Index: refpolicy-2.20260618/policy/modules/admin/bootloader.fc
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/admin/bootloader.fc
+++ refpolicy-2.20260618/policy/modules/admin/bootloader.fc
@@ -9,10 +9,12 @@
 /usr/bin/grub2?-install		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/bin/grub2?-mkconfig	--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/bin/grub2?-probe		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
-/usr/bin/lilo.*			--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/bin/kernel-install		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/bin/mkrlconf		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/bin/mkinitramfs		--	gen_context(system_u:object_r:mkinitramfs_exec_t,s0)
 /usr/bin/mvrefind		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 /usr/bin/refind-install		--	gen_context(system_u:object_r:bootloader_exec_t,s0)
+/usr/bin/update-initramfs	--	gen_context(system_u:object_r:mkinitramfs_exec_t,s0)
 /usr/bin/ybin.*			--	gen_context(system_u:object_r:bootloader_exec_t,s0)
 
 
Index: refpolicy-2.20260618/policy/modules/admin/bootloader.te
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/admin/bootloader.te
+++ refpolicy-2.20260618/policy/modules/admin/bootloader.te
@@ -8,6 +8,7 @@ policy_module(bootloader)
 attribute_role bootloader_roles;
 roleattribute system_r bootloader_roles;
 
+ifdef(`distro_redhat',`
 #
 # boot_runtime_t is the type for /boot/kernel.h,
 # which is automatically generated at boot time.
@@ -15,12 +16,18 @@ roleattribute system_r bootloader_roles;
 #
 type boot_runtime_t;
 files_type(boot_runtime_t)
+')
 
 type bootloader_t;
 type bootloader_exec_t;
 application_domain(bootloader_t, bootloader_exec_t)
 role bootloader_roles types bootloader_t;
 
+type mkinitramfs_t;
+type mkinitramfs_exec_t;
+application_domain(mkinitramfs_t, mkinitramfs_exec_t)
+role bootloader_roles types mkinitramfs_t;
+
 #
 # bootloader_etc_t is the configuration file,
 # grub.conf, lilo.conf, etc.
@@ -43,13 +50,10 @@ dev_node(bootloader_tmp_t)
 
 allow bootloader_t self:capability { chown dac_override dac_read_search fsetid mknod setgid sys_admin sys_rawio };
 dontaudit bootloader_t self:capability { net_admin sys_resource };
-allow bootloader_t self:process { execmem getsched signal_perms };
+allow bootloader_t self:process { execmem getsched getcap signal_perms };
 allow bootloader_t self:fifo_file rw_fifo_file_perms;
 
 allow bootloader_t bootloader_etc_t:file read_file_perms;
-# uncomment the following lines if you use "lilo -p"
-#allow bootloader_t bootloader_etc_t:file manage_file_perms;
-#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)
 
 manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
 manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
@@ -61,11 +65,15 @@ allow bootloader_t bootloader_tmp_t:dir
 # for tune2fs (cjp: ?)
 files_root_filetrans(bootloader_t, bootloader_tmp_t, file)
 
+domain_auto_transition_pattern(bootloader_t, mkinitramfs_exec_t, mkinitramfs_t)
+allow mkinitramfs_t bootloader_t:fd use;
+
 kernel_getattr_core_if(bootloader_t)
 kernel_read_network_state(bootloader_t)
 kernel_read_system_state(bootloader_t)
 kernel_read_software_raid_state(bootloader_t)
 kernel_read_kernel_sysctls(bootloader_t)
+kernel_read_vm_overcommit_sysctl(bootloader_t)
 kernel_search_debugfs(bootloader_t)
 kernel_setsched(bootloader_t)
 kernel_dontaudit_getattr_proc(bootloader_t)
@@ -98,6 +106,7 @@ fs_getattr_tmpfs(bootloader_t)
 fs_read_tmpfs_symlinks(bootloader_t)
 #Needed for EFI
 fs_getattr_efivarfs(bootloader_t)
+fs_manage_dos_dirs(bootloader_t)
 fs_manage_dos_files(bootloader_t)
 fs_mmap_read_dos_files(bootloader_t)
 fs_search_cgroup_dirs(bootloader_t)
@@ -176,17 +185,13 @@ userdom_dontaudit_manage_user_home_dirs(
 userdom_dontaudit_write_user_home_content_files(bootloader_t)
 
 ifdef(`distro_debian',`
+	# for /usr/lib/kernel/install.d/50-depmod.install
+	files_delete_kernel_modules(bootloader_t)
+	modutils_delete_module_deps(bootloader_t)
+
 	allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
 	fs_list_tmpfs(bootloader_t)
 
-	files_relabel_kernel_modules(bootloader_t)
-	files_relabelfrom_boot_files(bootloader_t)
-	files_delete_kernel_modules(bootloader_t)
-	files_relabelto_usr_files(bootloader_t)
-	files_search_var_lib(bootloader_t)
-	# for /usr/share/initrd-tools/scripts
-	files_exec_usr_files(bootloader_t)
-
 	fstools_manage_entry_files(bootloader_t)
 	fstools_relabelto_entry_files(bootloader_t)
 
@@ -244,6 +249,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	fwupd_read_var_file(bootloader_t)
+')
+
+optional_policy(`
 	gpm_getattr_gpmctl(bootloader_t)
 ')
 
@@ -271,3 +280,115 @@ optional_policy(`
 optional_policy(`
 	rpm_rw_pipes(bootloader_t)
 ')
+
+
+########################################
+#
+# mkinitramfs local policy
+#
+
+allow mkinitramfs_t self:capability sys_chroot;
+allow mkinitramfs_t self:process getsched;
+allow mkinitramfs_t self:fifo_file rw_fifo_file_perms;
+
+manage_dirs_pattern(mkinitramfs_t, bootloader_tmp_t, bootloader_tmp_t)
+manage_files_pattern(mkinitramfs_t, bootloader_tmp_t, bootloader_tmp_t)
+manage_lnk_files_pattern(mkinitramfs_t, bootloader_tmp_t, bootloader_tmp_t)
+files_tmp_filetrans(mkinitramfs_t, bootloader_tmp_t, { file dir })
+allow mkinitramfs_t bootloader_tmp_t:file relabelfrom;
+allow mkinitramfs_t bootloader_tmp_t:lnk_file relabelfrom;
+can_exec(mkinitramfs_t, bootloader_tmp_t)
+
+# /usr/share/initramfs-tools/hooks/keymap calls setupcon which uses /run for temp files
+files_runtime_filetrans(mkinitramfs_t, bootloader_tmp_t, file)
+
+can_exec(mkinitramfs_t, mkinitramfs_exec_t)
+
+domain_auto_transition_pattern(mkinitramfs_t, bootloader_exec_t, bootloader_t)
+allow bootloader_t mkinitramfs_t:fd use;
+
+kernel_read_kernel_sysctls(mkinitramfs_t)
+kernel_read_system_state(mkinitramfs_t)
+kernel_read_vm_overcommit_sysctl(mkinitramfs_t)
+
+dev_read_sysfs(mkinitramfs_t)
+dev_read_urand(mkinitramfs_t)
+domain_obj_id_change_exemption(mkinitramfs_t)
+
+consolesetup_read_conf(mkinitramfs_t)
+
+corecmd_exec_bin(mkinitramfs_t)
+corecmd_exec_shell(mkinitramfs_t)
+
+domain_use_interactive_fds(mkinitramfs_t)
+
+files_exec_usr_files(mkinitramfs_t)
+files_manage_boot_files(mkinitramfs_t)
+files_manage_kernel_modules(mkinitramfs_t)
+files_read_etc_files(mkinitramfs_t)
+files_read_kernel_modules(mkinitramfs_t)
+files_relabel_kernel_modules(mkinitramfs_t)
+files_search_var_lib(mkinitramfs_t)
+
+fs_list_efivars(mkinitramfs_t)
+fs_read_efivarfs_files(mkinitramfs_t)
+fs_read_cgroup_symlinks(mkinitramfs_t)
+fstools_exec(mkinitramfs_t)
+fstools_manage_runtime_files(mkinitramfs_t)
+
+init_read_state(mkinitramfs_t)
+
+libs_exec_ld_so(mkinitramfs_t)
+libs_exec_ldconfig(mkinitramfs_t)
+libs_exec_lib_files(mkinitramfs_t)
+libs_manage_lib_files(mkinitramfs_t)
+libs_relabelto_lib_files(mkinitramfs_t)
+
+miscfiles_read_localization(mkinitramfs_t)
+
+modutils_domtrans(mkinitramfs_t)
+modutils_read_module_config(mkinitramfs_t)
+modutils_read_module_deps(mkinitramfs_t)
+mount_domtrans(mkinitramfs_t)
+
+storage_raw_read_fixed_disk(mkinitramfs_t)
+sysnet_read_config(mkinitramfs_t)
+
+term_getattr_unallocated_ttys(mkinitramfs_t)
+
+udev_read_rules_files(mkinitramfs_t)
+
+userdom_dontaudit_getattr_user_home_dirs(mkinitramfs_t)
+
+# actually needed to avoid errors
+userdom_list_user_home_content(mkinitramfs_t)
+
+userdom_use_inherited_user_terminals(mkinitramfs_t)
+
+optional_policy(`
+	dpkg_exec(mkinitramfs_t)
+')
+
+optional_policy(`
+	loadkeys_exec(mkinitramfs_t)
+')
+
+optional_policy(`
+	lvm_domtrans(mkinitramfs_t)
+	lvm_manage_config(mkinitramfs_t)
+')
+
+optional_policy(`
+	raid_domtrans_mdadm(mkinitramfs_t)
+')
+
+optional_policy(`
+	udev_domtrans(mkinitramfs_t)
+')
+
+ifdef(`distro_debian',`
+	optional_policy(`
+		apt_use_fds(mkinitramfs_t)
+		apt_use_ptys(mkinitramfs_t)
+	')
+')
Index: refpolicy-2.20260618/policy/modules/admin/bootloader.if
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/admin/bootloader.if
+++ refpolicy-2.20260618/policy/modules/admin/bootloader.if
@@ -2,7 +2,7 @@
 
 ########################################
 ## <summary>
-##	Execute bootloader in the bootloader domain.
+##	Execute bootloader and mkinitramfs in their domains.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -13,10 +13,12 @@
 interface(`bootloader_domtrans',`
 	gen_require(`
 		type bootloader_t, bootloader_exec_t;
+		type mkinitramfs_t, mkinitramfs_exec_t;
 	')
 
 	corecmd_search_bin($1)
 	domtrans_pattern($1, bootloader_exec_t, bootloader_t)
+	domtrans_pattern($1, mkinitramfs_exec_t, mkinitramfs_t)
 ')
 
 ########################################
@@ -105,7 +107,7 @@ interface(`bootloader_rw_config',`
 ########################################
 ## <summary>
 ##	Read and write the bootloader
-##	temporary data in /tmp.
+##	temporary files in /tmp.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -123,6 +125,27 @@ interface(`bootloader_rw_tmp_files',`
 ')
 
 ########################################
+## <summary>
+##	Manage the bootloader temporary files in /tmp.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`bootloader_manage_tmp_files',`
+	gen_require(`
+		type bootloader_tmp_t;
+	')
+
+	files_search_tmp($1)
+	allow $1 bootloader_tmp_t:lnk_file read;
+	allow $1 bootloader_tmp_t:dir rw_dir_perms;
+	allow $1 bootloader_tmp_t:file manage_file_perms;
+')
+
+########################################
 ## <summary>
 ##	Create, read and write the bootloader
 ##	runtime data.
Index: refpolicy-2.20260618/policy/modules/system/raid.te
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/system/raid.te
+++ refpolicy-2.20260618/policy/modules/system/raid.te
@@ -97,6 +97,11 @@ userdom_dontaudit_use_unpriv_user_fds(md
 userdom_dontaudit_search_user_home_content(mdadm_t)
 
 optional_policy(`
+	apt_use_fds(mdadm_t)
+	dpkg_script_rw_inherited_pipes(mdadm_t)
+')
+
+optional_policy(`
 	cron_system_entry(mdadm_t, mdadm_exec_t)
 	cron_rw_inherited_tmp_files(mdadm_t)
 ')
Index: refpolicy-2.20260618/policy/modules/system/modutils.te
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/system/modutils.te
+++ refpolicy-2.20260618/policy/modules/system/modutils.te
@@ -134,11 +134,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	apt_use_fds(kmod_t)
-	apt_use_ptys(kmod_t)
-')
-
-optional_policy(`
 	# for postinst of a new kernel package
 	dpkg_manage_script_tmp_files(kmod_t)
 	dpkg_map_script_tmp_files(kmod_t)
@@ -148,6 +143,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	bootloader_manage_tmp_files(kmod_t)
+')
+
+optional_policy(`
 	firstboot_dontaudit_rw_pipes(kmod_t)
 	firstboot_dontaudit_rw_stream_sockets(kmod_t)
 ')
Index: refpolicy-2.20260618/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260618/policy/modules/kernel/corecommands.fc
@@ -51,6 +51,8 @@ ifdef(`distro_redhat',`
 /etc/hotplug/hotplug\.functions --	gen_context(system_u:object_r:bin_t,s0)
 /etc/hotplug\.d/default/default.*	gen_context(system_u:object_r:bin_t,s0)
 
+/etc/initramfs/post-update.d/.*	--	gen_context(system_u:object_r:bin_t,s0)
+
 /etc/kde/env(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 /etc/kde/shutdown(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
Index: refpolicy-2.20260618/policy/modules/system/fwupd.if
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/system/fwupd.if
+++ refpolicy-2.20260618/policy/modules/system/fwupd.if
@@ -34,3 +34,23 @@ interface(`fwupd_run',`
 	domtrans_pattern($1, fwupdmgr_exec_t, fwupdmgr_t)
 	roleattribute $2 fwupdmgr_roles;
 ')
+
+########################################
+## <summary>
+##      Read /var/lib/fwupd/* files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed to read
+##      </summary>
+## </param>
+## <rolecap/>
+#
+interface(`fwupd_read_var_file',`
+	gen_require(`
+		type fwupd_var_lib_t;
+	')
+
+	allow $1 fwupd_var_lib_t:dir search;
+	allow $1 fwupd_var_lib_t:file read_file_perms;
+')
Index: refpolicy-2.20260618/policy/modules/system/modutils.if
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/system/modutils.if
+++ refpolicy-2.20260618/policy/modules/system/modutils.if
@@ -40,6 +40,24 @@ interface(`modutils_read_module_deps',`
 
 ########################################
 ## <summary>
+##	rm kernel dependency files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`modutils_delete_module_deps',`
+	gen_require(`
+		type modules_dep_t;
+	')
+
+	allow $1 modules_dep_t:file unlink;
+')
+
+########################################
+## <summary>
 ##	Read the configuration options used when
 ##	loading modules.
 ## </summary>
Index: refpolicy-2.20260618/policy/modules/apps/xscreensaver.te
===================================================================
--- refpolicy-2.20260618.orig/policy/modules/apps/xscreensaver.te
+++ refpolicy-2.20260618/policy/modules/apps/xscreensaver.te
@@ -71,6 +71,10 @@ xserver_read_xkb_libs(xscreensaver_t)
 xserver_rw_xsession_log(xscreensaver_t)
 xserver_user_x_domain_template(xscreensaver, xscreensaver_t, xscreensaver_tmpfs_t)
 
+optional_policy(`
+	udev_search_runtime(xscreensaver_t)
+')
+
 tunable_policy(`xscreensaver_read_generic_user_content',`
 	userdom_list_user_tmp(xscreensaver_t)
 	userdom_list_user_home_content(xscreensaver_t)
