Label /usr/sbin/virtproxyd as virtd_exec_t
Allow postfix_domain to sendto unix dgram sockets.

Allow rhsmcertd_t dbus chat with anaconda install_t

Introduce xdm_manage_bootloader booelan
Rename samba_exec() to samba_exec_net()
Allow sssd to set samba setting
Allow dirsrv read slapd tmpfs files
Allow rhsmcertd to create cache file in /var/cache/cloud-what

Label /usr/bin/Xwayland with xserver_exec_t
Label /usr/libexec/gdm-runtime-config with xdm_exec_t
Allow D-bus communication between avahi and sosreport
Allow lldpad send to kdumpctl over a unix dgram socket
Revert "Allow lldpad send to kdump over a unix dgram socket"
Allow chronyc respond to a user chronyd instance
Allow ptp4l respond to pmc
Allow lldpad send to unconfined_t over a unix dgram socket

Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
Allow sysadm to read/write scsi files and manage shadow
Allow rhsmcertd execute gpg
Allow lldpad send to kdump over a unix dgram socket
Remove glusterd SELinux module from distribution policy

Allow login_userdomain read and map /var/lib/systemd files
Allow sysadm acces to kernel module resources
Allow sysadm to read/write scsi files and manage shadow
Allow sysadm access to files_unconfined and bind rpc ports
Allow sysadm read and view kernel keyrings
Allow bootloader to read tuned etc files
Update the policy for systemd-journal-upload
Allow journal mmap and read var lib files
Allow tuned to read rhsmcertd config files
Allow bootloader to read tuned etc files
Confine rhsm service and rhsm-facts service as rhsmcertd_t
Allow virtlogd_t read process state of user domains
Allow cockpit_ws_t get attributes of fs_t filesystems

Add the unconfined_dgram_send() interface
Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
Add checkpoint_restore cap2 capability
Allow fcoemon talk with unconfined user over unix domain datagram socket
Allow hostapd bind UDP sockets to the dhcpd port
Allow NetworkManager read and write z90crypt device
Allow abrt_domain read and write z90crypt device
Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
Allow mdadm read iscsi pid files

Allow dyntransition from sshd_t to unconfined_t

Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
Allow transition from xdm domain to unconfined_t domain.
Allow nftables read NetworkManager unnamed pipes
Create a policy for systemd-journal-upload
Add dev_getattr_infiniband_dev() interface.
Allow tcpdump and nmap get attributes of infiniband_device_t
Allow fcoemon create sysfs files
Allow nftables read NetworkManager unnamed pipes
Allow radius map its library files
Allow arpwatch get attributes of infiniband_device_t devices

Allow systemd-sleep get attributes of fixed disk device nodes
Allow systemd-sleep create hardware state information files
virtiofs supports Xattrs and SELinux
Label 4460/tcp port as ntske_port_t
Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
Allow chronyd_t to accept and make NTS-KE connections
Dontaudit NetworkManager write to initrc_tmp_t pipes
Allow logrotate rotate container log files
Allow rhsmd read process state of all domains and kernel threads

Allow nmap create and use rdma socket
Label /.k5identity file allow read of this file to rpc.gssd
Label /var/lib/kdump with kdump_var_lib_t
Label /run/libvirt/common with virt_common_var_run_t

Allow using opencryptoki for ipsec
Remove all kernel_getattr_proc() interface calls
Allow domain stat /proc filesystem
Allow pkcs-slotd create and use netlink_kobject_uevent_socket
Allow using opencryptoki for certmonger
install_t: Allow NoNewPriv transition from systemd
Remove all kernel_getattr_proc() interface calls
Allow httpd_sys_script_t read, write, and map hugetlbfs files