Index: refpolicy-2.20260801/config/appconfig-mcs/seusers
===================================================================
--- refpolicy-2.20260801.orig/config/appconfig-mcs/seusers
+++ refpolicy-2.20260801/config/appconfig-mcs/seusers
@@ -1,2 +1,4 @@
 root:root:s0-mcs_systemhigh
 __default__:user_u:s0
+sddm:xdm:s0
+Debian-gdm:xdm:s0
Index: refpolicy-2.20260801/config/appconfig-mls/seusers
===================================================================
--- refpolicy-2.20260801.orig/config/appconfig-mls/seusers
+++ refpolicy-2.20260801/config/appconfig-mls/seusers
@@ -1,2 +1,4 @@
 root:root:s0-mls_systemhigh
 __default__:user_u:s0
+sddm:xdm:s0
+Debian-gdm:xdm:s0
Index: refpolicy-2.20260801/config/appconfig-standard/seusers
===================================================================
--- refpolicy-2.20260801.orig/config/appconfig-standard/seusers
+++ refpolicy-2.20260801/config/appconfig-standard/seusers
@@ -1,2 +1,4 @@
 root:root
 __default__:user_u
+sddm:xdm:s0
+Debian-gdm:xdm:s0
Index: refpolicy-2.20260801/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20260801/policy/modules/services/xserver.te
@@ -89,8 +89,8 @@ gen_tunable(xserver_object_manager, fals
 gen_tunable(xserver_allow_dri, false)
 
 # for sddm to use pam for greeter
-role xdm_r;
-allow system_r xdm_r;
+role xdm_greeter_r;
+allow system_r xdm_greeter_r;
 
 attribute x_domain;
 
@@ -175,7 +175,7 @@ fs_associate_tmpfs(xconsole_device_t)
 files_associate_tmp(xconsole_device_t)
 
 type xdm_t;
-role xdm_r types xdm_t;
+role xdm_greeter_r types xdm_greeter_t;
 type xdm_exec_t;
 auth_login_pgm_domain(xdm_t)
 init_domain(xdm_t, xdm_exec_t)
@@ -313,6 +313,7 @@ userdom_read_user_tmp_files(xauth_t)
 
 xserver_rw_xdm_tmp_files(xauth_t)
 xserver_stream_connect(xauth_t)
+xserver_use_user_fonts(xdm_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_files(xauth_t)
@@ -335,15 +336,17 @@ optional_policy(`
 
 allow xdm_t self:capability { chown dac_override dac_read_search fowner fsetid ipc_owner kill mknod net_bind_service setgid setuid sys_nice sys_rawio sys_resource sys_tty_config };
 dontaudit xdm_t self:capability sys_admin;
-allow xdm_t self:process { getsched setexec setpgid setrlimit setsched signal_perms };
+allow xdm_t self:process { transition setcap getcap setfscreate getsched setexec setpgid setrlimit setsched signal_perms };
+allow xdm_t self:fd use;
 allow xdm_t self:fifo_file rw_fifo_file_perms;
 allow xdm_t self:shm create_shm_perms;
 allow xdm_t self:sem create_sem_perms;
 allow xdm_t self:unix_stream_socket { connectto create_stream_socket_perms };
-allow xdm_t self:unix_dgram_socket create_socket_perms;
+allow xdm_t self:unix_dgram_socket { sendto create_socket_perms };
 allow xdm_t self:socket create_socket_perms;
-allow xdm_t self:appletalk_socket create_socket_perms;
+allow xdm_t self:netlink_kobject_uevent_socket { create setopt bind getattr getopt read };
 allow xdm_t self:key { link search write };
+allow xdm_t self:bpf prog_load;
 
 # for sddm
 allow xdm_t xsession_exec_t:file entrypoint;
@@ -365,7 +368,7 @@ manage_files_pattern(xdm_t, xdm_rw_etc_t
 
 # files in /run/user/%{USERID}/*
 manage_dirs_pattern(xdm_t, xdm_runtime_t, xdm_runtime_t)
-manage_files_pattern(xdm_t, xdm_runtime_t, xdm_runtime_t)
+mmap_manage_files_pattern(xdm_t, xdm_runtime_t, xdm_runtime_t)
 
 manage_dirs_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
 manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
@@ -385,13 +388,15 @@ manage_files_pattern(xdm_t, xdm_auth_t,
 xserver_xdm_auth_filetrans(xdm_t, xdm_auth_t, file)
 
 manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
-manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
+mmap_manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
 files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file)
+allow xdm_t xdm_var_lib_t:dir watch;
 
 manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
 manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
 manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
-files_runtime_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file })
+manage_sock_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
+files_runtime_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file sock_file })
 
 allow xdm_t xserver_t:process signal;
 allow xdm_t xserver_t:unix_stream_socket connectto;
@@ -418,10 +423,15 @@ manage_files_pattern(xdm_t, xserver_log_
 manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)
 logging_log_filetrans(xdm_t, xserver_log_t, file)
 
+kernel_read_device_sysctls(xdm_t)
+kernel_read_fs_sysctls(xdm_t)
 kernel_read_system_state(xdm_t)
 kernel_read_kernel_sysctls(xdm_t)
 kernel_read_net_sysctls(xdm_t)
 kernel_read_network_state(xdm_t)
+kernel_read_psi(xdm_t)
+kernel_read_vm_overcommit_sysctl(xdm_t)
+kernel_search_key(xdm_t)
 kernel_view_key(xdm_t)
 
 corecmd_exec_shell(xdm_t)
@@ -429,14 +439,14 @@ corecmd_exec_bin(xdm_t)
 
 dev_read_rand(xdm_t)
 dev_read_sysfs(xdm_t)
+dev_read_sound(xdm_t)
+dev_write_sound(xdm_t)
 dev_getattr_framebuffer_dev(xdm_t)
 dev_setattr_framebuffer_dev(xdm_t)
 dev_getattr_mouse_dev(xdm_t)
 dev_setattr_mouse_dev(xdm_t)
 dev_rw_acpi_bios(xdm_t)
 dev_setattr_acpi_bios_dev(xdm_t)
-dev_rw_dri(xdm_t)
-dev_rw_agp(xdm_t)
 dev_getattr_xserver_misc_dev(xdm_t)
 dev_setattr_xserver_misc_dev(xdm_t)
 dev_getattr_misc_dev(xdm_t)
@@ -451,11 +461,16 @@ dev_setattr_sound_dev(xdm_t)
 dev_getattr_power_mgmt_dev(xdm_t)
 dev_setattr_power_mgmt_dev(xdm_t)
 
+auth_login_pgm_domain(xdm_t)
+
 domain_use_interactive_fds(xdm_t)
+domain_user_exemption_target(xdm_t)
 # Do not audit denied probes of /proc.
 domain_dontaudit_read_all_domains_state(xdm_t)
 
 files_read_etc_files(xdm_t)
+files_watch_etc_dirs(xdm_t)
+files_watch_etc_symlinks(xdm_t)
 files_read_var_files(xdm_t)
 files_read_etc_runtime_files(xdm_t)
 files_exec_etc_files(xdm_t)
@@ -463,14 +478,23 @@ files_list_mnt(xdm_t)
 # Read /usr/share/terminfo/l/linux and /usr/share/icons/default/index.theme...
 files_map_usr_files(xdm_t)
 files_read_usr_files(xdm_t)
+files_watch_usr_dirs(xdm_t)
 # Poweroff wants to create the /poweroff file when run from xdm
 files_create_boot_flag(xdm_t)
 
 fs_getattr_all_fs(xdm_t)
+fs_getattr_nsfs_files(xdm_t)
 fs_search_auto_mountpoints(xdm_t)
 fs_watch_memory_pressure(xdm_t)
+fs_create_cgroup_dirs(xdm_t)
+fs_delete_cgroup_dirs(xdm_t)
+fs_create_cgroup_files(xdm_t)
+fs_watch_cgroup_files(xdm_t)
+fs_rw_cgroup_files(xdm_t)
 
+mount_list_runtime(xdm_t)
 mount_watch_reads_runtime_files(xdm_t)
+mount_watch_runtime_dirs(xdm_t)
 
 storage_dontaudit_read_fixed_disk(xdm_t)
 storage_dontaudit_write_fixed_disk(xdm_t)
@@ -479,10 +503,13 @@ storage_dontaudit_raw_read_removable_dev
 storage_dontaudit_raw_write_removable_device(xdm_t)
 storage_dontaudit_setattr_removable_dev(xdm_t)
 storage_dontaudit_rw_scsi_generic(xdm_t)
+storage_rw_fuse(xdm_t)
 
 term_setattr_console(xdm_t)
 term_use_unallocated_ttys(xdm_t)
 term_setattr_unallocated_ttys(xdm_t)
+term_relabel_all_ttys(xdm_t)
+term_relabel_unallocated_ttys(xdm_t)
 
 auth_domtrans_pam_console(xdm_t)
 auth_manage_pam_runtime_dirs(xdm_t)
@@ -495,6 +522,8 @@ auth_write_login_records(xdm_t)
 # Run telinit->init to shutdown.
 init_telinit(xdm_t)
 
+init_get_system_status(xdm_t)
+
 init_pgm_entrypoint(xdm_t)
 
 libs_exec_lib_files(xdm_t)
@@ -505,14 +534,31 @@ miscfiles_read_hwdata(xdm_t)
 miscfiles_read_localization(xdm_t)
 miscfiles_read_fonts(xdm_t)
 
+selinux_use_status_page(xdm_t)
+seutil_read_file_contexts(xdm_t)
+
 sysnet_read_config(xdm_t)
 
 userdom_dontaudit_use_unpriv_user_fds(xdm_t)
-userdom_create_all_users_keys(xdm_t)
+userdom_manage_all_users_keys(xdm_t)
 # Search /proc for any user domain processes.
 userdom_read_all_users_state(xdm_t)
 userdom_signal_all_users(xdm_t)
 userdom_user_runtime_filetrans(xdm_t, xdm_runtime_t, dir)
+userdom_mmap_manage_user_runtime_files(xdm_t)
+
+userdom_read_user_home_content_symlinks(xdm_t)
+userdom_use_user_ttys(xdm_t)
+userdom_write_user_runtime_sockets(xdm_t)
+userdom_read_user_home_content_files(xdm_t)
+userdom_watch_user_runtime_dirs(xdm_t)
+xdg_generic_user_home_dir_filetrans_data(xdm_t, dir, ".local")
+xdg_read_config_files(xdm_t)
+xdg_manage_cache(xdm_t)
+xdg_manage_data(xdm_t)
+
+xserver_manage_mesa_shader_cache(xdm_t)
+xserver_read_xkb_libs(xdm_t)
 
 # for .dmrc: this was used by the Gnome Display Manager (gdm)
 # and it is now obsolete in Gnome3
@@ -522,6 +568,7 @@ xserver_manage_xsession_log(xdm_t)
 xserver_rw_session(xdm_t, xdm_tmpfs_t)
 xserver_unconfined(xdm_t)
 xserver_user_home_dir_filetrans_user_xsession_log(xdm_t)
+xserver_rw_mesa_shader_cache(xdm_t)
 
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(xdm_t)
@@ -549,8 +596,16 @@ tunable_policy(`xdm_sysadm_login',`
 #	allow xserver_t xdm_tmpfs_t:file rw_file_perms;
 ')
 
+tunable_policy(`xserver_allow_dri',`
+	dev_rw_dri(xdm_t)
+	dev_rw_agp(xdm_t)
+	dev_rw_dma_dev(xdm_t)
+')
+
 tunable_policy(`xserver_gnome_xdm',`
 	allow xdm_t self:process execmem;
+	dontaudit xdm_t xdm_tmpfs_t:file execute;
+	allow xdm_t xdm_var_lib_t:file execute;
 ')
 
 tunable_policy(`xserver_xdm_can_network',`
@@ -566,6 +621,7 @@ tunable_policy(`xserver_xdm_can_network'
 	corenet_udp_bind_generic_node(xdm_t)
 	corenet_tcp_connect_all_ports(xdm_t)
 	corenet_sendrecv_all_client_packets(xdm_t)
+	corenet_tcp_connect_xserver_port(xdm_t)
 	# xdm tries to bind to biff_port_t
 	corenet_dontaudit_tcp_bind_all_ports(xdm_t)
 ')
@@ -583,13 +639,18 @@ optional_policy(`
 ')
 
 optional_policy(`
-	allow xdm_t self:process getcap;
+	cups_dontaudit(xdm_t)
+')
 
+optional_policy(`
+	allow xdm_t self:dbus acquire_svc;
 	dbus_exec(xdm_t)
 	dbus_system_bus_client(xdm_t)
 	dbus_connect_system_bus(xdm_t)
+	dbus_write_session_runtime_socket(xdm_t)
 
 	optional_policy(`
+		accountsd_search_lib(xdm_t)
 		accountsd_dbus_chat(xdm_t)
 	')
 
@@ -606,9 +667,23 @@ optional_policy(`
 	')
 
 	optional_policy(`
+		init_dbus_chat(xdm_t)
+	')
+
+	optional_policy(`
+		auth_provide_userdb(xdm_t)
 		auth_use_pam_systemd(xdm_t)
 		systemd_dbus_chat_hostnamed(xdm_t)
 		systemd_read_logind_runtime_files(xdm_t)
+		systemd_read_logind_sessions_files(xdm_t)
+		systemd_read_user_runtime_units_files(xdm_t)
+		systemd_search_user_runtime(xdm_t)
+		systemd_write_user_runtime_socket(xdm_t)
+		systemd_connectto_logind(xdm_t)
+		systemd_link_all_user_keys(xdm_t)
+		systemd_search_all_user_keys(xdm_t)
+		systemd_watch_logind_sessions_dirs(xdm_t)
+		systemd_write_inherited_logind_inhibit_pipes(xdm_t)
 	')
 ')
 
@@ -649,20 +724,20 @@ optional_policy(`
 ')
 
 optional_policy(`
-	resmgr_stream_connect(xdm_t)
+	pulseaudio_manage_tmp_dirs(xdm_t)
+	pulseaudio_stream_connect(xdm_t)
 ')
 
 optional_policy(`
-	seutil_sigchld_newrole(xdm_t)
+	resmgr_stream_connect(xdm_t)
 ')
 
 optional_policy(`
-	shutdown_domtrans(xdm_t)
+	seutil_sigchld_newrole(xdm_t)
 ')
 
 optional_policy(`
-	unconfined_domain(xdm_t)
-	unconfined_domtrans(xdm_t)
+	shutdown_domtrans(xdm_t)
 ')
 
 optional_policy(`
@@ -675,6 +750,12 @@ optional_policy(`
 
 optional_policy(`
 	udev_run_domain(xdm_t, xdm_exec_t)
+	udev_list_runtime(xdm_t)
+	udev_read_runtime_files(xdm_t)
+')
+
+optional_policy(`
+	wm_exec(xdm_t)
 ')
 
 optional_policy(`
@@ -777,8 +858,6 @@ dev_rw_mtrr(xserver_t)
 dev_rw_acpi_bios(xserver_t)
 dev_rw_agp(xserver_t)
 dev_rw_framebuffer(xserver_t)
-dev_manage_dri_dev(xserver_t)
-dev_filetrans_dri(xserver_t)
 dev_create_generic_dirs(xserver_t)
 dev_setattr_generic_dirs(xserver_t)
 # for other device nodes such as the NVidia binary-only driver
@@ -844,6 +923,11 @@ ifdef(`enable_mls',`
 	range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh;
 ')
 
+tunable_policy(`xserver_allow_dri',`
+	dev_manage_dri_dev(xserver_t)
+	dev_filetrans_dri(xserver_t)
+')
+
 tunable_policy(`xserver_can_network',`
 	allow xserver_t self:tcp_socket create_stream_socket_perms;
 	allow xserver_t self:udp_socket create_socket_perms;
@@ -927,7 +1011,7 @@ dontaudit xserver_t xdm_var_lib_t:dir se
 read_files_pattern(xserver_t, xdm_var_run_t, xdm_var_run_t)
 
 # Label pid and temporary files with derived types.
-manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
+mmap_manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
 manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
 manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
 
@@ -1098,5 +1182,56 @@ allow xserver_unconfined_type xextension
 allow xserver_unconfined_type { x_domain xserver_t }:x_resource { read write };
 allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } { receive send };
 
+
+userdom_unpriv_user_template(xdm_greeter)
+
+allow xdm_greeter_t self:process setrlimit;
+
+# for wayland
+dev_rw_input_dev(xdm_greeter_t)
+userdom_watch_user_runtime_dirs(xdm_greeter_t)
+
+can_exec(xdm_greeter_t, xdm_exec_t)
+allow xdm_greeter_t xdm_exec_t:file entrypoint;
+
+# for xauth
+allow xdm_greeter_t xdm_tmp_t:file read_file_perms;
+
+
+# for /dev/dri/render*
+allow xdm_greeter_t xserver_t:fd use;
+dev_rw_dma_dev(xdm_greeter_t)
+dev_rw_dri(xdm_greeter_t)
+dev_watch_dev_dirs(xdm_greeter_t)
+
+kernel_request_load_module(xdm_greeter_t)
+
+fs_getattr_nsfs_files(xdm_greeter_t)
+
+miscfiles_read_fonts(xdm_greeter_t)
+
+xserver_read_xdm_state(xdm_greeter_t)
+xserver_read_xkb_libs(xdm_greeter_t)
+xserver_stream_connect(xdm_greeter_t)
+xserver_stream_connect_xdm(xdm_greeter_t)
+
+optional_policy(`
+	alsa_read_lib(xdm_greeter_t)
+')
+
+optional_policy(`
+	feedbackd_role(xdm_greeter, xdm_greeter_t, xdm_greeter_r)
+')
+
+optional_policy(`
+	pulseaudio_role(xdm_greeter, xdm_greeter_t, xdm_greeter_application_exec_domain, xdm_greeter_r)
+')
+
+optional_policy(`
+	systemd_read_logind_sessions_files(xdm_greeter_t)
+	systemd_watch_logind_sessions_dirs(xdm_greeter_t)
+')
+
+
 # for sddm to use pam for greeter
-gen_user(xdm,, xdm_r system_r, s0, s0)
+gen_user(xdm,, xdm_greeter_r system_r, s0, s0)
Index: refpolicy-2.20260801/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260801/policy/modules/apps/wm.if
@@ -57,13 +57,16 @@ template(`wm_role_template',`
 
 	allow $3 $1_wm_t:fd use;
 
-	allow $1_wm_t $3:unix_stream_socket { connectto read write getopt getattr accept };
-	allow $3 $1_wm_t:unix_stream_socket { connectto read write getopt };
+	allow $1_wm_t $3:unix_stream_socket { connectto read write getopt ioctl getattr accept };
+	allow $3 $1_wm_t:unix_stream_socket { connectto read write getopt shutdown };
+	allow $3 $1_wm_t:fifo_file read_fifo_file_perms;
 
 	# ptrace here would allow messing with keyboard
 	allow $3 $1_wm_t:process { signal_perms };
 	ps_process_pattern($3, $1_wm_t)
 
+	kernel_read_kernel_sysctls($1_wm_t)
+
 	allow $1_wm_t $3:process { sigkill signull signal };
 	ps_process_pattern($1_wm_t, $3)
 
@@ -72,6 +75,8 @@ template(`wm_role_template',`
 	corecmd_bin_domtrans($1_wm_t, $2)
 	corecmd_shell_domtrans($1_wm_t, $2)
 
+	domain_use_interactive_fds($1_wm_t)
+
 	mls_file_read_all_levels($1_wm_t)
 	mls_file_write_all_levels($1_wm_t)
 	mls_xwin_read_all_levels($1_wm_t)
@@ -85,16 +90,26 @@ template(`wm_role_template',`
 
 	userdom_rw_user_tmpfs_files($1_wm_t)
 	userdom_map_user_tmpfs_files($1_wm_t)
+	userdom_manage_user_tmp_files($1_wm_t)
+	userdom_map_user_tmp_files($1_wm_t)
 
+	xserver_read_xdm_state($1_wm_t)
 	xserver_role($1, $1_wm_t, $3, $4)
 	xserver_manage_core_devices($1_wm_t)
 
 	wm_write_pipes($1, $3)
 
+	tunable_policy(`wm_write_xdg_data', `
+		xdg_manage_data($1_wm_t)
+	')
+
 	optional_policy(`
 		dbus_connect_spec_session_bus($1, $1_wm_t)
+		dbus_getattr_session_runtime_socket($1_wm_t)
+		dbus_read_lib_files($1_wm_t)
 		dbus_spec_session_bus_client($1, $1_wm_t)
 		dbus_system_bus_client($1_wm_t)
+		dbus_write_session_runtime_socket($1_wm_t)
 
 		optional_policy(`
 			wm_dbus_chat($1, $3)
@@ -140,6 +155,17 @@ template(`wm_role_template',`
 	optional_policy(`
 		xscreensaver_run($1_wm_t, $4)
 	')
+
+	optional_policy(`
+		systemd_dbus_chat_logind($1_wm_t)
+	')
+
+	optional_policy(`
+		xdg_read_data_files($1_wm_t)
+		xdg_manage_cache($1_wm_t)
+		xdg_manage_config($1_wm_t)
+		xdg_watch_data_files($1_wm_t)
+	')
 ')
 
 ########################################
Index: refpolicy-2.20260801/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260801/policy/modules/kernel/corecommands.fc
@@ -116,6 +116,8 @@ ifdef(`distro_redhat',`
 /etc/X11/xdm/Xsetup_0		--	gen_context(system_u:object_r:bin_t,s0)
 /etc/X11/xinit(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
+/etc/xdg/Xwayland-session.d/.*	--	gen_context(system_u:object_r:bin_t,s0)
+
 /etc/xen/qemu-ifup		--	gen_context(system_u:object_r:bin_t,s0)
 /etc/xen/scripts(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
@@ -269,6 +271,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfconf/xfconfd	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfwm4/helper-dialog --	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/[^/]+-linux-gnu/libexec/.* -- gen_context(system_u:object_r:bin_t,s0)
 
 ifdef(`distro_debian',`
 /usr/lib/[^/]+/tumbler-1/tumblerd --	gen_context(system_u:object_r:bin_t,s0)
@@ -357,6 +360,7 @@ ifdef(`distro_debian',`
 /usr/share/PackageKit/helpers(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/reportbug/handle_bugscript -- gen_context(system_u:object_r:bin_t,s0)
 /usr/share/sandbox/sandboxX\.sh	--	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/sddm/scripts/.*	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/sectool/.*\.py	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
 /usr/share/smartmontools/.*	--	gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20260801/policy/modules/system/unconfined.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/unconfined.if
+++ refpolicy-2.20260801/policy/modules/system/unconfined.if
@@ -39,6 +39,7 @@ interface(`unconfined_domain_noaudit',`
 	allow $1 self:{ capability cap_userns } { audit_control audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
 	allow $1 self:{ capability2 cap2_userns } { bpf perfmon syslog wake_alarm };
 	allow $1 self:fifo_file manage_fifo_file_perms;
+	allow $1 self:system status;
 
 	# Manage most namespace capabilities
 	allow $1 self:user_namespace create;
@@ -56,8 +57,12 @@ interface(`unconfined_domain_noaudit',`
 	# used by Chrome for some reason
 	allow $1 self:dir manage_dir_perms;
 
+	# used by Chrome for some reason
+	allow $1 self:dir manage_dir_perms;
+
 	# for io_uring
 	allow $1 self:anon_inode { create map read write };
+	allow $1 self:io_uring allowed;
 
 	# Userland object managers
 	allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv };
Index: refpolicy-2.20260801/policy/modules/apps/gnome.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/gnome.if
+++ refpolicy-2.20260801/policy/modules/apps/gnome.if
@@ -114,6 +114,10 @@ template(`gnome_role_template',`
 		')
 
 		optional_policy(`
+			systemd_dbus_chat_logind($1_gkeyringd_t)
+		')
+
+		optional_policy(`
 			wm_dbus_chat($1, $1_gkeyringd_t)
 		')
 	')
@@ -822,6 +826,25 @@ interface(`gnome_mmap_gstreamer_orcexec'
 ')
 
 ########################################
+## <summary>
+##     mmap read gnome_xdg_config_t files
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`gnome_mmap_read_xdg_config_files',`
+	gen_require(`
+		type gnome_xdg_config_t;
+	')
+
+	allow $1 gnome_xdg_config_t:dir list_dir_perms;
+	allow $1 gnome_xdg_config_t:file mmap_read_file_perms;
+')
+
+########################################
 ## <summary>
 ##     watch gnome_xdg_config_t dirs
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260801/policy/modules/system/userdomain.if
@@ -122,6 +122,8 @@ template(`userdom_base_user_template',`
 	miscfiles_read_generic_certs($1_t)
 	miscfiles_watch_fonts_dirs($1_t)
 
+	userdom_write_user_runtime_sockets($1_t)
+
 	sysnet_read_config($1_t)
 
 	# kdeinit wants systemd status
@@ -173,6 +175,10 @@ template(`userdom_base_user_template',`
 	optional_policy(`
 		wayland_client_domain($1_t)
 	')
+
+	optional_policy(`
+		xscreensaver_send_dbus($1_t)
+	')
 ')
 
 #######################################
@@ -1000,6 +1006,7 @@ template(`userdom_login_user_template',
 	userdom_exec_user_tmp_files($1_t)
 	userdom_exec_user_home_content_files($1_t)
 
+	userdom_execmod_user_tmpfs_files($1_t)
 	userdom_map_user_tmpfs_files($1_t)
 
 	userdom_change_password_template($1)
@@ -1257,8 +1264,10 @@ template(`userdom_unpriv_user_template',
 	corenet_tcp_bind_xserver_port($1_t)
 
 	files_exec_usr_files($1_t)
+	files_watch_etc_symlinks($1_t)
 
 	miscfiles_manage_public_files($1_t)
+	miscfiles_watch_localization($1_t)
 	miscfiles_watch_public_dirs($1_t)
 
 	tunable_policy(`user_dmesg',`
@@ -1277,6 +1286,7 @@ template(`userdom_unpriv_user_template',
 	tunable_policy(`user_tcp_server',`
 		corenet_tcp_bind_generic_node($1_t)
 		corenet_tcp_bind_generic_port($1_t)
+		corenet_tcp_bind_all_unreserved_ports($1_t)
 	')
 
 	# Allow users to run UDP servers (bind to ports and accept connection from
@@ -1284,6 +1294,7 @@ template(`userdom_unpriv_user_template',
 	tunable_policy(`user_udp_server',`
 		corenet_udp_bind_generic_node($1_t)
 		corenet_udp_bind_generic_port($1_t)
+		corenet_udp_bind_all_unreserved_ports($1_t)
 	')
 
 	optional_policy(`
@@ -1630,6 +1641,8 @@ template(`userdom_xdg_user_template',`
 	xdg_manage_all_data($1_t)
 	xdg_relabel_all_data($1_t)
 	xdg_watch_all_data_dirs($1_t)
+	xdg_watch_all_data_files($1_t)
+	xdg_exec_data($1_t)
 
 	xdg_generic_user_home_dir_filetrans_cache($1_t, dir, ".cache")
 	xdg_generic_user_home_dir_filetrans_config($1_t, dir, ".config")
@@ -3681,6 +3694,24 @@ interface(`userdom_user_runtime_content'
 ')
 
 ########################################
+## <summary>
+##     write user runtime sockets
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_write_user_runtime_sockets',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:sock_file write;
+')
+
+########################################
 ## <summary>
 ##	Search users runtime directories.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/apps/pulseaudio.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/pulseaudio.te
+++ refpolicy-2.20260801/policy/modules/apps/pulseaudio.te
@@ -130,10 +130,13 @@ dev_read_sound(pulseaudio_t)
 dev_write_sound(pulseaudio_t)
 dev_read_sysfs(pulseaudio_t)
 dev_read_urand(pulseaudio_t)
+dev_rw_dma_dev(pulseaudio_t)
 dev_rw_dri(pulseaudio_t)
 dev_read_video_dev(pulseaudio_t)
 dev_write_video_dev(pulseaudio_t)
 
+files_read_etc_runtime_files(pulseaudio_t)
+
 files_read_usr_files(pulseaudio_t)
 files_map_usr_files(pulseaudio_t)
 
@@ -253,6 +256,7 @@ optional_policy(`
 	systemd_read_logind_sessions_files(pulseaudio_t)
 	# for /run/systemd/users/$PID
 	systemd_read_logind_runtime_files(pulseaudio_t)
+	systemd_watch_logind_sessions_dirs(pulseaudio_t)
 ')
 
 optional_policy(`
@@ -265,6 +269,7 @@ optional_policy(`
 	xserver_manage_xdm_tmp_files(pulseaudio_t)
 	xserver_read_xdm_lib_files(pulseaudio_t)
 	xserver_read_xdm_runtime_files(pulseaudio_t)
+	xserver_rw_mesa_shader_cache(pulseaudio_t)
 	xserver_user_x_domain_template(pulseaudio, pulseaudio_t, pulseaudio_tmpfs_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/system/xdg.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/xdg.if
+++ refpolicy-2.20260801/policy/modules/system/xdg.if
@@ -583,6 +583,24 @@ interface(`xdg_manage_config',`
 
 ########################################
 ## <summary>
+##	dontaudit write of xdg_config_t files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`xdg_dontaudit_config_file_write',`
+	gen_require(`
+		type xdg_config_t;
+	')
+
+	dontaudit $1 xdg_config_t:file write;
+')
+
+########################################
+## <summary>
 ##	Manage all the xdg config home files regardless of their specific type
 ## </summary>
 ## <param name="domain">
@@ -711,6 +729,24 @@ interface(`xdg_watch_data_dirs',`
 
 ########################################
 ## <summary>
+##	Watch the xdg data home files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xdg_watch_data_files',`
+	gen_require(`
+		type xdg_data_t;
+	')
+
+	allow $1 xdg_data_t:file watch;
+')
+
+########################################
+## <summary>
 ##	Watch all the xdg data home directories
 ## </summary>
 ## <param name="domain">
@@ -729,6 +765,24 @@ interface(`xdg_watch_all_data_dirs',`
 
 ########################################
 ## <summary>
+##	Watch all the xdg data home files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xdg_watch_all_data_files',`
+	gen_require(`
+		attribute xdg_data_type;
+	')
+
+	allow $1 xdg_data_type:file watch;
+')
+
+########################################
+## <summary>
 ##	Read the xdg data home files
 ## </summary>
 ## <param name="domain">
@@ -934,6 +988,24 @@ interface(`xdg_relabel_data',`
 ')
 
 ########################################
+## <summary>
+##	Allow domain to execute xdg_data_t, for some application config in kde
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xdg_exec_data',`
+	gen_require(`
+		type xdg_data_t;
+	')
+
+	can_exec($1, xdg_data_t)
+')
+
+########################################
 ## <summary>
 ##	Allow relabeling the xdg data home files, regardless of their type
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/apps/wm.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/wm.te
+++ refpolicy-2.20260801/policy/modules/apps/wm.te
@@ -7,6 +7,14 @@ policy_module(wm)
 
 attribute wm_domain;
 
+
+## <desc>
+##      <p>
+##      Grant the window manager domains write access to xdg data
+##      </p>
+## </desc>
+gen_tunable(`wm_write_xdg_data', false)
+
 type wm_exec_t;
 corecmd_executable_file(wm_exec_t)
 
Index: refpolicy-2.20260801/policy/modules/services/xserver.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/xserver.fc
+++ refpolicy-2.20260801/policy/modules/services/xserver.fc
@@ -40,6 +40,7 @@ HOME_DIR/\.Xauthority.*	--	gen_context(s
 /etc/kde[34]?/kdm/backgroundrc	gen_context(system_u:object_r:xdm_var_run_t,s0)
 
 /etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0)
+/etc/sddm/wayland-session --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/sddm/Xsession	--	gen_context(system_u:object_r:xsession_exec_t,s0)
 
 /etc/X11/[wx]dm/Xreset.* --	gen_context(system_u:object_r:xsession_exec_t,s0)
@@ -90,6 +91,8 @@ HOME_DIR/\.Xauthority.*	--	gen_context(s
 /usr/lib/xorg-server/Xorg	--	gen_context(system_u:object_r:xserver_exec_t,s0)
 /usr/lib/xorg-server/Xorg\.wrap	--	gen_context(system_u:object_r:xserver_exec_t,s0)
 /usr/lib/X11/xdm/Xsession	--	gen_context(system_u:object_r:xsession_exec_t,s0)
+/usr/lib/[^/]*/sddm/sddm-helper-start-wayland -- gen_context(system_u:object_r:xsession_exec_t,s0)
+/usr/lib/[^/]*/sddm/sddm-helper-start-x11user -- gen_context(system_u:object_r:xsession_exec_t,s0)
 
 /usr/libexec/gdm-runtime-config --	gen_context(system_u:object_r:xdm_exec_t,s0)
 /usr/libexec/gnome-remote-desktop-daemon --	gen_context(system_u:object_r:xdm_exec_t,s0)
@@ -130,6 +133,7 @@ ifndef(`distro_debian',`
 /var/lib/xdm/authdir(/.*)?	gen_context(system_u:object_r:xdm_auth_t,s0)
 /var/lib/xkb(/.*)?		gen_context(system_u:object_r:xkb_var_lib_t,s0)
 /var/lib/sddm(/.*)?		gen_context(system_u:object_r:xdm_var_lib_t,s0)
+/var/lib/sddm/state.conf --	gen_context(system_u:object_r:xdm_var_lib_t,s0)
 
 /var/log/[kwx]dm\.log.*	--	gen_context(system_u:object_r:xserver_log_t,s0)
 /var/log/lightdm(/.*)?		gen_context(system_u:object_r:xserver_log_t,s0)
@@ -152,6 +156,7 @@ ifndef(`distro_debian',`
 /run/xdmctl(/.*)?		gen_context(system_u:object_r:xdm_var_run_t,s0)
 
 /run/user/%{USERID}/ICEauthority.*	--	gen_context(system_u:object_r:iceauth_home_t,s0)
+/run/user/%{USERID}/xauth_.* --	gen_context(system_u:object_r:xauth_home_t,s0)
 
 ifdef(`distro_suse',`
 /var/lib/pam_devperm/:0	--	gen_context(system_u:object_r:xdm_var_lib_t,s0)
Index: refpolicy-2.20260801/config/appconfig-mcs/xdm_default_contexts
===================================================================
--- refpolicy-2.20260801.orig/config/appconfig-mcs/xdm_default_contexts
+++ refpolicy-2.20260801/config/appconfig-mcs/xdm_default_contexts
@@ -1 +1,2 @@
-system_r:xdm_t:s0		system_r:xdm_t:s0
+system_r:xdm_t:s0		xdm_greeter_r:xdm_greeter_t:s0
+system_r:init_t:s0		xdm_greeter_r:xdm_greeter_systemd_t:s0
Index: refpolicy-2.20260801/config/appconfig-mls/xdm_default_contexts
===================================================================
--- refpolicy-2.20260801.orig/config/appconfig-mls/xdm_default_contexts
+++ refpolicy-2.20260801/config/appconfig-mls/xdm_default_contexts
@@ -1 +1,2 @@
-system_r:xdm_t:s0		system_r:xdm_t:s0
+system_r:xdm_t:s0		xdm_greeter_r:xdm_greeter_t:s0
+system_r:init_t:s0		xdm_greeter_r:xdm_greeter_systemd_t:s0
Index: refpolicy-2.20260801/config/appconfig-standard/xdm_default_contexts
===================================================================
--- refpolicy-2.20260801.orig/config/appconfig-standard/xdm_default_contexts
+++ refpolicy-2.20260801/config/appconfig-standard/xdm_default_contexts
@@ -1 +1 @@
-system_r:xdm_t		system_r:xdm_t
+system_r:xdm_t		xdm_greeter_r:xdm_t
Index: refpolicy-2.20260801/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20260801/policy/modules/system/systemd.if
@@ -269,6 +269,14 @@ template(`systemd_role_template',`
 		xdg_read_data_files($1_systemd_t)
 	')
 
+	ifelse(`$1', sysadm, `
+		allow $1_systemd_t self:capability2 { bpf perfmon };
+		userdom_search_user_runtime($1_systemd_t)
+		allow $1_systemd_t bpf_t:dir { read open };
+		allow $1_systemd_t self:bpf { map_create map_read map_write };
+		allow $1_systemd_t self:capability sys_admin;
+	')
+
 	optional_policy(`
 		xserver_read_xdm_lib_files($1_systemd_t)
 		xserver_watch_xdm_lib_dirs($1_systemd_t)
@@ -1563,6 +1571,25 @@ interface(`systemd_use_logind_fds',`
 
 ######################################
 ## <summary>
+##   Connect to systemd-logind via unix sockets
+##   for /run/systemd/io.systemd.Login
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`systemd_connectto_logind',`
+	gen_require(`
+		type systemd_logind_t;
+	')
+
+	allow $1 systemd_logind_t:unix_stream_socket connectto;
+')
+
+######################################
+## <summary>
 ##      Watch logind sessions dirs.
 ## </summary>
 ## <param name="domain">
@@ -3033,6 +3060,24 @@ interface(`systemd_write_all_user_keys',
 ')
 
 ########################################
+## <summary>
+##	link keys for the all systemd --user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_link_all_user_keys',`
+	gen_require(`
+		attribute systemd_user_session_type;
+	')
+
+	allow $1 systemd_user_session_type:key link;
+')
+
+########################################
 ## <summary>
 ##    signal all systemd --user domains.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/services/ssh.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/ssh.if
+++ refpolicy-2.20260801/policy/modules/services/ssh.if
@@ -367,6 +367,8 @@ template(`ssh_role_template',`
 	manage_sock_files_pattern($2, ssh_home_t, ssh_home_t)
 	userdom_search_user_home_dirs($1_t)
 
+	read_files_pattern($1_ssh_agent_t, ssh_home_t, ssh_home_t)
+
 	optional_policy(`
 		systemd_user_app_status($1, ssh_t)
 	')
Index: refpolicy-2.20260801/policy/modules/apps/xscreensaver.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/xscreensaver.te
+++ refpolicy-2.20260801/policy/modules/apps/xscreensaver.te
@@ -39,6 +39,7 @@ userdom_user_tmpfs_file(xscreensaver_tmp
 allow xscreensaver_t self:capability { setgid setuid };
 allow xscreensaver_t self:process { setpgid setsched signal sigstop };
 allow xscreensaver_t self:fifo_file rw_fifo_file_perms;
+allow xscreensaver_t self:netlink_kobject_uevent_socket { bind create getattr setopt getopt read };
 
 allow xscreensaver_t xscreensaver_helper_t:process { signal sigstop };
 
Index: refpolicy-2.20260801/policy/modules/apps/xscreensaver.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/xscreensaver.if
+++ refpolicy-2.20260801/policy/modules/apps/xscreensaver.if
@@ -57,6 +57,25 @@ template(`xscreensaver_role',`
 
 ########################################
 ## <summary>
+##	send dbus messages to xscreensaver
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xscreensaver_send_dbus',`
+	gen_require(`
+		type xscreensaver_t;
+		class dbus send_msg;
+	')
+
+	allow $1 xscreensaver_t:dbus send_msg;
+')
+
+########################################
+## <summary>
 ##	Make a domain transition to the
 ##	xscreensaver target domain.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/services/cups.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/cups.if
+++ refpolicy-2.20260801/policy/modules/services/cups.if
@@ -362,3 +362,22 @@ interface(`cups_admin',`
 	admin_pattern($1, { cupsd_config_runtime_t cupsd_runtime_t hplip_runtime_t })
 	admin_pattern($1, cupsd_lpd_runtime_t)
 ')
+
+########################################
+## <summary>
+##	no access to cups
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`cups_dontaudit',`
+	gen_require(`
+		type cupsd_etc_t, cupsd_runtime_t;
+	')
+
+	dontaudit $1 cupsd_etc_t:dir search;
+	dontaudit $1 cupsd_runtime_t:dir search;
+')
Index: refpolicy-2.20260801/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/selinuxutil.te
+++ refpolicy-2.20260801/policy/modules/system/selinuxutil.te
@@ -574,6 +574,9 @@ term_use_all_terms(semanage_t)
 # Running genhomedircon requires this for finding all users
 auth_use_nsswitch(semanage_t)
 
+fs_getattr_tmpfs(semanage_t)
+fs_getattr_xattr_fs(semanage_t)
+
 # Python module compilations
 libs_dontaudit_manage_lib_dirs(semanage_t)
 libs_dontaudit_manage_lib_files(semanage_t)
Index: refpolicy-2.20260801/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20260801/policy/modules/services/xserver.if
@@ -1735,7 +1735,7 @@ interface(`xserver_rw_xdm_keys',`
 		type xdm_t;
 	')
 
-	allow $1 xdm_t:key { read setattr write };
+	allow $1 xdm_t:key { search read setattr write };
 ')
 
 ########################################
@@ -1753,7 +1753,7 @@ interface(`xserver_link_xdm_keys',`
 		type xdm_t;
 	')
 
-	allow $1 xdm_t:key link;
+	allow $1 xdm_t:key { search link };
 ')
 
 ########################################
Index: refpolicy-2.20260801/policy/modules/system/authlogin.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/authlogin.if
+++ refpolicy-2.20260801/policy/modules/system/authlogin.if
@@ -1864,6 +1864,30 @@ interface(`auth_use_nsswitch',`
 
 ########################################
 ## <summary>
+##	Provide userdb data via /run/systemd/userdb sock file
+## </summary>
+## <desc>
+##	<p>
+##	Allow the specified domain to provide userdb data
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`auth_provide_userdb',`
+	gen_require(`
+		attribute userdb_server;
+	')
+
+	typeattribute $1 userdb_server;
+')
+
+########################################
+## <summary>
 ##	Unconfined access to the authlogin module.
 ## </summary>
 ## <desc>
Index: refpolicy-2.20260801/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/authlogin.te
+++ refpolicy-2.20260801/policy/modules/system/authlogin.te
@@ -31,6 +31,7 @@ attribute can_write_shadow_passwords;
 attribute can_relabelto_shadow_passwords;
 attribute nsswitch_domain;
 attribute pam_domain;
+attribute userdb_server;
 
 type auth_cache_t;
 logging_log_file(auth_cache_t)
@@ -501,6 +502,7 @@ ifdef(`init_systemd', `
 	systemd_stream_connect_userdb(nsswitch_domain)
 	systemd_stream_connect_homed(nsswitch_domain)
 	systemd_stream_connect_nsresourced(nsswitch_domain)
+	allow nsswitch_domain userdb_server:unix_stream_socket connectto;
 ')
 
 optional_policy(`
Index: refpolicy-2.20260801/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20260801/policy/modules/system/systemd.te
@@ -1315,6 +1315,8 @@ kernel_read_system_state(systemd_machine
 dev_getattr_fs(systemd_machined_t)
 dev_setattr_urand_dev(systemd_machined_t)
 
+auth_provide_userdb(systemd_machined_t)
+
 files_read_etc_files(systemd_machined_t)
 files_read_etc_runtime_files(systemd_machined_t)
 
