Index: refpolicy-2.20260804/policy/modules/services/bluetooth.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/bluetooth.te
+++ refpolicy-2.20260804/policy/modules/services/bluetooth.te
@@ -92,6 +92,7 @@ can_exec(bluetooth_t, bluetooth_helper_e
 
 bluetooth_use_inherited_helper_stream_sockets(bluetooth_t)
 
+kernel_read_crypto_sysctls(bluetooth_t)
 kernel_read_kernel_sysctls(bluetooth_t)
 kernel_read_system_state(bluetooth_t)
 kernel_read_network_state(bluetooth_t)
@@ -129,6 +130,8 @@ miscfiles_read_localization(bluetooth_t)
 miscfiles_read_fonts(bluetooth_t)
 miscfiles_read_hwdata(bluetooth_t)
 
+udev_search_runtime(bluetooth_t)
+
 userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
 userdom_dontaudit_use_user_terminals(bluetooth_t)
 userdom_dontaudit_search_user_home_dirs(bluetooth_t)
@@ -232,5 +235,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	unconfined_dbus_send(bluetooth_t)
+')
+
+optional_policy(`
 	xserver_user_x_domain_template(bluetooth_helper, bluetooth_helper_t, bluetooth_helper_tmpfs_t)
 ')
Index: refpolicy-2.20260804/policy/modules/services/cups.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/cups.te
+++ refpolicy-2.20260804/policy/modules/services/cups.te
@@ -12,6 +12,13 @@ policy_module(cups)
 ## </desc>
 gen_tunable(cups_use_legacy_ldso, false)
 
+## <desc>
+## <p>
+## Allows legacy ld_so for old printer filters
+## </p>
+## </desc>
+gen_tunable(cups_legacy_ldso, false)
+
 type cupsd_config_t;
 type cupsd_config_exec_t;
 init_daemon_domain(cupsd_config_t, cupsd_config_exec_t)
@@ -332,6 +339,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	udev_read_runtime_files(cupsd_t)
+')
+
+optional_policy(`
 	virt_rw_all_image_chr_files(cupsd_t)
 ')
 
@@ -565,6 +576,10 @@ tunable_policy(`cups_use_legacy_ldso',`
 	libs_legacy_use_ld_so(cupsd_t)
 ')
 
+tunable_policy(`cups_legacy_ldso',`
+	libs_legacy_use_ld_so(cupsd_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(cups_pdf_t)
 	fs_manage_nfs_files(cups_pdf_t)
Index: refpolicy-2.20260804/policy/modules/services/dirmngr.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/dirmngr.te
+++ refpolicy-2.20260804/policy/modules/services/dirmngr.te
@@ -83,6 +83,7 @@ miscfiles_read_generic_certs(dirmngr_t)
 userdom_search_user_home_dirs(dirmngr_t)
 userdom_search_user_runtime(dirmngr_t)
 userdom_user_runtime_filetrans(dirmngr_t, dirmngr_tmp_t, dir)
+allow dirmngr_t dirmngr_tmp_t:dir manage_dir_perms;
 
 optional_policy(`
 	gpg_agent_tmp_filetrans(dirmngr_t, dirmngr_tmp_t, sock_file)
Index: refpolicy-2.20260804/policy/modules/services/ftp.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/ftp.te
+++ refpolicy-2.20260804/policy/modules/services/ftp.te
@@ -409,6 +409,13 @@ optional_policy(`
 	systemd_write_inherited_logind_sessions_pipes(ftpd_t)
 ')
 
+optional_policy(`
+	systemd_connect_machined(ftpd_t)
+	systemd_dbus_chat_logind(ftpd_t)
+	systemd_read_logind_state(ftpd_t)
+	systemd_write_inherited_logind_sessions_pipes(ftpd_t)
+')
+
 ########################################
 #
 # Ctl local policy
Index: refpolicy-2.20260804/policy/modules/services/policykit.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/policykit.te
+++ refpolicy-2.20260804/policy/modules/services/policykit.te
@@ -77,6 +77,7 @@ allow policykit_t self:unix_stream_socke
 rw_files_pattern(policykit_t, policykit_reload_t, policykit_reload_t)
 
 manage_files_pattern(policykit_t, policykit_var_lib_t, policykit_var_lib_t)
+allow policykit_t policykit_var_lib_t:dir watch;
 
 manage_dirs_pattern(policykit_t, policykit_runtime_t, policykit_runtime_t)
 manage_files_pattern(policykit_t, policykit_runtime_t, policykit_runtime_t)
@@ -105,12 +106,16 @@ fs_getattr_cgroup(policykit_t)
 
 auth_use_nsswitch(policykit_t)
 
+selinux_getattr_fs(policykit_t)
+seutil_search_default_contexts(policykit_t)
+
 userdom_getattr_all_users(policykit_t)
 userdom_read_all_users_state(policykit_t)
 
 optional_policy(`
 	dbus_system_domain(policykit_t, policykit_exec_t)
 	init_dbus_chat(policykit_t)
+	init_get_generic_units_status(policykit_t)
 	init_get_transient_units_status(policykit_t)
 	init_get_system_status(policykit_t)
 
@@ -135,10 +140,13 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_get_user_manager_units_status(policykit_t)
+
 	# for /run/systemd/machines
 	systemd_connect_machined(policykit_t)
 	systemd_read_machines(policykit_t)
 	systemd_watch_machines_dirs(policykit_t)
+	systemd_connect_machined(policykit_t)
 
 	# for /run/systemd/seats/seat*
 	systemd_read_logind_sessions_files(policykit_t)
Index: refpolicy-2.20260804/policy/modules/services/ssh.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/ssh.te
+++ refpolicy-2.20260804/policy/modules/services/ssh.te
@@ -17,7 +17,7 @@ gen_tunable(allow_ssh_keysign, false)
 ## Allow ssh logins as sysadm_r:sysadm_t
 ## </p>
 ## </desc>
-gen_tunable(ssh_sysadm_login, false)
+gen_tunable(ssh_sysadm_login, true)
 
 ## <desc>
 ## <p>
Index: refpolicy-2.20260804/policy/modules/kernel/files.if
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/kernel/files.if
+++ refpolicy-2.20260804/policy/modules/kernel/files.if
@@ -5821,6 +5821,41 @@ interface(`files_usr_filetrans',`
 
 ########################################
 ## <summary>
+##      Execute a usr_t file in the specified domain.
+## </summary>
+## <desc>
+##      <p>
+##      Execute a usr_t file in the specified domain.
+##      </p>
+##      <p>
+##      No interprocess communication (signals, pipes,
+##      etc.) is provided by this interface since
+##      the domains are not owned by this module.
+##      </p>
+## </desc>
+## <param name="domain">
+##      <summary>
+##      Domain allowed to transition.
+##      </summary>
+## </param>
+## <param name="target_domain">
+##      <summary>
+##      The type of the process.
+##      </summary>
+## </param>
+#
+interface(`files_usr_domtrans',`
+	gen_require(`
+		type usr_t;
+	')
+
+	files_list_usr($1)
+	domain_transition_pattern($1, usr_t, $2)
+	type_transition $1 usr_t:process $2;
+')
+
+########################################
+## <summary>
 ##	Search directories in /usr/src.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260804/policy/modules/system/fstools.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/fstools.te
+++ refpolicy-2.20260804/policy/modules/system/fstools.te
@@ -228,6 +228,14 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dmidecode_domtrans(fsadm_t)
+')
+
+optional_policy(`
+	fsdaemon_read_lib(fsadm_t)
+')
+
+optional_policy(`
 	fsdaemon_read_lib(fsadm_t)
 ')
 
@@ -264,6 +272,8 @@ optional_policy(`
 	# Xen causes losetup to run with a presumably accidentally inherited
 	# file handle for /run/xen-hotplug/block
 	udev_dontaudit_rw_runtime_files(fsadm_t)
+
+	udev_domtrans_udevadm(fsadm_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260804/policy/modules/apps/java.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/apps/java.te
+++ refpolicy-2.20260804/policy/modules/apps/java.te
@@ -128,11 +128,17 @@ tunable_policy(`allow_java_execstack',`
 auth_use_nsswitch(java_t)
 
 corecmd_search_bin(java_t)
+corecmd_exec_bin(java_t)
 
 dev_read_sysfs(java_t)
 
+fs_read_cgroup_files(java_t)
+fs_search_cgroup_dirs(java_t)
+
 locallogin_use_fds(java_t)
 
+libs_exec_lib_files(java_t)
+
 userdom_read_user_tmp_files(java_t)
 userdom_use_user_terminals(java_t)
 
Index: refpolicy-2.20260804/policy/modules/kernel/storage.if
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/kernel/storage.if
+++ refpolicy-2.20260804/policy/modules/kernel/storage.if
@@ -370,6 +370,30 @@ interface(`storage_dev_filetrans_fixed_d
 
 ########################################
 ## <summary>
+##	Create char devices in /dev with the fixed disk type
+##	via an automatic type transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional filename of the char device to be created
+##	</summary>
+## </param>
+#
+interface(`storage_dev_filetrans_fixed_disk_control',`
+	gen_require(`
+		type fixed_disk_device_t;
+	')
+
+	dev_filetrans($1, fixed_disk_device_t, chr_file, $2)
+')
+
+########################################
+## <summary>
 ##	Create block devices in on a tmpfs filesystem with the
 ##	fixed disk type via an automatic type transition.
 ## </summary>
Index: refpolicy-2.20260804/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/logging.te
+++ refpolicy-2.20260804/policy/modules/system/logging.te
@@ -118,7 +118,7 @@ allow auditctl_t self:netlink_audit_sock
 allow auditctl_t auditd_log_t:dir list_dir_perms;
 allow auditctl_t auditd_log_t:file read_file_perms;
 
-read_files_pattern(auditctl_t, auditd_etc_t, auditd_etc_t)
+mmap_read_files_pattern(auditctl_t, auditd_etc_t, auditd_etc_t)
 allow auditctl_t auditd_etc_t:dir list_dir_perms;
 dontaudit auditctl_t auditd_etc_t:file map;
 
@@ -129,7 +129,7 @@ files_getattr_all_dirs(auditctl_t)
 files_getattr_all_files(auditctl_t)
 files_read_etc_files(auditctl_t)
 
-kernel_dontaudit_getattr_proc(auditctl_t)
+kernel_getattr_proc(auditctl_t)
 kernel_read_kernel_sysctls(auditctl_t)
 kernel_read_proc_symlinks(auditctl_t)
 kernel_read_system_state(auditctl_t)
@@ -175,7 +175,7 @@ allow auditd_t self:tcp_socket create_st
 
 allow auditd_t auditd_etc_t:dir list_dir_perms;
 allow auditd_t auditd_etc_t:file read_file_perms;
-dontaudit auditd_t auditd_etc_t:file map;
+allow auditd_t auditd_etc_t:file map;
 
 allow auditd_t auditd_log_t:dir setattr;
 allow auditd_t auditd_log_t:file { append_file_perms create_file_perms link read_file_perms rename_file_perms setattr_file_perms unlink };
Index: refpolicy-2.20260804/policy/modules/services/memlockd.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/memlockd.te
+++ refpolicy-2.20260804/policy/modules/services/memlockd.te
@@ -37,7 +37,9 @@ logging_send_syslog_msg(memlockd_t)
 miscfiles_read_localization(memlockd_t)
 
 sysnet_mmap_read_config(memlockd_t)
+sysnet_read_config(memlockd_t)
 
 ifndef(`distro_debian', `
 	allow memlockd_t self:capability dac_read_search;
 ')
+
Index: refpolicy-2.20260804/policy/modules/services/sysstat.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/sysstat.te
+++ refpolicy-2.20260804/policy/modules/services/sysstat.te
@@ -31,6 +31,7 @@ logging_log_filetrans(sysstat_t, sysstat
 
 can_exec(sysstat_t, sysstat_exec_t)
 
+kernel_read_psi(sysstat_t)
 kernel_read_system_state(sysstat_t)
 kernel_read_network_state(sysstat_t)
 kernel_read_kernel_sysctls(sysstat_t)
Index: refpolicy-2.20260804/policy/modules/services/consolesetup.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/consolesetup.te
+++ refpolicy-2.20260804/policy/modules/services/consolesetup.te
@@ -51,6 +51,10 @@ term_use_unallocated_ttys(consolesetup_t
 
 miscfiles_read_localization(consolesetup_t)
 
-xserver_read_xkb_libs(consolesetup_t)
+optional_policy(`
+	loadkeys_domtrans(consolesetup_t)
+')
 
-loadkeys_domtrans(consolesetup_t)
+optional_policy(`
+	xserver_read_xkb_libs(consolesetup_t)
+')
Index: refpolicy-2.20260804/policy/modules/services/dbus.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/dbus.te
+++ refpolicy-2.20260804/policy/modules/services/dbus.te
@@ -236,7 +236,6 @@ ifdef(`init_systemd', `
 
 	tunable_policy(`dbus_broker_system_bus',`
 		init_get_system_status(system_dbusd_t)
-		init_get_generic_units_status(system_dbusd_t)
 		init_start_generic_units(system_dbusd_t)
 	')
 ')
@@ -324,6 +323,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	xdg_read_data_files(system_dbusd_t)
+')
+
+optional_policy(`
 	xserver_read_xdm_lib_files(system_dbusd_t)
 	xserver_use_xdm_fds(system_dbusd_t)
 ')
Index: refpolicy-2.20260804/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20260804/policy/modules/services/xserver.if
@@ -56,6 +56,9 @@ template(`xserver_restricted_role',`
 	stream_connect_pattern($2, xserver_tmp_t, xserver_tmp_t, xserver_t)
 	files_search_tmp($2)
 
+	# for /run/gdm3/dbus/
+	allow $2 xdm_var_run_t:sock_file write_sock_file_perms;
+
 	# Communicate via System V shared memory.
 	allow $2 xserver_t:fd use;
 	allow $2 xserver_t:shm r_shm_perms;
@@ -221,7 +224,7 @@ template(`xserver_role',`
 
 	xserver_read_xkb_libs($2)
 
-	allow $2 xdm_t:unix_stream_socket accept;
+	allow $2 xdm_t:unix_stream_socket { accept rw_socket_perms };
 
 	optional_policy(`
 		systemd_user_app_status($1, xserver_t)
Index: refpolicy-2.20260804/policy/modules/services/geoclue.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/geoclue.te
+++ refpolicy-2.20260804/policy/modules/services/geoclue.te
@@ -76,3 +76,12 @@ optional_policy(`
 	xserver_dbus_chat_xdm(geoclue_t)
 	xserver_read_xdm_state(geoclue_t)
 ')
+
+optional_policy(`
+	unconfined_dbus_send(geoclue_t)
+')
+
+optional_policy(`
+	xserver_dbus_chat_xdm(geoclue_t)
+	xserver_read_xdm_state(geoclue_t)
+')
Index: refpolicy-2.20260804/policy/modules/services/powerprofiles.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/powerprofiles.te
+++ refpolicy-2.20260804/policy/modules/services/powerprofiles.te
@@ -50,6 +50,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	devicekit_dbus_chat_power(power_profilesd_t)
+')
+
+optional_policy(`
 	unconfined_dbus_send(power_profilesd_t)
 ')
 
Index: refpolicy-2.20260804/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/authlogin.te
+++ refpolicy-2.20260804/policy/modules/system/authlogin.te
@@ -253,7 +253,9 @@ dev_read_urand(pam_domain)
 # for encrypted homedir
 dev_read_sysfs(pam_domain)
 
-auth_create_faillog_files(pam_domain)
+auth_manage_faillog(pam_domain)
+auth_log_filetrans_login_records(pam_domain, "wtmp.db-journal")
+auth_manage_login_records(pam_domain)
 auth_domtrans_upd_passwd(pam_domain)
 auth_rw_lastlog(pam_domain)
 auth_rw_faillog(pam_domain)
Index: refpolicy-2.20260804/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260804/policy/modules/apps/wm.if
@@ -77,6 +77,12 @@ template(`wm_role_template',`
 
 	domain_use_interactive_fds($1_wm_t)
 
+	files_usr_domtrans($1_wm_t, $2)
+
+	files_watch_etc_dirs($1_wm_t)
+	files_watch_usr_dirs($1_wm_t)
+	files_watch_var_lib_dirs($1_wm_t)
+
 	mls_file_read_all_levels($1_wm_t)
 	mls_file_write_all_levels($1_wm_t)
 	mls_xwin_read_all_levels($1_wm_t)
@@ -117,6 +123,15 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		colord_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
+		geoclue_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
+		gnome_mmap_read_xdg_config_files($1_wm_t)
 		gnome_stream_connect_all_gkeyringd($1_wm_t)
 	')
 
@@ -143,7 +158,10 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		systemd_list_userdb_runtime_dirs($1_wm_t)
+		systemd_read_logind_runtime_files($1_wm_t)
 		systemd_read_logind_state($1_wm_t)
+		systemd_search_user_runtime($1_wm_t)
 		systemd_use_logind_fds($1_wm_t)
 		systemd_user_app_status($1, $1_wm_t)
 		systemd_write_inherited_logind_inhibit_pipes($1_wm_t)
Index: refpolicy-2.20260804/policy/modules/services/geoclue.if
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/geoclue.if
+++ refpolicy-2.20260804/policy/modules/services/geoclue.if
@@ -1 +1,22 @@
 ## <summary>Geoclue is a D-Bus service that provides location information.</summary>
+
+
+########################################
+## <summary>
+##      Send and receive messages from geoclue over dbus
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`geoclue_dbus_chat',`
+	gen_require(`
+		type geoclue_t;
+		class dbus send_msg;
+	')
+
+	allow $1 geoclue_t:dbus send_msg;
+	allow geoclue_t $1:dbus send_msg;
+')
Index: refpolicy-2.20260804/policy/modules/apps/chromium.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/apps/chromium.te
+++ refpolicy-2.20260804/policy/modules/apps/chromium.te
@@ -304,6 +304,7 @@ optional_policy(`
 	optional_policy(`
 		systemd_list_resolved_runtime(chromium_t)
 		systemd_dbus_chat_hostnamed(chromium_t)
+		systemd_dbus_chat_logind(chromium_t)
 	')
 
 	optional_policy(`
Index: refpolicy-2.20260804/policy/modules/services/rasdaemon.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/rasdaemon.te
+++ refpolicy-2.20260804/policy/modules/services/rasdaemon.te
@@ -40,8 +40,14 @@ dev_write_sysfs(rasdaemon_t)
 dev_read_urand(rasdaemon_t)
 dev_rw_cpu_microcode(rasdaemon_t)
 
+# for ipmitool
+corecmd_exec_shell(rasdaemon_t)
+corecmd_exec_bin(rasdaemon_t)
+files_read_usr_files(rasdaemon_t)
+
 files_search_var_lib(rasdaemon_t)
 fs_create_tracefs_dirs(rasdaemon_t)
+fs_list_pstore_dirs(rasdaemon_t)
 fs_rw_tracefs_files(rasdaemon_t)
 
 logging_send_syslog_msg(rasdaemon_t)
Index: refpolicy-2.20260804/policy/modules/admin/usbguard.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/admin/usbguard.fc
+++ refpolicy-2.20260804/policy/modules/admin/usbguard.fc
@@ -6,6 +6,7 @@
 /run/usbguard\.pid					gen_context(system_u:object_r:usbguard_runtime_t,s0)
 
 /usr/bin/usbguard-daemon			--	gen_context(system_u:object_r:usbguard_daemon_exec_t,s0)
+/usr/bin/usbguard-dbus				--	gen_context(system_u:object_r:usbguard_daemon_exec_t,s0)
 
 
 /var/log/usbguard(/.*)?					gen_context(system_u:object_r:usbguard_log_t,s0)
Index: refpolicy-2.20260804/policy/modules/system/authlogin.if
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/authlogin.if
+++ refpolicy-2.20260804/policy/modules/system/authlogin.if
@@ -1787,13 +1787,18 @@ interface(`auth_rw_login_records',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##      <summary>
+##      The name of the file being created.
+##      </summary>
+## </param>
 #
 interface(`auth_log_filetrans_login_records',`
 	gen_require(`
 		type wtmp_t;
 	')
 
-	logging_log_filetrans($1, wtmp_t, file)
+	logging_log_filetrans($1, wtmp_t, file, $2)
 ')
 
 ########################################
Index: refpolicy-2.20260804/policy/modules/services/rpcbind.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/rpcbind.te
+++ refpolicy-2.20260804/policy/modules/services/rpcbind.te
@@ -66,6 +66,7 @@ dev_read_cpu_online(rpcbind_t)
 domain_use_interactive_fds(rpcbind_t)
 
 files_read_etc_runtime_files(rpcbind_t)
+fs_getattr_xattr_fs(rpcbind_t)
 
 fs_getattr_xattr_fs(rpcbind_t)
 
Index: refpolicy-2.20260804/policy/modules/services/policykit.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/policykit.fc
+++ refpolicy-2.20260804/policy/modules/services/policykit.fc
@@ -23,4 +23,8 @@
 /var/lib/polkit-1(/.*)?	gen_context(system_u:object_r:policykit_var_lib_t,s0)
 /var/lib/PolicyKit-public(/.*)?	gen_context(system_u:object_r:policykit_var_lib_t,s0)
 
+ifdef(`distro_debian',`
+/run/polkit(/.*)?	gen_context(system_u:object_r:policykit_runtime_t,s0)
+', `
 /run/PolicyKit(/.*)?	gen_context(system_u:object_r:policykit_runtime_t,s0)
+')
Index: refpolicy-2.20260804/policy/modules/admin/usbguard.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/admin/usbguard.te
+++ refpolicy-2.20260804/policy/modules/admin/usbguard.te
@@ -40,7 +40,7 @@ files_tmpfs_file(usbguard_tmpfs_t)
 #
 
 allow usbguard_t self:capability { chown dac_read_search fowner };
-allow usbguard_t self:process { getcap signal };
+allow usbguard_t self:process { getcap signal signull };
 allow usbguard_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow usbguard_t self:unix_stream_socket { connectto rw_stream_socket_perms };
 
@@ -66,6 +66,7 @@ setattr_files_pattern(usbguard_t, usbgua
 dev_rw_sysfs(usbguard_t)
 
 kernel_read_kernel_sysctls(usbguard_t)
+kernel_read_vm_overcommit_sysctl(usbguard_t)
 kernel_read_system_state(usbguard_t)
 kernel_search_debugfs(usbguard_t)
 kernel_dontaudit_getattr_proc(usbguard_t)
Index: refpolicy-2.20260804/policy/modules/services/apache.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/apache.te
+++ refpolicy-2.20260804/policy/modules/services/apache.te
@@ -513,6 +513,7 @@ files_map_etc_files(httpd_t)
 
 auth_use_nsswitch(httpd_t)
 
+init_read_state(httpd_t)
 init_rw_inherited_script_tmp_files(httpd_t)
 
 libs_exec_lib_files(httpd_t)
Index: refpolicy-2.20260804/policy/modules/services/accountsd.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/accountsd.te
+++ refpolicy-2.20260804/policy/modules/services/accountsd.te
@@ -60,6 +60,9 @@ logging_send_syslog_msg(accountsd_t)
 logging_set_loginuid(accountsd_t)
 logging_watch_generic_logs_dir(accountsd_t)
 
+selinux_getattr_fs(accountsd_t)
+seutil_search_default_contexts(accountsd_t)
+
 userdom_read_user_tmp_files(accountsd_t)
 userdom_read_user_home_content_files(accountsd_t)
 
Index: refpolicy-2.20260804/policy/modules/services/fail2ban.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/fail2ban.te
+++ refpolicy-2.20260804/policy/modules/services/fail2ban.te
@@ -100,6 +100,7 @@ logging_watch_audit_log(fail2ban_t)
 logging_send_syslog_msg(fail2ban_t)
 
 miscfiles_read_localization(fail2ban_t)
+miscfiles_search_generic_cert_dirs(fail2ban_t)
 
 sysnet_manage_config(fail2ban_t)
 sysnet_etc_filetrans_config(fail2ban_t)
Index: refpolicy-2.20260804/policy/modules/services/ntp.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/ntp.te
+++ refpolicy-2.20260804/policy/modules/services/ntp.te
@@ -139,6 +139,7 @@ init_get_generic_units_status(ntpd_t)
 logging_send_syslog_msg(ntpd_t)
 
 miscfiles_read_localization(ntpd_t)
+miscfiles_search_generic_cert_dirs(ntpd_t)
 
 userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
 userdom_list_user_home_dirs(ntpd_t)
Index: refpolicy-2.20260804/policy/modules/services/bind.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/bind.te
+++ refpolicy-2.20260804/policy/modules/services/bind.te
@@ -238,6 +238,7 @@ allow ndc_t named_conf_t:lnk_file read_l
 allow ndc_t named_zone_t:dir search_dir_perms;
 
 kernel_read_kernel_sysctls(ndc_t)
+kernel_read_net_sysctls(ndc_t)
 kernel_read_system_state(ndc_t)
 kernel_read_vm_overcommit_sysctl(ndc_t)
 
Index: refpolicy-2.20260804/policy/modules/services/mysql.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/mysql.te
+++ refpolicy-2.20260804/policy/modules/services/mysql.te
@@ -68,6 +68,7 @@ files_runtime_file(mysqlmanagerd_runtime
 allow mysqld_t self:capability { dac_override dac_read_search ipc_lock setgid setuid sys_resource };
 dontaudit mysqld_t self:capability sys_tty_config;
 allow mysqld_t self:process { getcap getsched rlimitinh setrlimit setsched signal_perms };
+allow mysqld_t self:io_uring allowed;
 allow mysqld_t self:fifo_file rw_fifo_file_perms;
 allow mysqld_t self:shm create_shm_perms;
 allow mysqld_t self:unix_stream_socket { accept connectto listen };
Index: refpolicy-2.20260804/policy/modules/services/switcheroo.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/switcheroo.te
+++ refpolicy-2.20260804/policy/modules/services/switcheroo.te
@@ -20,10 +20,12 @@ allow switcheroo_t self:netlink_kobject_
 
 kernel_read_system_state(switcheroo_t)
 
+dev_getattr_sysfs(switcheroo_t)
 dev_read_sysfs(switcheroo_t)
 
 miscfiles_read_localization(switcheroo_t)
 
+udev_read_runtime_files(switcheroo_t)
 udev_search_runtime(switcheroo_t)
 
 optional_policy(`
Index: refpolicy-2.20260804/policy/modules/services/rpc.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/rpc.te
+++ refpolicy-2.20260804/policy/modules/services/rpc.te
@@ -316,6 +316,8 @@ optional_policy(`
 allow nfsd_t self:capability { dac_override dac_read_search lease net_admin setpcap sys_admin sys_resource };
 allow nfsd_t self:netlink_generic_socket create_socket_perms;
 allow nfsd_t self:process setcap;
+allow nfsd_t self:netlink_generic_socket create_socket_perms;
+allow nfsd_t self:udp_socket listen;
 
 allow nfsd_t exports_t:file read_file_perms;
 allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms;
Index: refpolicy-2.20260804/policy/modules/system/libraries.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/libraries.fc
+++ refpolicy-2.20260804/policy/modules/system/libraries.fc
@@ -51,6 +51,8 @@ ifdef(`distro_redhat',`
 /opt/google/chrome-beta/libvulkan\.so\.1	gen_context(system_u:object_r:lib_t,s0)
 /opt/google/chrome-unstable/libvulkan\.so\.1	gen_context(system_u:object_r:lib_t,s0)
 
+/opt/intel/oneapi/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:lib_t,s0)
+
 /opt/openoffice4/program/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:lib_t,s0)
 
 /opt/(.*/)?/RealPlayer/.+\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
Index: refpolicy-2.20260804/policy/modules/services/boinc.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/boinc.te
+++ refpolicy-2.20260804/policy/modules/services/boinc.te
@@ -60,6 +60,7 @@ allow boinc_t self:tcp_socket { accept l
 allow boinc_t self:shm create_shm_perms;
 allow boinc_t self:fifo_file rw_fifo_file_perms;
 allow boinc_t self:sem create_sem_perms;
+allow boinc_t self:cap_userns sys_ptrace;
 
 can_exec(boinc_t, boinc_exec_t)
 
@@ -91,12 +92,14 @@ libs_exec_lib_files(boinc_t)
 libs_legacy_use_ld_so(boinc_t)
 
 domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
+allow boinc_t boinc_project_t:process sigkill;
 
 kernel_read_system_state(boinc_t)
 kernel_read_vm_sysctls(boinc_t)
 kernel_read_vm_overcommit_sysctl(boinc_t)
 kernel_read_kernel_sysctls(boinc_t)
 kernel_read_net_sysctls(boinc_t)
+kernel_read_network_state_symlinks(boinc_t)
 
 corenet_all_recvfrom_netlabel(boinc_t)
 corenet_tcp_sendrecv_generic_if(boinc_t)
@@ -124,6 +127,8 @@ corenet_tcp_connect_squid_port(boinc_t)
 corecmd_exec_bin(boinc_t)
 corecmd_exec_shell(boinc_t)
 
+dev_getattr_input_dev(boinc_t)
+dev_getattr_mouse_dev(boinc_t)
 dev_read_rand(boinc_t)
 dev_read_urand(boinc_t)
 dev_read_sysfs(boinc_t)
@@ -168,6 +173,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_tmpfilesd_managed(boinc_var_lib_t)
+')
+
+optional_policy(`
 	tunable_policy(`boinc_use_gpu',`
 		corenet_tcp_connect_xserver_port(boinc_t)
 
@@ -183,7 +192,7 @@ optional_policy(`
 #
 
 allow boinc_project_t self:capability { setgid setuid };
-allow boinc_project_t self:process { execmem execstack getcap noatsecure ptrace setcap setpgid setsched signal_perms };
+allow boinc_project_t self:process { execmem execstack getcap noatsecure ptrace setcap setpgid setsched getsched signal_perms };
 
 manage_dirs_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
 manage_files_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t)
@@ -193,7 +202,7 @@ files_tmp_filetrans(boinc_project_t, boi
 manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
 
-allow boinc_project_t boinc_var_lib_t:dir search;
+allow boinc_project_t boinc_var_lib_t:dir { search getattr };
 allow boinc_project_t boinc_var_lib_t:file rw_inherited_file_perms;
 
 allow boinc_project_t boinc_project_var_lib_t:file execmod;
@@ -216,8 +225,8 @@ corenet_tcp_bind_generic_node(boinc_proj
 corenet_sendrecv_boinc_client_packets(boinc_project_t)
 corenet_tcp_connect_boinc_port(boinc_project_t)
 
-dev_getattr_input_dev(boinc_t)
-dev_getattr_mouse_dev(boinc_t)
+dev_read_sysfs(boinc_project_t)
+dev_rw_dri(boinc_project_t)
 
 files_dontaudit_search_home(boinc_project_t)
 files_read_etc_files(boinc_project_t)
Index: refpolicy-2.20260804/policy/modules/services/boinc.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/boinc.fc
+++ refpolicy-2.20260804/policy/modules/services/boinc.fc
@@ -6,6 +6,7 @@
 
 /var/lib/boinc(/.*)?	gen_context(system_u:object_r:boinc_var_lib_t,s0)
 /var/lib/boinc-client(/.*)?	gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc-client/\.cache(/.*)?	gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
 /var/lib/boinc-client/projects(/.*)?	gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
 /var/lib/boinc-client/slots(/.*)?	gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
 
Index: refpolicy-2.20260804/policy/modules/services/aptcacher.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/aptcacher.te
+++ refpolicy-2.20260804/policy/modules/services/aptcacher.te
@@ -102,6 +102,7 @@ sysnet_mmap_config_files(aptcacher_t)
 allow acngtool_t self:capability dac_override;
 allow acngtool_t self:tcp_socket create_stream_socket_perms;
 allow acngtool_t self:unix_stream_socket create_socket_perms;
+allow acngtool_t self:process signal;
 
 allow acngtool_t aptcacher_conf_t:dir list_dir_perms;
 allow acngtool_t aptcacher_conf_t:file mmap_read_file_perms;
Index: refpolicy-2.20260804/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20260804/policy/modules/services/devicekit.te
@@ -87,6 +87,7 @@ allow devicekit_disk_t devicekit_runtime
 manage_dirs_pattern(devicekit_disk_t, devicekit_runtime_t, devicekit_runtime_t)
 manage_files_pattern(devicekit_disk_t, devicekit_runtime_t, devicekit_runtime_t)
 files_runtime_filetrans(devicekit_disk_t, devicekit_runtime_t, { dir file })
+fs_tmpfs_filetrans(devicekit_disk_t, devicekit_runtime_t, file)
 
 kernel_getattr_message_if(devicekit_disk_t)
 kernel_list_unlabeled(devicekit_disk_t)
@@ -184,6 +185,7 @@ optional_policy(`
 
 optional_policy(`
 	lvm_domtrans(devicekit_disk_t)
+	lvm_manage_runtime_files(devicekit_disk_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260804/policy/modules/services/dovecot.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/dovecot.te
+++ refpolicy-2.20260804/policy/modules/services/dovecot.te
@@ -113,7 +113,7 @@ allow dovecot_t dovecot_cert_t:lnk_file
 allow dovecot_t dovecot_keytab_t:file read_file_perms;
 
 manage_dirs_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
-manage_files_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
+mmap_manage_files_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
 files_tmp_filetrans(dovecot_t, dovecot_tmp_t, { file dir })
 
 manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
@@ -130,7 +130,7 @@ mmap_manage_files_pattern(dovecot_t, dov
 manage_lnk_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
 
 manage_dirs_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
-manage_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
+mmap_manage_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
 manage_lnk_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
 manage_sock_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
 manage_fifo_files_pattern(dovecot_t, dovecot_runtime_t, dovecot_runtime_t)
Index: refpolicy-2.20260804/policy/modules/services/samba.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/samba.te
+++ refpolicy-2.20260804/policy/modules/services/samba.te
@@ -221,6 +221,7 @@ mmap_manage_files_pattern(samba_net_t, s
 manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t)
 files_var_filetrans(samba_net_t, samba_var_t, dir, "samba")
 
+kernel_getattr_proc(samba_net_t)
 kernel_read_system_state(samba_net_t)
 kernel_read_network_state(samba_net_t)
 
@@ -623,6 +624,7 @@ allow smbcontrol_t self:fifo_file rw_fif
 allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms;
 allow smbcontrol_t self:unix_dgram_socket create_socket_perms;
 allow smbcontrol_t self:process { signal signull };
+allow smbcontrol_t self:netlink_route_socket { create bind };
 
 allow smbcontrol_t { winbind_t nmbd_t smbd_t }:process { signal signull };
 allow smbcontrol_t { smbd_t nmbd_t }:unix_dgram_socket sendto;
Index: refpolicy-2.20260804/policy/modules/system/fwupd.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/fwupd.te
+++ refpolicy-2.20260804/policy/modules/system/fwupd.te
@@ -82,6 +82,7 @@ allow fwupd_t fwupd_tmp_t:file manage_fi
 
 kernel_read_kernel_sysctls(fwupd_t)
 kernel_read_net_sysctls(fwupd_t)
+kernel_read_network_state_symlinks(fwupd_t)
 # for /proc/filesystems etc
 kernel_read_system_state(fwupd_t)
 kernel_read_vm_overcommit_sysctl(fwupd_t)
Index: refpolicy-2.20260804/policy/modules/services/cron.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/cron.fc
+++ refpolicy-2.20260804/policy/modules/services/cron.fc
@@ -18,6 +18,7 @@
 /var/log/cron.*	gen_context(system_u:object_r:cron_log_t,s0)
 /var/log/popularity-contest.*	gen_context(system_u:object_r:cron_log_t,s0)
 /var/log/rpmpkgs.*	--	gen_context(system_u:object_r:cron_log_t,s0)
+/var/log/wtmp\.report.*	--	gen_context(system_u:object_r:cron_log_t,s0)
 
 /run/anacron\.pid	--	gen_context(system_u:object_r:crond_runtime_t,s0)
 /run/atd\.pid	--	gen_context(system_u:object_r:crond_runtime_t,s0)
Index: refpolicy-2.20260804/policy/modules/services/certbot.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/certbot.te
+++ refpolicy-2.20260804/policy/modules/services/certbot.te
@@ -38,6 +38,7 @@ files_type(certbot_lib_t)
 #
 
 allow certbot_t self:fifo_file rw_inherited_fifo_file_perms;
+allow certbot_t self:process getsched;
 allow certbot_t self:capability { chown dac_override fsetid sys_resource };
 dontaudit certbot_t self:capability net_admin;
 allow certbot_t self:udp_socket all_udp_socket_perms;
Index: refpolicy-2.20260804/policy/modules/services/sysstat.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/sysstat.fc
+++ refpolicy-2.20260804/policy/modules/services/sysstat.fc
@@ -5,6 +5,7 @@
 /usr/lib/atsar/atsa.*	--	gen_context(system_u:object_r:sysstat_exec_t,s0)
 /usr/lib/sa/sa.*	--	gen_context(system_u:object_r:sysstat_exec_t,s0)
 /usr/lib/sysstat/sa.*	--	gen_context(system_u:object_r:sysstat_exec_t,s0)
+/usr/libexec/sysstat/.*	--	gen_context(system_u:object_r:sysstat_exec_t,s0)
 
 /var/log/atsar(/.*)?	gen_context(system_u:object_r:sysstat_log_t,s0)
 /var/log/sa(/.*)?	gen_context(system_u:object_r:sysstat_log_t,s0)
Index: refpolicy-2.20260804/policy/modules/admin/apt.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/admin/apt.te
+++ refpolicy-2.20260804/policy/modules/admin/apt.te
@@ -80,6 +80,7 @@ manage_files_pattern(apt_t, apt_var_lib_
 files_var_lib_filetrans(apt_t, apt_var_lib_t, dir)
 allow apt_t apt_var_lib_t:dir { manage_dir_perms watch };
 manage_lnk_files_pattern(apt_t, apt_var_lib_t, apt_var_lib_t)
+allow apt_t apt_var_lib_t:sock_file manage_sock_file_perms;
 
 allow apt_t apt_var_log_t:file manage_file_perms;
 allow apt_t apt_var_log_t:dir manage_dir_perms;
Index: refpolicy-2.20260804/policy/modules/admin/apt.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/admin/apt.fc
+++ refpolicy-2.20260804/policy/modules/admin/apt.fc
@@ -20,11 +20,13 @@ ifndef(`distro_redhat',`
 /usr/libexec/packagekitd	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /var/cache/apt-show-versions(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
 /var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
+/var/cache/swcatalog(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
 /var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)
 ')
 
 /var/cache/apt(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
 /var/cache/apt-xapian-index`'(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
+/var/cache/etckeeper(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
 
 /var/lib/apt(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)
 /var/lib/aptitude(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)
Index: refpolicy-2.20260804/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260804/policy/modules/kernel/corecommands.fc
@@ -46,6 +46,8 @@ ifdef(`distro_redhat',`
 /etc/dhcp/dhclient-enter-hooks\.d(/.*)? --	gen_context(system_u:object_r:bin_t,s0)
 /etc/dhcp/dhclient-exit-hooks\.d(/.*)? --	gen_context(system_u:object_r:bin_t,s0)
 
+/etc/etckeeper/[^/]+/[^/]+	--	gen_context(system_u:object_r:bin_t,s0)
+
 /etc/hotplug/.*agent		--	gen_context(system_u:object_r:bin_t,s0)
 /etc/hotplug/.*rc		-- 	gen_context(system_u:object_r:bin_t,s0)
 /etc/hotplug/hotplug\.functions --	gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20260804/policy/modules/services/postfix.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/postfix.te
+++ refpolicy-2.20260804/policy/modules/services/postfix.te
@@ -293,6 +293,7 @@ domain_use_interactive_fds(postfix_maste
 files_search_tmp(postfix_master_t)
 
 init_read_state(postfix_master_t)
+init_search_units(postfix_master_t)
 
 term_dontaudit_search_ptys(postfix_master_t)
 
Index: refpolicy-2.20260804/policy/modules/services/acpi.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/acpi.te
+++ refpolicy-2.20260804/policy/modules/services/acpi.te
@@ -64,6 +64,7 @@ logging_send_syslog_msg(acpi_t)
 
 allow acpid_t self:capability { kill mknod sys_admin sys_nice sys_time };
 dontaudit acpid_t self:capability { dac_override dac_read_search setuid sys_ptrace sys_tty_config };
+allow acpid_t self:capability2 perfmon;
 allow acpid_t self:process { getsession signal_perms getsched };
 
 allow acpid_t self:fifo_file rw_fifo_file_perms;
Index: refpolicy-2.20260804/policy/modules/services/mta.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/mta.fc
+++ refpolicy-2.20260804/policy/modules/services/mta.fc
@@ -7,8 +7,7 @@ HOME_DIR/Maildir(/.*)?	gen_context(syste
 HOME_DIR/DovecotMail(/.*)?	gen_context(system_u:object_r:mail_home_rw_t,s0)
 HOME_DIR/\.maildir(/.*)?	gen_context(system_u:object_r:mail_home_rw_t,s0)
 
-/etc/aliases	--	gen_context(system_u:object_r:etc_aliases_t,s0)
-/etc/aliases\.db	--	gen_context(system_u:object_r:etc_aliases_t,s0)
+/etc/aliases.*		--	gen_context(system_u:object_r:etc_aliases_t,s0)
 /etc/mail(/.*)?	gen_context(system_u:object_r:etc_mail_t,s0)
 /etc/mail/aliases.*	--	gen_context(system_u:object_r:etc_aliases_t,s0)
 /etc/msmtprc		--	gen_context(system_u:object_r:etc_mail_t,s0)
Index: refpolicy-2.20260804/policy/modules/services/matrixbot.fc
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/services/matrixbot.fc
+++ refpolicy-2.20260804/policy/modules/services/matrixbot.fc
@@ -1,4 +1,4 @@
 /etc/matrix-eno-bot(/.*)?		gen_context(system_u:object_r:matrixbot_conf_t,s0)
-/usr/sbin/matrix-eno-bot	--	gen_context(system_u:object_r:matrixbot_exec_t,s0)
+/usr/bin/matrix-eno-bot		--	gen_context(system_u:object_r:matrixbot_exec_t,s0)
 /var/lib/matrix-eno-bot(/.*)?		gen_context(system_u:object_r:matrixbot_state_t,s0)
 /var/log/matrix-eno-bot\.log.*	--	gen_context(system_u:object_r:matrixbot_log_t,s0)
Index: refpolicy-2.20260804/policy/modules/system/needrestart.te
===================================================================
--- refpolicy-2.20260804.orig/policy/modules/system/needrestart.te
+++ refpolicy-2.20260804/policy/modules/system/needrestart.te
@@ -24,7 +24,7 @@ dontaudit needrestart_t self:capability
 # sys_resource is for sd-askpwagent
 allow needrestart_t self:capability { dac_read_search kill sys_ptrace sys_resource };
 allow needrestart_t self:capability2 checkpoint_restore;
-allow needrestart_t self:process { getcap signal setrlimit };
+allow needrestart_t self:process { getsched getcap signal setrlimit };
 allow needrestart_t self:fifo_file rw_fifo_file_perms;
 
 # for /proc/*/cwd etc
@@ -81,6 +81,7 @@ init_admin(needrestart_t)
 init_list_var_lib_dirs(needrestart_t)
 init_manage_all_units(needrestart_t)
 init_read_state(needrestart_t)
+init_search_units(needrestart_t)
 init_start_generic_units(needrestart_t)
 init_unix_stream_socket_connectto(needrestart_t)
 
@@ -96,6 +97,11 @@ term_read_console(needrestart_t)
 userdom_use_user_ptys(needrestart_t)
 
 optional_policy(`
+	apache_list_modules(needrestart_t)
+	apache_read_module_files(needrestart_t)
+')
+
+optional_policy(`
 	dpkg_read_db(needrestart_t)
 ')
 
