Index: refpolicy-2.20260926/policy/modules/services/bluetooth.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/bluetooth.te
+++ refpolicy-2.20260926/policy/modules/services/bluetooth.te
@@ -92,6 +92,7 @@ can_exec(bluetooth_t, bluetooth_helper_e
 
 bluetooth_use_inherited_helper_stream_sockets(bluetooth_t)
 
+kernel_read_crypto_sysctls(bluetooth_t)
 kernel_read_kernel_sysctls(bluetooth_t)
 kernel_read_system_state(bluetooth_t)
 kernel_read_network_state(bluetooth_t)
@@ -129,6 +130,8 @@ miscfiles_read_localization(bluetooth_t)
 miscfiles_read_fonts(bluetooth_t)
 miscfiles_read_hwdata(bluetooth_t)
 
+udev_search_runtime(bluetooth_t)
+
 userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
 userdom_dontaudit_use_user_terminals(bluetooth_t)
 userdom_dontaudit_search_user_home_dirs(bluetooth_t)
@@ -232,5 +235,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	unconfined_dbus_send(bluetooth_t)
+')
+
+optional_policy(`
 	xserver_user_x_domain_template(bluetooth_helper, bluetooth_helper_t, bluetooth_helper_tmpfs_t)
 ')
Index: refpolicy-2.20260926/policy/modules/services/cups.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/cups.te
+++ refpolicy-2.20260926/policy/modules/services/cups.te
@@ -12,6 +12,13 @@ policy_module(cups)
 ## </desc>
 gen_tunable(cups_use_legacy_ldso, false)
 
+## <desc>
+## <p>
+## Allows legacy ld_so for old printer filters
+## </p>
+## </desc>
+gen_tunable(cups_legacy_ldso, false)
+
 type cupsd_config_t;
 type cupsd_config_exec_t;
 init_daemon_domain(cupsd_config_t, cupsd_config_exec_t)
@@ -332,6 +339,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	udev_read_runtime_files(cupsd_t)
+')
+
+optional_policy(`
 	virt_rw_all_image_chr_files(cupsd_t)
 ')
 
@@ -565,6 +576,10 @@ tunable_policy(`cups_use_legacy_ldso',`
 	libs_legacy_use_ld_so(cupsd_t)
 ')
 
+tunable_policy(`cups_legacy_ldso',`
+	libs_legacy_use_ld_so(cupsd_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(cups_pdf_t)
 	fs_manage_nfs_files(cups_pdf_t)
Index: refpolicy-2.20260926/policy/modules/services/dirmngr.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/dirmngr.te
+++ refpolicy-2.20260926/policy/modules/services/dirmngr.te
@@ -83,6 +83,7 @@ miscfiles_read_generic_certs(dirmngr_t)
 userdom_search_user_home_dirs(dirmngr_t)
 userdom_search_user_runtime(dirmngr_t)
 userdom_user_runtime_filetrans(dirmngr_t, dirmngr_tmp_t, dir)
+allow dirmngr_t dirmngr_tmp_t:dir manage_dir_perms;
 
 optional_policy(`
 	gpg_agent_tmp_filetrans(dirmngr_t, dirmngr_tmp_t, sock_file)
Index: refpolicy-2.20260926/policy/modules/services/ftp.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/ftp.te
+++ refpolicy-2.20260926/policy/modules/services/ftp.te
@@ -409,6 +409,13 @@ optional_policy(`
 	systemd_write_inherited_logind_sessions_pipes(ftpd_t)
 ')
 
+optional_policy(`
+	systemd_connect_machined(ftpd_t)
+	systemd_dbus_chat_logind(ftpd_t)
+	systemd_read_logind_state(ftpd_t)
+	systemd_write_inherited_logind_sessions_pipes(ftpd_t)
+')
+
 ########################################
 #
 # Ctl local policy
Index: refpolicy-2.20260926/policy/modules/services/policykit.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/policykit.te
+++ refpolicy-2.20260926/policy/modules/services/policykit.te
@@ -77,6 +77,7 @@ allow policykit_t self:unix_stream_socke
 rw_files_pattern(policykit_t, policykit_reload_t, policykit_reload_t)
 
 manage_files_pattern(policykit_t, policykit_var_lib_t, policykit_var_lib_t)
+allow policykit_t policykit_var_lib_t:dir watch;
 
 manage_dirs_pattern(policykit_t, policykit_runtime_t, policykit_runtime_t)
 manage_files_pattern(policykit_t, policykit_runtime_t, policykit_runtime_t)
@@ -105,12 +106,19 @@ fs_getattr_cgroup(policykit_t)
 
 auth_use_nsswitch(policykit_t)
 
+selinux_getattr_fs(policykit_t)
+seutil_search_default_contexts(policykit_t)
+
+term_getattr_pty_fs(policykit_t)
+
 userdom_getattr_all_users(policykit_t)
 userdom_read_all_users_state(policykit_t)
+userdom_use_inherited_user_terminals(policykit_t)
 
 optional_policy(`
 	dbus_system_domain(policykit_t, policykit_exec_t)
 	init_dbus_chat(policykit_t)
+	init_get_generic_units_status(policykit_t)
 	init_get_transient_units_status(policykit_t)
 	init_get_system_status(policykit_t)
 
@@ -135,10 +143,13 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_get_user_manager_units_status(policykit_t)
+
 	# for /run/systemd/machines
 	systemd_connect_machined(policykit_t)
 	systemd_read_machines(policykit_t)
 	systemd_watch_machines_dirs(policykit_t)
+	systemd_connect_machined(policykit_t)
 
 	# for /run/systemd/seats/seat*
 	systemd_read_logind_sessions_files(policykit_t)
Index: refpolicy-2.20260926/policy/modules/services/ssh.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/ssh.te
+++ refpolicy-2.20260926/policy/modules/services/ssh.te
@@ -17,7 +17,7 @@ gen_tunable(allow_ssh_keysign, false)
 ## Allow ssh logins as sysadm_r:sysadm_t
 ## </p>
 ## </desc>
-gen_tunable(ssh_sysadm_login, false)
+gen_tunable(ssh_sysadm_login, true)
 
 ## <desc>
 ## <p>
Index: refpolicy-2.20260926/policy/modules/kernel/files.if
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/kernel/files.if
+++ refpolicy-2.20260926/policy/modules/kernel/files.if
@@ -5821,6 +5821,41 @@ interface(`files_usr_filetrans',`
 
 ########################################
 ## <summary>
+##      Execute a usr_t file in the specified domain.
+## </summary>
+## <desc>
+##      <p>
+##      Execute a usr_t file in the specified domain.
+##      </p>
+##      <p>
+##      No interprocess communication (signals, pipes,
+##      etc.) is provided by this interface since
+##      the domains are not owned by this module.
+##      </p>
+## </desc>
+## <param name="domain">
+##      <summary>
+##      Domain allowed to transition.
+##      </summary>
+## </param>
+## <param name="target_domain">
+##      <summary>
+##      The type of the process.
+##      </summary>
+## </param>
+#
+interface(`files_usr_domtrans',`
+	gen_require(`
+		type usr_t;
+	')
+
+	files_list_usr($1)
+	domain_transition_pattern($1, usr_t, $2)
+	type_transition $1 usr_t:process $2;
+')
+
+########################################
+## <summary>
 ##	Search directories in /usr/src.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260926/policy/modules/system/fstools.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/fstools.te
+++ refpolicy-2.20260926/policy/modules/system/fstools.te
@@ -228,6 +228,14 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dmidecode_domtrans(fsadm_t)
+')
+
+optional_policy(`
+	fsdaemon_read_lib(fsadm_t)
+')
+
+optional_policy(`
 	fsdaemon_read_lib(fsadm_t)
 ')
 
@@ -264,6 +272,8 @@ optional_policy(`
 	# Xen causes losetup to run with a presumably accidentally inherited
 	# file handle for /run/xen-hotplug/block
 	udev_dontaudit_rw_runtime_files(fsadm_t)
+
+	udev_domtrans_udevadm(fsadm_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260926/policy/modules/apps/java.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/apps/java.te
+++ refpolicy-2.20260926/policy/modules/apps/java.te
@@ -128,11 +128,17 @@ tunable_policy(`allow_java_execstack',`
 auth_use_nsswitch(java_t)
 
 corecmd_search_bin(java_t)
+corecmd_exec_bin(java_t)
 
 dev_read_sysfs(java_t)
 
+fs_read_cgroup_files(java_t)
+fs_search_cgroup_dirs(java_t)
+
 locallogin_use_fds(java_t)
 
+libs_exec_lib_files(java_t)
+
 userdom_read_user_tmp_files(java_t)
 userdom_use_user_terminals(java_t)
 
Index: refpolicy-2.20260926/policy/modules/kernel/storage.if
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/kernel/storage.if
+++ refpolicy-2.20260926/policy/modules/kernel/storage.if
@@ -370,6 +370,30 @@ interface(`storage_dev_filetrans_fixed_d
 
 ########################################
 ## <summary>
+##	Create char devices in /dev with the fixed disk type
+##	via an automatic type transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional filename of the char device to be created
+##	</summary>
+## </param>
+#
+interface(`storage_dev_filetrans_fixed_disk_control',`
+	gen_require(`
+		type fixed_disk_device_t;
+	')
+
+	dev_filetrans($1, fixed_disk_device_t, chr_file, $2)
+')
+
+########################################
+## <summary>
 ##	Create block devices in on a tmpfs filesystem with the
 ##	fixed disk type via an automatic type transition.
 ## </summary>
Index: refpolicy-2.20260926/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/logging.te
+++ refpolicy-2.20260926/policy/modules/system/logging.te
@@ -118,7 +118,7 @@ allow auditctl_t self:netlink_audit_sock
 allow auditctl_t auditd_log_t:dir list_dir_perms;
 allow auditctl_t auditd_log_t:file read_file_perms;
 
-read_files_pattern(auditctl_t, auditd_etc_t, auditd_etc_t)
+mmap_read_files_pattern(auditctl_t, auditd_etc_t, auditd_etc_t)
 allow auditctl_t auditd_etc_t:dir list_dir_perms;
 dontaudit auditctl_t auditd_etc_t:file map;
 
@@ -129,7 +129,7 @@ files_getattr_all_dirs(auditctl_t)
 files_getattr_all_files(auditctl_t)
 files_read_etc_files(auditctl_t)
 
-kernel_dontaudit_getattr_proc(auditctl_t)
+kernel_getattr_proc(auditctl_t)
 kernel_read_kernel_sysctls(auditctl_t)
 kernel_read_proc_symlinks(auditctl_t)
 kernel_read_system_state(auditctl_t)
@@ -175,7 +175,7 @@ allow auditd_t self:tcp_socket create_st
 
 allow auditd_t auditd_etc_t:dir list_dir_perms;
 allow auditd_t auditd_etc_t:file read_file_perms;
-dontaudit auditd_t auditd_etc_t:file map;
+allow auditd_t auditd_etc_t:file map;
 
 allow auditd_t auditd_log_t:dir setattr;
 allow auditd_t auditd_log_t:file { append_file_perms create_file_perms link read_file_perms rename_file_perms setattr_file_perms unlink };
@@ -497,6 +497,8 @@ term_write_unallocated_ttys(syslogd_t)
 # for sending messages to logged in users
 init_read_utmp(syslogd_t)
 init_dontaudit_write_utmp(syslogd_t)
+init_read_generic_units_symlinks(syslogd_t)
+init_search_units(syslogd_t)
 term_write_all_ttys(syslogd_t)
 
 auth_use_nsswitch(syslogd_t)
Index: refpolicy-2.20260926/policy/modules/services/memlockd.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/memlockd.te
+++ refpolicy-2.20260926/policy/modules/services/memlockd.te
@@ -37,7 +37,9 @@ logging_send_syslog_msg(memlockd_t)
 miscfiles_read_localization(memlockd_t)
 
 sysnet_mmap_read_config(memlockd_t)
+sysnet_read_config(memlockd_t)
 
 ifndef(`distro_debian', `
 	allow memlockd_t self:capability dac_read_search;
 ')
+
Index: refpolicy-2.20260926/policy/modules/services/sysstat.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/sysstat.te
+++ refpolicy-2.20260926/policy/modules/services/sysstat.te
@@ -31,6 +31,7 @@ logging_log_filetrans(sysstat_t, sysstat
 
 can_exec(sysstat_t, sysstat_exec_t)
 
+kernel_read_psi(sysstat_t)
 kernel_read_system_state(sysstat_t)
 kernel_read_network_state(sysstat_t)
 kernel_read_kernel_sysctls(sysstat_t)
@@ -56,6 +57,7 @@ term_use_all_terms(sysstat_t)
 
 auth_use_nsswitch(sysstat_t)
 
+init_search_units(sysstat_t)
 init_use_fds(sysstat_t)
 
 locallogin_use_fds(sysstat_t)
Index: refpolicy-2.20260926/policy/modules/services/consolesetup.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/consolesetup.te
+++ refpolicy-2.20260926/policy/modules/services/consolesetup.te
@@ -51,6 +51,10 @@ term_use_unallocated_ttys(consolesetup_t
 
 miscfiles_read_localization(consolesetup_t)
 
-xserver_read_xkb_libs(consolesetup_t)
+optional_policy(`
+	loadkeys_domtrans(consolesetup_t)
+')
 
-loadkeys_domtrans(consolesetup_t)
+optional_policy(`
+	xserver_read_xkb_libs(consolesetup_t)
+')
Index: refpolicy-2.20260926/policy/modules/services/dbus.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/dbus.te
+++ refpolicy-2.20260926/policy/modules/services/dbus.te
@@ -236,7 +236,6 @@ ifdef(`init_systemd', `
 
 	tunable_policy(`dbus_broker_system_bus',`
 		init_get_system_status(system_dbusd_t)
-		init_get_generic_units_status(system_dbusd_t)
 		init_start_generic_units(system_dbusd_t)
 	')
 ')
@@ -324,6 +323,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	xdg_read_data_files(system_dbusd_t)
+')
+
+optional_policy(`
 	xserver_read_xdm_lib_files(system_dbusd_t)
 	xserver_use_xdm_fds(system_dbusd_t)
 ')
Index: refpolicy-2.20260926/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20260926/policy/modules/services/xserver.if
@@ -56,6 +56,9 @@ template(`xserver_restricted_role',`
 	stream_connect_pattern($2, xserver_tmp_t, xserver_tmp_t, xserver_t)
 	files_search_tmp($2)
 
+	# for /run/gdm3/dbus/
+	allow $2 xdm_var_run_t:sock_file write_sock_file_perms;
+
 	# Communicate via System V shared memory.
 	allow $2 xserver_t:fd use;
 	allow $2 xserver_t:shm r_shm_perms;
@@ -221,7 +224,7 @@ template(`xserver_role',`
 
 	xserver_read_xkb_libs($2)
 
-	allow $2 xdm_t:unix_stream_socket accept;
+	allow $2 xdm_t:unix_stream_socket { accept rw_socket_perms };
 
 	optional_policy(`
 		systemd_user_app_status($1, xserver_t)
Index: refpolicy-2.20260926/policy/modules/services/geoclue.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/geoclue.te
+++ refpolicy-2.20260926/policy/modules/services/geoclue.te
@@ -76,3 +76,12 @@ optional_policy(`
 	xserver_dbus_chat_xdm(geoclue_t)
 	xserver_read_xdm_state(geoclue_t)
 ')
+
+optional_policy(`
+	unconfined_dbus_send(geoclue_t)
+')
+
+optional_policy(`
+	xserver_dbus_chat_xdm(geoclue_t)
+	xserver_read_xdm_state(geoclue_t)
+')
Index: refpolicy-2.20260926/policy/modules/services/powerprofiles.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/powerprofiles.te
+++ refpolicy-2.20260926/policy/modules/services/powerprofiles.te
@@ -37,7 +37,7 @@ miscfiles_read_localization(power_profil
 policykit_dbus_chat(power_profilesd_t)
 systemd_dbus_chat_logind(power_profilesd_t)
 
-udev_search_runtime(power_profilesd_t)
+udev_read_runtime_files(power_profilesd_t)
 
 ifdef(`init_systemd',`
 	init_stream_connect(power_profilesd_t)
@@ -50,6 +50,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	devicekit_dbus_chat_power(power_profilesd_t)
+')
+
+optional_policy(`
 	unconfined_dbus_send(power_profilesd_t)
 ')
 
Index: refpolicy-2.20260926/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/authlogin.te
+++ refpolicy-2.20260926/policy/modules/system/authlogin.te
@@ -253,7 +253,9 @@ dev_read_urand(pam_domain)
 # for encrypted homedir
 dev_read_sysfs(pam_domain)
 
-auth_create_faillog_files(pam_domain)
+auth_manage_faillog(pam_domain)
+auth_log_filetrans_login_records(pam_domain, "wtmp.db-journal")
+auth_manage_login_records(pam_domain)
 auth_domtrans_upd_passwd(pam_domain)
 auth_rw_lastlog(pam_domain)
 auth_rw_faillog(pam_domain)
Index: refpolicy-2.20260926/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260926/policy/modules/apps/wm.if
@@ -77,6 +77,12 @@ template(`wm_role_template',`
 
 	domain_use_interactive_fds($1_wm_t)
 
+	files_usr_domtrans($1_wm_t, $2)
+
+	files_watch_etc_dirs($1_wm_t)
+	files_watch_usr_dirs($1_wm_t)
+	files_watch_var_lib_dirs($1_wm_t)
+
 	mls_file_read_all_levels($1_wm_t)
 	mls_file_write_all_levels($1_wm_t)
 	mls_xwin_read_all_levels($1_wm_t)
@@ -118,6 +124,15 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		colord_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
+		geoclue_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
+		gnome_mmap_read_xdg_config_files($1_wm_t)
 		gnome_stream_connect_all_gkeyringd($1_wm_t)
 	')
 
@@ -144,7 +159,10 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		systemd_list_userdb_runtime_dirs($1_wm_t)
+		systemd_read_logind_runtime_files($1_wm_t)
 		systemd_read_logind_state($1_wm_t)
+		systemd_search_user_runtime($1_wm_t)
 		systemd_use_logind_fds($1_wm_t)
 		systemd_user_app_status($1, $1_wm_t)
 		systemd_write_inherited_logind_inhibit_pipes($1_wm_t)
Index: refpolicy-2.20260926/policy/modules/apps/chromium.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/apps/chromium.te
+++ refpolicy-2.20260926/policy/modules/apps/chromium.te
@@ -304,6 +304,7 @@ optional_policy(`
 	optional_policy(`
 		systemd_list_resolved_runtime(chromium_t)
 		systemd_dbus_chat_hostnamed(chromium_t)
+		systemd_dbus_chat_logind(chromium_t)
 	')
 
 	optional_policy(`
Index: refpolicy-2.20260926/policy/modules/services/rasdaemon.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/rasdaemon.te
+++ refpolicy-2.20260926/policy/modules/services/rasdaemon.te
@@ -40,8 +40,14 @@ dev_write_sysfs(rasdaemon_t)
 dev_read_urand(rasdaemon_t)
 dev_rw_cpu_microcode(rasdaemon_t)
 
+# for ipmitool
+corecmd_exec_shell(rasdaemon_t)
+corecmd_exec_bin(rasdaemon_t)
+files_read_usr_files(rasdaemon_t)
+
 files_search_var_lib(rasdaemon_t)
 fs_create_tracefs_dirs(rasdaemon_t)
+fs_list_pstore_dirs(rasdaemon_t)
 fs_rw_tracefs_files(rasdaemon_t)
 
 logging_send_syslog_msg(rasdaemon_t)
Index: refpolicy-2.20260926/policy/modules/system/authlogin.if
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/authlogin.if
+++ refpolicy-2.20260926/policy/modules/system/authlogin.if
@@ -1802,13 +1802,18 @@ interface(`auth_rw_login_records',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##      <summary>
+##      The name of the file being created.
+##      </summary>
+## </param>
 #
 interface(`auth_log_filetrans_login_records',`
 	gen_require(`
 		type wtmp_t;
 	')
 
-	logging_log_filetrans($1, wtmp_t, file)
+	logging_log_filetrans($1, wtmp_t, file, $2)
 ')
 
 ########################################
Index: refpolicy-2.20260926/policy/modules/services/rpcbind.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/rpcbind.te
+++ refpolicy-2.20260926/policy/modules/services/rpcbind.te
@@ -66,6 +66,7 @@ dev_read_cpu_online(rpcbind_t)
 domain_use_interactive_fds(rpcbind_t)
 
 files_read_etc_runtime_files(rpcbind_t)
+fs_getattr_xattr_fs(rpcbind_t)
 
 fs_getattr_xattr_fs(rpcbind_t)
 
Index: refpolicy-2.20260926/policy/modules/admin/usbguard.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/usbguard.te
+++ refpolicy-2.20260926/policy/modules/admin/usbguard.te
@@ -40,7 +40,7 @@ files_tmpfs_file(usbguard_tmpfs_t)
 #
 
 allow usbguard_t self:capability { chown dac_read_search fowner };
-allow usbguard_t self:process { getcap signal };
+allow usbguard_t self:process { getcap signal signull };
 allow usbguard_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow usbguard_t self:unix_stream_socket { connectto rw_stream_socket_perms };
 
@@ -66,6 +66,7 @@ setattr_files_pattern(usbguard_t, usbgua
 dev_rw_sysfs(usbguard_t)
 
 kernel_read_kernel_sysctls(usbguard_t)
+kernel_read_vm_overcommit_sysctl(usbguard_t)
 kernel_read_system_state(usbguard_t)
 kernel_search_debugfs(usbguard_t)
 kernel_dontaudit_getattr_proc(usbguard_t)
Index: refpolicy-2.20260926/policy/modules/services/apache.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/apache.te
+++ refpolicy-2.20260926/policy/modules/services/apache.te
@@ -483,6 +483,7 @@ dev_read_urand(httpd_t)
 dev_rw_crypto(httpd_t)
 dev_rwx_zero(httpd_t)
 
+domain_dontaudit_search_all_domains_state(httpd_t)
 domain_use_interactive_fds(httpd_t)
 
 fs_getattr_all_fs(httpd_t)
@@ -509,6 +510,7 @@ files_map_etc_files(httpd_t)
 
 auth_use_nsswitch(httpd_t)
 
+init_read_state(httpd_t)
 init_rw_inherited_script_tmp_files(httpd_t)
 
 libs_exec_lib_files(httpd_t)
Index: refpolicy-2.20260926/policy/modules/services/accountsd.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/accountsd.te
+++ refpolicy-2.20260926/policy/modules/services/accountsd.te
@@ -51,6 +51,7 @@ auth_use_nsswitch(accountsd_t)
 auth_read_login_records(accountsd_t)
 auth_read_shadow(accountsd_t)
 
+init_read_generic_units_symlinks(accountsd_t)
 init_search_units(accountsd_t)
 
 miscfiles_read_localization(accountsd_t)
@@ -60,6 +61,9 @@ logging_send_syslog_msg(accountsd_t)
 logging_set_loginuid(accountsd_t)
 logging_watch_generic_logs_dir(accountsd_t)
 
+selinux_getattr_fs(accountsd_t)
+seutil_search_default_contexts(accountsd_t)
+
 userdom_read_user_tmp_files(accountsd_t)
 userdom_read_user_home_content_files(accountsd_t)
 
Index: refpolicy-2.20260926/policy/modules/services/fail2ban.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/fail2ban.te
+++ refpolicy-2.20260926/policy/modules/services/fail2ban.te
@@ -100,6 +100,7 @@ logging_watch_audit_log(fail2ban_t)
 logging_send_syslog_msg(fail2ban_t)
 
 miscfiles_read_localization(fail2ban_t)
+miscfiles_search_generic_cert_dirs(fail2ban_t)
 
 sysnet_manage_config(fail2ban_t)
 sysnet_etc_filetrans_config(fail2ban_t)
@@ -140,6 +141,7 @@ optional_policy(`
 
 allow fail2ban_client_t self:capability dac_read_search;
 allow fail2ban_client_t self:unix_stream_socket { connect create read write shutdown };
+allow fail2ban_client_t self:process getsched;
 
 domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
 
Index: refpolicy-2.20260926/policy/modules/services/ntp.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/ntp.te
+++ refpolicy-2.20260926/policy/modules/services/ntp.te
@@ -94,6 +94,7 @@ can_exec(ntpd_t, ntpd_exec_t)
 
 kernel_read_kernel_sysctls(ntpd_t)
 kernel_read_system_state(ntpd_t)
+kernel_read_net_sysctls(ntpd_t)
 kernel_read_network_state(ntpd_t)
 kernel_read_vm_overcommit_sysctl(ntpd_t)
 kernel_request_load_module(ntpd_t)
@@ -139,6 +140,7 @@ init_get_generic_units_status(ntpd_t)
 logging_send_syslog_msg(ntpd_t)
 
 miscfiles_read_localization(ntpd_t)
+miscfiles_search_generic_cert_dirs(ntpd_t)
 
 userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
 userdom_list_user_home_dirs(ntpd_t)
Index: refpolicy-2.20260926/policy/modules/services/bind.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/bind.te
+++ refpolicy-2.20260926/policy/modules/services/bind.te
@@ -81,7 +81,7 @@ allow named_t self:fifo_file rw_fifo_fil
 allow named_t self:unix_stream_socket { accept listen };
 allow named_t self:tcp_socket { accept listen };
 allow named_t self:anon_inode { create map read write };
-allow named_t self:io_uring sqpoll;
+allow named_t self:io_uring { sqpoll allowed };
 
 manage_files_pattern(named_t, dnssec_t, dnssec_t)
 filetrans_pattern(named_t, named_conf_t, dnssec_t, dir, "cache")
@@ -225,7 +225,7 @@ allow ndc_t self:process { getsched sets
 allow ndc_t self:fifo_file rw_fifo_file_perms;
 allow ndc_t self:unix_stream_socket { accept listen };
 allow ndc_t self:anon_inode { create map read write };
-allow ndc_t self:io_uring sqpoll;
+allow ndc_t self:io_uring { sqpoll allowed };
 
 allow ndc_t dnssec_t:file read_file_perms;
 allow ndc_t dnssec_t:lnk_file read_lnk_file_perms;
@@ -238,6 +238,7 @@ allow ndc_t named_conf_t:lnk_file read_l
 allow ndc_t named_zone_t:dir search_dir_perms;
 
 kernel_read_kernel_sysctls(ndc_t)
+kernel_read_net_sysctls(ndc_t)
 kernel_read_system_state(ndc_t)
 kernel_read_vm_overcommit_sysctl(ndc_t)
 
Index: refpolicy-2.20260926/policy/modules/services/mysql.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/mysql.te
+++ refpolicy-2.20260926/policy/modules/services/mysql.te
@@ -68,6 +68,7 @@ files_runtime_file(mysqlmanagerd_runtime
 allow mysqld_t self:capability { dac_override dac_read_search ipc_lock setgid setuid sys_resource };
 dontaudit mysqld_t self:capability sys_tty_config;
 allow mysqld_t self:process { getcap getsched rlimitinh setrlimit setsched signal_perms };
+allow mysqld_t self:io_uring allowed;
 allow mysqld_t self:fifo_file rw_fifo_file_perms;
 allow mysqld_t self:shm create_shm_perms;
 allow mysqld_t self:unix_stream_socket { accept connectto listen };
Index: refpolicy-2.20260926/policy/modules/services/switcheroo.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/switcheroo.te
+++ refpolicy-2.20260926/policy/modules/services/switcheroo.te
@@ -20,10 +20,12 @@ allow switcheroo_t self:netlink_kobject_
 
 kernel_read_system_state(switcheroo_t)
 
+dev_getattr_sysfs(switcheroo_t)
 dev_read_sysfs(switcheroo_t)
 
 miscfiles_read_localization(switcheroo_t)
 
+udev_read_runtime_files(switcheroo_t)
 udev_search_runtime(switcheroo_t)
 
 optional_policy(`
Index: refpolicy-2.20260926/policy/modules/services/rpc.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/rpc.te
+++ refpolicy-2.20260926/policy/modules/services/rpc.te
@@ -316,6 +316,8 @@ optional_policy(`
 allow nfsd_t self:capability { dac_override dac_read_search lease net_admin setpcap sys_admin sys_resource };
 allow nfsd_t self:netlink_generic_socket create_socket_perms;
 allow nfsd_t self:process setcap;
+allow nfsd_t self:netlink_generic_socket create_socket_perms;
+allow nfsd_t self:udp_socket listen;
 
 allow nfsd_t exports_t:file read_file_perms;
 allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms;
Index: refpolicy-2.20260926/policy/modules/system/libraries.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/libraries.fc
+++ refpolicy-2.20260926/policy/modules/system/libraries.fc
@@ -53,6 +53,8 @@ ifdef(`distro_redhat',`
 
 /opt/intel/oneapi/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:lib_t,s0)
 
+/opt/intel/oneapi/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:lib_t,s0)
+
 /opt/openoffice4/program/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:lib_t,s0)
 
 /opt/(.*/)?/RealPlayer/.+\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
Index: refpolicy-2.20260926/policy/modules/services/boinc.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/boinc.te
+++ refpolicy-2.20260926/policy/modules/services/boinc.te
@@ -60,6 +60,7 @@ allow boinc_t self:tcp_socket { accept l
 allow boinc_t self:shm create_shm_perms;
 allow boinc_t self:fifo_file rw_fifo_file_perms;
 allow boinc_t self:sem create_sem_perms;
+allow boinc_t self:cap_userns sys_ptrace;
 
 can_exec(boinc_t, boinc_exec_t)
 
@@ -91,12 +92,14 @@ libs_exec_lib_files(boinc_t)
 libs_legacy_use_ld_so(boinc_t)
 
 domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
+allow boinc_t boinc_project_t:process sigkill;
 
 kernel_read_system_state(boinc_t)
 kernel_read_vm_sysctls(boinc_t)
 kernel_read_vm_overcommit_sysctl(boinc_t)
 kernel_read_kernel_sysctls(boinc_t)
 kernel_read_net_sysctls(boinc_t)
+kernel_read_network_state_symlinks(boinc_t)
 
 corenet_all_recvfrom_netlabel(boinc_t)
 corenet_tcp_sendrecv_generic_if(boinc_t)
@@ -124,6 +127,8 @@ corenet_tcp_connect_squid_port(boinc_t)
 corecmd_exec_bin(boinc_t)
 corecmd_exec_shell(boinc_t)
 
+dev_getattr_input_dev(boinc_t)
+dev_getattr_mouse_dev(boinc_t)
 dev_read_rand(boinc_t)
 dev_read_urand(boinc_t)
 dev_read_sysfs(boinc_t)
@@ -168,6 +173,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_tmpfilesd_managed(boinc_var_lib_t)
+')
+
+optional_policy(`
 	tunable_policy(`boinc_use_gpu',`
 		corenet_tcp_connect_xserver_port(boinc_t)
 
@@ -183,7 +192,7 @@ optional_policy(`
 #
 
 allow boinc_project_t self:capability { setgid setuid };
-allow boinc_project_t self:process { execmem execstack getcap noatsecure ptrace setcap setpgid setsched signal_perms };
+allow boinc_project_t self:process { execmem execstack getcap noatsecure ptrace setcap setpgid setsched getsched signal_perms };
 
 manage_dirs_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
 manage_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
@@ -193,7 +202,7 @@ files_tmp_filetrans(boinc_project_t, boi
 manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 
-allow boinc_project_t boinc_var_lib_t:dir search;
+allow boinc_project_t boinc_var_lib_t:dir { search getattr };
 allow boinc_project_t boinc_var_lib_t:file rw_inherited_file_perms;
 
 allow boinc_project_t boinc_project_var_lib_t:file execmod;
@@ -216,12 +225,14 @@ corenet_tcp_bind_generic_node(boinc_proj
 corenet_sendrecv_boinc_client_packets(boinc_project_t)
 corenet_tcp_connect_boinc_port(boinc_project_t)
 
-dev_getattr_input_dev(boinc_t)
-dev_getattr_mouse_dev(boinc_t)
+dev_read_sysfs(boinc_project_t)
+dev_rw_dri(boinc_project_t)
 
 files_dontaudit_search_home(boinc_project_t)
 files_read_etc_files(boinc_project_t)
 
+init_dontaudit_use_fds(boinc_project_t)
+
 miscfiles_read_localization(boinc_project_t)
 
 term_getattr_ptmx(boinc_t)
Index: refpolicy-2.20260926/policy/modules/services/aptcacher.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/aptcacher.te
+++ refpolicy-2.20260926/policy/modules/services/aptcacher.te
@@ -102,6 +102,7 @@ sysnet_mmap_config_files(aptcacher_t)
 allow acngtool_t self:capability dac_override;
 allow acngtool_t self:tcp_socket create_stream_socket_perms;
 allow acngtool_t self:unix_stream_socket create_socket_perms;
+allow acngtool_t self:process signal;
 
 allow acngtool_t aptcacher_conf_t:dir list_dir_perms;
 allow acngtool_t aptcacher_conf_t:file mmap_read_file_perms;
Index: refpolicy-2.20260926/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20260926/policy/modules/services/devicekit.te
@@ -87,6 +87,7 @@ allow devicekit_disk_t devicekit_runtime
 manage_dirs_pattern(devicekit_disk_t, devicekit_runtime_t, devicekit_runtime_t)
 manage_files_pattern(devicekit_disk_t, devicekit_runtime_t, devicekit_runtime_t)
 files_runtime_filetrans(devicekit_disk_t, devicekit_runtime_t, { dir file })
+fs_tmpfs_filetrans(devicekit_disk_t, devicekit_runtime_t, file)
 
 kernel_getattr_message_if(devicekit_disk_t)
 kernel_list_unlabeled(devicekit_disk_t)
@@ -139,7 +140,7 @@ fs_search_all(devicekit_disk_t)
 mls_file_read_all_levels(devicekit_disk_t)
 mls_file_write_to_clearance(devicekit_disk_t)
 
-mount_rw_runtime_files(devicekit_disk_t)
+mount_manage_runtime_files(devicekit_disk_t)
 mount_watch_runtime_dirs(devicekit_disk_t)
 mount_watch_runtime_files(devicekit_disk_t)
 mount_watch_runtime_files_reads(devicekit_disk_t)
@@ -184,6 +185,7 @@ optional_policy(`
 
 optional_policy(`
 	lvm_domtrans(devicekit_disk_t)
+	lvm_manage_runtime_files(devicekit_disk_t)
 ')
 
 optional_policy(`
@@ -359,6 +361,7 @@ optional_policy(`
 
 optional_policy(`
 	udev_manage_runtime_files(devicekit_power_t)
+	udev_read_runtime_files(devicekit_power_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260926/policy/modules/services/dovecot.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/dovecot.te
+++ refpolicy-2.20260926/policy/modules/services/dovecot.te
@@ -113,7 +113,7 @@ allow dovecot_t dovecot_cert_t:lnk_file
 allow dovecot_t dovecot_keytab_t:file read_file_perms;
 
 manage_dirs_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
-manage_files_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
+mmap_manage_files_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
 files_tmp_filetrans(dovecot_t, dovecot_tmp_t, { file dir })
 
 manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
@@ -130,7 +130,7 @@ mmap_manage_files_pattern(dovecot_t, dov
 manage_lnk_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
 
 manage_dirs_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
-manage_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
+mmap_manage_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
 manage_lnk_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
 manage_sock_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
 manage_fifo_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
Index: refpolicy-2.20260926/policy/modules/services/samba.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/samba.te
+++ refpolicy-2.20260926/policy/modules/services/samba.te
@@ -221,6 +221,7 @@ mmap_manage_files_pattern(samba_net_t, s
 manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t)
 files_var_filetrans(samba_net_t, samba_var_t, dir, "samba")
 
+kernel_getattr_proc(samba_net_t)
 kernel_read_system_state(samba_net_t)
 kernel_read_network_state(samba_net_t)
 
@@ -623,6 +624,7 @@ allow smbcontrol_t self:fifo_file rw_fif
 allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms;
 allow smbcontrol_t self:unix_dgram_socket create_socket_perms;
 allow smbcontrol_t self:process { signal signull };
+allow smbcontrol_t self:netlink_route_socket { create bind };
 
 allow smbcontrol_t { winbind_t nmbd_t smbd_t }:process { signal signull };
 allow smbcontrol_t { smbd_t nmbd_t }:unix_dgram_socket sendto;
Index: refpolicy-2.20260926/policy/modules/system/fwupd.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/fwupd.te
+++ refpolicy-2.20260926/policy/modules/system/fwupd.te
@@ -88,6 +88,7 @@ allow fwupd_t fwupd_tmp_t:file manage_fi
 
 kernel_read_kernel_sysctls(fwupd_t)
 kernel_read_net_sysctls(fwupd_t)
+kernel_read_network_state_symlinks(fwupd_t)
 # for /proc/filesystems etc
 kernel_read_system_state(fwupd_t)
 kernel_read_vm_overcommit_sysctl(fwupd_t)
Index: refpolicy-2.20260926/policy/modules/services/certbot.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/certbot.te
+++ refpolicy-2.20260926/policy/modules/services/certbot.te
@@ -38,6 +38,7 @@ files_type(certbot_lib_t)
 #
 
 allow certbot_t self:fifo_file rw_inherited_fifo_file_perms;
+allow certbot_t self:process getsched;
 allow certbot_t self:capability { chown dac_override fsetid sys_resource };
 dontaudit certbot_t self:capability net_admin;
 allow certbot_t self:udp_socket all_udp_socket_perms;
Index: refpolicy-2.20260926/policy/modules/admin/apt.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/apt.te
+++ refpolicy-2.20260926/policy/modules/admin/apt.te
@@ -41,7 +41,7 @@ logging_log_file(apt_var_log_t)
 
 allow apt_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid };
 dontaudit apt_t self:capability net_admin;
-allow apt_t self:process { fork setpgid signal getsched };
+allow apt_t self:process { fork setpgid signal getsched setsched };
 allow apt_t self:fd use;
 allow apt_t self:fifo_file rw_fifo_file_perms;
 allow apt_t self:unix_dgram_socket sendto;
@@ -57,6 +57,7 @@ allow apt_t self:netlink_route_socket r_
 allow apt_t apt_lock_t:dir manage_dir_perms;
 allow apt_t apt_lock_t:file manage_file_perms;
 files_lock_filetrans(apt_t, apt_lock_t, { dir file })
+files_runtime_filetrans(apt_t, apt_lock_t, { file })
 
 manage_dirs_pattern(apt_t, apt_tmp_t, apt_tmp_t)
 mmap_manage_files_pattern(apt_t, apt_tmp_t, apt_tmp_t)
@@ -80,6 +81,7 @@ manage_files_pattern(apt_t, apt_var_lib_
 files_var_lib_filetrans(apt_t, apt_var_lib_t, dir)
 allow apt_t apt_var_lib_t:dir { manage_dir_perms watch };
 manage_lnk_files_pattern(apt_t, apt_var_lib_t, apt_var_lib_t)
+allow apt_t apt_var_lib_t:sock_file manage_sock_file_perms;
 
 allow apt_t apt_var_log_t:file manage_file_perms;
 allow apt_t apt_var_log_t:dir manage_dir_perms;
@@ -113,12 +115,14 @@ files_list_boot(apt_t)
 files_read_etc_files(apt_t)
 files_read_etc_runtime_files(apt_t)
 files_read_runtime_files(apt_t)
+files_rw_runtime_dirs(apt_t)
 files_watch_etc_dirs(apt_t)
 
 fs_getattr_all_fs(apt_t)
 
 init_get_system_status(apt_t)
 init_read_state(apt_t)
+init_search_units(apt_t)
 init_unix_stream_socket_connectto(apt_t)
 
 term_create_pty(apt_t, apt_devpts_t)
Index: refpolicy-2.20260926/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260926/policy/modules/kernel/corecommands.fc
@@ -48,6 +48,8 @@ ifdef(`distro_redhat',`
 
 /etc/etckeeper/[^/]+/[^/]+	--	gen_context(system_u:object_r:bin_t,s0)
 
+/etc/etckeeper/[^/]+/[^/]+	--	gen_context(system_u:object_r:bin_t,s0)
+
 /etc/hotplug/.*agent		--	gen_context(system_u:object_r:bin_t,s0)
 /etc/hotplug/.*rc		-- 	gen_context(system_u:object_r:bin_t,s0)
 /etc/hotplug/hotplug\.functions --	gen_context(system_u:object_r:bin_t,s0)
@@ -349,6 +351,7 @@ ifdef(`distro_debian',`
 /usr/share/gnome-sound-recorder/org\.gnome\.SoundRecorder	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0)
 /usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/gpm/gpm-systemd-wrapper.sh -- gen_context(system_u:object_r:bin_t,s0)
 /usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0)
 /usr/share/hal/scripts(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/share/ifupdown2/__main__\.py	--	gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20260926/policy/modules/services/postfix.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/postfix.te
+++ refpolicy-2.20260926/policy/modules/services/postfix.te
@@ -293,6 +293,7 @@ domain_use_interactive_fds(postfix_maste
 files_search_tmp(postfix_master_t)
 
 init_read_state(postfix_master_t)
+init_search_units(postfix_master_t)
 
 term_dontaudit_search_ptys(postfix_master_t)
 
Index: refpolicy-2.20260926/policy/modules/services/acpi.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/acpi.te
+++ refpolicy-2.20260926/policy/modules/services/acpi.te
@@ -15,11 +15,6 @@ init_daemon_domain(acpid_t, acpid_exec_t
 type acpid_initrc_exec_t;
 init_script_file(acpid_initrc_exec_t)
 
-type acpi_t;
-type acpi_exec_t;
-application_domain(acpi_t, acpi_exec_t)
-role acpi_roles types acpi_t;
-
 type acpid_lock_t;
 files_lock_file(acpid_lock_t)
 
@@ -40,30 +35,12 @@ files_type(acpid_var_lib_t)
 
 ########################################
 #
-# Client local policy
-#
-
-allow acpi_t self:capability { dac_override sys_admin };
-
-kernel_read_system_state(acpi_t)
-
-dev_rw_acpi_bios(acpi_t)
-
-fs_getattr_xattr_fs(acpi_t)
-
-term_use_all_terms(acpi_t)
-
-domain_use_interactive_fds(acpi_t)
-
-logging_send_syslog_msg(acpi_t)
-
-########################################
-#
 # Server local policy
 #
 
 allow acpid_t self:capability { kill mknod sys_admin sys_nice sys_time };
 dontaudit acpid_t self:capability { dac_override dac_read_search setuid sys_ptrace sys_tty_config };
+allow acpid_t self:capability2 perfmon;
 allow acpid_t self:process { getsession signal_perms getsched };
 
 allow acpid_t self:fifo_file rw_fifo_file_perms;
Index: refpolicy-2.20260926/policy/modules/system/needrestart.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/needrestart.te
+++ refpolicy-2.20260926/policy/modules/system/needrestart.te
@@ -14,6 +14,9 @@ role needrestart_roles types needrestart
 type needrestart_tmp_t;
 files_tmp_file(needrestart_tmp_t)
 
+type needrestart_run_t;
+files_runtime_file(needrestart_run_t)
+
 ########################################
 #
 # Local policy
@@ -24,14 +27,18 @@ dontaudit needrestart_t self:capability
 # sys_resource is for sd-askpwagent
 allow needrestart_t self:capability { dac_read_search kill sys_ptrace sys_resource };
 allow needrestart_t self:capability2 checkpoint_restore;
-allow needrestart_t self:process { getcap signal setrlimit };
+allow needrestart_t self:process { getsched getcap signal setrlimit };
 allow needrestart_t self:fifo_file rw_fifo_file_perms;
 
 # for /proc/*/cwd etc
 allow needrestart_t self:cap_userns sys_ptrace;
 
 allow needrestart_t needrestart_tmp_t:dir manage_dir_perms;
-files_tmp_filetrans(needrestart_t, needrestart_tmp_t, { dir })
+files_tmp_filetrans(needrestart_t, needrestart_tmp_t, { dir file })
+
+allow needrestart_t needrestart_run_t:dir manage_dir_perms;
+allow needrestart_t needrestart_run_t:file manage_file_perms;
+files_runtime_filetrans(needrestart_t, needrestart_run_t, { file dir })
 
 kernel_getattr_core_if(needrestart_t)
 kernel_read_kernel_sysctls(needrestart_t)
@@ -63,6 +70,7 @@ files_exec_etc_files(needrestart_t)
 
 files_list_boot(needrestart_t)
 files_read_kernel_img(needrestart_t)
+files_read_kernel_modules(needrestart_t)
 
 # for /var/cache/debconf/config.dat do we need a different label for that?
 files_read_var_files(needrestart_t)
@@ -76,11 +84,15 @@ files_search_var_lib(needrestart_t)
 
 fs_getattr_cgroup(needrestart_t)
 fs_getattr_nsfs_files(needrestart_t)
+fs_getattr_xattr_fs(needrestart_t)
+fs_list_tmpfs(needrestart_t)
 
 init_admin(needrestart_t)
 init_list_var_lib_dirs(needrestart_t)
 init_manage_all_units(needrestart_t)
 init_read_state(needrestart_t)
+init_read_utmp(needrestart_t)
+init_search_units(needrestart_t)
 init_start_generic_units(needrestart_t)
 init_unix_stream_socket_connectto(needrestart_t)
 
@@ -96,7 +108,13 @@ term_read_console(needrestart_t)
 userdom_use_user_ptys(needrestart_t)
 
 optional_policy(`
+	apache_list_modules(needrestart_t)
+	apache_read_module_files(needrestart_t)
+')
+
+optional_policy(`
 	dpkg_read_db(needrestart_t)
+	dpkg_dontaudit_manage_db(needrestart_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260926/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/selinuxutil.te
+++ refpolicy-2.20260926/policy/modules/system/selinuxutil.te
@@ -362,6 +362,7 @@ files_runtime_filetrans(restorecond_t, r
 allow restorecond_t selinux_config_t:file watch;
 
 kernel_getattr_debugfs(restorecond_t)
+kernel_getattr_proc(restorecond_t)
 kernel_read_system_state(restorecond_t)
 kernel_rw_pipes(restorecond_t)
 kernel_use_fds(restorecond_t)
Index: refpolicy-2.20260926/policy/modules/system/opensnitch.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/opensnitch.te
+++ refpolicy-2.20260926/policy/modules/system/opensnitch.te
@@ -29,7 +29,7 @@ files_config_file(opensnitchd_conf_t)
 type opensnitchd_log_t;
 logging_log_file(opensnitchd_log_t)
 
-allow opensnitchd_t self:capability { dac_override dac_read_search net_admin sys_ptrace sys_resource };
+allow opensnitchd_t self:capability { dac_override dac_read_search net_admin sys_ptrace sys_admin sys_resource };
 allow opensnitchd_t self:capability2 { bpf perfmon };
 allow opensnitchd_t self:cap_userns sys_ptrace;
 allow opensnitchd_t self:bpf { map_create map_read map_write prog_load prog_run };
Index: refpolicy-2.20260926/testing/sechecker.ini
===================================================================
--- refpolicy-2.20260926.orig/testing/sechecker.ini
+++ refpolicy-2.20260926/testing/sechecker.ini
@@ -135,6 +135,7 @@ exempt_source = acpi_t
                 newrole_t           # Conditional access (allow_polyinstantiation)
                 nfsd_t
                 ntop_t
+		opensnitchd_t	    # perf_event_open
                 plymouthd_t
                 podman_t
                 podman_user_t
Index: refpolicy-2.20260926/policy/modules/admin/dpkg.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/dpkg.te
+++ refpolicy-2.20260926/policy/modules/admin/dpkg.te
@@ -53,7 +53,7 @@ files_tmpfs_file(dpkg_script_tmpfs_t)
 # Local policy
 #
 
-allow dpkg_t self:capability { chown dac_override fowner fsetid kill linux_immutable mknod setgid setuid sys_nice sys_resource sys_tty_config };
+allow dpkg_t self:capability { chown dac_override dac_read_search fowner fsetid kill linux_immutable mknod setgid setuid sys_nice sys_resource sys_tty_config };
 allow dpkg_t self:process { fork getsched setfscreate setpgid };
 allow dpkg_t self:fd use;
 allow dpkg_t self:fifo_file rw_fifo_file_perms;
@@ -72,7 +72,7 @@ can_exec(dpkg_t,  dpkg_exec_t)
 
 allow dpkg_t dpkg_lock_t:file manage_file_perms;
 
-spec_domtrans_pattern(dpkg_t, dpkg_var_lib_t, dpkg_script_t)
+domtrans_pattern(dpkg_t, dpkg_var_lib_t, dpkg_script_t)
 spec_domtrans_pattern(dpkg_t, dpkg_script_tmp_t, dpkg_script_t)
 
 manage_dirs_pattern(dpkg_t, dpkg_tmp_t, dpkg_tmp_t)
@@ -237,10 +237,11 @@ allow dpkg_script_t dpkg_script_tmpfs_t:
 fs_tmpfs_filetrans(dpkg_script_t, dpkg_script_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
 kernel_getattr_proc(dpkg_script_t)
-kernel_read_kernel_sysctls(dpkg_script_t)
 kernel_read_software_raid_state(dpkg_script_t)
 kernel_read_system_state(dpkg_script_t)
 kernel_read_vm_overcommit_sysctl(dpkg_script_t)
+kernel_read_vm_sysctls(dpkg_script_t)
+kernel_rw_kernel_sysctl(dpkg_script_t)
 
 corecmd_exec_all_executables(dpkg_script_t)
 
@@ -391,6 +392,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	sysadm_rw_pipes(dpkg_script_t)
+')
+
+optional_policy(`
+	systemd_connect_machined(dpkg_script_t)
 	systemd_read_logind_state(dpkg_script_t)
 	systemd_dbus_chat_hostnamed(dpkg_script_t)
 	systemd_dbus_chat_logind(dpkg_script_t)
@@ -398,6 +404,7 @@ optional_policy(`
 	systemd_watch_passwd_runtime_dirs(dpkg_script_t)
 	systemd_reload_all_user_sessions(dpkg_script_t)
 	systemd_status_all_user_sessions(dpkg_script_t)
+	systemd_run_passwd_agent(dpkg_script_t, system_r)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260926/policy/modules/services/apache.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/apache.fc
+++ refpolicy-2.20260926/policy/modules/services/apache.fc
@@ -62,6 +62,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*
 /usr/lib/dirsrv/cgi-bin(/.*)?					gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
 /usr/lib/httpd(/.*)?						gen_context(system_u:object_r:httpd_modules_t,s0)
 /usr/lib/lighttpd(/.*)?						gen_context(system_u:object_r:httpd_modules_t,s0)
+/usr/lib/php/sessionclean				--	gen_context(system_u:object_r:httpd_exec_t,s0)
 /usr/lib/systemd/system/apache[^/]*\.service		--	gen_context(system_u:object_r:httpd_unit_t,s0)
 /usr/lib/systemd/system/httpd.*\.service		--	gen_context(system_u:object_r:httpd_unit_t,s0)
 /usr/lib/systemd/system/jetty.*\.service		--	gen_context(system_u:object_r:httpd_unit_t,s0)
Index: refpolicy-2.20260926/policy/modules/admin/dpkg.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/dpkg.fc
+++ refpolicy-2.20260926/policy/modules/admin/dpkg.fc
@@ -6,6 +6,8 @@
 /usr/bin/dpkg-reconfigure	--	gen_context(system_u:object_r:dpkg_exec_t,s0)
 /usr/bin/dselect	--	gen_context(system_u:object_r:dpkg_exec_t,s0)
 
+/var/cache/debconf(/.*)?	gen_context(system_u:object_r:dpkg_var_lib_t,s0)
+
 /var/lib/debtags(/.*)?	gen_context(system_u:object_r:dpkg_var_lib_t,s0)
 /var/lib/dpkg(/.*)?	gen_context(system_u:object_r:dpkg_var_lib_t,s0)
 /var/lib/dpkg/(meth)?lock	--	gen_context(system_u:object_r:dpkg_lock_t,s0)
Index: refpolicy-2.20260926/policy/modules/admin/backup.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/backup.fc
+++ refpolicy-2.20260926/policy/modules/admin/backup.fc
@@ -2,4 +2,6 @@
 /etc/cron\.daily/passwd	--	gen_context(system_u:object_r:backup_exec_t,s0)
 /etc/cron\.daily/standard	--	gen_context(system_u:object_r:backup_exec_t,s0)
 
+/usr/libexec/dpkg/dpkg-db-backup --	gen_context(system_u:object_r:backup_exec_t,s0)
+
 /var/backups(/.*)?	gen_context(system_u:object_r:backup_store_t,s0)
Index: refpolicy-2.20260926/policy/modules/admin/backup.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/backup.te
+++ refpolicy-2.20260926/policy/modules/admin/backup.te
@@ -11,6 +11,7 @@ roleattribute system_r backup_roles;
 type backup_t;
 type backup_exec_t;
 application_domain(backup_t, backup_exec_t)
+init_domain(backup_t, backup_exec_t)
 role backup_roles types backup_t;
 
 type backup_store_t;
Index: refpolicy-2.20260926/policy/modules/admin/apt.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/admin/apt.fc
+++ refpolicy-2.20260926/policy/modules/admin/apt.fc
@@ -1,5 +1,7 @@
 /etc/cron\.daily/apt	--	gen_context(system_u:object_r:apt_exec_t,s0)
 
+/run/unattended-upgrades.lock --	gen_context(system_u:object_r:apt_lock_t,s0)
+
 /usr/bin/apt		--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/apt-get	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:apt_exec_t,s0)
Index: refpolicy-2.20260926/policy/modules/system/needrestart.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/system/needrestart.fc
+++ refpolicy-2.20260926/policy/modules/system/needrestart.fc
@@ -1 +1,3 @@
 /usr/bin/needrestart	--	gen_context(system_u:object_r:needrestart_exec_t,s0)
+
+/run/needrestart(/.*)?		gen_context(system_u:object_r:needrestart_run_t,s0)
Index: refpolicy-2.20260926/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20260926/policy/modules/kernel/kernel.te
@@ -422,6 +422,7 @@ ifdef(`init_systemd',`
 	optional_policy(`
 		dev_manage_input_dev(kernel_t)
 		dev_filetrans_input_dev(kernel_t)
+		dev_filetrans_null_dev(kernel_t, "full")
 		dev_filetrans_vsock_dev(kernel_t)
 	')
 
@@ -537,6 +538,10 @@ optional_policy(`
 		gssproxy_stream_connect(kernel_t)
 	')
 
+	optional_policy(`
+		rpcbind_stream_connect(kernel_t)
+	')
+
 	tunable_policy(`nfs_export_all_ro',`
 		fs_getattr_noxattr_fs(kernel_t)
 		fs_list_noxattr_fs(kernel_t)
Index: refpolicy-2.20260926/policy/modules/services/rpc.fc
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/rpc.fc
+++ refpolicy-2.20260926/policy/modules/services/rpc.fc
@@ -6,7 +6,9 @@
 /etc/rc\.d/init\.d/rpcidmapd	--	gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
 
 /usr/bin/blkmapd	--	gen_context(system_u:object_r:blkmapd_exec_t,s0)
+/usr/bin/exportfs	--	gen_context(system_u:object_r:nfsd_exec_t,s0)
 /usr/bin/nfsdcld	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
+/usr/bin/nfsdctl	--	gen_context(system_u:object_r:nfsd_exec_t,s0)
 /usr/bin/rpc\..*	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 /usr/bin/rpc\.idmapd	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 /usr/bin/rpc\.gssd	--	gen_context(system_u:object_r:gssd_exec_t,s0)
Index: refpolicy-2.20260926/policy/modules/services/tftp.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/tftp.te
+++ refpolicy-2.20260926/policy/modules/services/tftp.te
@@ -74,6 +74,7 @@ corenet_sendrecv_tftp_server_packets(tft
 corenet_udp_bind_tftp_port(tftpd_t)
 
 dev_read_sysfs(tftpd_t)
+dev_read_urand(tftpd_t)
 
 domain_use_interactive_fds(tftpd_t)
 
Index: refpolicy-2.20260926/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20260926/policy/modules/services/xserver.te
@@ -774,8 +774,8 @@ allow xserver_t input_xevent_t:x_event s
 # execheap needed until the X module loader is fixed.
 # NVIDIA Needs execstack
 
-allow xserver_t self:capability { dac_override fowner fsetid ipc_owner mknod net_bind_service setgid setuid sys_admin sys_nice sys_rawio sys_tty_config };
-dontaudit xserver_t self:capability chown;
+allow xserver_t self:capability { dac_override dac_read_search fowner fsetid ipc_owner mknod net_bind_service setgid setuid sys_admin sys_nice sys_rawio sys_tty_config };
+dontaudit xserver_t self:capability { chown net_admin };
 allow xserver_t self:capability2 wake_alarm;
 allow xserver_t self:process { dyntransition fork getattr getcap getpgid getrlimit getsched getsession noatsecure rlimitinh setcap setkeycreate setpgid setsched setsockcreate share siginh signal_perms transition };
 allow xserver_t self:fd use;
@@ -831,6 +831,7 @@ allow xserver_t xauth_home_t:file read_f
 manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xserver_t, xserver_log_t, file)
 
+kernel_getattr_proc(xserver_t)
 kernel_read_system_state(xserver_t)
 kernel_read_device_sysctls(xserver_t)
 kernel_read_modprobe_sysctls(xserver_t)
Index: refpolicy-2.20260926/policy/modules/services/colord.te
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/services/colord.te
+++ refpolicy-2.20260926/policy/modules/services/colord.te
@@ -73,6 +73,7 @@ dev_read_video_dev(colord_t)
 dev_write_video_dev(colord_t)
 dev_rw_printer(colord_t)
 dev_read_rand(colord_t)
+dev_getattr_sysfs(colord_t)
 dev_read_sysfs(colord_t)
 dev_read_urand(colord_t)
 dev_list_sysfs(colord_t)
Index: refpolicy-2.20260926/policy/modules/kernel/devices.if
===================================================================
--- refpolicy-2.20260926.orig/policy/modules/kernel/devices.if
+++ refpolicy-2.20260926/policy/modules/kernel/devices.if
@@ -3822,6 +3822,30 @@ interface(`dev_manage_null_service',`
 
 ########################################
 ## <summary>
+##	Automatic type transition to the type
+##	for null device nodes when created in /dev.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`dev_filetrans_null_dev',`
+	gen_require(`
+		type device_t, null_device_t;
+	')
+
+	filetrans_pattern($1, device_t, null_device_t, chr_file, $2)
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to get the attributes
 ##	of the BIOS non-volatile RAM device.
 ## </summary>
