Index: refpolicy-2.20260801/policy/modules/apps/gpg.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/gpg.te
+++ refpolicy-2.20260801/policy/modules/apps/gpg.te
@@ -139,6 +139,7 @@ miscfiles_read_localization(gpg_t)
 miscfiles_read_generic_certs(gpg_t)
 
 userdom_use_user_terminals(gpg_t)
+userdom_user_home_dir_filetrans_user_home_content(gpg_t, file)
 
 userdom_manage_user_tmp_dirs(gpg_t)
 userdom_manage_user_tmp_files(gpg_t)
@@ -225,7 +226,7 @@ tunable_policy(`use_samba_home_dirs',`
 # Agent local policy
 #
 
-allow gpg_agent_t self:process { setrlimit signal_perms };
+allow gpg_agent_t self:process { setrlimit signal_perms getsched setsched };
 allow gpg_agent_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow gpg_agent_t self:fifo_file rw_fifo_file_perms;
 
@@ -301,6 +302,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gnome_dbus_chat_all_gkeyringd(gpg_agent_t)
+')
+
+optional_policy(`
 	mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20260801/policy/modules/roles/sysadm.te
@@ -49,6 +49,8 @@ allow sysadm_t self:netlink_route_socket
 # for debugging BPF programs
 allow sysadm_t self:capability2 bpf;
 
+kernel_request_load_module(sysadm_t)
+
 corecmd_exec_shell(sysadm_t)
 
 corenet_ib_access_unlabeled_pkeys(sysadm_t)
@@ -73,6 +75,7 @@ ubac_fd_exempt(sysadm_t)
 
 init_exec(sysadm_t)
 init_admin(sysadm_t)
+init_rw_stream_sockets(sysadm_t)
 
 # Add/remove user home directories
 userdom_manage_user_home_dirs(sysadm_t)
@@ -915,6 +918,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	qemu_role(sysadm_r, sysadm_t)
+')
+
+optional_policy(`
 	qpidd_admin(sysadm_t, sysadm_r)
 ')
 
Index: refpolicy-2.20260801/policy/modules/system/init.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/init.if
+++ refpolicy-2.20260801/policy/modules/system/init.if
@@ -3796,6 +3796,24 @@ interface(`init_reload_all_units',`
 	allow $1 { init_script_file_type systemdunit }:service reload;
 ')
 
+#######################################
+## <summary>
+##	getattr all systemd unit files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_getattr_all_units',`
+	gen_require(`
+		attribute systemdunit;
+	')
+
+	allow $1 systemdunit:file getattr;
+')
+
 ########################################
 ## <summary>
 ##	List systemd unit dirs and the files in them
Index: refpolicy-2.20260801/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/init.te
+++ refpolicy-2.20260801/policy/modules/system/init.te
@@ -296,7 +296,6 @@ ifdef(`init_systemd',`
 	allow init_t self:udp_socket create_socket_perms;
 	allow init_t self:netlink_route_socket create_netlink_socket_perms;
 	allow init_t initrc_t:unix_dgram_socket create_socket_perms;
-	allow init_t self:capability2 audit_read;
 	allow init_t self:key { search setattr write };
 	allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
 	allow init_t self:user_namespace create;
Index: refpolicy-2.20260801/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/logging.te
+++ refpolicy-2.20260801/policy/modules/system/logging.te
@@ -510,6 +510,7 @@ seutil_read_config(syslogd_t)
 
 userdom_dontaudit_use_unpriv_user_fds(syslogd_t)
 userdom_dontaudit_search_user_home_dirs(syslogd_t)
+userdom_search_user_runtime_root(syslogd_t)
 
 ifdef(`init_systemd',`
 	# for systemd-journal
@@ -564,6 +565,8 @@ ifdef(`init_systemd',`
 	systemd_relabelto_journal_files(syslogd_t)
 
 	udev_read_runtime_files(syslogd_t)
+	userdom_list_user_tmp(syslogd_t)
+	userdom_read_user_tmp_symlinks(syslogd_t)
 
 	# journald traverses /run/user/UID (which is mode 0700) to read symlinks in /run/user/UID/systemd/units/
 	allow syslogd_t self:capability dac_read_search;
Index: refpolicy-2.20260801/policy/modules/system/modutils.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/modutils.te
+++ refpolicy-2.20260801/policy/modules/system/modutils.te
@@ -116,6 +116,7 @@ miscfiles_read_localization(kmod_t)
 
 seutil_read_file_contexts(kmod_t)
 
+term_use_unallocated_ttys(kmod_t)
 userdom_use_user_terminals(kmod_t)
 
 userdom_dontaudit_search_user_home_dirs(kmod_t)
Index: refpolicy-2.20260801/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20260801/policy/modules/system/unconfined.te
@@ -39,6 +39,7 @@ logging_send_syslog_msg(unconfined_t)
 logging_run_auditctl(unconfined_t, unconfined_r)
 
 mount_run_unconfined(unconfined_t, unconfined_r)
+mount_watch_runtime_files_reads(unconfined_t)
 
 seutil_run_setfiles(unconfined_t, unconfined_r)
 seutil_run_semanage(unconfined_t, unconfined_r)
Index: refpolicy-2.20260801/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20260801/policy/modules/kernel/kernel.te
@@ -261,6 +261,7 @@ allow kernel_t self:unix_stream_socket c
 allow kernel_t self:fifo_file rw_fifo_file_perms;
 allow kernel_t self:sock_file read_sock_file_perms;
 allow kernel_t self:fd use;
+allow kernel_t self:perf_event cpu;
 
 allow kernel_t debugfs_t:dir search_dir_perms;
 
Index: refpolicy-2.20260801/policy/modules/admin/usermanage.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/admin/usermanage.te
+++ refpolicy-2.20260801/policy/modules/admin/usermanage.te
@@ -105,6 +105,7 @@ dev_read_urand(chfn_t)
 auth_run_chk_passwd(chfn_t, chfn_roles)
 auth_dontaudit_read_shadow(chfn_t)
 auth_use_nsswitch(chfn_t)
+auth_rw_shadow_lock(chfn_t)
 
 # allow checking if a shell is executable
 corecmd_check_exec_shell(chfn_t)
@@ -415,6 +416,7 @@ files_tmp_filetrans(sysadm_passwd_t, sys
 files_search_var(sysadm_passwd_t)
 files_dontaudit_search_home(sysadm_passwd_t)
 
+kernel_getattr_proc(sysadm_passwd_t)
 kernel_read_kernel_sysctls(sysadm_passwd_t)
 # for /proc/meminfo
 kernel_read_system_state(sysadm_passwd_t)
@@ -453,6 +455,9 @@ files_read_etc_runtime_files(sysadm_pass
 # for nscd lookups
 files_dontaudit_search_runtime(sysadm_passwd_t)
 
+files_etc_filetrans_etc(sysadm_passwd_t, file, "passwd.edit")
+files_etc_filetrans_etc(sysadm_passwd_t, file, "group.edit")
+
 # /usr/bin/passwd asks for w access to utmp, but it will operate
 # correctly without it.  Do not audit write denials to utmp.
 init_dontaudit_rw_utmp(sysadm_passwd_t)
Index: refpolicy-2.20260801/policy/modules/kernel/files.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/files.if
+++ refpolicy-2.20260801/policy/modules/kernel/files.if
@@ -3703,6 +3703,35 @@ interface(`files_etc_filetrans',`
 
 ########################################
 ## <summary>
+##	Create objects in /etc with type etc_t with specified
+##	name to overide default transition
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Object classes to be created.
+##	</summary>
+## </param>
+## <param name="name">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`files_etc_filetrans_etc',`
+	gen_require(`
+		type etc_t;
+	')
+
+	filetrans_pattern($1, etc_t, etc_t, $2, $3)
+')
+
+########################################
+## <summary>
 ##	Create a boot flag.
 ## </summary>
 ## <desc>
Index: refpolicy-2.20260801/policy/modules/system/unconfined.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/unconfined.if
+++ refpolicy-2.20260801/policy/modules/system/unconfined.if
@@ -37,7 +37,7 @@ interface(`unconfined_domain_noaudit',`
 
 	# Use most Linux capabilities
 	allow $1 self:{ capability cap_userns } { audit_control audit_write chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mknod net_admin net_bind_service net_broadcast net_raw setfcap setgid setpcap setuid sys_admin sys_boot sys_chroot sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config };
-	allow $1 self:{ capability2 cap2_userns } { bpf perfmon syslog wake_alarm };
+	allow $1 self:{ capability2 cap2_userns } { bpf perfmon syslog wake_alarm checkpoint_restore };
 	allow $1 self:fifo_file manage_fifo_file_perms;
 	allow $1 self:system status;
 
@@ -49,6 +49,8 @@ interface(`unconfined_domain_noaudit',`
 	# Transition to myself, to make get_ordered_context_list happy.
 	allow $1 self:process transition;
 
+	allow $1 self:perf_event { open read kernel cpu };
+
 	# Write access is for setting attributes under /proc/self/attr.
 	allow $1 self:file rw_file_perms;
 
@@ -388,6 +390,24 @@ interface(`unconfined_signal',`
 ')
 
 ########################################
+## <summary>
+##	rw unconfined domain semaphores
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unconfined_rw_sem',`
+	gen_require(`
+		type unconfined_t;
+	')
+
+	allow $1 unconfined_t:sem rw_sem_perms;
+')
+
+########################################
 ## <summary>
 ##	Read unconfined domain unnamed pipes.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260801/policy/modules/apps/wm.if
@@ -61,11 +61,17 @@ template(`wm_role_template',`
 	allow $3 $1_wm_t:unix_stream_socket { connectto read write getopt shutdown };
 	allow $3 $1_wm_t:fifo_file read_fifo_file_perms;
 
+	allow $1_wm_t self:capability sys_nice;
+
 	# ptrace here would allow messing with keyboard
 	allow $3 $1_wm_t:process { signal_perms };
 	ps_process_pattern($3, $1_wm_t)
 
+	dev_rw_input_dev($1_wm_t)
+
+	kernel_read_device_sysctls($1_wm_t)
 	kernel_read_kernel_sysctls($1_wm_t)
+	kernel_read_vm_overcommit_sysctl($1_wm_t)
 
 	allow $1_wm_t $3:process { sigkill signull signal };
 	ps_process_pattern($1_wm_t, $3)
@@ -83,6 +89,9 @@ template(`wm_role_template',`
 	files_watch_usr_dirs($1_wm_t)
 	files_watch_var_lib_dirs($1_wm_t)
 
+	fs_read_cgroup_symlinks($1_wm_t)
+	fs_create_cgroup_dirs($1_wm_t)
+
 	mls_file_read_all_levels($1_wm_t)
 	mls_file_write_all_levels($1_wm_t)
 	mls_xwin_read_all_levels($1_wm_t)
@@ -92,13 +101,28 @@ template(`wm_role_template',`
 	auth_domtrans_chk_passwd($1_wm_t)
 	auth_use_nsswitch($1_wm_t)
 
+	init_read_state($1_wm_t)
+
+	libs_read_lib_files($1_wm_t)
+	logging_send_syslog_msg($1_wm_t)
+
 	miscfiles_manage_fonts_cache($1_wm_t)
 
+	udev_list_runtime($1_wm_t)
+	userdom_manage_user_runtime_dirs($1_wm_t)
+	userdom_write_user_runtime_sockets($1_wm_t)
+
 	userdom_rw_user_tmpfs_files($1_wm_t)
 	userdom_map_user_tmpfs_files($1_wm_t)
 	userdom_manage_user_tmp_files($1_wm_t)
 	userdom_map_user_tmp_files($1_wm_t)
 
+	xdg_manage_data($1_wm_t)
+	xdg_watch_cache_dirs($1_wm_t)
+	xdg_watch_cache_files($1_wm_t)
+	xdg_watch_config_dirs($1_wm_t)
+	xdg_watch_data_dirs($1_wm_t)
+
 	xserver_read_xdm_state($1_wm_t)
 	xserver_role($1, $1_wm_t, $3, $4)
 	xserver_manage_core_devices($1_wm_t)
@@ -110,6 +134,10 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		apt_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
 		dbus_connect_spec_session_bus($1, $1_wm_t)
 		dbus_getattr_session_runtime_socket($1_wm_t)
 		dbus_read_lib_files($1_wm_t)
@@ -136,6 +164,10 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		iiosensorproxy_dbus_chat($1_wm_t)
+	')
+
+	optional_policy(`
 		modemmanager_dbus_chat($1_wm_t)
 	')
 
@@ -161,6 +193,7 @@ template(`wm_role_template',`
 		systemd_list_userdb_runtime_dirs($1_wm_t)
 		systemd_read_logind_runtime_files($1_wm_t)
 		systemd_read_logind_state($1_wm_t)
+		systemd_read_logind_sessions_files($1_wm_t)
 		systemd_search_user_runtime($1_wm_t)
 		systemd_use_logind_fds($1_wm_t)
 		systemd_user_app_status($1, $1_wm_t)
@@ -185,6 +218,10 @@ template(`wm_role_template',`
 		xdg_manage_config($1_wm_t)
 		xdg_watch_data_files($1_wm_t)
 	')
+
+	optional_policy(`
+		xdg_watch_config_files($1_wm_t)
+	')
 ')
 
 ########################################
@@ -272,6 +309,25 @@ interface(`wm_mmap_rw_tmpfs_files',`
 ')
 
 ########################################
+## <summary>
+##	mmap and read-write inherited files created by wm_domain in tmpfs filesystems.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to allow
+##	</summary>
+## </param>
+#
+interface(`wm_mmap_rw_inherited_tmpfs_files',`
+	gen_require(`
+		type wm_tmpfs_t;
+	')
+
+	fs_list_tmpfs($1)
+	allow $1 wm_tmpfs_t:file mmap_rw_inherited_file_perms;
+')
+
+########################################
 ## <summary>
 ##	Do not audit attempts to execute
 ##	files in temporary filesystems.
Index: refpolicy-2.20260801/policy/modules/apps/wm.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/wm.te
+++ refpolicy-2.20260801/policy/modules/apps/wm.te
@@ -47,6 +47,7 @@ files_tmp_filetrans(wm_domain, wm_tmp_t,
 manage_dirs_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
 manage_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
 mmap_read_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
+allow wm_domain wm_tmpfs_t:file { execute execmod };
 manage_lnk_files_pattern(wm_domain, wm_tmpfs_t, wm_tmpfs_t)
 fs_tmpfs_filetrans(wm_domain, wm_tmpfs_t, { dir file lnk_file })
 
Index: refpolicy-2.20260801/policy/modules/system/xdg.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/xdg.if
+++ refpolicy-2.20260801/policy/modules/system/xdg.if
@@ -103,6 +103,24 @@ interface(`xdg_watch_cache_dirs',`
 
 ########################################
 ## <summary>
+##	Watch the xdg cache home files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xdg_watch_cache_files',`
+	gen_require(`
+		type xdg_cache_t;
+	')
+
+	allow $1 xdg_cache_t:file watch;
+')
+
+########################################
+## <summary>
 ##	Watch all the xdg cache home directories
 ## </summary>
 ## <param name="domain">
@@ -121,6 +139,24 @@ interface(`xdg_watch_all_cache_dirs',`
 
 ########################################
 ## <summary>
+##	Watch all the xdg cache home files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xdg_watch_all_cache_files',`
+	gen_require(`
+		attribute xdg_cache_type;
+	')
+
+	allow $1 xdg_cache_type:file watch;
+')
+
+########################################
+## <summary>
 ##	Read the xdg cache home files
 ## </summary>
 ## <param name="domain">
@@ -407,6 +443,24 @@ interface(`xdg_watch_config_dirs',`
 ')
 
 ########################################
+## <summary>
+##	Watch the xdg config home files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`xdg_watch_config_files',`
+	gen_require(`
+		type xdg_config_t;
+	')
+
+	allow $1 xdg_config_t:file watch;
+')
+
+########################################
 ## <summary>
 ##	Watch all the xdg config home directories
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/system/lvm.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/lvm.if
+++ refpolicy-2.20260801/policy/modules/system/lvm.if
@@ -269,3 +269,22 @@ interface(`lvm_admin',`
 	files_search_tmp($1)
 	admin_pattern($1, lvm_tmp_t)
 ')
+
+######################################
+## <summary>
+##	Manage LVM metadata
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lvm_manage_metadata',`
+	gen_require(`
+		type lvm_metadata_t;
+	')
+
+	allow $1 lvm_metadata_t:dir manage_dir_perms;
+	allow $1 lvm_metadata_t:file manage_file_perms;
+')
Index: refpolicy-2.20260801/policy/modules/system/udev.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/udev.if
+++ refpolicy-2.20260801/policy/modules/system/udev.if
@@ -244,6 +244,26 @@ interface(`udev_relabel_rules_files',`
 
 ########################################
 ## <summary>
+##      read udev rules files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`udev_read_rules_files',`
+	gen_require(`
+		type udev_rules_t;
+	')
+
+	allow $1 udev_rules_t:dir list_dir_perms;
+	allow $1 udev_rules_t:file read_file_perms;
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
 ##	Search through udev runtime dirs.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260801/policy/modules/apps/xscreensaver.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/xscreensaver.fc
+++ refpolicy-2.20260801/policy/modules/apps/xscreensaver.fc
@@ -6,3 +6,4 @@ HOME_DIR/XScreenSaver		--	gen_context(sy
 /usr/bin/xscreensaver-gl-helper	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
 
 /usr/libexec/xscreensaver(/.*)?	--	gen_context(system_u:object_r:xscreensaver_helper_exec_t,s0)
+/usr/lib/[^/]*-linux-gnu/libexec/kscreenlocker_greet	--	gen_context(system_u:object_r:xscreensaver_exec_t,s0)
Index: refpolicy-2.20260801/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260801/policy/modules/system/userdomain.if
@@ -154,6 +154,10 @@ template(`userdom_base_user_template',`
 		logging_send_syslog_msg($1_t)
 	')
 
+	tunable_policy(`user_read_video',`
+		dev_read_video_dev($1_t)
+	')
+
 	tunable_policy(`user_ptrace',`
 		allow $1_t self:process ptrace;
 	')
@@ -169,10 +173,33 @@ template(`userdom_base_user_template',`
 	')
 
 	optional_policy(`
+		geoclue_dbus_chat($1_t)
+	')
+
+	optional_policy(`
 		kerneloops_dbus_chat($1_t)
 	')
 
 	optional_policy(`
+		ntp_dbus_chat($1_t)
+	')
+
+	optional_policy(`
+		obex_role_template($1, $1_r, $1_t)
+	')
+
+	optional_policy(`
+		pipewire_rw_stream_sockets($1_t)
+	')
+
+	optional_policy(`
+		powerprofiles_dbus_chat($1_t)
+	')
+
+	optional_policy(`
+		rtkit_scheduled($1_t)
+	')
+	optional_policy(`
 		wayland_client_domain($1_t)
 	')
 
@@ -782,6 +809,10 @@ template(`userdom_common_user_template',
 
 
 	optional_policy(`
+		accountsd_read_lib_files($1_t)
+	')
+
+	optional_policy(`
 		alsa_home_filetrans_alsa_home($1_t, file, ".asoundrc")
 		alsa_manage_home_files($1_t)
 		alsa_read_config($1_t)
@@ -1061,6 +1092,8 @@ template(`userdom_login_user_template',
 	init_dontaudit_use_fds($1_t)
 	init_dontaudit_use_script_fds($1_t)
 
+	# read interface is needed for lock access
+	libs_read_lib_files($1_t)
 	libs_watch_lib_dirs($1_t)
 	libs_exec_lib_files($1_t)
 
@@ -1636,9 +1669,11 @@ template(`userdom_xdg_user_template',`
 	xdg_manage_all_cache($1_t)
 	xdg_relabel_all_cache($1_t)
 	xdg_watch_all_cache_dirs($1_t)
+	xdg_watch_all_cache_files($1_t)
 	xdg_manage_all_config($1_t)
 	xdg_relabel_all_config($1_t)
 	xdg_watch_all_config_dirs($1_t)
+	xdg_watch_config_files($1_t)
 	xdg_manage_all_data($1_t)
 	xdg_relabel_all_data($1_t)
 	xdg_watch_all_data_dirs($1_t)
@@ -2089,10 +2124,10 @@ interface(`userdom_home_filetrans_user_h
 #
 interface(`userdom_user_home_domtrans',`
 	gen_require(`
-		type user_home_dir_t, user_home_t;
+		type user_home_dir_t, user_home_t, user_bin_t;
 	')
 
-	domain_auto_transition_pattern($1, user_home_t, $2)
+	domain_auto_transition_pattern($1, { user_home_t user_bin_t }, $2)
 	allow $1 user_home_dir_t:dir search_dir_perms;
 	files_search_home($1)
 ')
@@ -4035,6 +4070,24 @@ interface(`userdom_delete_all_user_runti
 ')
 
 ########################################
+## <summary>
+##	watch user runtime directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_watch_all_user_runtime_dirs',`
+	gen_require(`
+		attribute user_runtime_content_type;
+	')
+
+	allow $1 user_runtime_content_type:dir watch;
+')
+
+########################################
 ## <summary>
 ##	delete user runtime files
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20260801/policy/modules/services/devicekit.te
@@ -90,6 +90,7 @@ files_runtime_filetrans(devicekit_disk_t
 fs_tmpfs_filetrans(devicekit_disk_t, devicekit_runtime_t, file)
 
 kernel_getattr_message_if(devicekit_disk_t)
+kernel_get_sysvipc_info(devicekit_disk_t)
 kernel_list_unlabeled(devicekit_disk_t)
 kernel_dontaudit_getattr_unlabeled_files(devicekit_disk_t)
 kernel_read_fs_sysctls(devicekit_disk_t)
@@ -157,6 +158,7 @@ auth_use_nsswitch(devicekit_disk_t)
 logging_send_syslog_msg(devicekit_disk_t)
 
 miscfiles_read_localization(devicekit_disk_t)
+miscfiles_read_generic_certs(devicekit_disk_t)
 
 userdom_read_all_users_state(devicekit_disk_t)
 userdom_search_user_home_dirs(devicekit_disk_t)
Index: refpolicy-2.20260801/policy/modules/system/locallogin.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/locallogin.te
+++ refpolicy-2.20260801/policy/modules/system/locallogin.te
@@ -199,6 +199,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	# for motd
+	apt_read_db(local_login_t)
+')
+
+optional_policy(`
 	dbus_system_bus_client(local_login_t)
 ')
 
@@ -222,6 +227,7 @@ optional_policy(`
 
 optional_policy(`
 	systemd_dbus_chat_logind(local_login_t)
+	systemd_use_logind_fds(local_login_t)
 	systemd_write_inherited_logind_sessions_pipes(local_login_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/services/switcheroo.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/switcheroo.te
+++ refpolicy-2.20260801/policy/modules/services/switcheroo.te
@@ -17,6 +17,7 @@ init_daemon_domain(switcheroo_t, switche
 #
 
 allow switcheroo_t self:netlink_kobject_uevent_socket create_socket_perms;
+dontaudit switcheroo_t self:capability net_admin;
 
 kernel_read_system_state(switcheroo_t)
 
Index: refpolicy-2.20260801/policy/modules/services/cron.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/cron.te
+++ refpolicy-2.20260801/policy/modules/services/cron.te
@@ -339,6 +339,7 @@ optional_policy(`
 optional_policy(`
 	systemd_dbus_chat_logind(crond_t)
 	systemd_write_inherited_logind_sessions_pipes(crond_t)
+	systemd_connect_machined(crond_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260801/policy/modules/apps/xscreensaver.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/xscreensaver.te
+++ refpolicy-2.20260801/policy/modules/apps/xscreensaver.te
@@ -37,7 +37,7 @@ userdom_user_tmpfs_file(xscreensaver_tmp
 #
 
 allow xscreensaver_t self:capability { setgid setuid };
-allow xscreensaver_t self:process { setpgid setsched signal sigstop };
+allow xscreensaver_t self:process { setpgid setsched getsched getcap signal sigstop };
 allow xscreensaver_t self:fifo_file rw_fifo_file_perms;
 allow xscreensaver_t self:netlink_kobject_uevent_socket { bind create getattr setopt getopt read };
 
@@ -45,12 +45,22 @@ allow xscreensaver_t xscreensaver_helper
 
 allow xscreensaver_t xscreensaver_config_t:file manage_file_perms;
 
+dev_read_sysfs(xscreensaver_t)
+dev_rw_dma_dev(xscreensaver_t)
+dev_rw_dri(xscreensaver_t)
+
+kernel_getattr_proc(xscreensaver_t)
+kernel_read_device_sysctls(xscreensaver_t)
+kernel_read_kernel_sysctls(xscreensaver_t)
 kernel_read_system_state(xscreensaver_t)
 
 files_read_usr_files(xscreensaver_t)
+files_map_usr_files(xscreensaver_t)
+files_watch_runtime_dirs(xscreensaver_t)
 
 fs_dontaudit_getattr_xattr_fs(xscreensaver_t)
 
+accountsd_search_lib(xscreensaver_t)
 auth_dontaudit_read_shadow(xscreensaver_t)
 auth_use_nsswitch(xscreensaver_t)
 auth_domtrans_chk_passwd(xscreensaver_t)
@@ -64,11 +74,21 @@ logging_send_syslog_msg(xscreensaver_t)
 
 miscfiles_read_localization(xscreensaver_t)
 
+selinux_getattr_fs(xscreensaver_t)
+seutil_search_default_contexts(xscreensaver_t)
+
 userdom_use_user_terminals(xscreensaver_t)
+userdom_write_user_tmp_sockets(xscreensaver_t)
 
 xdg_read_pictures(xscreensaver_t)
+xdg_manage_cache(xscreensaver_t)
+xdg_manage_config(xscreensaver_t)
+xdg_manage_data(xscreensaver_t)
+xdg_watch_config_files(xscreensaver_t)
 
+xserver_manage_mesa_shader_cache(xscreensaver_t)
 xserver_read_xkb_libs(xscreensaver_t)
+xserver_rw_mesa_shader_cache(xscreensaver_t)
 xserver_rw_xsession_log(xscreensaver_t)
 xserver_user_x_domain_template(xscreensaver, xscreensaver_t, xscreensaver_tmpfs_t)
 
@@ -93,11 +113,34 @@ tunable_policy(`xscreensaver_read_generi
 ')
 
 optional_policy(`
+	dbus_all_session_bus_client(xscreensaver_t)
+	dbus_list_system_bus_runtime(xscreensaver_t)
+	dbus_write_session_runtime_socket(xscreensaver_t)
+	dbus_send_all_session_bus(xscreensaver_t)
+	dbus_system_bus_client(xscreensaver_t)
+	userdom_dbus_send_all_users(xscreensaver_t)
+')
+
+optional_policy(`
+	devicekit_dbus_chat_disk(xscreensaver_t)
+	devicekit_dbus_chat_power(xscreensaver_t)
+')
+
+optional_policy(`
+	systemd_dbus_chat_logind(xscreensaver_t)
+')
+
+optional_policy(`
+	udev_search_runtime(xscreensaver_t)
+')
+
+optional_policy(`
 	wm_application_domain(xscreensaver_t, xscreensaver_exec_t)
 	wm_send_dbus(xscreensaver_t)
 	wm_recv_dbus(xscreensaver_t)
 ')
 
+
 ########################################
 #
 # Helper local policy
@@ -123,6 +166,7 @@ files_dontaudit_search_home(xscreensaver
 # /etc/drirc
 files_read_etc_files(xscreensaver_helper_t)
 
+files_map_usr_files(xscreensaver_helper_t)
 files_read_usr_files(xscreensaver_helper_t)
 
 fs_dontaudit_getattr_xattr_fs(xscreensaver_helper_t)
Index: refpolicy-2.20260801/policy/modules/apps/evolution.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/evolution.te
+++ refpolicy-2.20260801/policy/modules/apps/evolution.te
@@ -308,15 +308,34 @@ corecmd_exec_bin(evolution_alarm_t)
 dev_read_urand(evolution_alarm_t)
 
 files_read_usr_files(evolution_alarm_t)
+files_map_usr_files(evolution_alarm_t)
+files_watch_etc_dirs(evolution_alarm_t)
+files_watch_usr_dirs(evolution_alarm_t)
+files_watch_var_lib_dirs(evolution_alarm_t)
 
 fs_dontaudit_getattr_xattr_fs(evolution_alarm_t)
 fs_search_auto_mountpoints(evolution_alarm_t)
 
+logging_send_syslog_msg(evolution_alarm_t)
+
 auth_use_nsswitch(evolution_alarm_t)
 
+gnome_mmap_read_xdg_config_files(evolution_alarm_t)
+
 miscfiles_read_localization(evolution_alarm_t)
 
 userdom_dontaudit_read_user_home_content_files(evolution_alarm_t)
+userdom_search_user_runtime(evolution_alarm_t)
+userdom_write_user_tmp_sockets(evolution_alarm_t)
+userdom_list_user_tmp(evolution_alarm_t)
+userdom_rw_user_tmp_files(evolution_alarm_t)
+userdom_map_user_tmp_files(evolution_alarm_t)
+userdom_watch_user_home_dirs(evolution_alarm_t)
+
+xdg_search_config_dirs(evolution_alarm_t)
+xdg_search_data_dirs(evolution_alarm_t)
+xdg_read_config_files(evolution_alarm_t)
+xdg_read_data_files(evolution_alarm_t)
 
 xserver_user_x_domain_template(evolution_alarm, evolution_alarm_t, evolution_alarm_tmpfs_t)
 xserver_read_xkb_libs(evolution_alarm_t)
@@ -336,6 +355,7 @@ tunable_policy(`use_samba_home_dirs',`
 optional_policy(`
 	dbus_all_session_bus_client(evolution_alarm_t)
 	dbus_connect_all_session_bus(evolution_alarm_t)
+	dbus_write_session_runtime_socket(evolution_alarm_t)
 
 	optional_policy(`
 		evolution_dbus_chat(evolution_alarm_t)
Index: refpolicy-2.20260801/policy/modules/services/dbus.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/dbus.if
+++ refpolicy-2.20260801/policy/modules/services/dbus.if
@@ -126,6 +126,9 @@ template(`dbus_role_template',`
 
 	kernel_getattr_proc($1_dbusd_t)
 
+	# for /sys/module/apparmor/parameters/enabled
+	dev_read_sysfs($1_dbusd_t)
+
 	corecmd_bin_domtrans($1_dbusd_t, $3)
 	corecmd_shell_domtrans($1_dbusd_t, $3)
 
Index: refpolicy-2.20260801/policy/modules/apps/gnome.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/gnome.te
+++ refpolicy-2.20260801/policy/modules/apps/gnome.te
@@ -35,6 +35,7 @@ userdom_user_home_content(gnome_keyring_
 type gnome_keyring_tmp_t;
 userdom_user_tmp_file(gnome_keyring_tmp_t)
 userdom_user_runtime_content(gnome_keyring_tmp_t)
+systemd_user_activated_sock_file(gnome_keyring_tmp_t)
 
 type gnome_xdg_cache_t;
 xdg_cache_content(gnome_xdg_cache_t)
@@ -135,6 +136,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	pipewire_stream_connect(gconfd_t)
+')
+
+optional_policy(`
 	pulseaudio_stream_connect(gconfd_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/apps/bubblewrap.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/bubblewrap.if
+++ refpolicy-2.20260801/policy/modules/apps/bubblewrap.if
@@ -48,7 +48,7 @@ template(`bubblewrap_role',`
 	allow $2 $1_bubblewrap_t:process signal_perms;
 	ps_process_pattern($1_bubblewrap_t, $2)
 
-	allow $1_bubblewrap_t self:process { sigkill setpgid getcap setcap };
+	allow $1_bubblewrap_t self:process { sigkill setpgid getcap setcap noatsecure };
 	allow $1_bubblewrap_t self:user_namespace create;
 	allow $1_bubblewrap_t self:cap_userns { dac_override sys_admin sys_ptrace setpcap net_admin };
 	allow $1_bubblewrap_t self:netlink_route_socket create_netlink_socket_perms;
@@ -61,10 +61,9 @@ template(`bubblewrap_role',`
 	kernel_read_kernel_sysctls($1_bubblewrap_t)
 	kernel_read_system_state($1_bubblewrap_t)
 
-	application_domain($1_bubblewrap_t, bubblewrap_exec_t)
-
 	dev_getattr_i2c($1_bubblewrap_t)
 	dev_read_rand($1_bubblewrap_t)
+	dev_read_urand($1_bubblewrap_t)
 	dev_remount_fs($1_bubblewrap_t)
 	dev_remount_sysfs($1_bubblewrap_t)
 
@@ -74,6 +73,7 @@ template(`bubblewrap_role',`
 	files_list_non_security($1_bubblewrap_t)
 	files_mounton_non_security($1_bubblewrap_t)
 	files_read_etc_files($1_bubblewrap_t)
+	files_read_usr_files($1_bubblewrap_t)
 	files_search_mnt($1_bubblewrap_t)
 
 	fs_getattr_nsfs_files($1_bubblewrap_t)
@@ -88,6 +88,8 @@ template(`bubblewrap_role',`
 	fs_unmount_tmpfs($1_bubblewrap_t)
 	fs_unmount_xattr_fs($1_bubblewrap_t)
 
+	logging_send_syslog_msg($1_bubblewrap_t)
+
 	miscfiles_read_localization($1_bubblewrap_t)
 
 	selinux_get_fs_mount($1_bubblewrap_t)
@@ -99,9 +101,12 @@ template(`bubblewrap_role',`
 	userdom_manage_tmpfs_role($1_r, $1_bubblewrap_t)
 	userdom_read_user_tmp_symlinks($1_bubblewrap_t)
 	userdom_read_user_home_content_symlinks($1_bubblewrap_t)
+	userdom_rw_user_tmp_files($1_bubblewrap_t)
 	userdom_manage_user_home_content_files($1_bubblewrap_t)
 	userdom_use_user_ptys($1_bubblewrap_t)
 	userdom_use_user_ttys($1_bubblewrap_t)
+	userdom_user_home_domtrans($1_bubblewrap_t, $2)
+	userdom_write_user_tmp_sockets($1_bubblewrap_t)
 
 	ifndef(`enable_mls',`
 		fs_search_removable($1_bubblewrap_t)
Index: refpolicy-2.20260801/policy/modules/kernel/corenetwork.te.in
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/corenetwork.te.in
+++ refpolicy-2.20260801/policy/modules/kernel/corenetwork.te.in
@@ -171,7 +171,7 @@ network_port(isakmp, udp,500,s0)
 network_port(iscsi, tcp,3260,s0)
 network_port(isns, tcp,3205,s0, udp,3205,s0)
 network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
-network_port(jabber_interserver, tcp,5269,s0)
+network_port(jabber_interserver, tcp,5269,s0, tcp,5270,s0)
 network_port(jboss_iiop, tcp,3528,s0, udp,3528,s0)
 network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)
 network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0)
Index: refpolicy-2.20260801/policy/modules/apps/chromium.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/chromium.te
+++ refpolicy-2.20260801/policy/modules/apps/chromium.te
@@ -107,9 +107,10 @@ allow chromium_t self:file create;
 allow chromium_t self:fifo_file rw_fifo_file_perms;
 allow chromium_t self:sem create_sem_perms;
 allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms;
+allow chromium_t self:netlink_route_socket nlmsg_write;
 allow chromium_t self:user_namespace create;
 # cap_userns sys_admin for the sandbox
-allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
+allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace setpcap };
 
 allow chromium_t chromium_exec_t:file execute_no_trans;
 
@@ -194,10 +195,12 @@ files_watch_runtime_dirs(chromium_t)
 # During find for /etc/whatever-release we get lots of output otherwise
 files_dontaudit_getattr_all_dirs(chromium_t)
 
-fs_dontaudit_getattr_xattr_fs(chromium_t)
+fs_getattr_xattr_fs(chromium_t)
 fs_getattr_tmpfs(chromium_t)
 fs_search_cgroup_dirs(chromium_t)
 
+logging_send_syslog_msg(chromium_t)
+
 miscfiles_read_all_certs(chromium_t)
 miscfiles_read_localization(chromium_t)
 
@@ -219,9 +222,14 @@ xdg_create_cache_dirs(chromium_t)
 xdg_create_config_dirs(chromium_t)
 xdg_create_data_dirs(chromium_t)
 xdg_manage_downloads(chromium_t)
+xdg_read_cache_files(chromium_t)
 xdg_read_config_files(chromium_t)
 xdg_read_data_files(chromium_t)
 
+# chrome wants to write to ~/.config/kwinrc and ~/.config/kcminputrc
+xdg_dontaudit_config_file_write(chromium_t)
+
+xserver_read_xkb_libs(chromium_t)
 xserver_user_x_domain_template(chromium, chromium_t, chromium_tmpfs_t)
 xserver_stream_connect_xdm(chromium_t)
 xserver_manage_mesa_shader_cache(chromium_t)
@@ -233,6 +241,7 @@ tunable_policy(`chromium_bind_tcp_unrese
 ')
 
 tunable_policy(`chromium_dri', `
+	dev_rw_dma_dev(chromium_t)
 	dev_rw_dri(chromium_t)
 ')
 
@@ -273,6 +282,7 @@ tunable_policy(`chromium_read_system_inf
 
 optional_policy(`
 	alsa_read_config(chromium_t)
+	alsa_read_lib(chromium_t)
 ')
 
 optional_policy(`
@@ -281,6 +291,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	colord_dbus_chat(chromium_t)
+')
+
+optional_policy(`
 	dbus_all_session_bus_client(chromium_t)
 	dbus_send_fifo_file_all_session_bus(chromium_t)
 	dbus_system_bus_client(chromium_t)
@@ -320,11 +334,19 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gnome_mmap_read_xdg_config_files(chromium_t)
+')
+
+optional_policy(`
 	networkmanager_dbus_chat(chromium_t)
 	networkmanager_watch_runtime_dirs(chromium_t)
 ')
 
 optional_policy(`
+	pipewire_stream_connect(chromium_t)
+')
+
+optional_policy(`
 	ssh_dontaudit_agent_tmp(chromium_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20260801/policy/modules/system/systemd.te
@@ -52,6 +52,13 @@ gen_tunable(systemd_socket_proxyd_bind_a
 ## </desc>
 gen_tunable(systemd_socket_proxyd_connect_any, false)
 
+## <desc>
+## <p>
+## Allow systemd-nspawn to be run by sysadmin directly
+## </p>
+## </desc>
+gen_tunable(systemd_nspawn_direct_admin, false)
+
 attribute systemd_log_parse_env_type;
 attribute systemd_tmpfiles_conf_type;
 attribute systemd_user_session_type;
@@ -1637,6 +1644,7 @@ files_getattr_default_dirs(systemd_nspaw
 files_getattr_tmp_dirs(systemd_nspawn_t)
 files_manage_etc_files(systemd_nspawn_t)
 files_manage_mnt_dirs(systemd_nspawn_t)
+files_manage_mnt_files(systemd_nspawn_t)
 files_mounton_mnt(systemd_nspawn_t)
 files_mounton_root(systemd_nspawn_t)
 files_mounton_tmp(systemd_nspawn_t)
@@ -1693,6 +1701,11 @@ userdom_manage_user_home_dirs(systemd_ns
 
 systemd_write_notify_socket(systemd_nspawn_t)
 
+tunable_policy(`systemd_nspawn_direct_admin',`
+	domain_use_interactive_fds(systemd_nspawn_t)
+	userdom_use_user_ptys(systemd_nspawn_t)
+')
+
 tunable_policy(`systemd_nspawn_labeled_namespace',`
 	allow systemd_nspawn_t systemd_nspawn_runtime_t:fifo_file manage_fifo_file_perms;
 	files_tmp_filetrans(systemd_nspawn_t, systemd_nspawn_runtime_t, fifo_file)
@@ -1847,9 +1860,11 @@ miscfiles_read_localization(systemd_pass
 
 seutil_search_default_contexts(systemd_passwd_agent_t)
 
+userdom_list_user_tmp(systemd_passwd_agent_t)
 userdom_use_user_terminals(systemd_passwd_agent_t)
 userdom_search_user_runtime(systemd_passwd_agent_t)
 systemd_search_user_runtime(systemd_passwd_agent_t)
+userdom_watch_all_user_runtime_dirs(systemd_passwd_agent_t)
 
 optional_policy(`
 	getty_use_fds(systemd_passwd_agent_t)
Index: refpolicy-2.20260801/policy/modules/system/sysnetwork.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/sysnetwork.te
+++ refpolicy-2.20260801/policy/modules/system/sysnetwork.te
@@ -161,8 +161,12 @@ term_dontaudit_use_all_ptys(dhcpc_t)
 term_dontaudit_use_unallocated_ttys(dhcpc_t)
 term_dontaudit_use_generic_ptys(dhcpc_t)
 
+# for /run/systemd/resolve/netif
+init_create_runtime_dirs(dhcpc_t)
+
 init_rw_utmp(dhcpc_t)
 init_get_system_status(dhcpc_t)
+init_start_generic_units(dhcpc_t)
 
 logging_send_syslog_msg(dhcpc_t)
 
@@ -250,6 +254,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	ntp_domtrans(dhcpc_t)
 	ntp_initrc_domtrans(dhcpc_t)
 	ntp_read_drift_files(dhcpc_t)
 	ntp_read_conf_files(dhcpc_t)
Index: refpolicy-2.20260801/policy/modules/services/container.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/container.te
+++ refpolicy-2.20260801/policy/modules/services/container.te
@@ -379,7 +379,9 @@ kernel_list_all_proc(container_domain)
 kernel_associate_proc(container_domain)
 kernel_read_kernel_sysctls(container_domain)
 kernel_rw_net_sysctls(container_domain)
+kernel_read_rpc_sysctls(container_t)
 kernel_read_system_state(container_domain)
+kernel_read_vm_sysctls(container_t)
 kernel_dontaudit_search_kernel_sysctl(container_domain)
 
 corecmd_exec_all_executables(container_domain)
@@ -907,7 +909,7 @@ manage_dirs_pattern(container_engine_dom
 manage_files_pattern(container_engine_domain, container_engine_lock_t, container_engine_lock_t)
 files_lock_filetrans(container_engine_domain, container_engine_lock_t, { dir file })
 
-allow container_engine_domain container_file_t:dir { manage_dir_perms relabel_dir_perms };
+allow container_engine_domain container_file_t:dir { manage_dir_perms relabel_dir_perms map };
 allow container_engine_domain container_file_t:file { exec_file_perms manage_file_perms relabel_file_perms };
 allow container_engine_domain container_file_t:blk_file { manage_blk_file_perms relabel_blk_file_perms };
 allow container_engine_domain container_file_t:chr_file { manage_chr_file_perms relabel_chr_file_perms };
Index: refpolicy-2.20260801/policy/modules/services/container.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/container.fc
+++ refpolicy-2.20260801/policy/modules/services/container.fc
@@ -24,6 +24,7 @@ HOME_DIR/\.docker(/.*)?		gen_context(sys
 /usr/bin/crun	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 /usr/bin/runc	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 
+/usr/libexec/lxc/lxc-monitord		--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 /usr/lib/systemd/system/docker.*	--	gen_context(system_u:object_r:container_engine_unit_t,s0)
 /usr/lib/systemd/system/containerd.*	--	gen_context(system_u:object_r:container_engine_unit_t,s0)
 /usr/lib/systemd/system/container-.*	--	gen_context(system_u:object_r:container_unit_t,s0)
Index: refpolicy-2.20260801/policy/modules/kernel/devices.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/devices.if
+++ refpolicy-2.20260801/policy/modules/kernel/devices.if
@@ -2371,6 +2371,24 @@ interface(`dev_ioctl_input_dev',`
 
 ########################################
 ## <summary>
+##	dontaudit writing the input event devices (/dev/input).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_dontaudit_write_input_dev',`
+	gen_require(`
+		type event_device_t;
+	')
+
+	dontaudit $1 event_device_t:chr_file write;
+')
+
+########################################
+## <summary>
 ##	Read and write ipmi devices (/dev/ipmi*).
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260801/policy/modules/system/authlogin.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/authlogin.te
+++ refpolicy-2.20260801/policy/modules/system/authlogin.te
@@ -129,6 +129,7 @@ kernel_dontaudit_search_kernel_sysctl(ch
 kernel_dontaudit_read_kernel_sysctl(chkpwd_t)
 kernel_dontaudit_getattr_proc(chkpwd_t)
 kernel_getattr_proc(chkpwd_t)
+kernel_read_kernel_sysctls(chkpwd_t)
 
 domain_dontaudit_use_interactive_fds(chkpwd_t)
 
Index: refpolicy-2.20260801/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260801/policy/modules/kernel/corecommands.fc
@@ -183,9 +183,11 @@ ifdef(`distro_gentoo',`
 /usr/lib/(.*/)?bin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/(.*/)?glib-2\.0(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/postfix/configure-instance\.sh -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/libreoffice/program(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 
 /usr/(.*/)?sbin(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/(.*/)?sbin(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/.*linux-gnu/webkitgtk.*/WebKitWebProcess -- gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib/atril/atrild		--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/at-spi2-core(/.*)?		gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20260801/policy/modules/system/lvm.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/lvm.te
+++ refpolicy-2.20260801/policy/modules/system/lvm.te
@@ -284,6 +284,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	unconfined_rw_sem(lvm_t)
+')
+
+optional_policy(`
 	usermanage_read_crack_db(lvm_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/services/ssh.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/ssh.te
+++ refpolicy-2.20260801/policy/modules/services/ssh.te
@@ -168,6 +168,7 @@ logging_send_syslog_msg(ssh_t)
 logging_read_generic_logs(ssh_t)
 
 auth_use_nsswitch(ssh_t)
+auth_manage_login_records(sshd_t)
 
 miscfiles_read_generic_certs(ssh_t)
 miscfiles_read_localization(ssh_t)
Index: refpolicy-2.20260801/policy/modules/kernel/devices.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/devices.fc
+++ refpolicy-2.20260801/policy/modules/kernel/devices.fc
@@ -63,6 +63,7 @@
 /dev/isst_interface	-c	gen_context(system_u:object_r:cpu_device_t,s0)
 /dev/jbm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/js.*		-c	gen_context(system_u:object_r:mouse_device_t,s0)
+/dev/kfd		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
 /dev/kmem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
 /dev/kmsg		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
 /dev/kqemu		-c	gen_context(system_u:object_r:qemu_device_t,s0)
Index: refpolicy-2.20260801/policy/modules/system/needrestart.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/needrestart.te
+++ refpolicy-2.20260801/policy/modules/system/needrestart.te
@@ -75,6 +75,7 @@ files_read_usr_files(needrestart_t)
 files_search_var_lib(needrestart_t)
 
 fs_getattr_cgroup(needrestart_t)
+fs_getattr_tmpfs_dirs(needrestart_t)
 fs_getattr_nsfs_files(needrestart_t)
 
 init_admin(needrestart_t)
Index: refpolicy-2.20260801/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/selinuxutil.te
+++ refpolicy-2.20260801/policy/modules/system/selinuxutil.te
@@ -536,6 +536,8 @@ allow semanage_t policy_config_t:file rw
 allow semanage_t policy_src_t:dir search;
 
 filetrans_pattern(semanage_t, selinux_config_t, semanage_store_t, dir, "modules")
+allow semanage_t semanage_store_t:dir relabelfrom;
+allow semanage_t semanage_store_t:file { relabelfrom relabelto };
 
 allow semanage_t semanage_tmp_t:dir manage_dir_perms;
 allow semanage_t semanage_tmp_t:file { manage_file_perms mmap_exec_file_perms };
@@ -550,6 +552,7 @@ corecmd_exec_bin(semanage_t)
 corecmd_exec_shell(semanage_t)
 
 dev_read_urand(semanage_t)
+dev_getattr_fs(semanage_t)
 
 domain_use_interactive_fds(semanage_t)
 
@@ -569,6 +572,7 @@ selinux_read_policy(semanage_t)
 # for setsebool:
 selinux_set_all_booleans(semanage_t)
 
+term_getattr_pty_fs(semanage_t)
 term_use_all_terms(semanage_t)
 
 # Running genhomedircon requires this for finding all users
Index: refpolicy-2.20260801/policy/modules/apps/gnome.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/gnome.if
+++ refpolicy-2.20260801/policy/modules/apps/gnome.if
@@ -50,6 +50,7 @@ template(`gnome_role_template',`
 	type $1_gkeyringd_t, gnomedomain, gkeyringd_domain;
 	userdom_user_application_domain($1_gkeyringd_t, gkeyringd_exec_t)
 	domain_user_exemption_target($1_gkeyringd_t)
+	allow $1_gkeyringd_t self:process setsched;
 
 	role $4 types $1_gkeyringd_t;
 
Index: refpolicy-2.20260801/policy/modules/system/selinuxutil.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/selinuxutil.if
+++ refpolicy-2.20260801/policy/modules/system/selinuxutil.if
@@ -89,6 +89,27 @@ interface(`seutil_exec_checkpolicy',`
 	can_exec($1, checkpolicy_exec_t)
 ')
 
+########################################
+## <summary>
+##	Execute restorecond in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`seutil_exec_restorecond',`
+	gen_require(`
+		type restorecond_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	can_exec($1, restorecond_exec_t)
+')
+
 #######################################
 ## <summary>
 ##	Execute load_policy in the load_policy domain.
Index: refpolicy-2.20260801/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20260801/policy/modules/system/systemd.if
@@ -179,6 +179,7 @@ template(`systemd_role_template',`
 	mount_watch_runtime_files($1_systemd_t)
 	mount_watch_reads_runtime_files($1_systemd_t)
 
+	seutil_exec_restorecond($1_systemd_t)
 	seutil_search_default_contexts($1_systemd_t)
 	seutil_read_file_contexts($1_systemd_t)
 
@@ -298,10 +299,15 @@ template(`systemd_role_template',`
 	')
 
 	optional_policy(`
+		dirmngr_create_tmp_named_sockets($1_systemd_t)
+		dirmngr_delete_tmp_named_sockets($1_systemd_t)
+		dirmngr_stream_connect($1_systemd_t)
 		dirmngr_tmp_dir_search($1_systemd_t)
 	')
 
 	optional_policy(`
+		gpg_create_agent_named_sockets($1_systemd_t)
+		gpg_delete_agent_named_sockets($1_systemd_t)
 		gpg_stream_connect_agent($1_systemd_t)
 	')
 
@@ -311,6 +317,7 @@ template(`systemd_role_template',`
 
 	optional_policy(`
 		obex_role_template($1, $1_r, $1_systemd_t)
+		obex_domtrans($1_systemd_t)
 	')
 
 	optional_policy(`
@@ -346,6 +353,7 @@ template(`systemd_role_template',`
 		xserver_watch_xdm_lib_dirs($1_systemd_t)
 		xserver_read_xdm_state($1_systemd_t)
 		xserver_use_user_fonts($1_systemd_t)
+		xserver_write_inherited_xsession_log($1_systemd_t)
 	')
 ')
 
Index: refpolicy-2.20260801/policy/modules/services/obex.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/obex.te
+++ refpolicy-2.20260801/policy/modules/services/obex.te
@@ -19,16 +19,26 @@ role obex_roles types obex_t;
 
 allow obex_t self:fifo_file rw_fifo_file_perms;
 allow obex_t self:socket create_stream_socket_perms;
+allow obex_t self:process signal;
+
+kernel_read_system_state(obex_t)
 
 dev_read_urand(obex_t)
 
+corecmd_search_bin(obex_t)
+
 files_read_etc_files(obex_t)
+files_read_usr_files(obex_t)
+files_map_usr_files(obex_t)
 
 logging_send_syslog_msg(obex_t)
 
 miscfiles_read_localization(obex_t)
 
 userdom_search_user_home_content(obex_t)
+userdom_search_user_runtime(obex_t)
+userdom_rw_user_tmp_files(obex_t)
+userdom_map_user_tmp_files(obex_t)
 
 optional_policy(`
 	bluetooth_use(obex_t)
@@ -36,8 +46,20 @@ optional_policy(`
 
 optional_policy(`
 	dbus_system_bus_client(obex_t)
+	dbus_write_session_runtime_socket(obex_t)
+	dbus_getattr_session_runtime_socket(obex_t)
 
 	optional_policy(`
 		bluetooth_dbus_chat(obex_t)
 	')
 ')
+
+optional_policy(`
+	gnome_mmap_read_xdg_config_files(obex_t)
+')
+
+optional_policy(`
+	xdg_search_cache_dirs(obex_t)
+	xdg_search_config_dirs(obex_t)
+	xdg_search_data_dirs(obex_t)
+')
Index: refpolicy-2.20260801/policy/modules/admin/logrotate.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/admin/logrotate.te
+++ refpolicy-2.20260801/policy/modules/admin/logrotate.te
@@ -65,6 +65,7 @@ files_var_lib_filetrans(logrotate_t, log
 
 can_exec(logrotate_t, { logrotate_exec_t logrotate_tmp_t })
 
+kernel_getattr_proc(logrotate_t)
 kernel_read_system_state(logrotate_t)
 kernel_read_kernel_sysctls(logrotate_t)
 
Index: refpolicy-2.20260801/policy/modules/apps/wireshark.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/wireshark.te
+++ refpolicy-2.20260801/policy/modules/apps/wireshark.te
@@ -56,6 +56,7 @@ fs_tmpfs_filetrans(wireshark_t, wireshar
 can_exec(wireshark_t, wireshark_exec_t)
 
 kernel_read_crypto_sysctls(wireshark_t)
+kernel_read_device_sysctls(wireshark_t)
 kernel_read_kernel_sysctls(wireshark_t)
 kernel_read_network_state(wireshark_t)
 kernel_read_system_state(wireshark_t)
@@ -111,6 +112,10 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`
+	dbus_write_session_runtime_socket(wireshark_t)
+')
+
+optional_policy(`
 	seutil_use_newrole_fds(wireshark_t)
 ')
 
@@ -128,6 +133,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	xserver_read_xkb_libs(wireshark_t)
 	xserver_user_x_domain_template(wireshark, wireshark_t, wireshark_tmpfs_t)
 	xserver_create_xdm_tmp_sockets(wireshark_t)
 	xserver_rw_mesa_shader_cache(wireshark_t)
Index: refpolicy-2.20260801/policy/modules/system/opensnitch.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/opensnitch.te
+++ refpolicy-2.20260801/policy/modules/system/opensnitch.te
@@ -68,6 +68,7 @@ domain_read_all_domains_state(opensnitch
 
 files_read_etc_symlinks(opensnitchd_t)
 files_read_kernel_symbol_table(opensnitchd_t)
+files_getattr_usr_files(opensnitchd_t)
 
 fs_rw_tracefs_files(opensnitchd_t)
 fs_search_tracefs(opensnitchd_t)
Index: refpolicy-2.20260801/policy/modules/services/ssh.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/ssh.if
+++ refpolicy-2.20260801/policy/modules/services/ssh.if
@@ -220,6 +220,7 @@ template(`ssh_server_template', `
 	# Access key files
 	allow $1_t sshd_key_t:file read_file_perms;
 
+	kernel_getattr_proc($1_t)
 	kernel_read_kernel_sysctls($1_t)
 	kernel_read_network_state($1_t)
 
@@ -369,6 +370,8 @@ template(`ssh_role_template',`
 	userdom_search_user_home_dirs($1_t)
 
 	read_files_pattern($1_ssh_agent_t, ssh_home_t, ssh_home_t)
+	manage_sock_files_pattern($1_ssh_agent_t, ssh_home_t, ssh_home_t)
+	allow $1_ssh_agent_t ssh_home_t:dir list_dir_perms;
 
 	optional_policy(`
 		systemd_user_app_status($1, ssh_t)
Index: refpolicy-2.20260801/policy/modules/services/dirmngr.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/dirmngr.if
+++ refpolicy-2.20260801/policy/modules/services/dirmngr.if
@@ -52,6 +52,24 @@ template(`dirmngr_role',`
 
 ############################################################
 ## <summary>
+##	create dirmngr_tmp_t sock_file
+## </summary>
+## <param name="domain">
+##	<summary>
+##	domain allowed access
+##	</summary>
+## </param>
+#
+interface(`dirmngr_create_tmp_named_sockets',`
+	gen_require(`
+		type dirmngr_tmp_t;
+	')
+
+	create_sock_files_pattern($1, dirmngr_tmp_t, dirmngr_tmp_t)
+')
+
+############################################################
+## <summary>
 ##	unlink dirmngr_tmp_t sock_file
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260801/policy/modules/apps/gpg.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/gpg.if
+++ refpolicy-2.20260801/policy/modules/apps/gpg.if
@@ -348,6 +348,24 @@ interface(`gpg_agent_tmp_filetrans',`
 
 ########################################
 ## <summary>
+##	create gpg_agent_tmp_t sock_file
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gpg_create_agent_named_sockets',`
+	gen_require(`
+		type gpg_agent_tmp_t;
+	')
+
+	create_sock_files_pattern($1, gpg_agent_tmp_t, gpg_agent_tmp_t)
+')
+
+########################################
+## <summary>
 ##	unlink gpg_agent_tmp_t sock_file
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260801/policy/modules/system/fstools.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/fstools.fc
+++ refpolicy-2.20260801/policy/modules/system/fstools.fc
@@ -62,6 +62,7 @@ ifdef(`distro_gentoo',`
 /var/swap			--	gen_context(system_u:object_r:swapfile_t,s0)
 
 /var/log/fsck(/.*)?		gen_context(system_u:object_r:fsadm_log_t,s0)
+/var/lib/btrfs(/.*)?		gen_context(system_u:object_r:fsadm_var_lib_t,s0)
 
 /run/blkid(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)
 /run/fsck(/.*)?		gen_context(system_u:object_r:fsadm_run_t,s0)
Index: refpolicy-2.20260801/policy/modules/services/powerprofiles.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/powerprofiles.te
+++ refpolicy-2.20260801/policy/modules/services/powerprofiles.te
@@ -26,6 +26,7 @@ kernel_read_system_state(power_profilesd
 dev_create_sysfs_files(power_profilesd_t)
 dev_read_sysfs(power_profilesd_t)
 dev_write_sysfs(power_profilesd_t)
+dev_watch_sysfs_dirs(power_profilesd_t)
 
 files_read_etc_files(power_profilesd_t)
 files_search_var_lib(power_profilesd_t)
Index: refpolicy-2.20260801/policy/modules/services/powerprofiles.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/powerprofiles.if
+++ refpolicy-2.20260801/policy/modules/services/powerprofiles.if
@@ -3,3 +3,24 @@
 ## <desc>
 ## Daemon to control power profiles for laptop
 ## </desc>
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      power-profiles-daemon over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`powerprofiles_dbus_chat',`
+        gen_require(`
+                type power_profilesd_t;
+                class dbus send_msg;
+        ')
+
+        allow $1 power_profilesd_t:dbus send_msg;
+        allow power_profilesd_t $1:dbus send_msg;
+')
Index: refpolicy-2.20260801/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20260801/policy/modules/services/xserver.if
@@ -138,6 +138,7 @@ template(`xserver_restricted_role',`
 
 	tunable_policy(`xserver_allow_dri',`
 		dev_rw_dri($2)
+		dev_rw_dma_dev($2)
 	')
 
 	optional_policy(`
@@ -145,6 +146,10 @@ template(`xserver_restricted_role',`
 		systemd_user_app_status($1, xauth_t)
 		systemd_user_app_status($1, xserver_t)
 	')
+
+	optional_policy(`
+		xfs_stream_connect($2)
+	')
 ')
 
 ########################################
Index: refpolicy-2.20260801/policy/modules/system/userdomain.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/userdomain.te
+++ refpolicy-2.20260801/policy/modules/system/userdomain.te
@@ -86,6 +86,13 @@ gen_tunable(user_ptrace, false)
 ## </desc>
 gen_tunable(user_i2c, false)
 
+## <desc>
+## <p>
+## Allow reading v4l devices
+## </p>
+## </desc>
+gen_tunable(user_read_video, false)
+
 attribute admindomain;
 
 # all user domains
Index: refpolicy-2.20260801/policy/modules/apps/mozilla.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/mozilla.te
+++ refpolicy-2.20260801/policy/modules/apps/mozilla.te
@@ -75,13 +75,15 @@ xdg_cache_content(mozilla_xdg_cache_t)
 
 allow mozilla_t self:capability { setgid setuid sys_nice };
 allow mozilla_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
-allow mozilla_t self:process { getsched setcap setrlimit setsched sigkill signal };
+allow mozilla_t self:process { getsched setcap getcap ptrace setrlimit setsched sigkill signal };
 allow mozilla_t self:user_namespace create;
 allow mozilla_t self:fifo_file rw_fifo_file_perms;
 allow mozilla_t self:shm create_shm_perms;
 allow mozilla_t self:sem create_sem_perms;
 allow mozilla_t self:socket create_socket_perms;
 allow mozilla_t self:unix_stream_socket { accept listen };
+allow mozilla_t self:netlink_route_socket nlmsg_write;
+allow mozilla_t self:netlink_kobject_uevent_socket { create getattr getopt setopt };
 
 allow mozilla_t mozilla_plugin_t:unix_stream_socket rw_socket_perms;
 allow mozilla_t mozilla_plugin_t:fd use;
@@ -106,6 +108,7 @@ manage_files_pattern(mozilla_t, mozilla_
 manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
 manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
 manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
+userdom_user_runtime_filetrans(mozilla_t, mozilla_tmpfs_t, sock_file)
 fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
 allow mozilla_t mozilla_plugin_tmpfs_t:file map;
 
@@ -174,11 +177,13 @@ files_map_usr_files(mozilla_t)
 files_read_usr_files(mozilla_t)
 files_watch_usr_dirs(mozilla_t)
 files_read_var_files(mozilla_t)
+files_map_var_lib_files(mozilla_t)
 files_read_var_lib_files(mozilla_t)
 files_read_var_symlinks(mozilla_t)
 files_dontaudit_getattr_boot_dirs(mozilla_t)
 
 fs_getattr_all_fs(mozilla_t)
+fs_getattr_nsfs_files(mozilla_t)
 fs_search_auto_mountpoints(mozilla_t)
 fs_list_inotifyfs(mozilla_t)
 fs_rw_tmpfs_files(mozilla_t)
@@ -187,6 +192,8 @@ term_dontaudit_getattr_pty_dirs(mozilla_
 
 auth_use_nsswitch(mozilla_t)
 
+libs_exec_lib_files(mozilla_t)
+
 logging_send_syslog_msg(mozilla_t)
 
 miscfiles_read_fonts(mozilla_t)
@@ -212,7 +219,12 @@ mozilla_run_plugin_config(mozilla_t, moz
 xdg_read_config_files(mozilla_t)
 xdg_read_data_files(mozilla_t)
 xdg_manage_downloads(mozilla_t)
+xdg_watch_cache_dirs(mozilla_t)
+xdg_watch_config_dirs(mozilla_t)
+xdg_watch_data_dirs(mozilla_t)
 
+xserver_manage_mesa_shader_cache(mozilla_t)
+xserver_read_xkb_libs(mozilla_t)
 xserver_rw_mesa_shader_cache(mozilla_t)
 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
 xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
@@ -269,6 +281,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	chromium_domtrans(mozilla_t)
+')
+
+optional_policy(`
 	dbus_all_session_bus_client(mozilla_t)
 	dbus_connect_all_session_bus(mozilla_t)
 	dbus_write_session_runtime_socket(mozilla_t)
@@ -291,6 +307,10 @@ optional_policy(`
 	')
 
 	optional_policy(`
+		rtkit_daemon_dbus_chat(mozilla_t)
+	')
+
+	optional_policy(`
 		systemd_dbus_chat_logind(mozilla_t)
 	')
 ')
@@ -308,6 +328,8 @@ optional_policy(`
 	gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome")
 	gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome2")
 	gnome_home_filetrans_gnome_home(mozilla_t, dir, ".gnome2_private")
+	gnome_mmap_read_xdg_config_files(mozilla_t)
+	gnome_watch_xdg_config_dirs(mozilla_t)
 ')
 
 optional_policy(`
@@ -333,10 +355,18 @@ optional_policy(`
 ')
 
 optional_policy(`
+	pipewire_stream_connect(mozilla_t)
+')
+
+optional_policy(`
 	pulseaudio_run(mozilla_t, mozilla_roles)
 ')
 
 optional_policy(`
+	rtkit_scheduled(mozilla_t)
+')
+
+optional_policy(`
 	thunderbird_domtrans(mozilla_t)
 ')
 
Index: refpolicy-2.20260801/policy/modules/apps/qemu.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/qemu.if
+++ refpolicy-2.20260801/policy/modules/apps/qemu.if
@@ -187,6 +187,25 @@ interface(`qemu_run',`
 
 ########################################
 ## <summary>
+##	Allow a domain to be in the qemu role
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed in the role
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`qemu_domain',`
+	gen_require(`
+		attribute_role qemu_roles;
+	')
+
+	role qemu_roles types $1;
+')
+
+########################################
+## <summary>
 ##	Read qemu process state files.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260801/policy/modules/apps/qemu.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/qemu.te
+++ refpolicy-2.20260801/policy/modules/apps/qemu.te
@@ -43,9 +43,15 @@ init_unit_file(qemu_unit_t)
 
 dev_read_sysfs(qemu_t)
 
+allow qemu_t self:anon_inode { create map read write };
+allow qemu_t self:io_uring allowed;
 allow qemu_t qemu_runtime_t:sock_file create_sock_file_perms;
 files_runtime_filetrans(qemu_t, qemu_runtime_t, sock_file)
 
+kernel_read_vm_sysctls(qemu_t)
+
+files_mmap_read_boot_files(qemu_t)
+
 tunable_policy(`qemu_full_network',`
 	corenet_udp_sendrecv_generic_if(qemu_t)
 	corenet_udp_sendrecv_generic_node(qemu_t)
Index: refpolicy-2.20260801/policy/modules/services/virt.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/virt.if
+++ refpolicy-2.20260801/policy/modules/services/virt.if
@@ -163,6 +163,8 @@ interface(`virt_domtrans_bridgehelper',`
 
 	corecmd_search_bin($1)
 	domtrans_pattern($1, virt_bridgehelper_exec_t, virt_bridgehelper_t)
+	allow $1 virt_bridgehelper_t:fd use;
+	allow virt_bridgehelper_t $1:unix_stream_socket { read write };
 ')
 
 ########################################
Index: refpolicy-2.20260801/policy/modules/services/virt.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/virt.te
+++ refpolicy-2.20260801/policy/modules/services/virt.te
@@ -1125,7 +1125,7 @@ optional_policy(`
 # Bridgehelper local policy
 #
 
-allow virt_bridgehelper_t self:process { getcap setcap };
+allow virt_bridgehelper_t self:process { getcap setcap getsched };
 allow virt_bridgehelper_t self:capability { net_admin setgid setpcap setuid };
 allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
 allow virt_bridgehelper_t self:tun_socket create_socket_perms;
@@ -1136,13 +1136,24 @@ allow virt_bridgehelper_t virt_etc_t:fil
 
 manage_files_pattern(virt_bridgehelper_t, svirt_home_t, svirt_home_t)
 
+kernel_getattr_proc(virt_bridgehelper_t)
+kernel_read_kernel_sysctls(virt_bridgehelper_t)
 kernel_read_network_state(virt_bridgehelper_t)
+kernel_read_system_state(virt_bridgehelper_t)
+
+dev_read_sysfs(virt_bridgehelper_t)
 
 corenet_rw_tun_tap_dev(virt_bridgehelper_t)
 
+domain_use_interactive_fds(virt_bridgehelper_t)
+
 userdom_search_user_home_dirs(virt_bridgehelper_t)
 userdom_use_user_ptys(virt_bridgehelper_t)
 
+optional_policy(`
+	qemu_domain(virt_bridgehelper_t)
+')
+
 ########################################
 #
 # Leaseshelper local policy
Index: refpolicy-2.20260801/policy/modules/apps/mplayer.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/mplayer.fc
+++ refpolicy-2.20260801/policy/modules/apps/mplayer.fc
@@ -1,3 +1,4 @@
+HOME_DIR/\.cache/mpv(/.*)?			gen_context(system_u:object_r:mplayer_xdg_cache_t,s0)
 HOME_DIR/\.cache/vlc(/.*)?			gen_context(system_u:object_r:mplayer_xdg_cache_t,s0)
 HOME_DIR/\.config/vlc(/.*)?			gen_context(system_u:object_r:mplayer_xdg_config_t,s0)
 HOME_DIR/\.local/share/vlc(/.*)?		gen_context(system_u:object_r:mplayer_xdg_data_t,s0)
@@ -6,7 +7,8 @@ HOME_DIR/\.mplayer(/.*)?	gen_context(sys
 
 /etc/mplayer(/.*)?	gen_context(system_u:object_r:mplayer_etc_t,s0)
 
-/usr/bin/mplayer	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
 /usr/bin/mencoder	--	gen_context(system_u:object_r:mencoder_exec_t,s0)
+/usr/bin/mplayer	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
+/usr/bin/mpv	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
 /usr/bin/vlc	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
 /usr/bin/xine	--	gen_context(system_u:object_r:mplayer_exec_t,s0)
Index: refpolicy-2.20260801/policy/modules/apps/mplayer.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/mplayer.te
+++ refpolicy-2.20260801/policy/modules/apps/mplayer.te
@@ -129,6 +129,7 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 tunable_policy(`xserver_allow_dri',`
+	dev_rw_dma_dev(mplayer_t)
 	dev_rw_dri(mplayer_t)
 ')
 
@@ -137,7 +138,7 @@ tunable_policy(`xserver_allow_dri',`
 # Mplayer local policy
 #
 
-allow mplayer_t self:process { getsched setsched signal_perms };
+allow mplayer_t self:process { getsched setsched signal_perms setrlimit };
 allow mplayer_t self:fifo_file rw_fifo_file_perms;
 allow mplayer_t self:sem create_sem_perms;
 allow mplayer_t self:udp_socket create_socket_perms;
@@ -155,11 +156,13 @@ manage_files_pattern(mplayer_t, mplayer_
 manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 manage_fifo_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
 manage_sock_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t)
+allow mplayer_t mplayer_tmpfs_t:dir manage_dir_perms;
 fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
 
 manage_dirs_pattern(mplayer_t, mplayer_xdg_cache_t, mplayer_xdg_cache_t)
 manage_files_pattern(mplayer_t, mplayer_xdg_cache_t, mplayer_xdg_cache_t)
 xdg_cache_filetrans(mplayer_t, mplayer_xdg_cache_t, dir, "vlc")
+xdg_cache_filetrans(mplayer_t, mplayer_xdg_cache_t, dir, "mpv")
 
 manage_dirs_pattern(mplayer_t, mplayer_xdg_config_t, mplayer_xdg_config_t)
 manage_files_pattern(mplayer_t, mplayer_xdg_config_t, mplayer_xdg_config_t)
@@ -233,7 +236,7 @@ xdg_read_music(mplayer_t)
 xdg_read_videos(mplayer_t)
 
 xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
-xserver_rw_mesa_shader_cache(mplayer_t)
+xserver_manage_mesa_shader_cache(mplayer_t)
 
 ifndef(`enable_mls',`
 	fs_list_dos(mplayer_t)
@@ -278,9 +281,19 @@ optional_policy(`
 	alsa_read_config(mplayer_t)
 ')
 
-# needed by vlc
+# needed by vlc and mplayer
 optional_policy(`
+	dbus_getattr_session_runtime_socket(mplayer_t)
+	dbus_write_session_runtime_socket(mplayer_t)
+	dbus_connect_all_session_bus(mplayer_t)
 	dbus_all_session_bus_client(mplayer_t)
+	dbus_system_bus_client(mplayer_t)
+')
+
+optional_policy(`
+	pipewire_stream_connect(mplayer_t)
+	pipewire_use_fds(mplayer_t)
+	pipewire_mmap_rw_tmpfs_files(mplayer_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260801/policy/modules/services/iiosensorproxy.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/iiosensorproxy.if
+++ refpolicy-2.20260801/policy/modules/services/iiosensorproxy.if
@@ -19,3 +19,24 @@
 ##  * PLLs (Phase Locked Loops)
 ##  * Variable/Programmable Gain Amplifiers (VGA, PGA)
 ## </desc>
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      iiosensorproxy over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`iiosensorproxy_dbus_chat',`
+	gen_require(`
+		type iiosensorproxy_t;
+		class dbus send_msg;
+	')
+
+	allow $1 iiosensorproxy_t:dbus send_msg;
+	allow iiosensorproxy_t $1:dbus send_msg;
+')
Index: refpolicy-2.20260801/policy/modules/services/iiosensorproxy.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/iiosensorproxy.te
+++ refpolicy-2.20260801/policy/modules/services/iiosensorproxy.te
@@ -42,6 +42,8 @@ allow iiosensorproxy_t self:netlink_kobj
 allow iiosensorproxy_t self:process { getsched setsched };
 allow iiosensorproxy_t self:unix_dgram_socket { create write };
 
+dev_create_sysfs_files(iiosensorproxy_t)
+dev_manage_sysfs_dirs(iiosensorproxy_t)
 kernel_read_system_state(iiosensorproxy_t)
 
 dev_read_iio(iiosensorproxy_t)
Index: refpolicy-2.20260801/policy/modules/apps/games.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/games.te
+++ refpolicy-2.20260801/policy/modules/apps/games.te
@@ -89,7 +89,7 @@ optional_policy(`
 # Client local policy
 #
 
-allow games_t self:process getsched;
+allow games_t self:process { setrlimit getsched };
 allow games_t self:fifo_file rw_fifo_file_perms;
 allow games_t self:sem create_sem_perms;
 allow games_t self:tcp_socket { accept listen };
@@ -116,6 +116,7 @@ can_exec(games_t, games_exec_t)
 
 kernel_read_kernel_sysctls(games_t)
 kernel_read_system_state(games_t)
+kernel_read_device_sysctls(games_t)
 
 corecmd_exec_bin(games_t)
 corecmd_exec_shell(games_t)
@@ -137,6 +138,7 @@ dev_read_mouse(games_t)
 dev_read_urand(games_t)
 dev_rw_dri(games_t)
 dev_write_sound(games_t)
+dev_watch_dev_dirs(games_t)
 
 files_list_var(games_t)
 files_search_mnt(games_t)
@@ -181,6 +183,7 @@ optional_policy(`
 	dbus_connect_all_session_bus(games_t)
 	dbus_read_lib_files(games_t)
 	dbus_system_bus_client(games_t)
+	dbus_write_session_runtime_socket(games_t)
 ')
 
 optional_policy(`
@@ -188,10 +191,20 @@ optional_policy(`
 ')
 
 optional_policy(`
+	pipewire_stream_connect(games_t)
+	pipewire_use_fds(games_t)
+	pipewire_mmap_rw_tmpfs_files(games_t)
+')
+
+optional_policy(`
 	pulseaudio_run(games_t, games_roles)
 ')
 
 optional_policy(`
+	rtkit_daemon_dbus_chat(games_t)
+')
+
+optional_policy(`
 	xdg_read_config_files(games_t)
 	xdg_read_data_files(games_t)
 ')
Index: refpolicy-2.20260801/policy/modules/services/mpd.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/mpd.te
+++ refpolicy-2.20260801/policy/modules/services/mpd.te
@@ -182,6 +182,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	pipewire_stream_connect(mpd_t)
+')
+
+optional_policy(`
 	pulseaudio_client_domain(mpd_t)
 	pulseaudio_domtrans(mpd_t)
 ')
Index: refpolicy-2.20260801/policy/modules/system/libraries.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/libraries.fc
+++ refpolicy-2.20260801/policy/modules/system/libraries.fc
@@ -133,6 +133,7 @@ ifdef(`distro_debian',`
 /usr/lib/catalyst/libGL\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/libADM5.*\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/libatiadlxx\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/libreoffice/program/[^/]+\.so	--	gen_context(system_u:object_r:lib_t,s0)
 /usr/lib/win32/.*\.so(\.[^/]*)*		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 
 /usr/lib/ADM_plugins/videoFilter/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
Index: refpolicy-2.20260801/policy/modules/services/dirmngr.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/dirmngr.te
+++ refpolicy-2.20260801/policy/modules/services/dirmngr.te
@@ -43,7 +43,7 @@ allow dirmngr_t dirmngr_conf_t:dir list_
 allow dirmngr_t dirmngr_conf_t:file read_file_perms;
 allow dirmngr_t dirmngr_conf_t:lnk_file read_lnk_file_perms;
 
-manage_files_pattern(dirmngr_t, dirmngr_home_t, dirmngr_home_t)
+mmap_manage_files_pattern(dirmngr_t, dirmngr_home_t, dirmngr_home_t)
 allow dirmngr_t dirmngr_home_t:dir { add_entry_dir_perms create_dir_perms list_dir_perms };
 
 manage_dirs_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
@@ -69,6 +69,8 @@ dev_read_urand(dirmngr_t)
 
 sysnet_dns_name_resolve(dirmngr_t)
 
+corecmd_search_bin(dirmngr_t)
+
 corenet_tcp_connect_http_port(dirmngr_t)
 corenet_tcp_connect_pgpkeyserver_port(dirmngr_t)
 corenet_tcp_connect_tor_port(dirmngr_t)
@@ -82,6 +84,7 @@ miscfiles_read_generic_certs(dirmngr_t)
 
 userdom_search_user_home_dirs(dirmngr_t)
 userdom_search_user_runtime(dirmngr_t)
+userdom_use_user_ptys(dirmngr_t)
 userdom_user_runtime_filetrans(dirmngr_t, dirmngr_tmp_t, dir)
 allow dirmngr_t dirmngr_tmp_t:dir manage_dir_perms;
 
Index: refpolicy-2.20260801/policy/modules/apps/chromium.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/chromium.if
+++ refpolicy-2.20260801/policy/modules/apps/chromium.if
@@ -48,12 +48,10 @@ template(`chromium_role',`
 	allow $3 chromium_sandbox_t:process signal_perms;
 	allow $3 chromium_naclhelper_t:process signal_perms;
 	allow chromium_t $3:process { signal signull };
-	allow chromium_t $3:unix_stream_socket { read write };
+	allow chromium_t $3:unix_stream_socket { connectto getopt read write };
 
 	allow $2 chromium_t:fifo_file write;
 
-	allow $3 chromium_t:unix_stream_socket connectto;
-
 	# for /tmp/.ICE-unix/* sockets
 	allow chromium_t $3:unix_stream_socket connectto;
 
