Allow irqbalance execute shell if irqbalance_run_unconfined is on
1556
Update irqbalance policy for using unconfined scripts
1556

virt: allow QEMU use of the qgs daemon for attestation
87744
qgs: add contrib module for TDX "qgs" daemon
87744
kernel: add interfaces for using SGX enclaves
87744
Allow coreos-installer search sssd library directory
95689
Label /dev/diag as diagnostic_device_t
95342
Allow irqbalance execute shell if irqbalance_run_unconfined is on
1556

Allow mptcpd the net_admin capability
81729
Allow networkmanager send a general signal to iptables
93741
Make bootupd use bootupd_tmp_t as its private type for files in /tmp
94508
Update bootupd policy
94508
Allow switcheroo-control dbus chat with xdm
93335
Update the files_search_mnt() interface
94184

Update policy for haproxyd
88045
Allow NetworkManager manage NetworkManager_etc_rw_t symlinks
86178
Allow lldpad connect to systemd-userdbd over a unix socket
84046
Allow gconfd connect to system dbus
77984
Allow login_pgm read filesystem sysctls
77745
Allow login_userdomain create /run/tlog directory with user_tmp_t
47241

Remove 3 permissive domains
82674
Allow tuned-ppd dbus chat with xdm
87203
Allow system-dbusd list systemd-machined directories
85379
Allow NetworkManager create and use icmp_socket
83529
Allow journalctl connect to systemd-userdbd over a unix socket
82673
allow gdm and iiosensorproxy talk to each other via D-bus
80697
Allow varnishd execute the prlimit64() syscall
77995
Allow system_dbusd_t r/w unix stream sockets of unconfined_service_t
61928
Add the getattr permission to 2 dontaudit interfaces
59145

automotive: Deny unknown classes/permissions (RHEL-86827)

Allow tuned-ppd read sssd public files
69526
Allow systemd-journal-upload read init pid files
62196
Label SetroubleshootPrivileged.py with setroubleshootd_exec_t
77319
Allow chronyd-restricted sendto to chronyc
82308
Allow chronyc sendto to chronyd-restricted
82308

Confine tuned-ppd
69526
Make tuned work with mls policy
69526
Allow afterburn to mount and read config drives
79319

Allow afterburn to mount and read config drives
82276

Allow svirt_t to connect to nbdkit over a unix stream socket
56029
Allow power-profiles-daemon the bpf capability
61117
Allow systemd-machined the kill user-namespace capability
76352

Add the files_read_root_files() interface
70849
Dontaudit systemd-logind remove all files
59145
Add the files_dontaudit_read_all_dirs() interface
59145
Add the files_dontaudit_delete_all_files() interface
59145
Allow rhsmcertd notify virt-who
77152
Allow irqbalance to run unconfined scripts conditionally
1556
Backport bootupd policy from current Fedora rawhide
70849
Support using systemd containers
76352
Allow svirt_t connect to unconfined_t over a unix domain socket
37539
Allow virt_domain to use pulseaudio - conditional
1379
Allow telnetd read network sysctls
58825
Allow alsa watch generic device directories
61472
Update switcheroo policy
24268

Allow rsyslog read systemd-logind session files
73839
Allow samba-bgqd connect to cupsd over an unix domain stream socket
72860
Allow svirt_t read sysfs files
70839
Allow xdm dbus chat with power-profiles-daemon
61117
Update power-profiles-daemon policy
61117
Confine power-profiles-daemon
61117
Allow virtqemud domain transition to nbdkit
56029
Add nbdkit interfaces defined conditionally
56029
Confine the switcheroo-control service
24268

Allow auditctl signal auditd
68969
Fix the cups_read_pid_files() interface to use read_files_pattern
69517
Dontaudit systemd-coredump the sys_resource capability
46339
Allow rpcd read network sysctls
1558
Allow irqbalance setpcap capability in the user namespace
69564
Allow traceroute_t bind rawip sockets to unreserved ports
54561
Allow svirt_t the sys_rawio capability
56955
56988
Exclude container-selinux manpage from selinux-policy-doc
69916

Update virtlogd policy
69433
Allow svirt_t the sys_rawio capability
56955
Allow qemu-ga the dac_override and dac_read_search capabilities
52476
Allow ip the setexec permission
62923
Allow alsa get attributes filesystems with extended attributes
61472
Allow bacula execute container in the container domain
21168
Allow httpd get attributes of dirsrv unit files
46808
Update samba-bgqd policy
69517
Allow samba-bgqd read cups config files
69517
Update policy for samba-bgqd
69517
Update bootupd policy for the removing-state-file test
66584
Allow qatlib search the content of the kernel debugging filesystem
53864
Allow qatlib connect to systemd-machined over a unix socket
53864
Update qatlib policy for v24.02 with new features
53864

Revert "Allow unconfined_t execute kmod in the kmod domain"
65008
Add policy for /usr/libexec/samba/samba-bgqd
53124

Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
56988
Allow lldpad create and use netlink_generic_socket
61832
Allow unconfined_t execute kmod in the kmod domain
54710
Allow confined users r/w to screen unix stream socket
50379
Label /root/.screenrc and /root/.tmux.conf with screen_home_t
50375
Allow iio-sensor-proxy the bpf capability
17346