[meta-selinux][PATCH 1/4] SELinux-FAQ: remove references to poky-selinux distro

Yocto Project Discussions
 help / color / mirror / Atom feed

* [meta-selinux][PATCH 1/4] SELinux-FAQ: remove references to poky-selinux distro
@ 2022-11-02  7:30 Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 2/4] base-files: set correct label for /var/volatile Yi Zhao
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Yi Zhao @ 2022-11-02  7:30 UTC (permalink / raw)
  To: yocto, joe_macdonald, joe

Update SELinux-FAQ as the poky-selinux distro has been removed for a
long time.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 SELinux-FAQ | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/SELinux-FAQ b/SELinux-FAQ
index 8f56b2b..2ae6649 100644
--- a/SELinux-FAQ
+++ b/SELinux-FAQ
@@ -47,7 +47,6 @@ controls could be added to an operating system.
 To enable SELinux features, this layers has done these works:
 
    * new DISTRO_FEATURES "selinux" defined
-   * new DISTRO "poky-selinux" defined, with DISTRO_FEATURES += "pam selinux"
    * config file for Linux kernel to enable SELinux
    * recipes for SELinux userland libraries and tools
    * package group (packagegroup-core-selinux) for SELinux userland packages
@@ -67,7 +66,7 @@ After init Poky build environment, please follow these steps:
 
    1. Add meta-selinux path to BUILDDIR/conf/bblayers.conf file.
 
-   2. Set DISTRO="poky-selinux" or add DISTRO_FEATURES:append=" pam selinux"
+   2. Add DISTRO_FEATURES:append=" acl xattr pam selinux"
       in BUILDDIR/conf/local.conf file.
 
    3. Build the default selinux image.
@@ -94,7 +93,6 @@ the following steps:
        $ bitbake core-image-custom
 
 
-
 ==============================================================================
 
 3 - Using SELinux 
@@ -109,7 +107,7 @@ Alternatively, you can add "selinux=0" to your kernel boot parameters. It is
 not recommended but useful on some testing situations.
 For example, when you are using qemu targets,  
 
-  $ runqemu qemumips core-image-selinux ext3 nographic bootparams="selinux=0"
+  $ runqemu qemumips core-image-selinux nographic bootparams="selinux=0"
 
 The initial filesystem relabel step requires considerable memory and can result
 in unexpected, sometimes impossible to reproduce, failures if an OOM condition
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [meta-selinux][PATCH 2/4] base-files: set correct label for /var/volatile
  2022-11-02  7:30 [meta-selinux][PATCH 1/4] SELinux-FAQ: remove references to poky-selinux distro Yi Zhao
@ 2022-11-02  7:30 ` Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 3/4] libsepol: fix build failure for refpolicy-mls Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git Yi Zhao
  2 siblings, 0 replies; 6+ messages in thread
From: Yi Zhao @ 2022-11-02  7:30 UTC (permalink / raw)
  To: yocto, joe_macdonald, joe

By default /var/volatile will be mounted with tmpfs_t instead of var_t
label, which will cause us to have to add some extra rules to eliminate
avc denials of some services.

Set rootcontext for /var/volatile in fstab to make sure it is mounted
with correct label.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 recipes-core/base-files/base-files_%.bbappend  |  1 +
 recipes-core/base-files/base-files_selinux.inc | 13 +++++++++++++
 2 files changed, 14 insertions(+)
 create mode 100644 recipes-core/base-files/base-files_%.bbappend
 create mode 100644 recipes-core/base-files/base-files_selinux.inc

diff --git a/recipes-core/base-files/base-files_%.bbappend b/recipes-core/base-files/base-files_%.bbappend
new file mode 100644
index 0000000..f167033
--- /dev/null
+++ b/recipes-core/base-files/base-files_%.bbappend
@@ -0,0 +1 @@
+require ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'base-files_selinux.inc', '', d)}
diff --git a/recipes-core/base-files/base-files_selinux.inc b/recipes-core/base-files/base-files_selinux.inc
new file mode 100644
index 0000000..f2373aa
--- /dev/null
+++ b/recipes-core/base-files/base-files_selinux.inc
@@ -0,0 +1,13 @@
+REFPOLICY_TYPE = "${@d.getVar('PREFERRED_PROVIDER_virtual/refpolicy').split('-')[1] or ''}"
+
+do_install:append () {
+    if [ -n "${REFPOLICY_TYPE}" ]; then
+        if [ "${REFPOLICY_TYPE}" = "standard" ]; then
+            sed -i 's/\s*\/var\/volatile\s*tmpfs\s*defaults/&,rootcontext=system_u:object_r:var_t/' \
+                ${D}${sysconfdir}/fstab
+        else
+            sed -i 's/\s*\/var\/volatile\s*tmpfs\s*defaults/&,rootcontext=system_u:object_r:var_t:s0/' \
+                ${D}${sysconfdir}/fstab
+        fi
+    fi
+}
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [meta-selinux][PATCH 3/4] libsepol: fix build failure for refpolicy-mls
  2022-11-02  7:30 [meta-selinux][PATCH 1/4] SELinux-FAQ: remove references to poky-selinux distro Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 2/4] base-files: set correct label for /var/volatile Yi Zhao
@ 2022-11-02  7:30 ` Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git Yi Zhao
  2 siblings, 0 replies; 6+ messages in thread
From: Yi Zhao @ 2022-11-02  7:30 UTC (permalink / raw)
  To: yocto, joe_macdonald, joe

Backport a patch to fix build failure for refpolicy-mls:
| Creating mls xserver.pp policy package
| libsepol.validate_user_datum: Invalid user datum
| libsepol.validate_datum_array_entries: Invalid datum array entries
| libsepol.validate_policydb: Invalid policydb
| /buildarea/build/tmp/work/qemux86_64-poky-linux/refpolicy-mls/2.20220520+gitAUTOINC+f311d401cd-r0/recipe-sysroot-native/usr/bin/semodule_package:
Error while reading policy module from tmp/xserver.mod
| make: *** [Rules.modular:98: xserver.pp] Error 1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 ...idation-of-user-declarations-in-modu.patch | 80 +++++++++++++++++++
 recipes-security/selinux/libsepol_3.4.bb      |  2 +
 2 files changed, 82 insertions(+)
 create mode 100644 recipes-security/selinux/libsepol/0001-libsepol-fix-validation-of-user-declarations-in-modu.patch

diff --git a/recipes-security/selinux/libsepol/0001-libsepol-fix-validation-of-user-declarations-in-modu.patch b/recipes-security/selinux/libsepol/0001-libsepol-fix-validation-of-user-declarations-in-modu.patch
new file mode 100644
index 0000000..47c1806
--- /dev/null
+++ b/recipes-security/selinux/libsepol/0001-libsepol-fix-validation-of-user-declarations-in-modu.patch
@@ -0,0 +1,80 @@
+From 4831f73dd356fd72916f594dbeae44d26c93bb6b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Tue, 7 Jun 2022 17:01:45 +0200
+Subject: [PATCH] libsepol: fix validation of user declarations in modules
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Users are allowed to be declared in modules. Modules do not get expanded
+leaving the `struct user_datum` members `exp_range` and `exp_dfltlevel`
+empty.
+Do no validate the expanded range and level for modular polices.
+
+Reported-by: bauen1 <j2468h@gmail.com>
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+
+Upstream-Status: Backport
+[https://github.com/SELinuxProject/selinux/commit/88a703399f3f44be2502fd4ecd22ac3d3c560694]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/policydb_validate.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/policydb_validate.c b/src/policydb_validate.c
+index da18282..99d4eb7 100644
+--- a/src/policydb_validate.c
++++ b/src/policydb_validate.c
+@@ -18,7 +18,7 @@ typedef struct validate {
+ typedef struct map_arg {
+ 	validate_t *flavors;
+ 	sepol_handle_t *handle;
+-	int mls;
++	policydb_t *policy;
+ } map_arg_t;
+ 
+ static int create_gap_ebitmap(char **val_to_name, uint32_t nprim, ebitmap_t *gaps)
+@@ -571,7 +571,7 @@ static int validate_mls_range(mls_range_t *range, validate_t *sens, validate_t *
+ 	return -1;
+ }
+ 
+-static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], int mls)
++static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], policydb_t *p)
+ {
+ 	if (validate_value(user->s.value, &flavors[SYM_USERS]))
+ 		goto bad;
+@@ -581,9 +581,9 @@ static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, valid
+ 		goto bad;
+ 	if (validate_mls_semantic_level(&user->dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
+ 		goto bad;
+-	if (mls && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
++	if (p->mls && p->policy_type != POLICY_MOD && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
+ 		goto bad;
+-	if (mls && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
++	if (p->mls && p->policy_type != POLICY_MOD && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
+ 		goto bad;
+ 	if (user->bounds && validate_value(user->bounds, &flavors[SYM_USERS]))
+ 		goto bad;
+@@ -599,7 +599,7 @@ static int validate_user_datum_wrapper(__attribute__((unused)) hashtab_key_t k,
+ {
+ 	map_arg_t *margs = args;
+ 
+-	return validate_user_datum(margs->handle, d, margs->flavors, margs->mls);
++	return validate_user_datum(margs->handle, d, margs->flavors, margs->policy);
+ }
+ 
+ static int validate_bool_datum(sepol_handle_t *handle, cond_bool_datum_t *boolean, validate_t flavors[])
+@@ -689,7 +689,7 @@ static int validate_datum(__attribute__ ((unused))hashtab_key_t k, hashtab_datum
+ 
+ static int validate_datum_array_entries(sepol_handle_t *handle, policydb_t *p, validate_t flavors[])
+ {
+-	map_arg_t margs = { flavors, handle, p->mls };
++	map_arg_t margs = { flavors, handle, p };
+ 
+ 	if (hashtab_map(p->p_commons.table, validate_common_datum_wrapper, &margs))
+ 		goto bad;
+-- 
+2.25.1
+
diff --git a/recipes-security/selinux/libsepol_3.4.bb b/recipes-security/selinux/libsepol_3.4.bb
index 49312da..e756557 100644
--- a/recipes-security/selinux/libsepol_3.4.bb
+++ b/recipes-security/selinux/libsepol_3.4.bb
@@ -11,6 +11,8 @@ require selinux_common.inc
 
 inherit lib_package
 
+SRC_URI += "file://0001-libsepol-fix-validation-of-user-declarations-in-modu.patch"
+
 S = "${WORKDIR}/git/libsepol"
 
 DEPENDS = "flex-native"
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git
  2022-11-02  7:30 [meta-selinux][PATCH 1/4] SELinux-FAQ: remove references to poky-selinux distro Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 2/4] base-files: set correct label for /var/volatile Yi Zhao
  2022-11-02  7:30 ` [meta-selinux][PATCH 3/4] libsepol: fix build failure for refpolicy-mls Yi Zhao
@ 2022-11-02  7:30 ` Yi Zhao
       [not found]   ` <20221107193343.jrkm4tdey75dwev6@siemens.com>
  2 siblings, 1 reply; 6+ messages in thread
From: Yi Zhao @ 2022-11-02  7:30 UTC (permalink / raw)
  To: yocto, joe_macdonald, joe

* Update to latest git rev.
* Drop obsolete and useless patches.
* Rebase patches.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 .../refpolicy/refpolicy-minimum_git.bb        |  93 +++----
 .../refpolicy/refpolicy-targeted_git.bb       |   1 -
 ...tile-alias-common-var-volatile-paths.patch |   4 +-
 ...inimum-make-sysadmin-module-optional.patch |  12 +-
 ...ed-make-unconfined_u-the-default-sel.patch |  12 +-
 ...box-set-aliases-for-bin-sbin-and-usr.patch |   4 +-
 ...icy-minimum-make-xdg-module-optional.patch |   8 +-
 ...ed-add-capability2-bpf-and-perfmon-f.patch |  52 ----
 ...y-policy-to-common-yocto-hostname-al.patch |   4 +-
 ...efpolicy-minimum-enable-nscd_use_shm.patch |  35 ---
 ...sr-bin-bash-context-to-bin-bash.bash.patch |   6 +-
 ...abel-resolv.conf-in-var-run-properly.patch |   4 +-
 ...-apply-login-context-to-login.shadow.patch |   4 +-
 ...-fc-hwclock-add-hwclock-alternatives.patch |   4 +-
 ...g-apply-policy-to-dmesg-alternatives.patch |   4 +-
 ...ssh-apply-policy-to-ssh-alternatives.patch |   8 +-
 ...ply-policy-to-network-commands-alter.patch |   4 +-
 ...v-apply-policy-to-udevadm-in-libexec.patch |   4 +-
 ...ply-rpm_exec-policy-to-cpio-binaries.patch |   8 +-
 ...c-su-apply-policy-to-su-alternatives.patch |   4 +-
 ...fc-fstools-fix-real-path-for-fstools.patch |  17 +-
 ...fix-update-alternatives-for-sysvinit.patch |  10 +-
 ...l-apply-policy-to-brctl-alternatives.patch |   4 +-
 ...apply-policy-to-nologin-alternatives.patch |   8 +-
 ...apply-policy-to-sulogin-alternatives.patch |   4 +-
 ...tp-apply-policy-to-ntpd-alternatives.patch |   4 +-
 ...pply-policy-to-kerberos-alternatives.patch |   4 +-
 ...ap-apply-policy-to-ldap-alternatives.patch |   4 +-
 ...ply-policy-to-postgresql-alternative.patch |   4 +-
 ...-apply-policy-to-screen-alternatives.patch |   4 +-
 ...ply-policy-to-usermanage-alternative.patch |  26 +-
 ...etty-add-file-context-to-start_getty.patch |   4 +-
 ...k-apply-policy-to-vlock-alternatives.patch |   4 +-
 ...for-init-scripts-and-systemd-service.patch |   8 +-
 ...bs_dist-set-aliase-for-root-director.patch |   4 +-
 ...ystem-logging-add-rules-for-the-syml.patch |   6 +-
 ...ystem-logging-add-rules-for-syslogd-.patch |   8 +-
 ...ernel-files-add-rules-for-the-symlin.patch |  26 +-
 ...ystem-logging-fix-auditd-startup-fai.patch |  10 +-
 ...ernel-terminal-don-t-audit-tty_devic.patch |   6 +-
 ...rvices-rpcbind-allow-rpcbind_t-to-c.patch} |  23 +-
 ...ystem-modutils-allow-mod_t-to-access.patch |  67 -----
 ...ystem-getty-allow-getty_t-to-search-.patch |  32 ---
 ...stem-systemd-enable-support-for-sys.patch} |  10 +-
 ...stem-systemd-allow-systemd_logind_t.patch} |   8 +-
 ...dmin-usermanage-allow-useradd-to-rel.patch |  71 -----
 ...oles-sysadm-allow-sysadm-to-use-init.patch |  36 +++
 ...es-system-systemd-systemd-user-fixes.patch |  84 ++++++
 ...stem-mount-make-mount_t-domain-MLS-.patch} |   8 +-
 ...ystem-systemd-fix-systemd-resolved-s.patch |  60 ----
 ...les-sysadm-MLS-sysadm-rw-to-clearan.patch} |  10 +-
 ...ystem-systemd-allow-systemd_-_t-to-g.patch | 156 -----------
 ...rvices-rpc-make-nfsd_t-domain-MLS-t.patch} |  12 +-
 ...ystem-logging-fix-syslogd-failures-f.patch |  55 ----
 ...min-dmesg-make-dmesg_t-MLS-trusted-.patch} |   6 +-
 ...es-system-systemd-systemd-user-fixes.patch | 172 ------------
 ...rnel-kernel-make-kernel_t-MLS-trust.patch} |   8 +-
 ...ystem-sysnetwork-support-priviledge-.patch | 132 ---------
 ...stem-init-make-init_t-MLS-trusted-f.patch} |   8 +-
 ...ystem-modutils-allow-kmod_t-to-write.patch |  34 ---
 ...stem-systemd-make-systemd-tmpfiles_.patch} |   8 +-
 ...stem-systemd-systemd-make-systemd_-.patch} |  26 +-
 ...stem-logging-add-the-syslogd_t-to-t.patch} |  15 +-
 ...stem-init-make-init_t-MLS-trusted-f.patch} |   8 +-
 ...stem-init-all-init_t-to-read-any-le.patch} |   8 +-
 ...stem-logging-allow-auditd_t-to-writ.patch} |   8 +-
 ...rnel-kernel-make-kernel_t-MLS-trust.patch} |   8 +-
 ...stem-setrans-allow-setrans_t-use-fd.patch} |   8 +-
 ...stem-systemd-make-_systemd_t-MLS-tr.patch} |   8 +-
 ...stem-logging-make-syslogd_runtime_t.patch} |  12 +-
 ...emd-resolved-is-linked-to-libselinux.patch |  33 ---
 ...md-allow-DNS-resolution-over-io.syst.patch |  63 -----
 ...systemd-to-watch-and-watch-reads-on-.patch |  94 -------
 ...-transition-for-systemd-networkd-run.patch |  32 ---
 ...ing-file-context-for-run-systemd-net.patch |  29 --
 ...-contexts-for-systemd-network-genera.patch |  38 ---
 ...ow-udev-to-read-systemd-networkd-run.patch |  34 ---
 ...s-apply-policy-to-findfs-alternative.patch |  29 --
 .../refpolicy/refpolicy_common.inc            | 261 +++++++++---------
 recipes-security/refpolicy/refpolicy_git.inc  |   4 +-
 80 files changed, 521 insertions(+), 1637 deletions(-)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
 rename recipes-security/refpolicy/refpolicy/{0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch => 0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch} (52%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
 rename recipes-security/refpolicy/refpolicy/{0038-policy-modules-system-systemd-enable-support-for-sys.patch => 0035-policy-modules-system-systemd-enable-support-for-sys.patch} (91%)
 rename recipes-security/refpolicy/refpolicy/{0045-policy-modules-system-systemd-allow-systemd_logind_t.patch => 0036-policy-modules-system-systemd-allow-systemd_logind_t.patch} (88%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
 create mode 100644 recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
 create mode 100644 recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
 rename recipes-security/refpolicy/refpolicy/{0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch => 0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch} (84%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
 rename recipes-security/refpolicy/refpolicy/{0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch => 0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch} (83%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
 rename recipes-security/refpolicy/refpolicy/{0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch => 0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch} (84%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
 rename recipes-security/refpolicy/refpolicy/{0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch => 0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch} (90%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
 rename recipes-security/refpolicy/refpolicy/{0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch => 0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch} (94%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
 rename recipes-security/refpolicy/refpolicy/{0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch => 0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch} (89%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
 rename recipes-security/refpolicy/refpolicy/{0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch => 0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch} (92%)
 rename recipes-security/refpolicy/refpolicy/{0053-policy-modules-system-systemd-systemd-make-systemd_-.patch => 0046-policy-modules-system-systemd-systemd-make-systemd_-.patch} (82%)
 rename recipes-security/refpolicy/refpolicy/{0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch => 0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch} (78%)
 rename recipes-security/refpolicy/refpolicy/{0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch => 0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch} (85%)
 rename recipes-security/refpolicy/refpolicy/{0056-policy-modules-system-init-all-init_t-to-read-any-le.patch => 0049-policy-modules-system-init-all-init_t-to-read-any-le.patch} (88%)
 rename recipes-security/refpolicy/refpolicy/{0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch => 0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch} (87%)
 rename recipes-security/refpolicy/refpolicy/{0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch => 0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch} (83%)
 rename recipes-security/refpolicy/refpolicy/{0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch => 0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch} (83%)
 rename recipes-security/refpolicy/refpolicy/{0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch => 0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch} (88%)
 rename recipes-security/refpolicy/refpolicy/{0061-policy-modules-system-logging-make-syslogd_runtime_t.patch => 0054-policy-modules-system-logging-make-syslogd_runtime_t.patch} (84%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
 delete mode 100644 recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch

diff --git a/recipes-security/refpolicy/refpolicy-minimum_git.bb b/recipes-security/refpolicy/refpolicy-minimum_git.bb
index 2e95b9f..5940ce2 100644
--- a/recipes-security/refpolicy/refpolicy-minimum_git.bb
+++ b/recipes-security/refpolicy/refpolicy-minimum_git.bb
@@ -14,29 +14,29 @@ domains are unconfined. \
 SRC_URI += " \
         file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
         file://0002-refpolicy-minimum-make-xdg-module-optional.patch \
-        file://0003-refpolicy-minimum-enable-nscd_use_shm.patch \
         "
 
 POLICY_NAME = "minimum"
 
 CORE_POLICY_MODULES = "unconfined \
-	selinuxutil \
-	storage \
-	sysnetwork \
-	application \
-	libraries \
-	miscfiles \
-	logging \
-	userdomain \
-	init \
-	mount \
-	modutils \
-	getty \
-	authlogin \
-	locallogin \
-	"
-#systemd dependent policy modules
-CORE_POLICY_MODULES += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'clock systemd udev fstools dbus', '', d)}"
+    selinuxutil \
+    storage \
+    sysnetwork \
+    application \
+    libraries \
+    miscfiles \
+    logging \
+    userdomain \
+    init \
+    mount \
+    modutils \
+    getty \
+    authlogin \
+    locallogin \
+    dbus \
+    "
+# systemd dependent policy modules
+CORE_POLICY_MODULES += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'clock systemd udev fstools', '', d)}"
 
 # nscd caches libc-issued requests to the name service.
 # Without nscd.pp, commands want to use these caches will be blocked.
@@ -60,39 +60,38 @@ EXTRA_POLICY_MODULES += "modutils consoletype hostname netutils"
 # 
 # PURGE_POLICY_MODULES += "xdg xen"
 
-
 POLICY_MODULES_MIN = "${CORE_POLICY_MODULES} ${EXTRA_POLICY_MODULES}"
 
-# re-write the same func from refpolicy_common.inc
-prepare_policy_store () {
-	oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
-	POL_PRIORITY=100
-	POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
-	POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
-	POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
+# Re-write the same func from refpolicy_common.inc
+prepare_policy_store() {
+    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
+    POL_PRIORITY=100
+    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
+    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
+    POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
 
-	# Prepare to create policy store
-	mkdir -p ${POL_STORE}
-	mkdir -p ${POL_ACTIVE_MODS}
+    # Prepare to create policy store
+    mkdir -p ${POL_STORE}
+    mkdir -p ${POL_ACTIVE_MODS}
 
-	# get hll type from suffix on base policy module
-	HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
-	HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
+    # Get hll type from suffix on base policy module
+    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
+    HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
 
-	for i in base ${POLICY_MODULES_MIN}; do
-		MOD_FILE=${POL_SRC}/${i}.${HLL_TYPE}
-		MOD_DIR=${POL_ACTIVE_MODS}/${i}
-		mkdir -p ${MOD_DIR}
-		echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
+    for i in base ${POLICY_MODULES_MIN}; do
+        MOD_FILE=${POL_SRC}/${i}.${HLL_TYPE}
+        MOD_DIR=${POL_ACTIVE_MODS}/${i}
+        mkdir -p ${MOD_DIR}
+        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
 
-		if ! bzip2 -t ${MOD_FILE} >/dev/null 2>&1; then
-			${HLL_BIN} ${MOD_FILE} | bzip2 --stdout > ${MOD_DIR}/cil
-			bzip2 -f ${MOD_FILE} && mv -f ${MOD_FILE}.bz2 ${MOD_FILE}
-		else
-			bunzip2 --stdout ${MOD_FILE} | \
-				${HLL_BIN} | \
-				bzip2 --stdout > ${MOD_DIR}/cil
-		fi
-		cp ${MOD_FILE} ${MOD_DIR}/hll
-	done
+        if ! bzip2 -t ${MOD_FILE} >/dev/null 2>&1; then
+            ${HLL_BIN} ${MOD_FILE} | bzip2 --stdout > ${MOD_DIR}/cil
+            bzip2 -f ${MOD_FILE} && mv -f ${MOD_FILE}.bz2 ${MOD_FILE}
+        else
+            bunzip2 --stdout ${MOD_FILE} | \
+                ${HLL_BIN} | \
+                bzip2 --stdout > ${MOD_DIR}/cil
+        fi
+        cp ${MOD_FILE} ${MOD_DIR}/hll
+    done
 }
diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb b/recipes-security/refpolicy/refpolicy-targeted_git.bb
index 15226db..de81d46 100644
--- a/recipes-security/refpolicy/refpolicy-targeted_git.bb
+++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb
@@ -14,5 +14,4 @@ include refpolicy_${PV}.inc
 
 SRC_URI += " \
         file://0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch \
-        file://0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch \
         "
diff --git a/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch b/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
index c3a03f3..1605d90 100644
--- a/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
+++ b/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
@@ -1,4 +1,4 @@
-From d39f2ddbfcfd6e224a50bf327a7bd0031d74d0c6 Mon Sep 17 00:00:00 2001
+From ee66387c393af77b88c833f5d271efe48036112c Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Thu, 28 Mar 2019 16:14:09 -0400
 Subject: [PATCH] fc/subs/volatile: alias common /var/volatile paths
@@ -29,5 +29,5 @@ index ba22ce7e7..23d4328f7 100644
 +/var/volatile/log /var/log
 +/var/volatile/tmp /var/tmp
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
index f607cbb..657c5cd 100644
--- a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
+++ b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
@@ -1,4 +1,4 @@
-From 669293ddf351f231b34979a7d708601ccbd11930 Mon Sep 17 00:00:00 2001
+From 0e3b79ae0ae468640d7092c9a91a91d258d07645 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Fri, 5 Apr 2019 11:53:28 -0400
 Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  2 files changed, 11 insertions(+), 7 deletions(-)
 
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 5a19f0e43..1f4a671dc 100644
+index 671b5aef3..8ce3d5956 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
-@@ -556,13 +556,15 @@ ifdef(`init_systemd',`
+@@ -615,13 +615,15 @@ ifdef(`init_systemd',`
  		unconfined_write_keys(init_t)
  	')
  ',`
@@ -48,10 +48,10 @@ index 5a19f0e43..1f4a671dc 100644
  	')
  ')
 diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
-index 109980e79..313112371 100644
+index 7728de804..a8ff403dd 100644
 --- a/policy/modules/system/locallogin.te
 +++ b/policy/modules/system/locallogin.te
-@@ -265,7 +265,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
+@@ -274,7 +274,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
  userdom_search_user_home_dirs(sulogin_t)
  userdom_use_user_ptys(sulogin_t)
  
@@ -63,5 +63,5 @@ index 109980e79..313112371 100644
  # by default, sulogin does not use pam...
  # sulogin_pam might need to be defined otherwise
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
index 9939b59..64e658e 100644
--- a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
+++ b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
@@ -1,14 +1,14 @@
-From bf7b74e7c38b546e162eb5a3bd4774e3d84d593d Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
+From 60b4e5ea5668a71b2a0660461daecea66fd11d51 Mon Sep 17 00:00:00 2001
+From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Mon, 20 Apr 2020 11:50:03 +0800
 Subject: [PATCH] refpolicy-targeted: make unconfined_u the default selinux
  user
 
 For targeted policy type, we define unconfined_u as the default selinux
-user for root and normal users, so users could login in and run most
+user for root and normal users, so users could login and run most
 commands and services on unconfined domains.
 
-Upstream-Status: Inappropriate [configuration]
+Upstream-Status: Inappropriate [embedded specific]
 
 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
 Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
@@ -38,7 +38,7 @@ index ce614b41b..c0903d98b 100644
 +root:unconfined_u:s0-mcs_systemhigh
 +__default__:unconfined_u:s0
 diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
-index 4972094cb..b6d769412 100644
+index d116a1b9b..32720f68f 100644
 --- a/policy/modules/system/unconfined.te
 +++ b/policy/modules/system/unconfined.te
 @@ -20,6 +20,11 @@ type unconfined_execmem_t alias ada_t;
@@ -77,5 +77,5 @@ index ca203758c..e737cd9cc 100644
 +	gen_user(root, sysadm, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
  ')
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch b/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
index d2b8139..ef00602 100644
--- a/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
+++ b/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
@@ -1,4 +1,4 @@
-From 974befcafcee1377e122f19a4182f74eea757158 Mon Sep 17 00:00:00 2001
+From 8fa6c5b7b99a50b09e9dffd142c066fa41319750 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Thu, 28 Mar 2019 20:48:10 -0400
 Subject: [PATCH] fc/subs/busybox: set aliases for bin, sbin and usr
@@ -29,5 +29,5 @@ index 23d4328f7..690007f22 100644
 +/usr/lib/busybox/sbin /usr/sbin
 +/usr/lib/busybox/usr /usr
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
index 84764e5..25afa3b 100644
--- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
+++ b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
@@ -1,4 +1,4 @@
-From 1ff0e212ce737bba59d90977a58a15250bc84ea9 Mon Sep 17 00:00:00 2001
+From 9a8d6b634d4f714fc63125be5e23228c565d1aaf Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Wed, 29 Sep 2021 11:08:49 +0800
 Subject: [PATCH] refpolicy-minimum: make xdg module optional
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 8cea6baa1..218834495 100644
+index 7b717d3ba..3b07b368d 100644
 --- a/policy/modules/system/systemd.te
 +++ b/policy/modules/system/systemd.te
-@@ -276,10 +276,14 @@ files_type(systemd_update_run_t)
+@@ -298,10 +298,14 @@ init_unit_file(systemd_user_manager_unit_t)
  
  type systemd_conf_home_t;
  init_unit_file(systemd_conf_home_t)
@@ -36,5 +36,5 @@ index 8cea6baa1..218834495 100644
  type systemd_user_runtime_notify_t;
  userdom_user_runtime_content(systemd_user_runtime_notify_t)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
deleted file mode 100644
index e4c081d..0000000
--- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From b46903aaf7e52f9c4c51a2fa7fe7a85190da98b1 Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Wed, 29 Sep 2021 16:43:54 +0800
-Subject: [PATCH] refpolicy-targeted: add capability2 bpf and perfmon for
- unconfined_t
-
-Fixes:
-avc: denied { bpf } for pid=433 comm="systemd" capability=39
-scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-tclass=capability2 permissive=0
-
-avc: denied { perfmon } for pid=433 comm="systemd" capability=38
-scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-tclass=capability2 permissive=0
-
-type=USER_AVC msg=audit(1632901631.693:86): pid=433 uid=0 auid=0 ses=3
-subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='avc:
-denied { reload } for auid=n/a uid=0 gid=0 cmdline=""
-scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-tclass=system permissive=0  exe="/lib/systemd/systemd" sauid=0
-hostname=? addr=? terminal=?'UID="root" AUID="root" AUID="root"
-UID="root" GID="root" SAUID="root"
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/unconfined.if | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
-index a139cfe78..807e959c3 100644
---- a/policy/modules/system/unconfined.if
-+++ b/policy/modules/system/unconfined.if
-@@ -66,6 +66,11 @@ interface(`unconfined_domain_noaudit',`
- 	files_start_etc_service($1)
- 	files_stop_etc_service($1)
- 
-+	ifdef(`init_systemd',`
-+		allow $1 self:capability2 { bpf perfmon };
-+		allow $1 self:system reload;
-+	')
-+
- 	tunable_policy(`allow_execheap',`
- 		# Allow making the stack executable via mprotect.
- 		allow $1 self:process execheap;
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch b/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
index 6596e76..94ac31b 100644
--- a/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
+++ b/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
@@ -1,4 +1,4 @@
-From 9c6f3c5acc01607a67277f69faa67e34dc98232b Mon Sep 17 00:00:00 2001
+From 5a0bbd1920205f488b6a4565f7217b9d0825067b Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] fc/hostname: apply policy to common yocto hostname
@@ -22,5 +22,5 @@ index 83ddeb573..cf523bc4c 100644
 +/usr/bin/hostname\.net-tools	--	gen_context(system_u:object_r:hostname_exec_t,s0)
 +/usr/bin/hostname\.coreutils	--	gen_context(system_u:object_r:hostname_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch b/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
deleted file mode 100644
index edf9caa..0000000
--- a/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 5f992b59a74cc6cde8fd20162a11065dc30fd7ab Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Fri, 26 Feb 2021 09:13:23 +0800
-Subject: [PATCH] refpolicy-minimum: enable nscd_use_shm
-
-Fixes:
-avc: denied { listen } for pid=199 comm="systemd-resolve"
-path="/run/systemd/resolve/io.systemd.Resolve"
-scontext=system_u:system_r:systemd_resolved_t:s0
-tcontext=system_u:system_r:systemd_resolved_t:s0
-tclass=unix_stream_socket permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/services/nscd.te | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te
-index ada67edb1..9801fc228 100644
---- a/policy/modules/services/nscd.te
-+++ b/policy/modules/services/nscd.te
-@@ -15,7 +15,7 @@ gen_require(`
- ##	can use nscd shared memory.
- ##	</p>
- ## </desc>
--gen_tunable(nscd_use_shm, false)
-+gen_tunable(nscd_use_shm, true)
- 
- attribute_role nscd_roles;
- 
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch b/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
index cf333f1..eff0255 100644
--- a/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
+++ b/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
@@ -1,4 +1,4 @@
-From bbc8b58fe5fe709dfadbffc86e17ebd2d76a257c Mon Sep 17 00:00:00 2001
+From c9219d2f7be1e641b3866b770a9b570c12333b93 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Thu, 28 Mar 2019 21:37:32 -0400
 Subject: [PATCH] fc/bash: apply /usr/bin/bash context to /bin/bash.bash
@@ -15,7 +15,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 4c18154ce..9187e50af 100644
+index 0c05c693d..b70940928 100644
 --- a/policy/modules/kernel/corecommands.fc
 +++ b/policy/modules/kernel/corecommands.fc
 @@ -142,6 +142,7 @@ ifdef(`distro_gentoo',`
@@ -27,5 +27,5 @@ index 4c18154ce..9187e50af 100644
  /usr/bin/fish			--	gen_context(system_u:object_r:shell_exec_t,s0)
  /usr/bin/git-shell		--	gen_context(system_u:object_r:shell_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch b/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
index 078c246..06c8087 100644
--- a/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
+++ b/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
@@ -1,4 +1,4 @@
-From 3cccdec2aaa273ca09100ca957f4968a25f4f3a3 Mon Sep 17 00:00:00 2001
+From 51631a7eaaea1fab4b36a2488497cf725317ce6e Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Thu, 4 Apr 2019 10:45:03 -0400
 Subject: [PATCH] fc/resolv.conf: label resolv.conf in var/run/ properly
@@ -25,5 +25,5 @@ index 14505efe9..c9ec4e5ab 100644
  ifdef(`distro_gentoo',`
  /var/lib/dhcpc(/.*)?		gen_context(system_u:object_r:dhcpc_state_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch b/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
index b4747f7..70c5566 100644
--- a/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
+++ b/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
@@ -1,4 +1,4 @@
-From 9a1e1c7b65cb3f5ab97ce05463ca02a3eaa57d86 Mon Sep 17 00:00:00 2001
+From 1c61b10d21a22d4110bc880b23477295f6cd9efb Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Thu, 28 Mar 2019 21:43:53 -0400
 Subject: [PATCH] fc/login: apply login context to login.shadow
@@ -24,5 +24,5 @@ index 50efcff7b..5cb48882c 100644
  /usr/bin/pam_timestamp_check	--	gen_context(system_u:object_r:pam_exec_t,s0)
  /usr/bin/tcb_convert		--	gen_context(system_u:object_r:updpwd_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch b/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
index 33f6a10..2f9f703 100644
--- a/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
@@ -1,4 +1,4 @@
-From 73716015ab28a9474912902e9467f2d2a864ecd0 Mon Sep 17 00:00:00 2001
+From e4d7d9fb1cb157bf205874e1a81d5719017866a1 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Thu, 28 Mar 2019 21:59:18 -0400
 Subject: [PATCH] fc/hwclock: add hwclock alternatives
@@ -21,5 +21,5 @@ index 301965892..139485835 100644
  /usr/sbin/hwclock	--	gen_context(system_u:object_r:hwclock_exec_t,s0)
 +/usr/sbin/hwclock\.util-linux	--	gen_context(system_u:object_r:hwclock_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch b/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
index 5f2ffdf..6e576a8 100644
--- a/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
@@ -1,4 +1,4 @@
-From 504e8429500ab0984adfd52bb09a3e993b87f2f1 Mon Sep 17 00:00:00 2001
+From ac6536f04674ccc051744e6eb3644e68fe38da33 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Fri, 29 Mar 2019 08:26:55 -0400
 Subject: [PATCH] fc/dmesg: apply policy to dmesg alternatives
@@ -19,5 +19,5 @@ index e52fdfcf8..526b92ed2 100644
  /usr/bin/dmesg		--		gen_context(system_u:object_r:dmesg_exec_t,s0)
 +/usr/bin/dmesg\.util-linux		--		gen_context(system_u:object_r:dmesg_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch b/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
index 585850b..611c0d3 100644
--- a/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
@@ -1,4 +1,4 @@
-From 8ad451ceff2ba4ea26290a7ba9918406a90bb10f Mon Sep 17 00:00:00 2001
+From a56887ca448b60ad6715348b2cfe533e8109a040 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Fri, 29 Mar 2019 09:20:58 -0400
 Subject: [PATCH] fc/ssh: apply policy to ssh alternatives
@@ -12,11 +12,11 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
-index 60060c35c..518043a9b 100644
+index 5c512e972..0448c1877 100644
 --- a/policy/modules/services/ssh.fc
 +++ b/policy/modules/services/ssh.fc
 @@ -4,6 +4,7 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
- /etc/ssh/ssh_host.*_key		--	gen_context(system_u:object_r:sshd_key_t,s0)
+ /etc/ssh/ssh_host.*_key(\.pub)?	--	gen_context(system_u:object_r:sshd_key_t,s0)
  
  /usr/bin/ssh			--	gen_context(system_u:object_r:ssh_exec_t,s0)
 +/usr/bin/ssh\.openssh	--	gen_context(system_u:object_r:ssh_exec_t,s0)
@@ -24,5 +24,5 @@ index 60060c35c..518043a9b 100644
  /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
  /usr/bin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch b/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
index 0621923..7af147d 100644
--- a/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
+++ b/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
@@ -1,4 +1,4 @@
-From c85fd7d9c45770b31de44bb35521e2251882df10 Mon Sep 17 00:00:00 2001
+From 47a5e9a0bd4960534998798ab1a5ab62e77b2b61 Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Tue, 9 Jun 2015 21:22:52 +0530
 Subject: [PATCH] fc/sysnetwork: apply policy to network commands alternatives
@@ -43,5 +43,5 @@ index c9ec4e5ab..4ca151524 100644
  /usr/sbin/tc			--	gen_context(system_u:object_r:ifconfig_exec_t,s0)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch b/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
index cc3e529..434fc1d 100644
--- a/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
+++ b/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
@@ -1,4 +1,4 @@
-From aa2635a54f9c36205ebc469f799a56ece01ac610 Mon Sep 17 00:00:00 2001
+From bbc6eb20e9509a61236051df7a5fa552a8f2654d Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Fri, 29 Mar 2019 09:36:08 -0400
 Subject: [PATCH] fc/udev: apply policy to udevadm in libexec
@@ -25,5 +25,5 @@ index 7898ff01c..bc717e60c 100644
  /usr/sbin/start_udev --	gen_context(system_u:object_r:udev_exec_t,s0)
  ')
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch b/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
index b039f53..bf562d6 100644
--- a/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
+++ b/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
@@ -1,4 +1,4 @@
-From faf757c732c9a022499b584cea64ce1fcc78e118 Mon Sep 17 00:00:00 2001
+From 00533fded8e2264f8bdc68c8ed79644a10e4e2ad Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Fri, 29 Mar 2019 09:54:07 -0400
 Subject: [PATCH] fc/rpm: apply rpm_exec policy to cpio binaries
@@ -12,10 +12,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/admin/rpm.fc b/policy/modules/admin/rpm.fc
-index aaf530c2b..618b18cec 100644
+index 3f842f942..12973ac8b 100644
 --- a/policy/modules/admin/rpm.fc
 +++ b/policy/modules/admin/rpm.fc
-@@ -66,4 +66,6 @@ ifdef(`distro_redhat',`
+@@ -71,4 +71,6 @@ ifdef(`distro_redhat',`
  
  ifdef(`enable_mls',`
  /usr/sbin/cpio	--	gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -23,5 +23,5 @@ index aaf530c2b..618b18cec 100644
 +/usr/bin/cpio\.cpio	--	gen_context(system_u:object_r:rpm_exec_t,s0)
  ')
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch b/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
index 14c7d5b..32d38f1 100644
--- a/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
@@ -1,4 +1,4 @@
-From 52853ae9ee13038c5ffae8616858c442d412a2b8 Mon Sep 17 00:00:00 2001
+From 4b202554e646a60000c1acad7bbdfae1078bdc10 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Thu, 13 Feb 2014 00:33:07 -0500
 Subject: [PATCH] fc/su: apply policy to su alternatives
@@ -23,5 +23,5 @@ index 3375c9692..a9868cd58 100644
 +/usr/bin/su\.shadow		--	gen_context(system_u:object_r:su_exec_t,s0)
 +/usr/bin/su\.util-linux		--	gen_context(system_u:object_r:su_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch b/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
index c2e0ca8..de0aad7 100644
--- a/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
+++ b/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
@@ -1,4 +1,4 @@
-From 4f3a637c0385204c0b87806d158e106fb9f88972 Mon Sep 17 00:00:00 2001
+From f64a5d6a2f2e72ae6c5122220eb759117b6384c8 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Mon, 27 Jan 2014 03:54:01 -0500
 Subject: [PATCH] fc/fstools: fix real path for fstools
@@ -10,14 +10,14 @@ Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
 Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 ---
- policy/modules/system/fstools.fc | 10 ++++++++++
- 1 file changed, 10 insertions(+)
+ policy/modules/system/fstools.fc | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
 
 diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
-index d871294e8..bef711850 100644
+index 8fbd5ce44..2842afbcc 100644
 --- a/policy/modules/system/fstools.fc
 +++ b/policy/modules/system/fstools.fc
-@@ -59,7 +59,9 @@
+@@ -58,7 +58,9 @@
  /usr/sbin/addpart		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/badblocks		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/blkid			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -27,12 +27,13 @@ index d871294e8..bef711850 100644
  /usr/sbin/cfdisk		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/clubufflush		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/delpart		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -73,10 +75,12 @@
+@@ -72,10 +74,13 @@
  /usr/sbin/efibootmgr		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/fatsort		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/fdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 +/usr/sbin/fdisk\.util-linux			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/findfs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
++/usr/sbin/findfs\.util-linux		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/fsck.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/gdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/hdparm		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -40,7 +41,7 @@ index d871294e8..bef711850 100644
  /usr/sbin/install-mbr		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/jfs_.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/losetup.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -84,24 +88,30 @@
+@@ -83,24 +88,30 @@
  /usr/sbin/make_reiser4		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/mkdosfs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/mke2fs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -72,5 +73,5 @@ index d871294e8..bef711850 100644
  /usr/sbin/zhack			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/zinject		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch b/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
index b3ab0cc..5e9c197 100644
--- a/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
+++ b/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
@@ -1,4 +1,4 @@
-From e1439aa43af6ef15b35eac3cdbf0cea561768362 Mon Sep 17 00:00:00 2001
+From 6d2a96abd1e292d0c34ff77501e618cfc193655f Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] fc/init: fix update-alternatives for sysvinit
@@ -26,7 +26,7 @@ index bf51c103f..91ed72be0 100644
  
  /run/shutdown\.pid	--	gen_context(system_u:object_r:shutdown_runtime_t,s0)
 diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 9187e50af..0ecabe34e 100644
+index b70940928..e6077fd5b 100644
 --- a/policy/modules/kernel/corecommands.fc
 +++ b/policy/modules/kernel/corecommands.fc
 @@ -151,6 +151,8 @@ ifdef(`distro_gentoo',`
@@ -39,10 +39,10 @@ index 9187e50af..0ecabe34e 100644
  /usr/bin/sash			--	gen_context(system_u:object_r:shell_exec_t,s0)
  /usr/bin/sesh			--	gen_context(system_u:object_r:shell_exec_t,s0)
 diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
-index 63cf195e6..5268bddb2 100644
+index 1a99e5824..7f0b7c699 100644
 --- a/policy/modules/system/init.fc
 +++ b/policy/modules/system/init.fc
-@@ -40,6 +40,7 @@ ifdef(`distro_gentoo',`
+@@ -41,6 +41,7 @@ ifdef(`distro_gentoo',`
  /usr/libexec/dcc/stop-.* --	gen_context(system_u:object_r:initrc_exec_t,s0)
  
  /usr/sbin/init(ng)?	--	gen_context(system_u:object_r:init_exec_t,s0)
@@ -51,5 +51,5 @@ index 63cf195e6..5268bddb2 100644
  /usr/sbin/upstart	--	gen_context(system_u:object_r:init_exec_t,s0)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch b/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
index b9812b7..b0ba609 100644
--- a/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
@@ -1,4 +1,4 @@
-From 274066b3397b53d63134aee94a0148d9c7d1886d Mon Sep 17 00:00:00 2001
+From 2e9c22ee83b7d4fea7b177ca8111c06e69338db9 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 10:19:54 +0800
 Subject: [PATCH] fc/brctl: apply policy to brctl alternatives
@@ -20,5 +20,5 @@ index ed472f095..2a852b0fd 100644
  /usr/sbin/brctl	--	gen_context(system_u:object_r:brctl_exec_t,s0)
 +/usr/sbin/brctl\.bridge-utils	--	gen_context(system_u:object_r:brctl_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch b/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
index e0ddc5e..58ac463 100644
--- a/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
@@ -1,4 +1,4 @@
-From ab0267f77e38bcda797cfe00ba6fa49ba89e334a Mon Sep 17 00:00:00 2001
+From c43f2d7ddf1d0c2185796e0297dd9f85b9663aaf Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 10:21:51 +0800
 Subject: [PATCH] fc/corecommands: apply policy to nologin alternatives
@@ -11,10 +11,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 0ecabe34e..e27e701ef 100644
+index e6077fd5b..0df59e837 100644
 --- a/policy/modules/kernel/corecommands.fc
 +++ b/policy/modules/kernel/corecommands.fc
-@@ -304,6 +304,8 @@ ifdef(`distro_debian',`
+@@ -306,6 +306,8 @@ ifdef(`distro_debian',`
  /usr/sbin/insmod_ksymoops_clean	--	gen_context(system_u:object_r:bin_t,s0)
  /usr/sbin/mkfs\.cramfs		--	gen_context(system_u:object_r:bin_t,s0)
  /usr/sbin/nologin		--	gen_context(system_u:object_r:shell_exec_t,s0)
@@ -24,5 +24,5 @@ index 0ecabe34e..e27e701ef 100644
  /usr/sbin/sesh			--	gen_context(system_u:object_r:shell_exec_t,s0)
  /usr/sbin/smrsh			--	gen_context(system_u:object_r:shell_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch b/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
index 2fe3740..3c43254 100644
--- a/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
@@ -1,4 +1,4 @@
-From cfb86acce9fe9da9b88c853c0b22d48d99602fbb Mon Sep 17 00:00:00 2001
+From 11c95928e325aea7e4c41a9cdf969f9bdd306611 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 10:43:28 +0800
 Subject: [PATCH] fc/locallogin: apply policy to sulogin alternatives
@@ -21,5 +21,5 @@ index fc8d58507..59e6e9601 100644
 +/usr/sbin/sulogin\.util-linux	--	gen_context(system_u:object_r:sulogin_exec_t,s0)
  /usr/sbin/sushell	--	gen_context(system_u:object_r:sulogin_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch b/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
index 4b046ce..cbae4c5 100644
--- a/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
@@ -1,4 +1,4 @@
-From e159e70b533b500390337ec666d678c7424afb90 Mon Sep 17 00:00:00 2001
+From 5841a5bd25e6017b6ccff4f56628ad6e950eadad Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 10:45:23 +0800
 Subject: [PATCH] fc/ntp: apply policy to ntpd alternatives
@@ -23,5 +23,5 @@ index cd69ea5d5..49ffe6f68 100644
  /usr/sbin/sntp				--	gen_context(system_u:object_r:ntpdate_exec_t,s0)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch b/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
index 9d2e6fa..76e7fe9 100644
--- a/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
@@ -1,4 +1,4 @@
-From 95797c20fb68558b9f37ded3f1cc9a4ef09717f9 Mon Sep 17 00:00:00 2001
+From 8126ec521e5a0f72da098f5d90b5b5b392006b7c Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 10:55:05 +0800
 Subject: [PATCH] fc/kerberos: apply policy to kerberos alternatives
@@ -46,5 +46,5 @@ index df21fcc78..ce0166edd 100644
  /var/log/kadmin\.log.*	--	gen_context(system_u:object_r:kadmind_log_t,s0)
  /var/log/kadmind\.log.*	--	gen_context(system_u:object_r:kadmind_log_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch b/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
index e0b7b9e..a46c9c9 100644
--- a/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
@@ -1,4 +1,4 @@
-From 6b43af067ec45bce1b7059fc549e246f53311d3a Mon Sep 17 00:00:00 2001
+From c71ea08245069001b56aadd7bb0af28e019f45e4 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 11:06:13 +0800
 Subject: [PATCH] fc/ldap: apply policy to ldap alternatives
@@ -36,5 +36,5 @@ index 0a1d08d0f..65b202962 100644
  /run/openldap(/.*)?	gen_context(system_u:object_r:slapd_runtime_t,s0)
  /run/slapd.*	-s	gen_context(system_u:object_r:slapd_runtime_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch b/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
index 4a1a2dc..0a0464f 100644
--- a/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
+++ b/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
@@ -1,4 +1,4 @@
-From 5f664c3a38853129fa1703032822c203dbeaf0a6 Mon Sep 17 00:00:00 2001
+From 72726c1bc51628e6eb56e758f1e334f9b9a0f17e Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 11:13:16 +0800
 Subject: [PATCH] fc/postgresql: apply policy to postgresql alternatives
@@ -33,5 +33,5 @@ index f31a52cf8..f9bf46870 100644
  /usr/share/jonas/pgsql(/.*)?		gen_context(system_u:object_r:postgresql_db_t,s0)
  ')
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch b/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
index 9ae9435..e95cb3c 100644
--- a/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
@@ -1,4 +1,4 @@
-From 2d1634127f8f5c9ec98f866711b8d15b7df815d1 Mon Sep 17 00:00:00 2001
+From 003a22f73563ef7b8b4ab6a6a0cb4a920a43570f Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 11:15:33 +0800
 Subject: [PATCH] fc/screen: apply policy to screen alternatives
@@ -21,5 +21,5 @@ index e51e01d97..238dc263e 100644
 +/usr/bin/screen-.*		--	gen_context(system_u:object_r:screen_exec_t,s0)
  /usr/bin/tmux		--	gen_context(system_u:object_r:screen_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch b/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
index 2dbdcf4..a92b809 100644
--- a/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
+++ b/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
@@ -1,4 +1,4 @@
-From 2323a6ab69c4a74ab127c16e38f14616a289b3d1 Mon Sep 17 00:00:00 2001
+From fdf7c2d27b6ecf08c88bb98e52a7d8284ac828af Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 11:25:34 +0800
 Subject: [PATCH] fc/usermanage: apply policy to usermanage alternatives
@@ -7,26 +7,28 @@ Upstream-Status: Inappropriate [embedded specific]
 
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 ---
- policy/modules/admin/usermanage.fc | 6 ++++++
- 1 file changed, 6 insertions(+)
+ policy/modules/admin/usermanage.fc | 8 ++++++++
+ 1 file changed, 8 insertions(+)
 
 diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
-index 620eefc6f..bf1ff09ab 100644
+index 7209a8dd0..c9dc1f000 100644
 --- a/policy/modules/admin/usermanage.fc
 +++ b/policy/modules/admin/usermanage.fc
-@@ -4,7 +4,11 @@ ifdef(`distro_debian',`
+@@ -4,8 +4,13 @@ ifdef(`distro_debian',`
  
  /usr/bin/chage		--	gen_context(system_u:object_r:passwd_exec_t,s0)
  /usr/bin/chfn		--	gen_context(system_u:object_r:chfn_exec_t,s0)
 +/usr/bin/chfn\.shadow		--	gen_context(system_u:object_r:chfn_exec_t,s0)
 +/usr/bin/chfn\.util-linux		--	gen_context(system_u:object_r:chfn_exec_t,s0)
+ /usr/bin/chpasswd	--	gen_context(system_u:object_r:passwd_exec_t,s0)
++/usr/bin/chpasswd\.shadow	--	gen_context(system_u:object_r:passwd_exec_t,s0)
  /usr/bin/chsh		--	gen_context(system_u:object_r:chfn_exec_t,s0)
 +/usr/bin/chsh\.shadow		--	gen_context(system_u:object_r:chfn_exec_t,s0)
 +/usr/bin/chsh\.util-linux		--	gen_context(system_u:object_r:chfn_exec_t,s0)
  /usr/bin/crack_[a-z]*	--	gen_context(system_u:object_r:crack_exec_t,s0)
  /usr/bin/cracklib-[a-z]* --	gen_context(system_u:object_r:crack_exec_t,s0)
  /usr/bin/gpasswd	--	gen_context(system_u:object_r:groupadd_exec_t,s0)
-@@ -14,6 +18,7 @@ ifdef(`distro_debian',`
+@@ -15,6 +20,7 @@ ifdef(`distro_debian',`
  /usr/bin/grpconv	--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
  /usr/bin/grpunconv	--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
  /usr/bin/passwd		--	gen_context(system_u:object_r:passwd_exec_t,s0)
@@ -34,7 +36,15 @@ index 620eefc6f..bf1ff09ab 100644
  /usr/bin/pwconv		--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
  /usr/bin/pwunconv	--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
  /usr/bin/useradd	--	gen_context(system_u:object_r:useradd_exec_t,s0)
-@@ -39,6 +44,7 @@ ifdef(`distro_debian',`
+@@ -26,6 +32,7 @@ ifdef(`distro_debian',`
+ /usr/lib/cracklib_dict.* --	gen_context(system_u:object_r:crack_db_t,s0)
+ 
+ /usr/sbin/chpasswd	--	gen_context(system_u:object_r:passwd_exec_t,s0)
++/usr/sbin/chpasswd\.shadow	--	gen_context(system_u:object_r:passwd_exec_t,s0)
+ /usr/sbin/crack_[a-z]*	--	gen_context(system_u:object_r:crack_exec_t,s0)
+ /usr/sbin/cracklib-[a-z]* --	gen_context(system_u:object_r:crack_exec_t,s0)
+ /usr/sbin/gpasswd	--	gen_context(system_u:object_r:groupadd_exec_t,s0)
+@@ -41,6 +48,7 @@ ifdef(`distro_debian',`
  /usr/sbin/usermod	--	gen_context(system_u:object_r:useradd_exec_t,s0)
  /usr/sbin/vigr		--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
  /usr/sbin/vipw		--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
@@ -43,5 +53,5 @@ index 620eefc6f..bf1ff09ab 100644
  /usr/share/cracklib(/.*)?	gen_context(system_u:object_r:crack_db_t,s0)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch b/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
index c0d9cf4..f6fa8a0 100644
--- a/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
+++ b/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
@@ -1,4 +1,4 @@
-From dbd399143d6fbda828cfc9f2546bc730e0da584c Mon Sep 17 00:00:00 2001
+From 863ece4fd9815997486c04ce89180707435669e4 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 15 Nov 2019 16:07:30 +0800
 Subject: [PATCH] fc/getty: add file context to start_getty
@@ -23,5 +23,5 @@ index 116ea6421..53ff6137b 100644
  /usr/sbin/.*getty	--	gen_context(system_u:object_r:getty_exec_t,s0)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch b/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
index 71521e8..7f63b14 100644
--- a/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
+++ b/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
@@ -1,4 +1,4 @@
-From 0280f05e2c9665f094d7098cd03e11d75908bcdb Mon Sep 17 00:00:00 2001
+From 5bb33b7d9d7915399cca7d8c6fbdd9c0e27c1cd8 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Wed, 18 Dec 2019 15:04:41 +0800
 Subject: [PATCH] fc/vlock: apply policy to vlock alternatives
@@ -21,5 +21,5 @@ index f668cde9c..c4bc50984 100644
  
  /usr/sbin/vlock-main	--	gen_context(system_u:object_r:vlock_exec_t,s0)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch b/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
index ca9b644..cfb2fd5 100644
--- a/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
+++ b/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
@@ -1,4 +1,4 @@
-From 7f8b07b7af0c3cd8bbec49082b42011ac433df45 Mon Sep 17 00:00:00 2001
+From 574df1810c8f32bbf24b223f72f6622b0df7e82c Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Tue, 30 Jun 2020 10:45:57 +0800
 Subject: [PATCH] fc: add fcontext for init scripts and systemd service files
@@ -34,7 +34,7 @@ index 382c067f9..0ecc5acc4 100644
  /usr/bin/rngd	--	gen_context(system_u:object_r:rngd_exec_t,s0)
  
 diff --git a/policy/modules/services/rpc.fc b/policy/modules/services/rpc.fc
-index 88d2acaf0..d9c0a4aa7 100644
+index 75c2f0617..fa881ba2e 100644
 --- a/policy/modules/services/rpc.fc
 +++ b/policy/modules/services/rpc.fc
 @@ -1,7 +1,9 @@
@@ -46,7 +46,7 @@ index 88d2acaf0..d9c0a4aa7 100644
 +/etc/rc\.d/init\.d/nfscommon	--	gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
  /etc/rc\.d/init\.d/rpcidmapd	--	gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
  
- /usr/bin/rpc\..*	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
+ /usr/bin/nfsdcld	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
 diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
 index 5681acb51..4ff5f990a 100644
 --- a/policy/modules/system/logging.fc
@@ -60,5 +60,5 @@ index 5681acb51..4ff5f990a 100644
  /usr/lib/systemd/systemd-kmsg-syslogd	--	gen_context(system_u:object_r:syslogd_exec_t,s0)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch b/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
index dc10350..82b4708 100644
--- a/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
+++ b/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
@@ -1,4 +1,4 @@
-From 0bb081084a2d12f9041bfae195481d898b5a0ba1 Mon Sep 17 00:00:00 2001
+From 01f57c996e09fb68daf3d97805c46c27a6d34304 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Sun, 5 Apr 2020 22:03:45 +0800
 Subject: [PATCH] file_contexts.subs_dist: set aliase for /root directory
@@ -26,5 +26,5 @@ index 690007f22..f80499ebf 100644
 +# Add an aliase for it
 +/root /home/root
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch b/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
index f8a4cec..06b792a 100644
--- a/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
+++ b/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
@@ -1,4 +1,4 @@
-From 9c676fe5ff2a14206f25bf8ed932c305f13dcfdc Mon Sep 17 00:00:00 2001
+From 2e9b42143ccb92f04d8d57430b3ae1e9f55eb00e Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] policy/modules/system/logging: add rules for the symlink of
@@ -30,7 +30,7 @@ index 4ff5f990a..dee26a9f4 100644
  /var/log/dmesg		--	gen_context(system_u:object_r:var_log_t,s0)
  /var/log/syslog		--	gen_context(system_u:object_r:var_log_t,s0)
 diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
-index 341763730..30d402c75 100644
+index cf7ef1721..b627cacb8 100644
 --- a/policy/modules/system/logging.if
 +++ b/policy/modules/system/logging.if
 @@ -1086,10 +1086,12 @@ interface(`logging_append_all_inherited_logs',`
@@ -100,5 +100,5 @@ index 341763730..30d402c75 100644
  
  ########################################
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch b/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
index a06b3f4..ecfc018 100644
--- a/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
+++ b/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
@@ -1,4 +1,4 @@
-From c9759b1024873819cf594fe7ac3bf06bcf0d959d Mon Sep 17 00:00:00 2001
+From 26dc5529db7664ae248eba4dbc5d17915c371137 Mon Sep 17 00:00:00 2001
 From: Joe MacDonald <joe_macdonald@mentor.com>
 Date: Fri, 29 Mar 2019 10:33:18 -0400
 Subject: [PATCH] policy/modules/system/logging: add rules for syslogd symlink
@@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 21e3285a9..abee7df9c 100644
+index abd61e6bd..90d8ccd31 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -411,6 +411,7 @@ files_search_spool(syslogd_t)
+@@ -420,6 +420,7 @@ files_search_spool(syslogd_t)
  
  # Allow access for syslog-ng
  allow syslogd_t var_log_t:dir { create setattr };
@@ -30,5 +30,5 @@ index 21e3285a9..abee7df9c 100644
  # for systemd but can not be conditional
  files_runtime_filetrans(syslogd_t, syslogd_tmp_t, dir, "log")
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch b/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
index ffa78ac..48e8acf 100644
--- a/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
+++ b/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
@@ -1,4 +1,4 @@
-From fd55f9f292617c7475c62c07ed6c478b4bd9eda5 Mon Sep 17 00:00:00 2001
+From 9052089dfc4f7466fcf304ab282c2e32933a5881 Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] policy/modules/kernel/files: add rules for the symlink of
@@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  2 files changed, 9 insertions(+)
 
 diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
-index 826722f4e..677ae96c3 100644
+index f6ff6b079..279df3d3c 100644
 --- a/policy/modules/kernel/files.fc
 +++ b/policy/modules/kernel/files.fc
-@@ -172,6 +172,7 @@ HOME_ROOT/lost\+found/.*	<<none>>
+@@ -170,6 +170,7 @@ HOME_ROOT/lost\+found/.*	<<none>>
  # /tmp
  #
  /tmp			-d	gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
@@ -30,10 +30,10 @@ index 826722f4e..677ae96c3 100644
  /tmp/\.journal			<<none>>
  
 diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index 495cbe2f4..b308eefd9 100644
+index f7217b226..451f302af 100644
 --- a/policy/modules/kernel/files.if
 +++ b/policy/modules/kernel/files.if
-@@ -4555,6 +4555,7 @@ interface(`files_search_tmp',`
+@@ -4750,6 +4750,7 @@ interface(`files_search_tmp',`
  	')
  
  	allow $1 tmp_t:dir search_dir_perms;
@@ -41,7 +41,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4591,6 +4592,7 @@ interface(`files_list_tmp',`
+@@ -4786,6 +4787,7 @@ interface(`files_list_tmp',`
  	')
  
  	allow $1 tmp_t:dir list_dir_perms;
@@ -49,7 +49,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4627,6 +4629,7 @@ interface(`files_delete_tmp_dir_entry',`
+@@ -4822,6 +4824,7 @@ interface(`files_delete_tmp_dir_entry',`
  	')
  
  	allow $1 tmp_t:dir del_entry_dir_perms;
@@ -57,7 +57,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4645,6 +4648,7 @@ interface(`files_read_generic_tmp_files',`
+@@ -4840,6 +4843,7 @@ interface(`files_read_generic_tmp_files',`
  	')
  
  	read_files_pattern($1, tmp_t, tmp_t)
@@ -65,7 +65,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4663,6 +4667,7 @@ interface(`files_manage_generic_tmp_dirs',`
+@@ -4858,6 +4862,7 @@ interface(`files_manage_generic_tmp_dirs',`
  	')
  
  	manage_dirs_pattern($1, tmp_t, tmp_t)
@@ -73,7 +73,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4699,6 +4704,7 @@ interface(`files_manage_generic_tmp_files',`
+@@ -4894,6 +4899,7 @@ interface(`files_manage_generic_tmp_files',`
  	')
  
  	manage_files_pattern($1, tmp_t, tmp_t)
@@ -81,7 +81,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4735,6 +4741,7 @@ interface(`files_rw_generic_tmp_sockets',`
+@@ -4930,6 +4936,7 @@ interface(`files_rw_generic_tmp_sockets',`
  	')
  
  	rw_sock_files_pattern($1, tmp_t, tmp_t)
@@ -89,7 +89,7 @@ index 495cbe2f4..b308eefd9 100644
  ')
  
  ########################################
-@@ -4942,6 +4949,7 @@ interface(`files_tmp_filetrans',`
+@@ -5137,6 +5144,7 @@ interface(`files_tmp_filetrans',`
  	')
  
  	filetrans_pattern($1, tmp_t, $2, $3, $4)
@@ -98,5 +98,5 @@ index 495cbe2f4..b308eefd9 100644
  
  ########################################
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch b/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
index 3f10d06..22ce8f2 100644
--- a/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
+++ b/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
@@ -1,4 +1,4 @@
-From a196ae5e13b3f8e0d2e7ff27c8d481c9376b18e9 Mon Sep 17 00:00:00 2001
+From eed095029b270bbc49dc67d6b7b6b2fe9c3bca07 Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] policy/modules/system/logging: fix auditd startup failures
@@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index abee7df9c..cc530a2be 100644
+index 90d8ccd31..d3b06db7d 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -161,6 +161,7 @@ dontaudit auditd_t auditd_etc_t:file map;
+@@ -169,6 +169,7 @@ dontaudit auditd_t auditd_etc_t:file map;
  manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
  allow auditd_t auditd_log_t:dir setattr;
  manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
@@ -28,7 +28,7 @@ index abee7df9c..cc530a2be 100644
  allow auditd_t var_log_t:dir search_dir_perms;
  
  manage_files_pattern(auditd_t, auditd_runtime_t, auditd_runtime_t)
-@@ -290,6 +291,7 @@ optional_policy(`
+@@ -298,6 +299,7 @@ optional_policy(`
  allow audisp_remote_t self:capability { setpcap setuid };
  allow audisp_remote_t self:process { getcap setcap };
  allow audisp_remote_t self:tcp_socket create_socket_perms;
@@ -37,5 +37,5 @@ index abee7df9c..cc530a2be 100644
  
  manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch b/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
index 3421a43..f62db74 100644
--- a/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
+++ b/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
@@ -1,4 +1,4 @@
-From bfcb86c9c9ad6a9f10a8556320443d8c96adedc9 Mon Sep 17 00:00:00 2001
+From 3f24b88886fcd1a17248d8d674a02d01061d937a Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] policy/modules/kernel/terminal: don't audit tty_device_t in
@@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
-index 55c18dffb..e8c0735eb 100644
+index e5645c7c5..6e9f654ac 100644
 --- a/policy/modules/kernel/terminal.if
 +++ b/policy/modules/kernel/terminal.if
 @@ -335,9 +335,12 @@ interface(`term_use_console',`
@@ -34,5 +34,5 @@ index 55c18dffb..e8c0735eb 100644
  
  ########################################
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch b/recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
similarity index 52%
rename from recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
rename to recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
index f9aa158..0b00f5a 100644
--- a/recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
+++ b/recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
@@ -1,4 +1,4 @@
-From d1352b688603b16eb6da7a30198d8b7abfc55d1e Mon Sep 17 00:00:00 2001
+From 9c84425bbcaef5913fb6e309b8811639134714ed Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Wed, 1 Jul 2020 08:44:07 +0800
 Subject: [PATCH] policy/modules/services/rpcbind: allow rpcbind_t to create
@@ -13,14 +13,14 @@ Upstream-Status: Inappropriate [embedded specific]
 
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 ---
- policy/modules/services/rpcbind.te | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
+ policy/modules/services/rpcbind.te | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
-index 168c28ca3..e1eb7d5fc 100644
+index 137c21ece..2a712192b 100644
 --- a/policy/modules/services/rpcbind.te
 +++ b/policy/modules/services/rpcbind.te
-@@ -25,16 +25,17 @@ files_type(rpcbind_var_lib_t)
+@@ -25,7 +25,7 @@ files_type(rpcbind_var_lib_t)
  # Local policy
  #
  
@@ -29,17 +29,6 @@ index 168c28ca3..e1eb7d5fc 100644
  # net_admin is for SO_SNDBUFFORCE
  dontaudit rpcbind_t self:capability net_admin;
  allow rpcbind_t self:fifo_file rw_fifo_file_perms;
- allow rpcbind_t self:unix_stream_socket { accept listen };
- allow rpcbind_t self:tcp_socket { accept listen };
- 
-+manage_dirs_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
- manage_files_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
- manage_sock_files_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
--files_runtime_filetrans(rpcbind_t, rpcbind_runtime_t, { file sock_file })
-+files_runtime_filetrans(rpcbind_t, rpcbind_runtime_t, { file sock_file dir })
- 
- manage_dirs_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t)
- manage_files_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch b/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
deleted file mode 100644
index e7ce388..0000000
--- a/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From b3ff2e8572cd929c419775e57b547f309ba9d8fb Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Mon, 24 Aug 2020 11:29:09 +0800
-Subject: [PATCH] policy/modules/system/modutils: allow mod_t to access
- confidentiality of class lockdown
-
-The SELinux lockdown implementation was introduced since kernel 5.6 by
-commit 59438b46471ae6cdfb761afc8c9beaf1e428a331. We need to allow mod_t
-and udev_t to access confidentiality of class lockdown to mount tracefs.
-
-Fixes:
-kernel: Could not create tracefs 'iwlwifi_data/filter' entry
-kernel: Could not create tracefs 'enable' entry
-kernel: Could not create tracefs 'id' entry
-kernel: Could not create tracefs 'filter' entry
-kernel: Could not create tracefs 'trigger' entry
-kernel: Could not create tracefs 'format' entry
-
-audit[170]: AVC avc:  denied  { confidentiality } for  pid=170
-comm="modprobe" lockdown_reason="use of tracefs"
-scontext=system_u:system_r:kmod_t:s15:c0.c1023
-tcontext=system_u:system_r:kmod_t:s15:c0.c1023 tclass=lockdown
-permissive=0
-
-audit[190]: AVC avc:  denied  { confidentiality } for  pid=190
-comm="systemd-udevd" lockdown_reason="use of tracefs"
-scontext=system_u:system_r:udev_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=lockdown
-permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/modutils.te | 2 ++
- policy/modules/system/udev.te     | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
-index b0a419dc1..5b4f0aca1 100644
---- a/policy/modules/system/modutils.te
-+++ b/policy/modules/system/modutils.te
-@@ -41,6 +41,8 @@ dontaudit kmod_t self:capability sys_admin;
- allow kmod_t self:udp_socket create_socket_perms;
- allow kmod_t self:rawip_socket create_socket_perms;
- 
-+allow kmod_t self:lockdown confidentiality;
-+
- # Read module config and dependency information
- list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
- read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
-diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
-index c50ff68c1..4c5a690fb 100644
---- a/policy/modules/system/udev.te
-+++ b/policy/modules/system/udev.te
-@@ -67,6 +67,8 @@ ifdef(`init_systemd',`
- # for systemd-udevd to rename interfaces
- allow udev_t self:netlink_route_socket nlmsg_write;
- 
-+allow udev_t self:lockdown confidentiality;
-+
- can_exec(udev_t, udev_exec_t)
- 
- allow udev_t udev_helper_exec_t:dir list_dir_perms;
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
deleted file mode 100644
index 0dfe0ee..0000000
--- a/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 175b493e7fe69de274388a7f251e74ec9cd56c41 Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Tue, 23 Jun 2020 08:39:44 +0800
-Subject: [PATCH] policy/modules/system/getty: allow getty_t to search tmpfs
-
-Fixes:
-avc:  denied  { search } for  pid=211 comm="agetty" name="/" dev="tmpfs"
-ino=1 scontext=system_u:system_r:getty_t
-tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/getty.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
-index e6e76a93b..c704ddb82 100644
---- a/policy/modules/system/getty.te
-+++ b/policy/modules/system/getty.te
-@@ -68,6 +68,7 @@ files_read_etc_runtime_files(getty_t)
- files_read_etc_files(getty_t)
- files_search_spool(getty_t)
- files_dontaudit_search_var_lib(getty_t)
-+fs_search_tmpfs(getty_t)
- 
- fs_search_auto_mountpoints(getty_t)
- # for error condition handling
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
similarity index 91%
rename from recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch
rename to recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
index cc29c7b..43b2f4d 100644
--- a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch
+++ b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
@@ -1,4 +1,4 @@
-From 93d4f198bd469a8728f5ce0cc51ff18f8a58b23b Mon Sep 17 00:00:00 2001
+From 6465e39b6dfe8daa88cab321e3cf44ccc9f1441d Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Thu, 4 Feb 2016 06:03:19 -0500
 Subject: [PATCH] policy/modules/system/systemd: enable support for
@@ -36,10 +36,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 3d9198342..31d28a0e3 100644
+index ef25974ac..362248d17 100644
 --- a/policy/modules/system/systemd.te
 +++ b/policy/modules/system/systemd.te
-@@ -10,7 +10,7 @@ policy_module(systemd, 1.12.6)
+@@ -10,7 +10,7 @@ policy_module(systemd)
  ## Enable support for systemd-tmpfiles to manage all non-security files.
  ## </p>
  ## </desc>
@@ -48,7 +48,7 @@ index 3d9198342..31d28a0e3 100644
  
  ## <desc>
  ## <p>
-@@ -1396,6 +1396,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
+@@ -1640,6 +1640,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
  files_relabelto_home(systemd_tmpfiles_t)
  files_relabelto_etc_dirs(systemd_tmpfiles_t)
  files_setattr_lock_dirs(systemd_tmpfiles_t)
@@ -60,5 +60,5 @@ index 3d9198342..31d28a0e3 100644
  files_manage_etc_symlinks(systemd_tmpfiles_t)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
similarity index 88%
rename from recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
rename to recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
index 49aa7a6..56b6119 100644
--- a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
+++ b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
@@ -1,4 +1,4 @@
-From 4e2df7ca542b6c94e74345daaecb33efc82d749a Mon Sep 17 00:00:00 2001
+From 2acb5ddbd04c578a420418e3bcb572bbd2dfbae6 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Sat, 18 Dec 2021 09:26:43 +0800
 Subject: [PATCH] policy/modules/system/systemd: allow systemd_logind_t to read
@@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 847895e63..1a83148c1 100644
+index 362248d17..4a1e06640 100644
 --- a/policy/modules/system/systemd.te
 +++ b/policy/modules/system/systemd.te
-@@ -721,6 +721,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
+@@ -920,6 +920,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
  userdom_relabelto_user_runtime_dirs(systemd_logind_t)
  userdom_setattr_user_ttys(systemd_logind_t)
  userdom_use_user_ttys(systemd_logind_t)
@@ -39,5 +39,5 @@ index 847895e63..1a83148c1 100644
  # Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
  # The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch b/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
deleted file mode 100644
index 9465a3e..0000000
--- a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 07866ad826b299194c1bfd7978e5077dde72a68e Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Mon, 11 Oct 2021 10:10:10 +0800
-Subject: [PATCH] policy/modules/admin/usermanage: allow useradd to relabel
- user home files
-
-Fixes:
-avc: denied { relabelfrom } for pid=491 comm="useradd" name=".bashrc"
-dev="vda" ino=12641 scontext=root:sysadm_r:useradd_t
-tcontext=user_u:object_r:user_home_t tclass=file permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/admin/usermanage.te  |  2 ++
- policy/modules/system/userdomain.if | 18 ++++++++++++++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
-index 98646b4b4..50c479498 100644
---- a/policy/modules/admin/usermanage.te
-+++ b/policy/modules/admin/usermanage.te
-@@ -496,6 +496,7 @@ files_read_etc_runtime_files(useradd_t)
- 
- fs_search_auto_mountpoints(useradd_t)
- fs_getattr_xattr_fs(useradd_t)
-+fs_search_tmpfs(useradd_t)
- 
- mls_file_upgrade(useradd_t)
- 
-@@ -541,6 +542,7 @@ userdom_home_filetrans_user_home_dir(useradd_t)
- userdom_manage_user_home_content_dirs(useradd_t)
- userdom_manage_user_home_content_files(useradd_t)
- userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
-+userdom_relabel_user_home_content_files(useradd_t)
- 
- optional_policy(`
- 	mta_manage_spool(useradd_t)
-diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 22b3c1bf7..ec625170d 100644
---- a/policy/modules/system/userdomain.if
-+++ b/policy/modules/system/userdomain.if
-@@ -2362,6 +2362,24 @@ interface(`userdom_dontaudit_relabel_user_home_content_files',`
- 	dontaudit $1 user_home_t:file relabel_file_perms;
- ')
- 
-+########################################
-+## <summary>
-+##	Relabel user home files.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`userdom_relabel_user_home_content_files',`
-+	gen_require(`
-+		type user_home_t;
-+	')
-+
-+	allow $1 user_home_t:file relabel_file_perms;
-+')
-+
- ########################################
- ## <summary>
- ##	Read user home subdirectory symbolic links.
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
new file mode 100644
index 0000000..78c4dc8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
@@ -0,0 +1,36 @@
+From 51a7f8058fee569322c1a0597fccd36c318ad943 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Fri, 28 Oct 2022 11:56:09 +0800
+Subject: [PATCH] policy/modules/roles/sysadm: allow sysadm to use init file
+ descriptors
+
+Root can not login via console without this.
+
+Fixes:
+avc: denied { use } for pid=323 comm="sh" path="/dev/tty1"
+dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t
+tcontext=system_u:system_r:init_t tclass=fd permissive=0
+
+Upstream-Status: Pending
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/roles/sysadm.te | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
+index bb715a847..088c954f5 100644
+--- a/policy/modules/roles/sysadm.te
++++ b/policy/modules/roles/sysadm.te
+@@ -86,6 +86,8 @@ ifdef(`init_systemd',`
+ 	# LookupDynamicUserByUID on org.freedesktop.systemd1.
+ 	init_dbus_chat(sysadm_t)
+ 
++	init_use_fds(sysadm_t)
++
+ 	# Allow sysadm to get the status of and set properties of other users,
+ 	# sessions, and seats on the system.
+ 	systemd_dbus_chat_logind(sysadm_t)
+-- 
+2.25.1
+
diff --git a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
new file mode 100644
index 0000000..85bb82b
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
@@ -0,0 +1,84 @@
+From 5b6f3fcb1ddabd0a66541959306e7b0adfe2b2b0 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Thu, 4 Feb 2021 10:48:54 +0800
+Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
+
+Fixes:
+systemctl[277]: Failed to connect to bus: No medium found
+
+avc: denied { mknod } for  pid=297 comm="systemd" capability=27
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
+
+avc: denied { bpf } for pid=297 comm="systemd" capability=39
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
+
+avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
+
+avc: denied { perfmon } for pid=297 comm="systemd" capability=38
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/roles/sysadm.te   |  2 ++
+ policy/modules/system/systemd.if | 21 ++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
+index 088c954f5..92f50fd5a 100644
+--- a/policy/modules/roles/sysadm.te
++++ b/policy/modules/roles/sysadm.te
+@@ -98,6 +98,8 @@ ifdef(`init_systemd',`
+ 
+ 	# Allow sysadm to follow logs in the journal, i.e. with podman logs -f
+ 	systemd_watch_journal_dirs(sysadm_t)
++
++	systemd_sysadm_user(sysadm_t)
+ ')
+ 
+ tunable_policy(`allow_ptrace',`
+diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
+index 9dc91fbb7..325ca548b 100644
+--- a/policy/modules/system/systemd.if
++++ b/policy/modules/system/systemd.if
+@@ -58,7 +58,7 @@ template(`systemd_role_template',`
+ 	allow $1_systemd_t self:process { getsched signal };
+ 	allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
+ 	allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
+-	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms };
++	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms noatsecure };
+ 	corecmd_shell_domtrans($1_systemd_t, $3)
+ 	corecmd_bin_domtrans($1_systemd_t, $3)
+ 
+@@ -2613,3 +2613,22 @@ interface(`systemd_use_inherited_machined_ptys', `
+ 	allow $1 systemd_machined_t:fd use;
+ 	allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
+ ')
++
++#########################################
++## <summary>
++##	sysadm user for systemd --user
++## </summary>
++## <param name="role">
++##	<summary>
++##  Role allowed access.
++##	</summary>
++## </param>
++#
++interface(`systemd_sysadm_user',`
++	gen_require(`
++		type sysadm_systemd_t;
++	')
++
++	allow sysadm_systemd_t self:capability { mknod sys_admin };
++	allow sysadm_systemd_t self:capability2 { bpf perfmon };
++')
+-- 
+2.25.1
+
diff --git a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
similarity index 84%
rename from recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
rename to recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
index 4cae8c6..c3b4b55 100644
--- a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
+++ b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
@@ -1,4 +1,4 @@
-From 705008ba8ef960cf2e4813b4b8c5a87b919d545f Mon Sep 17 00:00:00 2001
+From ccdd22cc2776b695f96faffc88699aa2b182e085 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Sat, 15 Feb 2014 04:22:47 -0500
 Subject: [PATCH] policy/modules/system/mount: make mount_t domain MLS trusted
@@ -19,10 +19,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
-index e39ab41a8..3481f9294 100644
+index d028723ce..97f49e58e 100644
 --- a/policy/modules/system/mount.te
 +++ b/policy/modules/system/mount.te
-@@ -116,6 +116,7 @@ fs_dontaudit_write_all_image_files(mount_t)
+@@ -112,6 +112,7 @@ fs_dontaudit_write_all_image_files(mount_t)
  
  mls_file_read_all_levels(mount_t)
  mls_file_write_all_levels(mount_t)
@@ -31,5 +31,5 @@ index e39ab41a8..3481f9294 100644
  selinux_get_enforce_mode(mount_t)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
deleted file mode 100644
index ea8af31..0000000
--- a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 99139408a7919282e97e1b2fcd5da33248386d73 Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Mon, 25 Jan 2021 14:14:59 +0800
-Subject: [PATCH] policy/modules/system/systemd: fix systemd-resolved startup
- failures
-
-* Allow systemd_resolved_t to manage systemd_resolved_runtime_t link
-  files
-* Allow systemd_resolved_t to send and recevie messages from dhcpc over
-  dbus
-
-Fixes:
-avc:  denied  { create } for  pid=329 comm="systemd-resolve"
-name=".#stub-resolv.conf53cb7f9d1e3aa72b"
-scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:systemd_resolved_runtime_t:s0 tclass=lnk_file
-permissive=0
-
-avc:  denied  { send_msg } for msgtype=method_call
-interface=org.freedesktop.resolve1.Manager member=RevertLink
-dest=org.freedesktop.resolve1 spid=340 tpid=345
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
-tclass=dbus permissive=0
-
-avc:  denied  { send_msg } for msgtype=method_return dest=:1.6 spid=345
-tpid=340 scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=dbus
-permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 31d28a0e3..448905ff7 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -1199,6 +1199,7 @@ allow systemd_resolved_t systemd_networkd_runtime_t:dir watch;
- 
- manage_dirs_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
- manage_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
-+manage_lnk_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
- manage_sock_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
- init_runtime_filetrans(systemd_resolved_t, systemd_resolved_runtime_t, dir)
- 
-@@ -1236,6 +1237,7 @@ optional_policy(`
- 	dbus_system_bus_client(systemd_resolved_t)
- 	dbus_watch_system_bus_runtime_dirs(systemd_resolved_t)
- 	dbus_watch_system_bus_runtime_named_sockets(systemd_resolved_t)
-+	sysnet_dbus_chat_dhcpc(systemd_resolved_t)
- ')
- 
- #########################################
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
similarity index 83%
rename from recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
index 86317b3..d711612 100644
--- a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
+++ b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
@@ -1,4 +1,4 @@
-From ef2b9196f3a51745a3644489d316bda7cd67f72d Mon Sep 17 00:00:00 2001
+From 64498d6cd30a0a65a24e3e7ab22cca5921c2db89 Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Mon, 28 Jan 2019 14:05:18 +0800
 Subject: [PATCH] policy/modules/roles/sysadm: MLS - sysadm rw to clearance
@@ -7,7 +7,7 @@ The two new rules make sysadm_t domain MLS trusted for:
  - reading from files at all levels.
  - writing to processes up to its clearance(s0-s15).
 
-With default MLS policy, root user would login in as sysadm_t:s0 by
+With default MLS policy, root user would login as sysadm_t:s0 by
 default. Most processes will run in sysadm_t:s0 because no
 domtrans/rangetrans rules, as a result, even root could not access
 high level files/processes.
@@ -23,10 +23,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index e1933a5bd..0682ed31a 100644
+index 92f50fd5a..8c154d474 100644
 --- a/policy/modules/roles/sysadm.te
 +++ b/policy/modules/roles/sysadm.te
-@@ -44,6 +44,8 @@ logging_watch_all_logs(sysadm_t)
+@@ -45,6 +45,8 @@ logging_watch_all_logs(sysadm_t)
  logging_watch_audit_log(sysadm_t)
  
  mls_process_read_all_levels(sysadm_t)
@@ -36,5 +36,5 @@ index e1933a5bd..0682ed31a 100644
  selinux_read_policy(sysadm_t)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
deleted file mode 100644
index 91588f1..0000000
--- a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From 81e63f86d6d030eaf0204796e32011c08e7b5e52 Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Tue, 28 Sep 2021 10:03:04 +0800
-Subject: [PATCH] policy/modules/system/systemd: allow systemd_*_t to get the
- attributes of tmpfs and cgroups
-
-Fixes:
-avc: denied { getattr } for pid=245 comm="systemd-network" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_networkd_t
-tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
-
-avc: denied { getattr } for pid=252 comm="systemd-resolve" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_resolved_t
-tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
-
-avc: denied { getattr } for pid=260 comm="systemd-user-se" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_sessions_t
-tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
-
-avc: denied { search } for pid=293 comm="systemd-user-ru" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_user_runtime_dir_t
-tcontext=system_u:object_r:cgroup_t tclass=dir permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 35 ++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 448905ff7..847895e63 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -337,6 +337,10 @@ udev_read_runtime_files(systemd_backlight_t)
- 
- files_search_var_lib(systemd_backlight_t)
- 
-+fs_getattr_tmpfs(systemd_backlight_t)
-+fs_search_cgroup_dirs(systemd_backlight_t)
-+fs_getattr_cgroup(systemd_backlight_t)
-+
- #######################################
- #
- # Binfmt local policy
-@@ -447,6 +451,7 @@ files_list_usr(systemd_generator_t)
- fs_list_efivars(systemd_generator_t)
- fs_getattr_cgroup(systemd_generator_t)
- fs_getattr_xattr_fs(systemd_generator_t)
-+fs_getattr_tmpfs(systemd_generator_t)
- 
- init_create_runtime_files(systemd_generator_t)
- init_manage_runtime_dirs(systemd_generator_t)
-@@ -515,6 +520,10 @@ systemd_log_parse_environment(systemd_hostnamed_t)
- # Allow reading /run/udev/data/+dmi:id
- udev_read_runtime_files(systemd_hostnamed_t)
- 
-+fs_getattr_tmpfs(systemd_hostnamed_t)
-+fs_search_cgroup_dirs(systemd_hostnamed_t)
-+fs_getattr_cgroup(systemd_hostnamed_t)
-+
- optional_policy(`
- 	dbus_connect_system_bus(systemd_hostnamed_t)
- 	dbus_system_bus_client(systemd_hostnamed_t)
-@@ -835,6 +844,10 @@ dev_read_sysfs(systemd_modules_load_t)
- files_mmap_read_kernel_modules(systemd_modules_load_t)
- files_read_etc_files(systemd_modules_load_t)
- 
-+fs_getattr_tmpfs(systemd_modules_load_t)
-+fs_search_cgroup_dirs(systemd_modules_load_t)
-+fs_getattr_cgroup(systemd_modules_load_t)
-+
- modutils_read_module_config(systemd_modules_load_t)
- modutils_read_module_deps(systemd_modules_load_t)
- 
-@@ -885,6 +898,7 @@ files_watch_runtime_dirs(systemd_networkd_t)
- files_watch_root_dirs(systemd_networkd_t)
- files_list_runtime(systemd_networkd_t)
- fs_getattr_xattr_fs(systemd_networkd_t)
-+fs_getattr_tmpfs(systemd_networkd_t)
- fs_getattr_cgroup(systemd_networkd_t)
- fs_search_cgroup_dirs(systemd_networkd_t)
- fs_read_nsfs_files(systemd_networkd_t)
-@@ -1185,6 +1199,10 @@ udev_read_runtime_files(systemd_rfkill_t)
- 
- systemd_log_parse_environment(systemd_rfkill_t)
- 
-+fs_getattr_tmpfs(systemd_rfkill_t)
-+fs_search_cgroup_dirs(systemd_rfkill_t)
-+fs_getattr_cgroup(systemd_rfkill_t)
-+
- #########################################
- #
- # Resolved local policy
-@@ -1224,6 +1242,9 @@ auth_use_nsswitch(systemd_resolved_t)
- files_watch_root_dirs(systemd_resolved_t)
- files_watch_runtime_dirs(systemd_resolved_t)
- files_list_runtime(systemd_resolved_t)
-+fs_getattr_tmpfs(systemd_resolved_t)
-+fs_search_cgroup_dirs(systemd_resolved_t)
-+fs_getattr_cgroup(systemd_resolved_t)
- 
- init_dgram_send(systemd_resolved_t)
- 
-@@ -1288,6 +1309,10 @@ seutil_read_file_contexts(systemd_sessions_t)
- 
- systemd_log_parse_environment(systemd_sessions_t)
- 
-+fs_getattr_tmpfs(systemd_sessions_t)
-+fs_search_cgroup_dirs(systemd_sessions_t)
-+fs_getattr_cgroup(systemd_sessions_t)
-+
- ########################################
- #
- # sysctl local policy
-@@ -1304,6 +1329,9 @@ kernel_rw_all_sysctls(systemd_sysctl_t)
- kernel_dontaudit_getattr_proc(systemd_sysctl_t)
- 
- files_read_etc_files(systemd_sysctl_t)
-+fs_getattr_tmpfs(systemd_sysctl_t)
-+fs_search_cgroup_dirs(systemd_sysctl_t)
-+fs_getattr_cgroup(systemd_sysctl_t)
- 
- systemd_log_parse_environment(systemd_sysctl_t)
- 
-@@ -1409,6 +1437,8 @@ fs_getattr_tmpfs(systemd_tmpfiles_t)
- fs_getattr_xattr_fs(systemd_tmpfiles_t)
- fs_list_tmpfs(systemd_tmpfiles_t)
- fs_relabelfrom_tmpfs_dirs(systemd_tmpfiles_t)
-+fs_search_cgroup_dirs(systemd_tmpfiles_t)
-+fs_getattr_cgroup(systemd_tmpfiles_t)
- 
- selinux_get_fs_mount(systemd_tmpfiles_t)
- selinux_use_status_page(systemd_tmpfiles_t)
-@@ -1497,6 +1527,10 @@ allow systemd_update_done_t systemd_update_run_t:file manage_file_perms;
- files_etc_filetrans(systemd_update_done_t, systemd_update_run_t, file)
- files_var_filetrans(systemd_update_done_t, systemd_update_run_t, file)
- 
-+fs_getattr_tmpfs(systemd_update_done_t)
-+fs_search_cgroup_dirs(systemd_update_done_t)
-+fs_getattr_cgroup(systemd_update_done_t)
-+
- kernel_read_kernel_sysctls(systemd_update_done_t)
- 
- selinux_use_status_page(systemd_update_done_t)
-@@ -1601,6 +1635,7 @@ fs_unmount_tmpfs(systemd_user_runtime_dir_t)
- fs_relabelfrom_tmpfs_dirs(systemd_user_runtime_dir_t)
- fs_read_cgroup_files(systemd_user_runtime_dir_t)
- fs_getattr_cgroup(systemd_user_runtime_dir_t)
-+fs_search_cgroup_dirs(systemd_user_runtime_dir_t)
- 
- kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
- kernel_dontaudit_getattr_proc(systemd_user_runtime_dir_t)
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
similarity index 84%
rename from recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
rename to recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
index f659e7e..d22dacf 100644
--- a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
+++ b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
@@ -1,4 +1,4 @@
-From 18ad027229a06fdcb833482dff0c2ae637d08e78 Mon Sep 17 00:00:00 2001
+From e82c43e60ef52ba00e8f2af5b46b2a6d49331209 Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Fri, 23 Aug 2013 12:01:53 +0800
 Subject: [PATCH] policy/modules/services/rpc: make nfsd_t domain MLS trusted
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  2 files changed, 7 insertions(+)
 
 diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index ca951cb44..a32c59eb1 100644
+index 5124ae016..a40db8507 100644
 --- a/policy/modules/kernel/kernel.te
 +++ b/policy/modules/kernel/kernel.te
-@@ -356,6 +356,8 @@ mls_process_read_all_levels(kernel_t)
+@@ -368,6 +368,8 @@ mls_process_read_all_levels(kernel_t)
  mls_process_write_all_levels(kernel_t)
  mls_file_write_all_levels(kernel_t)
  mls_file_read_all_levels(kernel_t)
@@ -28,7 +28,7 @@ index ca951cb44..a32c59eb1 100644
  ifdef(`distro_redhat',`
  	# Bugzilla 222337
 diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
-index e1eb7d5fc..da0994749 100644
+index 2a712192b..923e48db7 100644
 --- a/policy/modules/services/rpcbind.te
 +++ b/policy/modules/services/rpcbind.te
 @@ -73,6 +73,11 @@ logging_send_syslog_msg(rpcbind_t)
@@ -36,7 +36,7 @@ index e1eb7d5fc..da0994749 100644
  miscfiles_read_localization(rpcbind_t)
  
 +# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
-+# because the are running in different level. So add rules to allow this.
++# because they are running in different level. So add rules to allow this.
 +mls_socket_read_all_levels(rpcbind_t)
 +mls_socket_write_all_levels(rpcbind_t)
 +
@@ -44,5 +44,5 @@ index e1eb7d5fc..da0994749 100644
  	term_dontaudit_use_unallocated_ttys(rpcbind_t)
  ')
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch b/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
deleted file mode 100644
index 2232d48..0000000
--- a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From dc2c9c91219311f6c4d985169dff6c5931a465d7 Mon Sep 17 00:00:00 2001
-From: Wenzong Fan <wenzong.fan@windriver.com>
-Date: Thu, 4 Feb 2016 02:10:15 -0500
-Subject: [PATCH] policy/modules/system/logging: fix syslogd failures for
- systemd
-
-Fixes:
-syslogd[243]: Error opening log file: /var/log/auth.log: Permission denied
-syslogd[243]: Error opening log file: /var/log/syslog: Permission denied
-syslogd[243]: Error opening log file: /var/log/kern.log: Permission denied
-syslogd[243]: Error opening log file: /var/log/mail.log: Permission denied
-syslogd[243]: Error opening log file: /var/log/mail.err: Permission denied
-syslogd[243]: Error opening log file: /var/log/messages: Permission denied
-
-avc:  denied  { search } for  pid=243 comm="syslogd" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t
-tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
-
-avc:  denied  { write } for  pid=162 comm="systemd-journal"
-name="syslog" dev="tmpfs" ino=515 scontext=system_u:system_r:syslogd_t
-tcontext=system_u:object_r:syslogd_runtime_t tclass=sock_file
-permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/logging.te | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index cc530a2be..5b4b5ec5d 100644
---- a/policy/modules/system/logging.te
-+++ b/policy/modules/system/logging.te
-@@ -431,7 +431,7 @@ files_search_var_lib(syslogd_t)
- 
- # manage runtime files
- allow syslogd_t syslogd_runtime_t:dir create_dir_perms;
--allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink };
-+allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink write };
- allow syslogd_t syslogd_runtime_t:file map;
- manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
- files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
-@@ -495,6 +495,7 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
- 
- fs_getattr_all_fs(syslogd_t)
- fs_search_auto_mountpoints(syslogd_t)
-+fs_search_tmpfs(syslogd_t)
- 
- mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
- 
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
similarity index 90%
rename from recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
rename to recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
index ace056a..30c84f6 100644
--- a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
+++ b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
@@ -1,4 +1,4 @@
-From b41a910654f5c5fe198b1695df18b6f6a1af7904 Mon Sep 17 00:00:00 2001
+From 9343914c0486b5aa6ff7cceeb8f6c399115e5fb3 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Tue, 30 Jun 2020 10:18:20 +0800
 Subject: [PATCH] policy/modules/admin/dmesg: make dmesg_t MLS trusted reading
@@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
-index f3421fdbb..d87ee5583 100644
+index f1da315a9..89478c38e 100644
 --- a/policy/modules/admin/dmesg.te
 +++ b/policy/modules/admin/dmesg.te
 @@ -52,6 +52,8 @@ miscfiles_read_localization(dmesg_t)
@@ -32,5 +32,5 @@ index f3421fdbb..d87ee5583 100644
  	seutil_sigchld_newrole(dmesg_t)
  ')
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch b/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
deleted file mode 100644
index 108f62f..0000000
--- a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 20b2608718064a92f9255adb459a97d95fdbc22e Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Thu, 4 Feb 2021 10:48:54 +0800
-Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
-
-Fixes:
-systemctl[1598]: Failed to connect to bus: $DBUS_SESSION_BUS_ADDRESS and
-$XDG_RUNTIME_DIR not defined (consider using --machine=<user>@.host
---user to connect to bus of other user)
-
-avc: denied { connectto } for  pid=293 comm="login"
-path="/run/systemd/userdb/io.systemd.Multiplexer"
-scontext=system_u:system_r:local_login_t
-tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
-permissive=0
-
-avc: denied { read } for  pid=293 comm="login" name="io.systemd.DropIn"
-dev="tmpfs" ino=44 scontext=system_u:system_r:local_login_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { read } for  pid=293 comm="login"
-name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
-scontext=system_u:system_r:local_login_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { connectto } for  pid=244 comm="systemd-logind"
-path="/run/systemd/userdb/io.systemd.Multiplexer"
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
-permissive=0
-
-avc: denied { read } for  pid=244 comm="systemd-logind"
-name="io.systemd.DropIn" dev="tmpfs" ino=44
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { read } for  pid=244 comm="systemd-logind"
-name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { mknod } for  pid=297 comm="systemd" capability=27
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
-
-avc: denied { setrlimit } for pid=297 comm="systemd"
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=process permissive=0
-
-avc: denied { bpf } for pid=297 comm="systemd" capability=39
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
-
-avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
-
-avc: denied { perfmon } for pid=297 comm="systemd" capability=38
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
-
-avc: denied { watch } for pid=297 comm="systemd" path="/etc" dev="vda"
-ino=173 scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=system_u:object_r:etc_t tclass=dir permissive=0
-
-avc: denied { getattr } for pid=297 comm="systemd" name="/" dev="vda"
-ino=2 scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
-
-avc: denied { read } for pid=297 comm="systemd" name="unix" dev="proc"
-ino=4026532057 scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=system_u:object_r:proc_net_t tclass=file permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/roles/sysadm.te   |  2 ++
- policy/modules/system/init.if    |  1 +
- policy/modules/system/systemd.if | 27 ++++++++++++++++++++++++++-
- 3 files changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index 46d3e2f0b..e1933a5bd 100644
---- a/policy/modules/roles/sysadm.te
-+++ b/policy/modules/roles/sysadm.te
-@@ -92,6 +92,8 @@ ifdef(`init_systemd',`
- 	# Allow sysadm to query and set networking settings on the system.
- 	systemd_dbus_chat_networkd(sysadm_t)
- 	fs_read_nsfs_files(sysadm_t)
-+
-+	systemd_sysadm_user(sysadm_t)
- ')
- 
- tunable_policy(`allow_ptrace',`
-diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index 0171ee299..8ca29f654 100644
---- a/policy/modules/system/init.if
-+++ b/policy/modules/system/init.if
-@@ -959,6 +959,7 @@ interface(`init_unix_stream_socket_connectto',`
- 	')
- 
- 	allow $1 init_t:unix_stream_socket connectto;
-+	allow $1 initrc_t:unix_stream_socket connectto;
- ')
- 
- ########################################
-diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 38adf050c..5c44d8d8a 100644
---- a/policy/modules/system/systemd.if
-+++ b/policy/modules/system/systemd.if
-@@ -57,7 +57,7 @@ template(`systemd_role_template',`
- 	allow $1_systemd_t self:process { getsched signal };
- 	allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
- 	allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
--	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms };
-+	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms noatsecure };
- 	corecmd_shell_domtrans($1_systemd_t, $3)
- 	corecmd_bin_domtrans($1_systemd_t, $3)
- 
-@@ -88,8 +88,11 @@ template(`systemd_role_template',`
- 
- 	fs_manage_cgroup_files($1_systemd_t)
- 	fs_watch_cgroup_files($1_systemd_t)
-+	files_watch_etc_dirs($1_systemd_t)
-+	fs_getattr_xattr_fs($1_systemd_t)
- 
- 	kernel_dontaudit_getattr_proc($1_systemd_t)
-+	kernel_read_network_state($1_systemd_t)
- 
- 	selinux_use_status_page($1_systemd_t)
- 
-@@ -1052,6 +1055,7 @@ interface(`systemd_stream_connect_userdb', `
- 	init_search_runtime($1)
- 	allow $1 systemd_userdb_runtime_t:dir list_dir_perms;
- 	allow $1 systemd_userdb_runtime_t:sock_file write_sock_file_perms;
-+	allow $1 systemd_userdb_runtime_t:lnk_file read_lnk_file_perms;
- 	init_unix_stream_socket_connectto($1)
- ')
- 
-@@ -2003,3 +2007,24 @@ interface(`systemd_use_inherited_machined_ptys', `
- 	allow $1 systemd_machined_t:fd use;
- 	allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
- ')
-+
-+#########################################
-+## <summary>
-+##	sysadm user for systemd --user
-+## </summary>
-+## <param name="role">
-+##	<summary>
-+##  Role allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`systemd_sysadm_user',`
-+	gen_require(`
-+		type sysadm_systemd_t;
-+	')
-+
-+	allow sysadm_systemd_t self:capability { mknod sys_admin };
-+	allow sysadm_systemd_t self:capability2 { bpf perfmon };
-+	allow sysadm_systemd_t self:process setrlimit;
-+	allow $1 sysadm_systemd_t:system reload;
-+')
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
similarity index 94%
rename from recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
rename to recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
index 8b9f98c..932047a 100644
--- a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
+++ b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
@@ -1,4 +1,4 @@
-From c2e99e27acc1454d792b3e8d6f24d3a2a3be29e3 Mon Sep 17 00:00:00 2001
+From 057e4e6a6e2e87edcd6a93dd533620700b00b1c2 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Fri, 13 Oct 2017 07:20:40 +0000
 Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@@ -59,10 +59,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index a32c59eb1..1c53754ee 100644
+index a40db8507..40cd52825 100644
 --- a/policy/modules/kernel/kernel.te
 +++ b/policy/modules/kernel/kernel.te
-@@ -358,6 +358,8 @@ mls_file_write_all_levels(kernel_t)
+@@ -370,6 +370,8 @@ mls_file_write_all_levels(kernel_t)
  mls_file_read_all_levels(kernel_t)
  mls_socket_write_all_levels(kernel_t)
  mls_fd_use_all_levels(kernel_t)
@@ -72,5 +72,5 @@ index a32c59eb1..1c53754ee 100644
  ifdef(`distro_redhat',`
  	# Bugzilla 222337
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch b/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
deleted file mode 100644
index 504e028..0000000
--- a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From d1c159d4400722e783d12cc3684c1cf15004f7a9 Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Thu, 24 Sep 2020 14:05:52 +0800
-Subject: [PATCH] policy/modules/system/sysnetwork: support priviledge
- separation for dhcpcd
-
-Fixes:
-
-avc:  denied  { sys_chroot } for  pid=332 comm="dhcpcd" capability=18
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc:  denied  { setgid } for  pid=332 comm="dhcpcd" capability=6
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc:  denied  { setuid } for  pid=332 comm="dhcpcd" capability=7
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc:  denied  { setrlimit } for  pid=332 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=process
-permissive=0
-
-avc:  denied  { create } for  pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc:  denied  { setopt } for  pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc:  denied  { bind } for  pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc:  denied  { getattr } for  pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc:  denied  { read } for  pid=330 comm="dhcpcd" name="n1" dev="tmpfs"
-ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
-
-avc:  denied  { open } for  pid=330 comm="dhcpcd"
-path="/run/udev/data/n1" dev="tmpfs" ino=15616
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
-
-avc:  denied  { getattr } for  pid=330 comm="dhcpcd"
-path="/run/udev/data/n1" dev="tmpfs" ino=15616
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
-
-avc:  denied  { connectto } for  pid=1600 comm="dhcpcd"
-path="/run/dhcpcd/unpriv.sock"
-scontext=root:sysadm_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=unix_stream_socket permissive=0
-
-avc:  denied  { kill } for  pid=314 comm="dhcpcd" capability=5
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc:  denied  { getattr } for  pid=300 comm="dhcpcd"
-path="net:[4026532008]" dev="nsfs" ino=4026532008
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/sysnetwork.te | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index 4c317cc4c..05a9a52b8 100644
---- a/policy/modules/system/sysnetwork.te
-+++ b/policy/modules/system/sysnetwork.te
-@@ -58,10 +58,11 @@ ifdef(`distro_debian',`
- # DHCP client local policy
- #
- allow dhcpc_t self:capability { dac_override fsetid net_admin net_bind_service net_raw setpcap sys_nice sys_resource sys_tty_config };
-+allow dhcpc_t self:capability { setgid setuid sys_chroot kill };
- dontaudit dhcpc_t self:capability { sys_ptrace sys_tty_config };
- # for access("/etc/bashrc", X_OK) on Red Hat
- dontaudit dhcpc_t self:capability { dac_read_search sys_module };
--allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms };
-+allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms setrlimit };
- 
- allow dhcpc_t self:fifo_file rw_fifo_file_perms;
- allow dhcpc_t self:tcp_socket create_stream_socket_perms;
-@@ -69,8 +70,10 @@ allow dhcpc_t self:udp_socket create_socket_perms;
- allow dhcpc_t self:packet_socket create_socket_perms;
- allow dhcpc_t self:netlink_generic_socket create_socket_perms;
- allow dhcpc_t self:netlink_route_socket create_netlink_socket_perms;
-+allow dhcpc_t self:netlink_kobject_uevent_socket create_socket_perms;
- allow dhcpc_t self:rawip_socket create_socket_perms;
- allow dhcpc_t self:unix_dgram_socket { create_socket_perms sendto };
-+allow dhcpc_t self:unix_stream_socket connectto;
- 
- allow dhcpc_t dhcp_etc_t:dir list_dir_perms;
- read_lnk_files_pattern(dhcpc_t, dhcp_etc_t, dhcp_etc_t)
-@@ -146,6 +149,7 @@ files_manage_var_files(dhcpc_t)
- fs_getattr_all_fs(dhcpc_t)
- fs_search_auto_mountpoints(dhcpc_t)
- fs_search_cgroup_dirs(dhcpc_t)
-+fs_read_nsfs_files(dhcpc_t)
- 
- term_dontaudit_use_all_ttys(dhcpc_t)
- term_dontaudit_use_all_ptys(dhcpc_t)
-@@ -181,6 +185,7 @@ ifdef(`init_systemd',`
- 	init_stream_connect(dhcpc_t)
- 	init_get_all_units_status(dhcpc_t)
- 	init_search_units(dhcpc_t)
-+	udev_read_runtime_files(dhcpc_t)
- ')
- 
- optional_policy(`
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
similarity index 89%
rename from recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
rename to recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
index b4da47d..9e52b7f 100644
--- a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
+++ b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
@@ -1,4 +1,4 @@
-From 7bcc117ea39532427df297299c10ca1d2948a70c Mon Sep 17 00:00:00 2001
+From c47e288e8950e7e92e3c90972ca7ef8ef9fc6a7f Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Fri, 15 Jan 2016 03:47:05 -0500
 Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 4 insertions(+)
 
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 932d1f7b3..36becaa6e 100644
+index 97a75cf86..fee846cb5 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
-@@ -219,6 +219,10 @@ mls_process_write_all_levels(init_t)
+@@ -229,6 +229,10 @@ mls_process_write_all_levels(init_t)
  mls_fd_use_all_levels(init_t)
  mls_process_set_level(init_t)
  
@@ -42,5 +42,5 @@ index 932d1f7b3..36becaa6e 100644
  # otherwise the call fails and sysvinit tries to load the policy
  # again when using the initramfs
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
deleted file mode 100644
index 2f94974..0000000
--- a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 8343ff97a265836ba1e1e2f4159f888c21e5cabe Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Tue, 9 Feb 2021 17:31:55 +0800
-Subject: [PATCH] policy/modules/system/modutils: allow kmod_t to write keys
-
-Fixes:
-kernel: cfg80211: Problem loading in-kernel X.509 certificate (-13)
-
-avc:  denied  { write } for  pid=219 comm="modprobe"
-scontext=system_u:system_r:kmod_t tcontext=system_u:system_r:kmod_t
-tclass=key permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/modutils.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
-index 5b4f0aca1..008f286a8 100644
---- a/policy/modules/system/modutils.te
-+++ b/policy/modules/system/modutils.te
-@@ -42,6 +42,7 @@ allow kmod_t self:udp_socket create_socket_perms;
- allow kmod_t self:rawip_socket create_socket_perms;
- 
- allow kmod_t self:lockdown confidentiality;
-+allow kmod_t self:key write;
- 
- # Read module config and dependency information
- list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
--- 
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
similarity index 92%
rename from recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
rename to recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
index 4b768e0..1bfbb16 100644
--- a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
+++ b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
@@ -1,4 +1,4 @@
-From d965e6a02854a07c4783cf33e95bf3c7cf9f56f1 Mon Sep 17 00:00:00 2001
+From afd35f6c73551c674e5bfe7cc1832b6a0ea717a6 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Thu, 4 Feb 2016 06:03:19 -0500
 Subject: [PATCH] policy/modules/system/systemd: make systemd-tmpfiles_t domain
@@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 1a83148c1..736107fad 100644
+index 4a1e06640..b44b9b2d7 100644
 --- a/policy/modules/system/systemd.te
 +++ b/policy/modules/system/systemd.te
-@@ -1483,6 +1483,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
+@@ -1694,6 +1694,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
  
  systemd_log_parse_environment(systemd_tmpfiles_t)
  
@@ -59,5 +59,5 @@ index 1a83148c1..736107fad 100644
  userdom_relabel_user_runtime_root_dirs(systemd_tmpfiles_t)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
similarity index 82%
rename from recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
rename to recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
index 60f7dae..800439c 100644
--- a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
+++ b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
@@ -1,4 +1,4 @@
-From 71986d0c6775408a1c89415dd5d4e7ea03302248 Mon Sep 17 00:00:00 2001
+From 8aa70c13d63e093bff87ea938d35dcc76e5bdd56 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Thu, 18 Jun 2020 09:59:58 +0800
 Subject: [PATCH] policy/modules/system/systemd: systemd-*: make systemd_*_t
@@ -43,12 +43,12 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 12 insertions(+)
 
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 736107fad..8cea6baa1 100644
+index b44b9b2d7..7b717d3ba 100644
 --- a/policy/modules/system/systemd.te
 +++ b/policy/modules/system/systemd.te
-@@ -341,6 +341,9 @@ fs_getattr_tmpfs(systemd_backlight_t)
+@@ -373,6 +373,9 @@ files_search_var_lib(systemd_backlight_t)
+ fs_getattr_all_fs(systemd_backlight_t)
  fs_search_cgroup_dirs(systemd_backlight_t)
- fs_getattr_cgroup(systemd_backlight_t)
  
 +mls_file_read_to_clearance(systemd_backlight_t)
 +mls_file_write_to_clearance(systemd_backlight_t)
@@ -56,9 +56,9 @@ index 736107fad..8cea6baa1 100644
  #######################################
  #
  # Binfmt local policy
-@@ -479,6 +482,9 @@ term_use_unallocated_ttys(systemd_generator_t)
+@@ -528,6 +531,9 @@ term_use_unallocated_ttys(systemd_generator_t)
  
- udev_search_runtime(systemd_generator_t)
+ udev_read_runtime_files(systemd_generator_t)
  
 +mls_file_read_to_clearance(systemd_generator_t)
 +mls_file_write_to_clearance(systemd_generator_t)
@@ -66,19 +66,19 @@ index 736107fad..8cea6baa1 100644
  ifdef(`distro_gentoo',`
  	corecmd_shell_entry_type(systemd_generator_t)
  ')
-@@ -723,6 +729,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
+@@ -922,6 +928,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
  userdom_use_user_ttys(systemd_logind_t)
  domain_read_all_domains_state(systemd_logind_t)
  
-+mls_file_read_to_clearance(systemd_logind_t)
-+mls_file_write_to_clearance(systemd_logind_t)
++mls_file_read_all_levels(systemd_logind_t)
++mls_file_write_all_levels(systemd_logind_t)
 +
  # Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
  # The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
  # should fix the problem where user directories in /run/user/$UID/ are not getting the proper context
-@@ -1204,6 +1213,9 @@ fs_getattr_tmpfs(systemd_rfkill_t)
- fs_search_cgroup_dirs(systemd_rfkill_t)
- fs_getattr_cgroup(systemd_rfkill_t)
+@@ -1412,6 +1421,9 @@ udev_read_runtime_files(systemd_rfkill_t)
+ 
+ systemd_log_parse_environment(systemd_rfkill_t)
  
 +mls_file_read_to_clearance(systemd_rfkill_t)
 +mls_file_write_to_clearance(systemd_rfkill_t)
@@ -87,5 +87,5 @@ index 736107fad..8cea6baa1 100644
  #
  # Resolved local policy
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
similarity index 78%
rename from recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
rename to recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
index 75be11d..cb3894c 100644
--- a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
+++ b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
@@ -1,4 +1,4 @@
-From 511f7fdad45a150f7ea3666eb51463573eabab0a Mon Sep 17 00:00:00 2001
+From 2afa5753f2ef8c7cee5ad0511c521d252bedf3e5 Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] policy/modules/system/logging: add the syslogd_t to trusted
@@ -14,18 +14,17 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
 Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 ---
- policy/modules/system/logging.te | 4 ++++
- 1 file changed, 4 insertions(+)
+ policy/modules/system/logging.te | 3 +++
+ 1 file changed, 3 insertions(+)
 
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 5b4b5ec5d..e67c25a9e 100644
+index d3b06db7d..f63965d4d 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -498,6 +498,10 @@ fs_search_auto_mountpoints(syslogd_t)
- fs_search_tmpfs(syslogd_t)
+@@ -505,6 +505,9 @@ fs_getattr_all_fs(syslogd_t)
+ fs_search_auto_mountpoints(syslogd_t)
  
  mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
-+mls_file_read_all_levels(syslogd_t)
 +mls_socket_write_all_levels(syslogd_t) # Need to be able to sendto dgram
 +mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
 +mls_fd_use_all_levels(syslogd_t)
@@ -33,5 +32,5 @@ index 5b4b5ec5d..e67c25a9e 100644
  term_write_console(syslogd_t)
  # Allow syslog to a terminal
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
similarity index 85%
rename from recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
rename to recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
index 5c01ef4..16f0e4e 100644
--- a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
+++ b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
@@ -1,4 +1,4 @@
-From 3f875fae6d9a4538b3e7d33f30dd2a98fc9ea2bd Mon Sep 17 00:00:00 2001
+From f87bb3cb0843af69f9aecaef0a4052e04b15a630 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Tue, 28 May 2019 16:41:37 +0800
 Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 36becaa6e..9c0a98eb7 100644
+index fee846cb5..df7f87f17 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
-@@ -218,6 +218,7 @@ mls_file_write_all_levels(init_t)
+@@ -228,6 +228,7 @@ mls_file_write_all_levels(init_t)
  mls_process_write_all_levels(init_t)
  mls_fd_use_all_levels(init_t)
  mls_process_set_level(init_t)
@@ -29,5 +29,5 @@ index 36becaa6e..9c0a98eb7 100644
  # MLS trusted for lowering/raising the level of files
  mls_file_downgrade(init_t)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
similarity index 88%
rename from recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
rename to recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
index d3ddcd2..fb56eca 100644
--- a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
+++ b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
@@ -1,4 +1,4 @@
-From a59dae035b7d5063e0f25c4cf40b5b180ad69022 Mon Sep 17 00:00:00 2001
+From f3c0f18b647631fd2ffc1e86c9e3f51cbf74d60f Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Wed, 3 Feb 2016 04:16:06 -0500
 Subject: [PATCH] policy/modules/system/init: all init_t to read any level
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 9c0a98eb7..5a19f0e43 100644
+index df7f87f17..671b5aef3 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
-@@ -224,6 +224,9 @@ mls_key_write_all_levels(init_t)
+@@ -234,6 +234,9 @@ mls_key_write_all_levels(init_t)
  mls_file_downgrade(init_t)
  mls_file_upgrade(init_t)
  
@@ -36,5 +36,5 @@ index 9c0a98eb7..5a19f0e43 100644
  # otherwise the call fails and sysvinit tries to load the policy
  # again when using the initramfs
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
similarity index 87%
rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
rename to recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
index 47328be..aa02eb1 100644
--- a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
+++ b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
@@ -1,4 +1,4 @@
-From 96437ba860d352304246fbe3381030da0665f239 Mon Sep 17 00:00:00 2001
+From cb7a4ff6081f19d05b109512275ec9a537f2f6d2 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Thu, 25 Feb 2016 04:25:08 -0500
 Subject: [PATCH] policy/modules/system/logging: allow auditd_t to write socket
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index e67c25a9e..f8d8b73f0 100644
+index f63965d4d..7e41596f4 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -215,6 +215,8 @@ miscfiles_read_localization(auditd_t)
+@@ -223,6 +223,8 @@ miscfiles_read_localization(auditd_t)
  
  mls_file_read_all_levels(auditd_t)
  mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
@@ -35,5 +35,5 @@ index e67c25a9e..f8d8b73f0 100644
  seutil_dontaudit_read_config(auditd_t)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
similarity index 83%
rename from recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
rename to recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
index ad92c7f..16bdf84 100644
--- a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
+++ b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
@@ -1,4 +1,4 @@
-From 102255e89863c5a31d0d6c8df67b258d819b9a68 Mon Sep 17 00:00:00 2001
+From 023e7b92a805103c54aec06bbd9465e4fbf7a6f2 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Thu, 31 Oct 2019 17:35:59 +0800
 Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index 1c53754ee..2031576e0 100644
+index 40cd52825..d08610543 100644
 --- a/policy/modules/kernel/kernel.te
 +++ b/policy/modules/kernel/kernel.te
-@@ -360,6 +360,7 @@ mls_socket_write_all_levels(kernel_t)
+@@ -372,6 +372,7 @@ mls_socket_write_all_levels(kernel_t)
  mls_fd_use_all_levels(kernel_t)
  # https://bugzilla.redhat.com/show_bug.cgi?id=667370
  mls_file_downgrade(kernel_t)
@@ -27,5 +27,5 @@ index 1c53754ee..2031576e0 100644
  ifdef(`distro_redhat',`
  	# Bugzilla 222337
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
similarity index 83%
rename from recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
rename to recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
index 96d0588..b916084 100644
--- a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
+++ b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
@@ -1,4 +1,4 @@
-From 5fa9e03a3b90f97e573a7724cd9d49b53730d083 Mon Sep 17 00:00:00 2001
+From 55fe90eba640e6d52bb269176f45a3a5e2c3ed80 Mon Sep 17 00:00:00 2001
 From: Roy Li <rongqing.li@windriver.com>
 Date: Sat, 22 Feb 2014 13:35:38 +0800
 Subject: [PATCH] policy/modules/system/setrans: allow setrans_t use fd at any
@@ -13,10 +13,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
-index 25aadfc5f..564e2d4d1 100644
+index 12e66aad9..5510f7fac 100644
 --- a/policy/modules/system/setrans.te
 +++ b/policy/modules/system/setrans.te
-@@ -73,6 +73,8 @@ mls_net_receive_all_levels(setrans_t)
+@@ -69,6 +69,8 @@ mls_net_receive_all_levels(setrans_t)
  mls_socket_write_all_levels(setrans_t)
  mls_process_read_all_levels(setrans_t)
  mls_socket_read_all_levels(setrans_t)
@@ -26,5 +26,5 @@ index 25aadfc5f..564e2d4d1 100644
  selinux_compute_access_vector(setrans_t)
  
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
similarity index 88%
rename from recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
rename to recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
index 8bfe607..c4dc87b 100644
--- a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
+++ b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
@@ -1,4 +1,4 @@
-From fe70aaf9a104b4b0c3439d2767eccb0136951f08 Mon Sep 17 00:00:00 2001
+From c9afe0dc30f51f7ad7b93b8878c88df1146272a0 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Mon, 22 Feb 2021 11:28:12 +0800
 Subject: [PATCH] policy/modules/system/systemd: make *_systemd_t MLS trusted
@@ -24,10 +24,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 5c44d8d8a..5f2038f22 100644
+index 325ca548b..b23b9bb0a 100644
 --- a/policy/modules/system/systemd.if
 +++ b/policy/modules/system/systemd.if
-@@ -171,6 +171,9 @@ template(`systemd_role_template',`
+@@ -196,6 +196,9 @@ template(`systemd_role_template',`
  		xdg_read_config_files($1_systemd_t)
  		xdg_read_data_files($1_systemd_t)
  	')
@@ -38,5 +38,5 @@ index 5c44d8d8a..5f2038f22 100644
  
  ######################################
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
similarity index 84%
rename from recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
rename to recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
index 7bdc9d6..ab87039 100644
--- a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
+++ b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
@@ -1,4 +1,4 @@
-From f8a12b28b70689ab520e7ae94d306afe9dcbb556 Mon Sep 17 00:00:00 2001
+From 7a65c9f3636b43f3a29349ea1c045d5281efa5aa Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Sat, 18 Dec 2021 17:31:45 +0800
 Subject: [PATCH] policy/modules/system/logging: make syslogd_runtime_t MLS
@@ -23,7 +23,7 @@ dev="tmpfs" ino=9854 scontext=system_u:system_r:rpcd_t:s0-s15:c0.c1023
 tcontext=system_u:object_r:syslogd_var_run_t:s15:c0.c1023 tclass=dir
 permissive=0
 
-Upstream-Status: Pending
+Upstream-Status: Inappropriate [embedded specific]
 
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 ---
@@ -31,18 +31,18 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index f8d8b73f0..badf56f16 100644
+index 7e41596f4..0c25457d6 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -438,6 +438,8 @@ allow syslogd_t syslogd_runtime_t:file map;
+@@ -447,6 +447,8 @@ allow syslogd_t syslogd_runtime_t:file map;
  manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
  files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
  
 +mls_trusted_object(syslogd_runtime_t)
 +
- kernel_read_crypto_sysctls(syslogd_t)
  kernel_read_system_state(syslogd_t)
  kernel_read_network_state(syslogd_t)
+ kernel_read_kernel_sysctls(syslogd_t)
 -- 
-2.17.1
+2.25.1
 
diff --git a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch b/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
deleted file mode 100644
index e0db7d3..0000000
--- a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 52a4222397f5d3b28ca15a45bb2ace209a4afc3e Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Thu, 31 Mar 2022 13:09:10 -0400
-Subject: [PATCH] systemd: systemd-resolved is linked to libselinux
-
-systemd-resolved as of systemd 250 fails to start with this error:
-
-Failed to initialize SELinux labeling handle: No such file or directory
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/3a22db2410de479e5baa88f3f668a7a4ac198950]
-
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 8cea6baa1..beb301cc6 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -1261,6 +1261,7 @@ fs_getattr_cgroup(systemd_resolved_t)
- 
- init_dgram_send(systemd_resolved_t)
- 
-+seutil_libselinux_linked(systemd_resolved_t)
- seutil_read_file_contexts(systemd_resolved_t)
- 
- systemd_log_parse_environment(systemd_resolved_t)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch b/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
deleted file mode 100644
index 63da7cd..0000000
--- a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 1ba0911e157c64ea15636c5707f38f1bdc9a46c8 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Wed, 27 Apr 2022 01:09:52 -0400
-Subject: [PATCH] sysnetwork, systemd: allow DNS resolution over
- io.systemd.Resolve
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/1a0acc9c0d8c7c49ad4ca2cabd44bc66450f45e0]
-
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/sysnetwork.if |  1 +
- policy/modules/system/systemd.if    | 21 +++++++++++++++++++++
- 2 files changed, 22 insertions(+)
-
-diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
-index 8664a67c8..140d48508 100644
---- a/policy/modules/system/sysnetwork.if
-+++ b/policy/modules/system/sysnetwork.if
-@@ -844,6 +844,7 @@ interface(`sysnet_dns_name_resolve',`
- 	ifdef(`init_systemd',`
- 		optional_policy(`
- 			systemd_dbus_chat_resolved($1)
-+			systemd_stream_connect_resolved($1)
- 		')
- 		# This seems needed when the mymachines NSS module is used
- 		optional_policy(`
-diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 5f2038f22..9143fb4c0 100644
---- a/policy/modules/system/systemd.if
-+++ b/policy/modules/system/systemd.if
-@@ -1835,6 +1835,27 @@ interface(`systemd_tmpfilesd_managed',`
- 	')
- ')
- 
-+#######################################
-+## <summary>
-+##	Connect to systemd resolved over
-+##	/run/systemd/resolve/io.systemd.Resolve .
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`systemd_stream_connect_resolved',`
-+	gen_require(`
-+		type systemd_resolved_t;
-+		type systemd_resolved_runtime_t;
-+	')
-+
-+	files_search_runtime($1)
-+	stream_connect_pattern($1, systemd_resolved_runtime_t, systemd_resolved_runtime_t, systemd_resolved_t)
-+')
-+
- ########################################
- ## <summary>
- ##   Send and receive messages from
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch b/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
deleted file mode 100644
index 88f070d..0000000
--- a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 50670946f04257cc2110facbc61884e2cf0d8327 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Fri, 6 May 2022 21:16:29 -0400
-Subject: [PATCH] term, init: allow systemd to watch and watch reads on
- unallocated ttys
-
-As of systemd 250, systemd needs to be able to add a watch on and watch
-reads on unallocated ttys in order to start getty.
-
-systemd[55548]: getty@tty1.service: Failed to set up standard input: Permission denied
-systemd[55548]: getty@tty1.service: Failed at step STDIN spawning /sbin/agetty: Permission denied
-
-time->Fri May  6 21:17:58 2022
-type=PROCTITLE msg=audit(1651886278.452:1770): proctitle="(agetty)"
-type=PATH msg=audit(1651886278.452:1770): item=0 name="/dev/tty1" inode=18 dev=00:05 mode=020620 ouid=0 ogid=5 rdev=04:01 obj=system_u:object_r:tty_device_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
-type=CWD msg=audit(1651886278.452:1770): cwd="/"
-type=SYSCALL msg=audit(1651886278.452:1770): arch=c000003e syscall=254 success=no exit=-13 a0=3 a1=60ba5c21e020 a2=18 a3=23 items=1 ppid=1 pid=55551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(agetty)" exe="/lib/systemd/systemd" subj=system_u:system_r:init_t:s0 key=(null)
-type=AVC msg=audit(1651886278.452:1770): avc:  denied  { watch watch_reads } for  pid=55551 comm="(agetty)" path="/dev/tty1" dev="devtmpfs" ino=18 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file permissive=0
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/308ab9f69a4623f5dace8da151e70c6316f055a8]
-
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/kernel/terminal.if | 38 +++++++++++++++++++++++++++++++
- policy/modules/system/init.te     |  2 ++
- 2 files changed, 40 insertions(+)
-
-diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
-index e8c0735eb..6e9f654ac 100644
---- a/policy/modules/kernel/terminal.if
-+++ b/policy/modules/kernel/terminal.if
-@@ -1287,6 +1287,44 @@ interface(`term_dontaudit_use_unallocated_ttys',`
- 	dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
- ')
- 
-+########################################
-+## <summary>
-+##	Watch unallocated ttys.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`term_watch_unallocated_ttys',`
-+	gen_require(`
-+		type tty_device_t;
-+	')
-+
-+	dev_list_all_dev_nodes($1)
-+	allow $1 tty_device_t:chr_file watch;
-+')
-+
-+########################################
-+## <summary>
-+##	Watch reads on unallocated ttys.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`term_watch_reads_unallocated_ttys',`
-+	gen_require(`
-+		type tty_device_t;
-+	')
-+
-+	dev_list_all_dev_nodes($1)
-+	allow $1 tty_device_t:chr_file watch_reads;
-+')
-+
- ########################################
- ## <summary>
- ##	Get the attributes of all tty device nodes.
-diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 5a19f0e43..24cef0924 100644
---- a/policy/modules/system/init.te
-+++ b/policy/modules/system/init.te
-@@ -518,6 +518,8 @@ ifdef(`init_systemd',`
- 	term_create_devpts_dirs(init_t)
- 	term_create_ptmx(init_t)
- 	term_create_controlling_term(init_t)
-+	term_watch_unallocated_ttys(init_t)
-+	term_watch_reads_unallocated_ttys(init_t)
- 
- 	# udevd is a "systemd kobject uevent socket activated daemon"
- 	udev_create_kobject_uevent_sockets(init_t)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
deleted file mode 100644
index 1029490..0000000
--- a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 6f8a8ecd8bafd6e8a3515b53db2a2982a02ff254 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Thu, 31 Mar 2022 13:22:37 -0400
-Subject: [PATCH] systemd: add file transition for systemd-networkd runtime
-
-systemd-networkd creates the /run/systemd/network directory which should
-be labeled appropriately.
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/663b62f27cb12c22f056eba9326cf3f7f78d8a9e]
-
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index beb301cc6..654c6a42a 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -917,6 +917,7 @@ auth_use_nsswitch(systemd_networkd_t)
- 
- init_dgram_send(systemd_networkd_t)
- init_read_state(systemd_networkd_t)
-+init_runtime_filetrans(systemd_networkd_t, systemd_networkd_runtime_t, dir)
- 
- logging_send_syslog_msg(systemd_networkd_t)
- 
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch b/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
deleted file mode 100644
index f84eb4a..0000000
--- a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 2e3f371b59bee343c42e4c69495df0f3719b6e24 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Sat, 2 Apr 2022 15:44:01 -0400
-Subject: [PATCH] systemd: add missing file context for /run/systemd/network
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/f2fe1ae15485da7b6269b7d0d7dbed9a834f1876]
-
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.fc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
-index 34db8c034..d21914227 100644
---- a/policy/modules/system/systemd.fc
-+++ b/policy/modules/system/systemd.fc
-@@ -85,6 +85,7 @@ HOME_DIR/\.local/share/systemd(/.*)?		gen_context(system_u:object_r:systemd_data
- 
- /run/systemd/ask-password(/.*)?	gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
- /run/systemd/ask-password-block(/.*)?	gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
-+/run/systemd/network(/.*)?  gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
- /run/systemd/resolve(/.*)?  gen_context(system_u:object_r:systemd_resolved_runtime_t,s0)
- /run/systemd/seats(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
- /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch b/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
deleted file mode 100644
index 0aaf096..0000000
--- a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 143d339b2e6611c56cd0210279757ebee9632731 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Thu, 19 May 2022 11:42:51 -0400
-Subject: [PATCH] systemd: add file contexts for systemd-network-generator
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/73adba0a39b7409bc4bbfa0e962108c2b1e5f2a5]
-
-Thanks-To: Zhao Yi
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.fc | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
-index d21914227..1a35bd65c 100644
---- a/policy/modules/system/systemd.fc
-+++ b/policy/modules/system/systemd.fc
-@@ -35,6 +35,7 @@
- /usr/lib/systemd/systemd-machined	--	gen_context(system_u:object_r:systemd_machined_exec_t,s0)
- /usr/lib/systemd/systemd-modules-load	--	gen_context(system_u:object_r:systemd_modules_load_exec_t,s0)
- /usr/lib/systemd/systemd-networkd	--	gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
-+/usr/lib/systemd/systemd-network-generator	--	gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
- /usr/lib/systemd/systemd-pstore		--	gen_context(system_u:object_r:systemd_pstore_exec_t,s0)
- /usr/lib/systemd/systemd-resolved	--	gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
- /usr/lib/systemd/systemd-rfkill		--	gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
-@@ -60,6 +61,7 @@ HOME_DIR/\.local/share/systemd(/.*)?		gen_context(system_u:object_r:systemd_data
- /usr/lib/systemd/system/systemd-backlight.*	--	gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
- /usr/lib/systemd/system/systemd-binfmt.*	--	gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
- /usr/lib/systemd/system/systemd-networkd.*		gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
-+/usr/lib/systemd/system/systemd-network-generator.*		gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
- /usr/lib/systemd/system/systemd-rfkill.*	--	gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
- /usr/lib/systemd/system/systemd-socket-proxyd\.service	--	gen_context(system_u:object_r:systemd_socket_proxyd_unit_file_t,s0)
- 
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
deleted file mode 100644
index 259863c..0000000
--- a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 6508bc8a3440525384fcfcd8ad55a4cd5c79b912 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge <me@concord.sh>
-Date: Thu, 19 May 2022 11:43:44 -0400
-Subject: [PATCH] systemd, udev: allow udev to read systemd-networkd runtime
-
-udev searches for .link files and applies custom udev rules to devices
-as they come up.
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/998ef975f38c70d57e7220b88ae5e62c88ebb770]
-
-Thanks-To: Zhao Yi
-Signed-off-by: Kenton Groombridge <me@concord.sh>
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/udev.te | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
-index 4c5a690fb..8e243c0f2 100644
---- a/policy/modules/system/udev.te
-+++ b/policy/modules/system/udev.te
-@@ -270,6 +270,8 @@ ifdef(`init_systemd',`
- 	systemd_read_hwdb(udev_t)
- 	systemd_read_logind_sessions_files(udev_t)
- 	systemd_read_logind_runtime_files(udev_t)
-+	# udev searches for .link files and applies custom udev rules
-+	systemd_read_networkd_runtime(udev_t)
- 
- 	optional_policy(`
- 		init_dbus_chat(udev_t)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch b/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
deleted file mode 100644
index 6535a4b..0000000
--- a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 3e3ec39659ae068d20efbb5f13054d90960c3c3f Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Thu, 19 May 2022 16:51:49 +0800
-Subject: [PATCH] fc/fstools: apply policy to findfs alternative
-
-Add file context for findfs alternative which is provided by util-linux.
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/fstools.fc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
-index bef711850..91be0ef3d 100644
---- a/policy/modules/system/fstools.fc
-+++ b/policy/modules/system/fstools.fc
-@@ -77,6 +77,7 @@
- /usr/sbin/fdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/fdisk\.util-linux			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/findfs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/usr/sbin/findfs\.util-linux		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/fsck.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/gdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/hdparm		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index bb0c0dd..a51312f 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -7,10 +7,10 @@ PROVIDES = "virtual/refpolicy"
 RPROVIDES:${PN} = "refpolicy"
 
 # Specific config files for Poky
-SRC_URI += "file://customizable_types  \
-	    file://setrans-mls.conf  \
-	    file://setrans-mcs.conf  \
-	   "
+SRC_URI += "file://customizable_types \
+            file://setrans-mls.conf \
+            file://setrans-mcs.conf \
+           "
 
 # Base patches applied to all Yocto-based platforms.  Your own version of
 # refpolicy should provide a version of these and place them in your own
@@ -49,64 +49,49 @@ SRC_URI += " \
         file://0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch \
         file://0032-policy-modules-system-logging-fix-auditd-startup-fai.patch \
         file://0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch \
-        file://0034-policy-modules-system-modutils-allow-mod_t-to-access.patch \
-        file://0035-policy-modules-system-getty-allow-getty_t-to-search-.patch \
-        file://0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
-        file://0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch \
-        file://0038-policy-modules-system-systemd-enable-support-for-sys.patch \
-        file://0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch \
-        file://0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch \
-        file://0041-policy-modules-system-logging-fix-syslogd-failures-f.patch \
-        file://0042-policy-modules-system-systemd-systemd-user-fixes.patch \
-        file://0043-policy-modules-system-sysnetwork-support-priviledge-.patch \
-        file://0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch \
-        file://0045-policy-modules-system-systemd-allow-systemd_logind_t.patch \
-        file://0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
-        file://0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
-        file://0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
-        file://0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
-        file://0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
-        file://0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
-        file://0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
-        file://0053-policy-modules-system-systemd-systemd-make-systemd_-.patch \
-        file://0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
-        file://0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
-        file://0056-policy-modules-system-init-all-init_t-to-read-any-le.patch \
-        file://0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
-        file://0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
-        file://0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
-        file://0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
-        file://0061-policy-modules-system-logging-make-syslogd_runtime_t.patch \
-        file://0062-systemd-systemd-resolved-is-linked-to-libselinux.patch \
-        file://0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch \
-        file://0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch \
-        file://0065-systemd-add-file-transition-for-systemd-networkd-run.patch \
-        file://0066-systemd-add-missing-file-context-for-run-systemd-net.patch \
-        file://0067-systemd-add-file-contexts-for-systemd-network-genera.patch \
-        file://0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch \
-        file://0069-fc-fstools-apply-policy-to-findfs-alternative.patch \
+        file://0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
+        file://0035-policy-modules-system-systemd-enable-support-for-sys.patch \
+        file://0036-policy-modules-system-systemd-allow-systemd_logind_t.patch \
+        file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
+        file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
+        file://0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
+        file://0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
+        file://0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
+        file://0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
+        file://0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
+        file://0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
+        file://0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
+        file://0046-policy-modules-system-systemd-systemd-make-systemd_-.patch \
+        file://0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
+        file://0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
+        file://0049-policy-modules-system-init-all-init_t-to-read-any-le.patch \
+        file://0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
+        file://0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
+        file://0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
+        file://0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
+        file://0054-policy-modules-system-logging-make-syslogd_runtime_t.patch \
         "
 
 S = "${WORKDIR}/refpolicy"
 
-CONFFILES:${PN} += "${sysconfdir}/selinux/config"
+CONFFILES:${PN} = "${sysconfdir}/selinux/config"
 FILES:${PN} += " \
-	${sysconfdir}/selinux/${POLICY_NAME}/ \
-	${datadir}/selinux/${POLICY_NAME}/*.pp \
-	${localstatedir}/lib/selinux/${POLICY_NAME}/ \
-	"
+    ${sysconfdir}/selinux/${POLICY_NAME}/ \
+    ${datadir}/selinux/${POLICY_NAME}/*.pp \
+    ${localstatedir}/lib/selinux/${POLICY_NAME}/ \
+    "
 FILES:${PN}-dev =+ " \
-        ${datadir}/selinux/${POLICY_NAME}/include/ \
-        ${sysconfdir}/selinux/sepolgen.conf \
-"
+    ${datadir}/selinux/${POLICY_NAME}/include/ \
+    ${sysconfdir}/selinux/sepolgen.conf \
+    "
 
 EXTRANATIVEPATH += "bzip2-native"
 
-DEPENDS += "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
+DEPENDS = "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
 
-RDEPENDS:${PN}-dev =+ " \
-        python3-core \
-"
+RDEPENDS:${PN}-dev = " \
+    python3-core \
+    "
 
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 
@@ -129,83 +114,83 @@ POLICY_MLS_SENS ?= "16"
 POLICY_MLS_CATS ?= "1024"
 POLICY_MCS_CATS ?= "1024"
 
-EXTRA_OEMAKE += "NAME=${POLICY_NAME} \
-	TYPE=${POLICY_TYPE} \
-	DISTRO=${POLICY_DISTRO} \
-	UBAC=${POLICY_UBAC} \
-	UNK_PERMS=${POLICY_UNK_PERMS} \
-	DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
-	SYSTEMD=${POLICY_SYSTEMD} \
-	MONOLITHIC=${POLICY_MONOLITHIC} \
-	CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
-	QUIET=${POLICY_QUIET} \
-	MLS_SENS=${POLICY_MLS_SENS} \
-	MLS_CATS=${POLICY_MLS_CATS} \
-	MCS_CATS=${POLICY_MCS_CATS}"
+EXTRA_OEMAKE = "NAME=${POLICY_NAME} \
+    TYPE=${POLICY_TYPE} \
+    DISTRO=${POLICY_DISTRO} \
+    UBAC=${POLICY_UBAC} \
+    UNK_PERMS=${POLICY_UNK_PERMS} \
+    DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
+    SYSTEMD=${POLICY_SYSTEMD} \
+    MONOLITHIC=${POLICY_MONOLITHIC} \
+    CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
+    QUIET=${POLICY_QUIET} \
+    MLS_SENS=${POLICY_MLS_SENS} \
+    MLS_CATS=${POLICY_MLS_CATS} \
+    MCS_CATS=${POLICY_MCS_CATS}"
 
 EXTRA_OEMAKE += "tc_usrbindir=${STAGING_BINDIR_NATIVE}"
 EXTRA_OEMAKE += "OUTPUT_POLICY=`${STAGING_BINDIR_NATIVE}/checkpolicy -V | cut -d' ' -f1`"
 EXTRA_OEMAKE += "CC='${BUILD_CC}' CFLAGS='${BUILD_CFLAGS}' PYTHON='${PYTHON}'"
 
-python __anonymous () {
+python __anonymous() {
     import re
 
-    # make sure DEFAULT_ENFORCING is something sane
+    # Make sure DEFAULT_ENFORCING is something sane
     if not re.match('^(enforcing|permissive|disabled)$',
                     d.getVar('DEFAULT_ENFORCING'),
                     flags=0):
         d.setVar('DEFAULT_ENFORCING', 'permissive')
 }
 
-disable_policy_modules () {
-	for module in ${PURGE_POLICY_MODULES} ; do
-		sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" ${S}/policy/modules.conf
-	done
+disable_policy_modules() {
+    for module in ${PURGE_POLICY_MODULES} ; do
+        sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" ${S}/policy/modules.conf
+    done
 }
 
 do_compile() {
-	if [ -f "${WORKDIR}/modules.conf" ] ; then
-		cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
-	fi
-	oe_runmake conf
-	disable_policy_modules
-	oe_runmake policy
+    if [ -f "${WORKDIR}/modules.conf" ] ; then
+        cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
+    fi
+    oe_runmake conf
+    disable_policy_modules
+    oe_runmake policy
 }
 
-prepare_policy_store () {
-	oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
-	POL_PRIORITY=100
-	POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
-	POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
-	POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
-
-	# Prepare to create policy store
-	mkdir -p ${POL_STORE}
-	mkdir -p ${POL_ACTIVE_MODS}
-
-	# get hll type from suffix on base policy module
-	HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
-	HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
-
-	for i in ${POL_SRC}/*.${HLL_TYPE}; do
-		MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
-		MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
-		mkdir -p ${MOD_DIR}
-		echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
-		if ! bzip2 -t $i >/dev/null 2>&1; then
-			${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
-			bzip2 -f $i && mv -f $i.bz2 $i
-		else
-			bunzip2 --stdout $i | \
-				${HLL_BIN} | \
-				bzip2 --stdout > ${MOD_DIR}/cil
-		fi
-		cp $i ${MOD_DIR}/hll
-	done
+prepare_policy_store() {
+    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
+    POL_PRIORITY=100
+    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
+    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
+    POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
+
+    # Prepare to create policy store
+    mkdir -p ${POL_STORE}
+    mkdir -p ${POL_ACTIVE_MODS}
+
+    # Get hll type from suffix on base policy module
+    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
+    HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
+
+    for i in ${POL_SRC}/*.${HLL_TYPE}; do
+        MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
+        MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
+        mkdir -p ${MOD_DIR}
+        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
+        if ! bzip2 -t $i >/dev/null 2>&1; then
+            ${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
+            bzip2 -f $i && mv -f $i.bz2 $i
+        else
+            bunzip2 --stdout $i | \
+                ${HLL_BIN} | \
+                bzip2 --stdout > ${MOD_DIR}/cil
+        fi
+        cp $i ${MOD_DIR}/hll
+    done
 }
 
-rebuild_policy () {
-	cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
+rebuild_policy() {
+    cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
 module-store = direct
 [setfiles]
 path = ${STAGING_DIR_NATIVE}${base_sbindir_native}/setfiles
@@ -219,29 +204,29 @@ args = \$@
 policy-version = 33
 EOF
 
-	# Create policy store and build the policy
-	semodule -p ${D} -s ${POLICY_NAME} -n -B
-	rm -f ${D}${sysconfdir}/selinux/semanage.conf
-	# no need to leave final dir created by semanage laying around
-	rm -rf ${D}${localstatedir}/lib/selinux/final
+    # Create policy store and build the policy
+    semodule -p ${D} -s ${POLICY_NAME} -n -B
+    rm -f ${D}${sysconfdir}/selinux/semanage.conf
+    # No need to leave final dir created by semanage laying around
+    rm -rf ${D}${localstatedir}/lib/selinux/final
 }
 
-install_misc_files () {
-	cat ${WORKDIR}/customizable_types >> \
-		${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
+install_misc_files() {
+    cat ${WORKDIR}/customizable_types >> \
+        ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
 
-	# install setrans.conf for mls/mcs policy
-	if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
-		install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
-			${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
-	fi
+    # Install setrans.conf for mls/mcs policy
+    if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
+        install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
+            ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
+    fi
 
-	# install policy headers
-	oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
+    # Install policy headers
+    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
 }
 
-install_config () {
-	echo "\
+install_config() {
+    echo "\
 # This file controls the state of SELinux on the system.
 # SELINUX= can take one of these three values:
 #     enforcing - SELinux security policy is enforced.
@@ -256,22 +241,22 @@ SELINUX=${DEFAULT_ENFORCING}
 #     mcs - Multi Category Security protection.
 SELINUXTYPE=${POLICY_NAME}
 " > ${WORKDIR}/config
-	install -d ${D}/${sysconfdir}/selinux
-	install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
+    install -d ${D}/${sysconfdir}/selinux
+    install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
 }
 
-do_install () {
-	prepare_policy_store
-	rebuild_policy
-	install_misc_files
-	install_config
+do_install() {
+    prepare_policy_store
+    rebuild_policy
+    install_misc_files
+    install_config
 }
 
-do_install:append(){
-	# While building policies on target, Makefile will be searched from SELINUX_DEVEL_PATH
-	echo "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > ${D}${sysconfdir}/selinux/sepolgen.conf
+do_install:append() {
+    # While building policies on target, Makefile will be searched from SELINUX_DEVEL_PATH
+    echo "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > ${D}${sysconfdir}/selinux/sepolgen.conf
 }
 
-sysroot_stage_all:append () {
-	sysroot_stage_dir ${D}${sysconfdir} ${SYSROOT_DESTDIR}${sysconfdir}
+sysroot_stage_all:append() {
+    sysroot_stage_dir ${D}${sysconfdir} ${SYSROOT_DESTDIR}${sysconfdir}
 }
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
index 9e78aed..54e0890 100644
--- a/recipes-security/refpolicy/refpolicy_git.inc
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -1,8 +1,8 @@
-PV = "2.20210908+git${SRCPV}"
+PV = "2.20221101+git${SRCPV}"
 
 SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=master;name=refpolicy;destsuffix=refpolicy"
 
-SRCREV_refpolicy ?= "23a8d103f379361cfe63a9ee064564624e108196"
+SRCREV_refpolicy ?= "03d486e306555da161b653c88e804ce23f3a0ea4"
 
 UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
 
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git
       [not found]   ` <20221107193343.jrkm4tdey75dwev6@siemens.com>
@ 2022-11-08  2:29     ` Yi Zhao
       [not found]     ` <17257B1B9EFC9AB1.28792@lists.yoctoproject.org>
  1 sibling, 0 replies; 6+ messages in thread
From: Yi Zhao @ 2022-11-08  2:29 UTC (permalink / raw)
  To: Joe MacDonald; +Cc: yocto, joe_macdonald, joe


On 11/8/22 03:33, Joe MacDonald wrote:
> Hi Yi,
>
> Can you explain the reason for moving the dbus module to the list of
> always-on modules and out of the systemd conditional for
> refpolicy-minimum_git.bb?


This is introduced by commit e1cdd5a94493db1da7d4a815760453a54c45f11c in 
refpolicy:

commit e1cdd5a94493db1da7d4a815760453a54c45f11c
Author: Kenton Groombridge <me@concord.sh>
Date:   Sun Oct 2 19:07:08 2022 -0400

     dbus, init, mount, rpc: minor fixes for mount.nfs

     mount.nfs will attempt to start the rpc-statd.service unit but will 
fall
     back to executing start-statd directly. Dontaudit attempts to start the
     unit and perform a domain transition to start-statd from mount.

     Signed-off-by: Kenton Groombridge <me@concord.sh>


diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index e75a9eeed..d028723ce 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
[snip]
@@ -141,6 +145,8 @@ selinux_getattr_fs(mount_t)

  userdom_use_all_users_fds(mount_t)

+dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
+
  ifdef(`distro_redhat',`
         optional_policy(`
                 auth_read_pam_console_data(mount_t)
@@ -210,6 +216,10 @@ optional_policy(`
         puppet_rw_tmp(mount_t)
  ')
[snip]


Now dbus module is required by mount module.


//Yi


>
> Thanks,
> -Joe.
>
> [[meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git] On 22.11.02 (Wed 15:30) Yi Zhao wrote:
>
>> * Update to latest git rev.
>> * Drop obsolete and useless patches.
>> * Rebase patches.
>>
>> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ---
>>   .../refpolicy/refpolicy-minimum_git.bb        |  93 +++----
>>   .../refpolicy/refpolicy-targeted_git.bb       |   1 -
>>   ...tile-alias-common-var-volatile-paths.patch |   4 +-
>>   ...inimum-make-sysadmin-module-optional.patch |  12 +-
>>   ...ed-make-unconfined_u-the-default-sel.patch |  12 +-
>>   ...box-set-aliases-for-bin-sbin-and-usr.patch |   4 +-
>>   ...icy-minimum-make-xdg-module-optional.patch |   8 +-
>>   ...ed-add-capability2-bpf-and-perfmon-f.patch |  52 ----
>>   ...y-policy-to-common-yocto-hostname-al.patch |   4 +-
>>   ...efpolicy-minimum-enable-nscd_use_shm.patch |  35 ---
>>   ...sr-bin-bash-context-to-bin-bash.bash.patch |   6 +-
>>   ...abel-resolv.conf-in-var-run-properly.patch |   4 +-
>>   ...-apply-login-context-to-login.shadow.patch |   4 +-
>>   ...-fc-hwclock-add-hwclock-alternatives.patch |   4 +-
>>   ...g-apply-policy-to-dmesg-alternatives.patch |   4 +-
>>   ...ssh-apply-policy-to-ssh-alternatives.patch |   8 +-
>>   ...ply-policy-to-network-commands-alter.patch |   4 +-
>>   ...v-apply-policy-to-udevadm-in-libexec.patch |   4 +-
>>   ...ply-rpm_exec-policy-to-cpio-binaries.patch |   8 +-
>>   ...c-su-apply-policy-to-su-alternatives.patch |   4 +-
>>   ...fc-fstools-fix-real-path-for-fstools.patch |  17 +-
>>   ...fix-update-alternatives-for-sysvinit.patch |  10 +-
>>   ...l-apply-policy-to-brctl-alternatives.patch |   4 +-
>>   ...apply-policy-to-nologin-alternatives.patch |   8 +-
>>   ...apply-policy-to-sulogin-alternatives.patch |   4 +-
>>   ...tp-apply-policy-to-ntpd-alternatives.patch |   4 +-
>>   ...pply-policy-to-kerberos-alternatives.patch |   4 +-
>>   ...ap-apply-policy-to-ldap-alternatives.patch |   4 +-
>>   ...ply-policy-to-postgresql-alternative.patch |   4 +-
>>   ...-apply-policy-to-screen-alternatives.patch |   4 +-
>>   ...ply-policy-to-usermanage-alternative.patch |  26 +-
>>   ...etty-add-file-context-to-start_getty.patch |   4 +-
>>   ...k-apply-policy-to-vlock-alternatives.patch |   4 +-
>>   ...for-init-scripts-and-systemd-service.patch |   8 +-
>>   ...bs_dist-set-aliase-for-root-director.patch |   4 +-
>>   ...ystem-logging-add-rules-for-the-syml.patch |   6 +-
>>   ...ystem-logging-add-rules-for-syslogd-.patch |   8 +-
>>   ...ernel-files-add-rules-for-the-symlin.patch |  26 +-
>>   ...ystem-logging-fix-auditd-startup-fai.patch |  10 +-
>>   ...ernel-terminal-don-t-audit-tty_devic.patch |   6 +-
>>   ...rvices-rpcbind-allow-rpcbind_t-to-c.patch} |  23 +-
>>   ...ystem-modutils-allow-mod_t-to-access.patch |  67 -----
>>   ...ystem-getty-allow-getty_t-to-search-.patch |  32 ---
>>   ...stem-systemd-enable-support-for-sys.patch} |  10 +-
>>   ...stem-systemd-allow-systemd_logind_t.patch} |   8 +-
>>   ...dmin-usermanage-allow-useradd-to-rel.patch |  71 -----
>>   ...oles-sysadm-allow-sysadm-to-use-init.patch |  36 +++
>>   ...es-system-systemd-systemd-user-fixes.patch |  84 ++++++
>>   ...stem-mount-make-mount_t-domain-MLS-.patch} |   8 +-
>>   ...ystem-systemd-fix-systemd-resolved-s.patch |  60 ----
>>   ...les-sysadm-MLS-sysadm-rw-to-clearan.patch} |  10 +-
>>   ...ystem-systemd-allow-systemd_-_t-to-g.patch | 156 -----------
>>   ...rvices-rpc-make-nfsd_t-domain-MLS-t.patch} |  12 +-
>>   ...ystem-logging-fix-syslogd-failures-f.patch |  55 ----
>>   ...min-dmesg-make-dmesg_t-MLS-trusted-.patch} |   6 +-
>>   ...es-system-systemd-systemd-user-fixes.patch | 172 ------------
>>   ...rnel-kernel-make-kernel_t-MLS-trust.patch} |   8 +-
>>   ...ystem-sysnetwork-support-priviledge-.patch | 132 ---------
>>   ...stem-init-make-init_t-MLS-trusted-f.patch} |   8 +-
>>   ...ystem-modutils-allow-kmod_t-to-write.patch |  34 ---
>>   ...stem-systemd-make-systemd-tmpfiles_.patch} |   8 +-
>>   ...stem-systemd-systemd-make-systemd_-.patch} |  26 +-
>>   ...stem-logging-add-the-syslogd_t-to-t.patch} |  15 +-
>>   ...stem-init-make-init_t-MLS-trusted-f.patch} |   8 +-
>>   ...stem-init-all-init_t-to-read-any-le.patch} |   8 +-
>>   ...stem-logging-allow-auditd_t-to-writ.patch} |   8 +-
>>   ...rnel-kernel-make-kernel_t-MLS-trust.patch} |   8 +-
>>   ...stem-setrans-allow-setrans_t-use-fd.patch} |   8 +-
>>   ...stem-systemd-make-_systemd_t-MLS-tr.patch} |   8 +-
>>   ...stem-logging-make-syslogd_runtime_t.patch} |  12 +-
>>   ...emd-resolved-is-linked-to-libselinux.patch |  33 ---
>>   ...md-allow-DNS-resolution-over-io.syst.patch |  63 -----
>>   ...systemd-to-watch-and-watch-reads-on-.patch |  94 -------
>>   ...-transition-for-systemd-networkd-run.patch |  32 ---
>>   ...ing-file-context-for-run-systemd-net.patch |  29 --
>>   ...-contexts-for-systemd-network-genera.patch |  38 ---
>>   ...ow-udev-to-read-systemd-networkd-run.patch |  34 ---
>>   ...s-apply-policy-to-findfs-alternative.patch |  29 --
>>   .../refpolicy/refpolicy_common.inc            | 261 +++++++++---------
>>   recipes-security/refpolicy/refpolicy_git.inc  |   4 +-
>>   80 files changed, 521 insertions(+), 1637 deletions(-)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
>>   rename recipes-security/refpolicy/refpolicy/{0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch => 0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch} (52%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
>>   rename recipes-security/refpolicy/refpolicy/{0038-policy-modules-system-systemd-enable-support-for-sys.patch => 0035-policy-modules-system-systemd-enable-support-for-sys.patch} (91%)
>>   rename recipes-security/refpolicy/refpolicy/{0045-policy-modules-system-systemd-allow-systemd_logind_t.patch => 0036-policy-modules-system-systemd-allow-systemd_logind_t.patch} (88%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
>>   create mode 100644 recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
>>   create mode 100644 recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
>>   rename recipes-security/refpolicy/refpolicy/{0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch => 0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch} (84%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
>>   rename recipes-security/refpolicy/refpolicy/{0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch => 0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch} (83%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
>>   rename recipes-security/refpolicy/refpolicy/{0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch => 0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch} (84%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
>>   rename recipes-security/refpolicy/refpolicy/{0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch => 0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch} (90%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
>>   rename recipes-security/refpolicy/refpolicy/{0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch => 0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch} (94%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
>>   rename recipes-security/refpolicy/refpolicy/{0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch => 0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch} (89%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
>>   rename recipes-security/refpolicy/refpolicy/{0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch => 0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch} (92%)
>>   rename recipes-security/refpolicy/refpolicy/{0053-policy-modules-system-systemd-systemd-make-systemd_-.patch => 0046-policy-modules-system-systemd-systemd-make-systemd_-.patch} (82%)
>>   rename recipes-security/refpolicy/refpolicy/{0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch => 0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch} (78%)
>>   rename recipes-security/refpolicy/refpolicy/{0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch => 0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch} (85%)
>>   rename recipes-security/refpolicy/refpolicy/{0056-policy-modules-system-init-all-init_t-to-read-any-le.patch => 0049-policy-modules-system-init-all-init_t-to-read-any-le.patch} (88%)
>>   rename recipes-security/refpolicy/refpolicy/{0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch => 0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch} (87%)
>>   rename recipes-security/refpolicy/refpolicy/{0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch => 0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch} (83%)
>>   rename recipes-security/refpolicy/refpolicy/{0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch => 0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch} (83%)
>>   rename recipes-security/refpolicy/refpolicy/{0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch => 0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch} (88%)
>>   rename recipes-security/refpolicy/refpolicy/{0061-policy-modules-system-logging-make-syslogd_runtime_t.patch => 0054-policy-modules-system-logging-make-syslogd_runtime_t.patch} (84%)
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
>>   delete mode 100644 recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
>>
>> diff --git a/recipes-security/refpolicy/refpolicy-minimum_git.bb b/recipes-security/refpolicy/refpolicy-minimum_git.bb
>> index 2e95b9f..5940ce2 100644
>> --- a/recipes-security/refpolicy/refpolicy-minimum_git.bb
>> +++ b/recipes-security/refpolicy/refpolicy-minimum_git.bb
>> @@ -14,29 +14,29 @@ domains are unconfined. \
>>   SRC_URI += " \
>>           file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
>>           file://0002-refpolicy-minimum-make-xdg-module-optional.patch \
>> -        file://0003-refpolicy-minimum-enable-nscd_use_shm.patch \
>>           "
>>   
>>   POLICY_NAME = "minimum"
>>   
>>   CORE_POLICY_MODULES = "unconfined \
>> -	selinuxutil \
>> -	storage \
>> -	sysnetwork \
>> -	application \
>> -	libraries \
>> -	miscfiles \
>> -	logging \
>> -	userdomain \
>> -	init \
>> -	mount \
>> -	modutils \
>> -	getty \
>> -	authlogin \
>> -	locallogin \
>> -	"
>> -#systemd dependent policy modules
>> -CORE_POLICY_MODULES += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'clock systemd udev fstools dbus', '', d)}"
>> +    selinuxutil \
>> +    storage \
>> +    sysnetwork \
>> +    application \
>> +    libraries \
>> +    miscfiles \
>> +    logging \
>> +    userdomain \
>> +    init \
>> +    mount \
>> +    modutils \
>> +    getty \
>> +    authlogin \
>> +    locallogin \
>> +    dbus \
>> +    "
>> +# systemd dependent policy modules
>> +CORE_POLICY_MODULES += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'clock systemd udev fstools', '', d)}"
>>   
>>   # nscd caches libc-issued requests to the name service.
>>   # Without nscd.pp, commands want to use these caches will be blocked.
>> @@ -60,39 +60,38 @@ EXTRA_POLICY_MODULES += "modutils consoletype hostname netutils"
>>   #
>>   # PURGE_POLICY_MODULES += "xdg xen"
>>   
>> -
>>   POLICY_MODULES_MIN = "${CORE_POLICY_MODULES} ${EXTRA_POLICY_MODULES}"
>>   
>> -# re-write the same func from refpolicy_common.inc
>> -prepare_policy_store () {
>> -	oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>> -	POL_PRIORITY=100
>> -	POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>> -	POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>> -	POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>> +# Re-write the same func from refpolicy_common.inc
>> +prepare_policy_store() {
>> +    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>> +    POL_PRIORITY=100
>> +    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>> +    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>> +    POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>>   
>> -	# Prepare to create policy store
>> -	mkdir -p ${POL_STORE}
>> -	mkdir -p ${POL_ACTIVE_MODS}
>> +    # Prepare to create policy store
>> +    mkdir -p ${POL_STORE}
>> +    mkdir -p ${POL_ACTIVE_MODS}
>>   
>> -	# get hll type from suffix on base policy module
>> -	HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
>> -	HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>> +    # Get hll type from suffix on base policy module
>> +    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
>> +    HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>>   
>> -	for i in base ${POLICY_MODULES_MIN}; do
>> -		MOD_FILE=${POL_SRC}/${i}.${HLL_TYPE}
>> -		MOD_DIR=${POL_ACTIVE_MODS}/${i}
>> -		mkdir -p ${MOD_DIR}
>> -		echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>> +    for i in base ${POLICY_MODULES_MIN}; do
>> +        MOD_FILE=${POL_SRC}/${i}.${HLL_TYPE}
>> +        MOD_DIR=${POL_ACTIVE_MODS}/${i}
>> +        mkdir -p ${MOD_DIR}
>> +        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>>   
>> -		if ! bzip2 -t ${MOD_FILE} >/dev/null 2>&1; then
>> -			${HLL_BIN} ${MOD_FILE} | bzip2 --stdout > ${MOD_DIR}/cil
>> -			bzip2 -f ${MOD_FILE} && mv -f ${MOD_FILE}.bz2 ${MOD_FILE}
>> -		else
>> -			bunzip2 --stdout ${MOD_FILE} | \
>> -				${HLL_BIN} | \
>> -				bzip2 --stdout > ${MOD_DIR}/cil
>> -		fi
>> -		cp ${MOD_FILE} ${MOD_DIR}/hll
>> -	done
>> +        if ! bzip2 -t ${MOD_FILE} >/dev/null 2>&1; then
>> +            ${HLL_BIN} ${MOD_FILE} | bzip2 --stdout > ${MOD_DIR}/cil
>> +            bzip2 -f ${MOD_FILE} && mv -f ${MOD_FILE}.bz2 ${MOD_FILE}
>> +        else
>> +            bunzip2 --stdout ${MOD_FILE} | \
>> +                ${HLL_BIN} | \
>> +                bzip2 --stdout > ${MOD_DIR}/cil
>> +        fi
>> +        cp ${MOD_FILE} ${MOD_DIR}/hll
>> +    done
>>   }
>> diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb b/recipes-security/refpolicy/refpolicy-targeted_git.bb
>> index 15226db..de81d46 100644
>> --- a/recipes-security/refpolicy/refpolicy-targeted_git.bb
>> +++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb
>> @@ -14,5 +14,4 @@ include refpolicy_${PV}.inc
>>   
>>   SRC_URI += " \
>>           file://0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch \
>> -        file://0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch \
>>           "
>> diff --git a/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch b/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
>> index c3a03f3..1605d90 100644
>> --- a/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
>> @@ -1,4 +1,4 @@
>> -From d39f2ddbfcfd6e224a50bf327a7bd0031d74d0c6 Mon Sep 17 00:00:00 2001
>> +From ee66387c393af77b88c833f5d271efe48036112c Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Thu, 28 Mar 2019 16:14:09 -0400
>>   Subject: [PATCH] fc/subs/volatile: alias common /var/volatile paths
>> @@ -29,5 +29,5 @@ index ba22ce7e7..23d4328f7 100644
>>   +/var/volatile/log /var/log
>>   +/var/volatile/tmp /var/tmp
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
>> index f607cbb..657c5cd 100644
>> --- a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
>> @@ -1,4 +1,4 @@
>> -From 669293ddf351f231b34979a7d708601ccbd11930 Mon Sep 17 00:00:00 2001
>> +From 0e3b79ae0ae468640d7092c9a91a91d258d07645 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Fri, 5 Apr 2019 11:53:28 -0400
>>   Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
>> @@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    2 files changed, 11 insertions(+), 7 deletions(-)
>>   
>>   diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
>> -index 5a19f0e43..1f4a671dc 100644
>> +index 671b5aef3..8ce3d5956 100644
>>   --- a/policy/modules/system/init.te
>>   +++ b/policy/modules/system/init.te
>> -@@ -556,13 +556,15 @@ ifdef(`init_systemd',`
>> +@@ -615,13 +615,15 @@ ifdef(`init_systemd',`
>>    		unconfined_write_keys(init_t)
>>    	')
>>    ',`
>> @@ -48,10 +48,10 @@ index 5a19f0e43..1f4a671dc 100644
>>    	')
>>    ')
>>   diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
>> -index 109980e79..313112371 100644
>> +index 7728de804..a8ff403dd 100644
>>   --- a/policy/modules/system/locallogin.te
>>   +++ b/policy/modules/system/locallogin.te
>> -@@ -265,7 +265,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
>> +@@ -274,7 +274,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
>>    userdom_search_user_home_dirs(sulogin_t)
>>    userdom_use_user_ptys(sulogin_t)
>>    
>> @@ -63,5 +63,5 @@ index 109980e79..313112371 100644
>>    # by default, sulogin does not use pam...
>>    # sulogin_pam might need to be defined otherwise
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
>> index 9939b59..64e658e 100644
>> --- a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
>> @@ -1,14 +1,14 @@
>> -From bf7b74e7c38b546e162eb5a3bd4774e3d84d593d Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> +From 60b4e5ea5668a71b2a0660461daecea66fd11d51 Mon Sep 17 00:00:00 2001
>> +From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Mon, 20 Apr 2020 11:50:03 +0800
>>   Subject: [PATCH] refpolicy-targeted: make unconfined_u the default selinux
>>    user
>>   
>>   For targeted policy type, we define unconfined_u as the default selinux
>> -user for root and normal users, so users could login in and run most
>> +user for root and normal users, so users could login and run most
>>   commands and services on unconfined domains.
>>   
>> -Upstream-Status: Inappropriate [configuration]
>> +Upstream-Status: Inappropriate [embedded specific]
>>   
>>   Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
>> @@ -38,7 +38,7 @@ index ce614b41b..c0903d98b 100644
>>   +root:unconfined_u:s0-mcs_systemhigh
>>   +__default__:unconfined_u:s0
>>   diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
>> -index 4972094cb..b6d769412 100644
>> +index d116a1b9b..32720f68f 100644
>>   --- a/policy/modules/system/unconfined.te
>>   +++ b/policy/modules/system/unconfined.te
>>   @@ -20,6 +20,11 @@ type unconfined_execmem_t alias ada_t;
>> @@ -77,5 +77,5 @@ index ca203758c..e737cd9cc 100644
>>   +	gen_user(root, sysadm, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
>>    ')
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch b/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
>> index d2b8139..ef00602 100644
>> --- a/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
>> @@ -1,4 +1,4 @@
>> -From 974befcafcee1377e122f19a4182f74eea757158 Mon Sep 17 00:00:00 2001
>> +From 8fa6c5b7b99a50b09e9dffd142c066fa41319750 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Thu, 28 Mar 2019 20:48:10 -0400
>>   Subject: [PATCH] fc/subs/busybox: set aliases for bin, sbin and usr
>> @@ -29,5 +29,5 @@ index 23d4328f7..690007f22 100644
>>   +/usr/lib/busybox/sbin /usr/sbin
>>   +/usr/lib/busybox/usr /usr
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
>> index 84764e5..25afa3b 100644
>> --- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
>> @@ -1,4 +1,4 @@
>> -From 1ff0e212ce737bba59d90977a58a15250bc84ea9 Mon Sep 17 00:00:00 2001
>> +From 9a8d6b634d4f714fc63125be5e23228c565d1aaf Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Wed, 29 Sep 2021 11:08:49 +0800
>>   Subject: [PATCH] refpolicy-minimum: make xdg module optional
>> @@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 6 insertions(+), 2 deletions(-)
>>   
>>   diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 8cea6baa1..218834495 100644
>> +index 7b717d3ba..3b07b368d 100644
>>   --- a/policy/modules/system/systemd.te
>>   +++ b/policy/modules/system/systemd.te
>> -@@ -276,10 +276,14 @@ files_type(systemd_update_run_t)
>> +@@ -298,10 +298,14 @@ init_unit_file(systemd_user_manager_unit_t)
>>    
>>    type systemd_conf_home_t;
>>    init_unit_file(systemd_conf_home_t)
>> @@ -36,5 +36,5 @@ index 8cea6baa1..218834495 100644
>>    type systemd_user_runtime_notify_t;
>>    userdom_user_runtime_content(systemd_user_runtime_notify_t)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
>> deleted file mode 100644
>> index e4c081d..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
>> +++ /dev/null
>> @@ -1,52 +0,0 @@
>> -From b46903aaf7e52f9c4c51a2fa7fe7a85190da98b1 Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Wed, 29 Sep 2021 16:43:54 +0800
>> -Subject: [PATCH] refpolicy-targeted: add capability2 bpf and perfmon for
>> - unconfined_t
>> -
>> -Fixes:
>> -avc: denied { bpf } for pid=433 comm="systemd" capability=39
>> -scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> -tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> -tclass=capability2 permissive=0
>> -
>> -avc: denied { perfmon } for pid=433 comm="systemd" capability=38
>> -scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> -tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> -tclass=capability2 permissive=0
>> -
>> -type=USER_AVC msg=audit(1632901631.693:86): pid=433 uid=0 auid=0 ses=3
>> -subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='avc:
>> -denied { reload } for auid=n/a uid=0 gid=0 cmdline=""
>> -scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> -tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> -tclass=system permissive=0  exe="/lib/systemd/systemd" sauid=0
>> -hostname=? addr=? terminal=?'UID="root" AUID="root" AUID="root"
>> -UID="root" GID="root" SAUID="root"
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/unconfined.if | 5 +++++
>> - 1 file changed, 5 insertions(+)
>> -
>> -diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
>> -index a139cfe78..807e959c3 100644
>> ---- a/policy/modules/system/unconfined.if
>> -+++ b/policy/modules/system/unconfined.if
>> -@@ -66,6 +66,11 @@ interface(`unconfined_domain_noaudit',`
>> - 	files_start_etc_service($1)
>> - 	files_stop_etc_service($1)
>> -
>> -+	ifdef(`init_systemd',`
>> -+		allow $1 self:capability2 { bpf perfmon };
>> -+		allow $1 self:system reload;
>> -+	')
>> -+
>> - 	tunable_policy(`allow_execheap',`
>> - 		# Allow making the stack executable via mprotect.
>> - 		allow $1 self:process execheap;
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch b/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
>> index 6596e76..94ac31b 100644
>> --- a/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
>> @@ -1,4 +1,4 @@
>> -From 9c6f3c5acc01607a67277f69faa67e34dc98232b Mon Sep 17 00:00:00 2001
>> +From 5a0bbd1920205f488b6a4565f7217b9d0825067b Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] fc/hostname: apply policy to common yocto hostname
>> @@ -22,5 +22,5 @@ index 83ddeb573..cf523bc4c 100644
>>   +/usr/bin/hostname\.net-tools	--	gen_context(system_u:object_r:hostname_exec_t,s0)
>>   +/usr/bin/hostname\.coreutils	--	gen_context(system_u:object_r:hostname_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch b/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
>> deleted file mode 100644
>> index edf9caa..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
>> +++ /dev/null
>> @@ -1,35 +0,0 @@
>> -From 5f992b59a74cc6cde8fd20162a11065dc30fd7ab Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Fri, 26 Feb 2021 09:13:23 +0800
>> -Subject: [PATCH] refpolicy-minimum: enable nscd_use_shm
>> -
>> -Fixes:
>> -avc: denied { listen } for pid=199 comm="systemd-resolve"
>> -path="/run/systemd/resolve/io.systemd.Resolve"
>> -scontext=system_u:system_r:systemd_resolved_t:s0
>> -tcontext=system_u:system_r:systemd_resolved_t:s0
>> -tclass=unix_stream_socket permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/services/nscd.te | 2 +-
>> - 1 file changed, 1 insertion(+), 1 deletion(-)
>> -
>> -diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te
>> -index ada67edb1..9801fc228 100644
>> ---- a/policy/modules/services/nscd.te
>> -+++ b/policy/modules/services/nscd.te
>> -@@ -15,7 +15,7 @@ gen_require(`
>> - ##	can use nscd shared memory.
>> - ##	</p>
>> - ## </desc>
>> --gen_tunable(nscd_use_shm, false)
>> -+gen_tunable(nscd_use_shm, true)
>> -
>> - attribute_role nscd_roles;
>> -
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch b/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
>> index cf333f1..eff0255 100644
>> --- a/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
>> @@ -1,4 +1,4 @@
>> -From bbc8b58fe5fe709dfadbffc86e17ebd2d76a257c Mon Sep 17 00:00:00 2001
>> +From c9219d2f7be1e641b3866b770a9b570c12333b93 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Thu, 28 Mar 2019 21:37:32 -0400
>>   Subject: [PATCH] fc/bash: apply /usr/bin/bash context to /bin/bash.bash
>> @@ -15,7 +15,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
>> -index 4c18154ce..9187e50af 100644
>> +index 0c05c693d..b70940928 100644
>>   --- a/policy/modules/kernel/corecommands.fc
>>   +++ b/policy/modules/kernel/corecommands.fc
>>   @@ -142,6 +142,7 @@ ifdef(`distro_gentoo',`
>> @@ -27,5 +27,5 @@ index 4c18154ce..9187e50af 100644
>>    /usr/bin/fish			--	gen_context(system_u:object_r:shell_exec_t,s0)
>>    /usr/bin/git-shell		--	gen_context(system_u:object_r:shell_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch b/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
>> index 078c246..06c8087 100644
>> --- a/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
>> @@ -1,4 +1,4 @@
>> -From 3cccdec2aaa273ca09100ca957f4968a25f4f3a3 Mon Sep 17 00:00:00 2001
>> +From 51631a7eaaea1fab4b36a2488497cf725317ce6e Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Thu, 4 Apr 2019 10:45:03 -0400
>>   Subject: [PATCH] fc/resolv.conf: label resolv.conf in var/run/ properly
>> @@ -25,5 +25,5 @@ index 14505efe9..c9ec4e5ab 100644
>>    ifdef(`distro_gentoo',`
>>    /var/lib/dhcpc(/.*)?		gen_context(system_u:object_r:dhcpc_state_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch b/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
>> index b4747f7..70c5566 100644
>> --- a/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
>> @@ -1,4 +1,4 @@
>> -From 9a1e1c7b65cb3f5ab97ce05463ca02a3eaa57d86 Mon Sep 17 00:00:00 2001
>> +From 1c61b10d21a22d4110bc880b23477295f6cd9efb Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Thu, 28 Mar 2019 21:43:53 -0400
>>   Subject: [PATCH] fc/login: apply login context to login.shadow
>> @@ -24,5 +24,5 @@ index 50efcff7b..5cb48882c 100644
>>    /usr/bin/pam_timestamp_check	--	gen_context(system_u:object_r:pam_exec_t,s0)
>>    /usr/bin/tcb_convert		--	gen_context(system_u:object_r:updpwd_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch b/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
>> index 33f6a10..2f9f703 100644
>> --- a/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 73716015ab28a9474912902e9467f2d2a864ecd0 Mon Sep 17 00:00:00 2001
>> +From e4d7d9fb1cb157bf205874e1a81d5719017866a1 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Thu, 28 Mar 2019 21:59:18 -0400
>>   Subject: [PATCH] fc/hwclock: add hwclock alternatives
>> @@ -21,5 +21,5 @@ index 301965892..139485835 100644
>>    /usr/sbin/hwclock	--	gen_context(system_u:object_r:hwclock_exec_t,s0)
>>   +/usr/sbin/hwclock\.util-linux	--	gen_context(system_u:object_r:hwclock_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch b/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
>> index 5f2ffdf..6e576a8 100644
>> --- a/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 504e8429500ab0984adfd52bb09a3e993b87f2f1 Mon Sep 17 00:00:00 2001
>> +From ac6536f04674ccc051744e6eb3644e68fe38da33 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Fri, 29 Mar 2019 08:26:55 -0400
>>   Subject: [PATCH] fc/dmesg: apply policy to dmesg alternatives
>> @@ -19,5 +19,5 @@ index e52fdfcf8..526b92ed2 100644
>>    /usr/bin/dmesg		--		gen_context(system_u:object_r:dmesg_exec_t,s0)
>>   +/usr/bin/dmesg\.util-linux		--		gen_context(system_u:object_r:dmesg_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch b/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
>> index 585850b..611c0d3 100644
>> --- a/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 8ad451ceff2ba4ea26290a7ba9918406a90bb10f Mon Sep 17 00:00:00 2001
>> +From a56887ca448b60ad6715348b2cfe533e8109a040 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Fri, 29 Mar 2019 09:20:58 -0400
>>   Subject: [PATCH] fc/ssh: apply policy to ssh alternatives
>> @@ -12,11 +12,11 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
>> -index 60060c35c..518043a9b 100644
>> +index 5c512e972..0448c1877 100644
>>   --- a/policy/modules/services/ssh.fc
>>   +++ b/policy/modules/services/ssh.fc
>>   @@ -4,6 +4,7 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
>> - /etc/ssh/ssh_host.*_key		--	gen_context(system_u:object_r:sshd_key_t,s0)
>> + /etc/ssh/ssh_host.*_key(\.pub)?	--	gen_context(system_u:object_r:sshd_key_t,s0)
>>    
>>    /usr/bin/ssh			--	gen_context(system_u:object_r:ssh_exec_t,s0)
>>   +/usr/bin/ssh\.openssh	--	gen_context(system_u:object_r:ssh_exec_t,s0)
>> @@ -24,5 +24,5 @@ index 60060c35c..518043a9b 100644
>>    /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
>>    /usr/bin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch b/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
>> index 0621923..7af147d 100644
>> --- a/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
>> @@ -1,4 +1,4 @@
>> -From c85fd7d9c45770b31de44bb35521e2251882df10 Mon Sep 17 00:00:00 2001
>> +From 47a5e9a0bd4960534998798ab1a5ab62e77b2b61 Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Tue, 9 Jun 2015 21:22:52 +0530
>>   Subject: [PATCH] fc/sysnetwork: apply policy to network commands alternatives
>> @@ -43,5 +43,5 @@ index c9ec4e5ab..4ca151524 100644
>>    /usr/sbin/tc			--	gen_context(system_u:object_r:ifconfig_exec_t,s0)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch b/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
>> index cc3e529..434fc1d 100644
>> --- a/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
>> @@ -1,4 +1,4 @@
>> -From aa2635a54f9c36205ebc469f799a56ece01ac610 Mon Sep 17 00:00:00 2001
>> +From bbc6eb20e9509a61236051df7a5fa552a8f2654d Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Fri, 29 Mar 2019 09:36:08 -0400
>>   Subject: [PATCH] fc/udev: apply policy to udevadm in libexec
>> @@ -25,5 +25,5 @@ index 7898ff01c..bc717e60c 100644
>>    /usr/sbin/start_udev --	gen_context(system_u:object_r:udev_exec_t,s0)
>>    ')
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch b/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
>> index b039f53..bf562d6 100644
>> --- a/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
>> @@ -1,4 +1,4 @@
>> -From faf757c732c9a022499b584cea64ce1fcc78e118 Mon Sep 17 00:00:00 2001
>> +From 00533fded8e2264f8bdc68c8ed79644a10e4e2ad Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Fri, 29 Mar 2019 09:54:07 -0400
>>   Subject: [PATCH] fc/rpm: apply rpm_exec policy to cpio binaries
>> @@ -12,10 +12,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/admin/rpm.fc b/policy/modules/admin/rpm.fc
>> -index aaf530c2b..618b18cec 100644
>> +index 3f842f942..12973ac8b 100644
>>   --- a/policy/modules/admin/rpm.fc
>>   +++ b/policy/modules/admin/rpm.fc
>> -@@ -66,4 +66,6 @@ ifdef(`distro_redhat',`
>> +@@ -71,4 +71,6 @@ ifdef(`distro_redhat',`
>>    
>>    ifdef(`enable_mls',`
>>    /usr/sbin/cpio	--	gen_context(system_u:object_r:rpm_exec_t,s0)
>> @@ -23,5 +23,5 @@ index aaf530c2b..618b18cec 100644
>>   +/usr/bin/cpio\.cpio	--	gen_context(system_u:object_r:rpm_exec_t,s0)
>>    ')
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch b/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
>> index 14c7d5b..32d38f1 100644
>> --- a/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 52853ae9ee13038c5ffae8616858c442d412a2b8 Mon Sep 17 00:00:00 2001
>> +From 4b202554e646a60000c1acad7bbdfae1078bdc10 Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Thu, 13 Feb 2014 00:33:07 -0500
>>   Subject: [PATCH] fc/su: apply policy to su alternatives
>> @@ -23,5 +23,5 @@ index 3375c9692..a9868cd58 100644
>>   +/usr/bin/su\.shadow		--	gen_context(system_u:object_r:su_exec_t,s0)
>>   +/usr/bin/su\.util-linux		--	gen_context(system_u:object_r:su_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch b/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
>> index c2e0ca8..de0aad7 100644
>> --- a/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
>> @@ -1,4 +1,4 @@
>> -From 4f3a637c0385204c0b87806d158e106fb9f88972 Mon Sep 17 00:00:00 2001
>> +From f64a5d6a2f2e72ae6c5122220eb759117b6384c8 Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Mon, 27 Jan 2014 03:54:01 -0500
>>   Subject: [PATCH] fc/fstools: fix real path for fstools
>> @@ -10,14 +10,14 @@ Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
>>   Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>   ---
>> - policy/modules/system/fstools.fc | 10 ++++++++++
>> - 1 file changed, 10 insertions(+)
>> + policy/modules/system/fstools.fc | 11 +++++++++++
>> + 1 file changed, 11 insertions(+)
>>   
>>   diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
>> -index d871294e8..bef711850 100644
>> +index 8fbd5ce44..2842afbcc 100644
>>   --- a/policy/modules/system/fstools.fc
>>   +++ b/policy/modules/system/fstools.fc
>> -@@ -59,7 +59,9 @@
>> +@@ -58,7 +58,9 @@
>>    /usr/sbin/addpart		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/badblocks		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/blkid			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> @@ -27,12 +27,13 @@ index d871294e8..bef711850 100644
>>    /usr/sbin/cfdisk		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/clubufflush		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/delpart		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> -@@ -73,10 +75,12 @@
>> +@@ -72,10 +74,13 @@
>>    /usr/sbin/efibootmgr		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/fatsort		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/fdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>   +/usr/sbin/fdisk\.util-linux			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/findfs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> ++/usr/sbin/findfs\.util-linux		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/fsck.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/gdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/hdparm		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> @@ -40,7 +41,7 @@ index d871294e8..bef711850 100644
>>    /usr/sbin/install-mbr		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/jfs_.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/losetup.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> -@@ -84,24 +88,30 @@
>> +@@ -83,24 +88,30 @@
>>    /usr/sbin/make_reiser4		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/mkdosfs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/mke2fs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> @@ -72,5 +73,5 @@ index d871294e8..bef711850 100644
>>    /usr/sbin/zhack			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>    /usr/sbin/zinject		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch b/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
>> index b3ab0cc..5e9c197 100644
>> --- a/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
>> @@ -1,4 +1,4 @@
>> -From e1439aa43af6ef15b35eac3cdbf0cea561768362 Mon Sep 17 00:00:00 2001
>> +From 6d2a96abd1e292d0c34ff77501e618cfc193655f Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] fc/init: fix update-alternatives for sysvinit
>> @@ -26,7 +26,7 @@ index bf51c103f..91ed72be0 100644
>>    
>>    /run/shutdown\.pid	--	gen_context(system_u:object_r:shutdown_runtime_t,s0)
>>   diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
>> -index 9187e50af..0ecabe34e 100644
>> +index b70940928..e6077fd5b 100644
>>   --- a/policy/modules/kernel/corecommands.fc
>>   +++ b/policy/modules/kernel/corecommands.fc
>>   @@ -151,6 +151,8 @@ ifdef(`distro_gentoo',`
>> @@ -39,10 +39,10 @@ index 9187e50af..0ecabe34e 100644
>>    /usr/bin/sash			--	gen_context(system_u:object_r:shell_exec_t,s0)
>>    /usr/bin/sesh			--	gen_context(system_u:object_r:shell_exec_t,s0)
>>   diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
>> -index 63cf195e6..5268bddb2 100644
>> +index 1a99e5824..7f0b7c699 100644
>>   --- a/policy/modules/system/init.fc
>>   +++ b/policy/modules/system/init.fc
>> -@@ -40,6 +40,7 @@ ifdef(`distro_gentoo',`
>> +@@ -41,6 +41,7 @@ ifdef(`distro_gentoo',`
>>    /usr/libexec/dcc/stop-.* --	gen_context(system_u:object_r:initrc_exec_t,s0)
>>    
>>    /usr/sbin/init(ng)?	--	gen_context(system_u:object_r:init_exec_t,s0)
>> @@ -51,5 +51,5 @@ index 63cf195e6..5268bddb2 100644
>>    /usr/sbin/upstart	--	gen_context(system_u:object_r:init_exec_t,s0)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch b/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
>> index b9812b7..b0ba609 100644
>> --- a/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 274066b3397b53d63134aee94a0148d9c7d1886d Mon Sep 17 00:00:00 2001
>> +From 2e9c22ee83b7d4fea7b177ca8111c06e69338db9 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 10:19:54 +0800
>>   Subject: [PATCH] fc/brctl: apply policy to brctl alternatives
>> @@ -20,5 +20,5 @@ index ed472f095..2a852b0fd 100644
>>    /usr/sbin/brctl	--	gen_context(system_u:object_r:brctl_exec_t,s0)
>>   +/usr/sbin/brctl\.bridge-utils	--	gen_context(system_u:object_r:brctl_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch b/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
>> index e0ddc5e..58ac463 100644
>> --- a/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From ab0267f77e38bcda797cfe00ba6fa49ba89e334a Mon Sep 17 00:00:00 2001
>> +From c43f2d7ddf1d0c2185796e0297dd9f85b9663aaf Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 10:21:51 +0800
>>   Subject: [PATCH] fc/corecommands: apply policy to nologin alternatives
>> @@ -11,10 +11,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
>> -index 0ecabe34e..e27e701ef 100644
>> +index e6077fd5b..0df59e837 100644
>>   --- a/policy/modules/kernel/corecommands.fc
>>   +++ b/policy/modules/kernel/corecommands.fc
>> -@@ -304,6 +304,8 @@ ifdef(`distro_debian',`
>> +@@ -306,6 +306,8 @@ ifdef(`distro_debian',`
>>    /usr/sbin/insmod_ksymoops_clean	--	gen_context(system_u:object_r:bin_t,s0)
>>    /usr/sbin/mkfs\.cramfs		--	gen_context(system_u:object_r:bin_t,s0)
>>    /usr/sbin/nologin		--	gen_context(system_u:object_r:shell_exec_t,s0)
>> @@ -24,5 +24,5 @@ index 0ecabe34e..e27e701ef 100644
>>    /usr/sbin/sesh			--	gen_context(system_u:object_r:shell_exec_t,s0)
>>    /usr/sbin/smrsh			--	gen_context(system_u:object_r:shell_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch b/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
>> index 2fe3740..3c43254 100644
>> --- a/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From cfb86acce9fe9da9b88c853c0b22d48d99602fbb Mon Sep 17 00:00:00 2001
>> +From 11c95928e325aea7e4c41a9cdf969f9bdd306611 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 10:43:28 +0800
>>   Subject: [PATCH] fc/locallogin: apply policy to sulogin alternatives
>> @@ -21,5 +21,5 @@ index fc8d58507..59e6e9601 100644
>>   +/usr/sbin/sulogin\.util-linux	--	gen_context(system_u:object_r:sulogin_exec_t,s0)
>>    /usr/sbin/sushell	--	gen_context(system_u:object_r:sulogin_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch b/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
>> index 4b046ce..cbae4c5 100644
>> --- a/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From e159e70b533b500390337ec666d678c7424afb90 Mon Sep 17 00:00:00 2001
>> +From 5841a5bd25e6017b6ccff4f56628ad6e950eadad Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 10:45:23 +0800
>>   Subject: [PATCH] fc/ntp: apply policy to ntpd alternatives
>> @@ -23,5 +23,5 @@ index cd69ea5d5..49ffe6f68 100644
>>    /usr/sbin/sntp				--	gen_context(system_u:object_r:ntpdate_exec_t,s0)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch b/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
>> index 9d2e6fa..76e7fe9 100644
>> --- a/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 95797c20fb68558b9f37ded3f1cc9a4ef09717f9 Mon Sep 17 00:00:00 2001
>> +From 8126ec521e5a0f72da098f5d90b5b5b392006b7c Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 10:55:05 +0800
>>   Subject: [PATCH] fc/kerberos: apply policy to kerberos alternatives
>> @@ -46,5 +46,5 @@ index df21fcc78..ce0166edd 100644
>>    /var/log/kadmin\.log.*	--	gen_context(system_u:object_r:kadmind_log_t,s0)
>>    /var/log/kadmind\.log.*	--	gen_context(system_u:object_r:kadmind_log_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch b/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
>> index e0b7b9e..a46c9c9 100644
>> --- a/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 6b43af067ec45bce1b7059fc549e246f53311d3a Mon Sep 17 00:00:00 2001
>> +From c71ea08245069001b56aadd7bb0af28e019f45e4 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 11:06:13 +0800
>>   Subject: [PATCH] fc/ldap: apply policy to ldap alternatives
>> @@ -36,5 +36,5 @@ index 0a1d08d0f..65b202962 100644
>>    /run/openldap(/.*)?	gen_context(system_u:object_r:slapd_runtime_t,s0)
>>    /run/slapd.*	-s	gen_context(system_u:object_r:slapd_runtime_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch b/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
>> index 4a1a2dc..0a0464f 100644
>> --- a/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
>> @@ -1,4 +1,4 @@
>> -From 5f664c3a38853129fa1703032822c203dbeaf0a6 Mon Sep 17 00:00:00 2001
>> +From 72726c1bc51628e6eb56e758f1e334f9b9a0f17e Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 11:13:16 +0800
>>   Subject: [PATCH] fc/postgresql: apply policy to postgresql alternatives
>> @@ -33,5 +33,5 @@ index f31a52cf8..f9bf46870 100644
>>    /usr/share/jonas/pgsql(/.*)?		gen_context(system_u:object_r:postgresql_db_t,s0)
>>    ')
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch b/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
>> index 9ae9435..e95cb3c 100644
>> --- a/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 2d1634127f8f5c9ec98f866711b8d15b7df815d1 Mon Sep 17 00:00:00 2001
>> +From 003a22f73563ef7b8b4ab6a6a0cb4a920a43570f Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 11:15:33 +0800
>>   Subject: [PATCH] fc/screen: apply policy to screen alternatives
>> @@ -21,5 +21,5 @@ index e51e01d97..238dc263e 100644
>>   +/usr/bin/screen-.*		--	gen_context(system_u:object_r:screen_exec_t,s0)
>>    /usr/bin/tmux		--	gen_context(system_u:object_r:screen_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch b/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
>> index 2dbdcf4..a92b809 100644
>> --- a/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
>> @@ -1,4 +1,4 @@
>> -From 2323a6ab69c4a74ab127c16e38f14616a289b3d1 Mon Sep 17 00:00:00 2001
>> +From fdf7c2d27b6ecf08c88bb98e52a7d8284ac828af Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 11:25:34 +0800
>>   Subject: [PATCH] fc/usermanage: apply policy to usermanage alternatives
>> @@ -7,26 +7,28 @@ Upstream-Status: Inappropriate [embedded specific]
>>   
>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>   ---
>> - policy/modules/admin/usermanage.fc | 6 ++++++
>> - 1 file changed, 6 insertions(+)
>> + policy/modules/admin/usermanage.fc | 8 ++++++++
>> + 1 file changed, 8 insertions(+)
>>   
>>   diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
>> -index 620eefc6f..bf1ff09ab 100644
>> +index 7209a8dd0..c9dc1f000 100644
>>   --- a/policy/modules/admin/usermanage.fc
>>   +++ b/policy/modules/admin/usermanage.fc
>> -@@ -4,7 +4,11 @@ ifdef(`distro_debian',`
>> +@@ -4,8 +4,13 @@ ifdef(`distro_debian',`
>>    
>>    /usr/bin/chage		--	gen_context(system_u:object_r:passwd_exec_t,s0)
>>    /usr/bin/chfn		--	gen_context(system_u:object_r:chfn_exec_t,s0)
>>   +/usr/bin/chfn\.shadow		--	gen_context(system_u:object_r:chfn_exec_t,s0)
>>   +/usr/bin/chfn\.util-linux		--	gen_context(system_u:object_r:chfn_exec_t,s0)
>> + /usr/bin/chpasswd	--	gen_context(system_u:object_r:passwd_exec_t,s0)
>> ++/usr/bin/chpasswd\.shadow	--	gen_context(system_u:object_r:passwd_exec_t,s0)
>>    /usr/bin/chsh		--	gen_context(system_u:object_r:chfn_exec_t,s0)
>>   +/usr/bin/chsh\.shadow		--	gen_context(system_u:object_r:chfn_exec_t,s0)
>>   +/usr/bin/chsh\.util-linux		--	gen_context(system_u:object_r:chfn_exec_t,s0)
>>    /usr/bin/crack_[a-z]*	--	gen_context(system_u:object_r:crack_exec_t,s0)
>>    /usr/bin/cracklib-[a-z]* --	gen_context(system_u:object_r:crack_exec_t,s0)
>>    /usr/bin/gpasswd	--	gen_context(system_u:object_r:groupadd_exec_t,s0)
>> -@@ -14,6 +18,7 @@ ifdef(`distro_debian',`
>> +@@ -15,6 +20,7 @@ ifdef(`distro_debian',`
>>    /usr/bin/grpconv	--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>    /usr/bin/grpunconv	--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>    /usr/bin/passwd		--	gen_context(system_u:object_r:passwd_exec_t,s0)
>> @@ -34,7 +36,15 @@ index 620eefc6f..bf1ff09ab 100644
>>    /usr/bin/pwconv		--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>    /usr/bin/pwunconv	--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>    /usr/bin/useradd	--	gen_context(system_u:object_r:useradd_exec_t,s0)
>> -@@ -39,6 +44,7 @@ ifdef(`distro_debian',`
>> +@@ -26,6 +32,7 @@ ifdef(`distro_debian',`
>> + /usr/lib/cracklib_dict.* --	gen_context(system_u:object_r:crack_db_t,s0)
>> +
>> + /usr/sbin/chpasswd	--	gen_context(system_u:object_r:passwd_exec_t,s0)
>> ++/usr/sbin/chpasswd\.shadow	--	gen_context(system_u:object_r:passwd_exec_t,s0)
>> + /usr/sbin/crack_[a-z]*	--	gen_context(system_u:object_r:crack_exec_t,s0)
>> + /usr/sbin/cracklib-[a-z]* --	gen_context(system_u:object_r:crack_exec_t,s0)
>> + /usr/sbin/gpasswd	--	gen_context(system_u:object_r:groupadd_exec_t,s0)
>> +@@ -41,6 +48,7 @@ ifdef(`distro_debian',`
>>    /usr/sbin/usermod	--	gen_context(system_u:object_r:useradd_exec_t,s0)
>>    /usr/sbin/vigr		--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>    /usr/sbin/vipw		--	gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>> @@ -43,5 +53,5 @@ index 620eefc6f..bf1ff09ab 100644
>>    /usr/share/cracklib(/.*)?	gen_context(system_u:object_r:crack_db_t,s0)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch b/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
>> index c0d9cf4..f6fa8a0 100644
>> --- a/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
>> @@ -1,4 +1,4 @@
>> -From dbd399143d6fbda828cfc9f2546bc730e0da584c Mon Sep 17 00:00:00 2001
>> +From 863ece4fd9815997486c04ce89180707435669e4 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Fri, 15 Nov 2019 16:07:30 +0800
>>   Subject: [PATCH] fc/getty: add file context to start_getty
>> @@ -23,5 +23,5 @@ index 116ea6421..53ff6137b 100644
>>    /usr/sbin/.*getty	--	gen_context(system_u:object_r:getty_exec_t,s0)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch b/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
>> index 71521e8..7f63b14 100644
>> --- a/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
>> @@ -1,4 +1,4 @@
>> -From 0280f05e2c9665f094d7098cd03e11d75908bcdb Mon Sep 17 00:00:00 2001
>> +From 5bb33b7d9d7915399cca7d8c6fbdd9c0e27c1cd8 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Wed, 18 Dec 2019 15:04:41 +0800
>>   Subject: [PATCH] fc/vlock: apply policy to vlock alternatives
>> @@ -21,5 +21,5 @@ index f668cde9c..c4bc50984 100644
>>    
>>    /usr/sbin/vlock-main	--	gen_context(system_u:object_r:vlock_exec_t,s0)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch b/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
>> index ca9b644..cfb2fd5 100644
>> --- a/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
>> @@ -1,4 +1,4 @@
>> -From 7f8b07b7af0c3cd8bbec49082b42011ac433df45 Mon Sep 17 00:00:00 2001
>> +From 574df1810c8f32bbf24b223f72f6622b0df7e82c Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Tue, 30 Jun 2020 10:45:57 +0800
>>   Subject: [PATCH] fc: add fcontext for init scripts and systemd service files
>> @@ -34,7 +34,7 @@ index 382c067f9..0ecc5acc4 100644
>>    /usr/bin/rngd	--	gen_context(system_u:object_r:rngd_exec_t,s0)
>>    
>>   diff --git a/policy/modules/services/rpc.fc b/policy/modules/services/rpc.fc
>> -index 88d2acaf0..d9c0a4aa7 100644
>> +index 75c2f0617..fa881ba2e 100644
>>   --- a/policy/modules/services/rpc.fc
>>   +++ b/policy/modules/services/rpc.fc
>>   @@ -1,7 +1,9 @@
>> @@ -46,7 +46,7 @@ index 88d2acaf0..d9c0a4aa7 100644
>>   +/etc/rc\.d/init\.d/nfscommon	--	gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
>>    /etc/rc\.d/init\.d/rpcidmapd	--	gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
>>    
>> - /usr/bin/rpc\..*	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
>> + /usr/bin/nfsdcld	--	gen_context(system_u:object_r:rpcd_exec_t,s0)
>>   diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
>>   index 5681acb51..4ff5f990a 100644
>>   --- a/policy/modules/system/logging.fc
>> @@ -60,5 +60,5 @@ index 5681acb51..4ff5f990a 100644
>>    /usr/lib/systemd/systemd-kmsg-syslogd	--	gen_context(system_u:object_r:syslogd_exec_t,s0)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch b/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
>> index dc10350..82b4708 100644
>> --- a/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
>> @@ -1,4 +1,4 @@
>> -From 0bb081084a2d12f9041bfae195481d898b5a0ba1 Mon Sep 17 00:00:00 2001
>> +From 01f57c996e09fb68daf3d97805c46c27a6d34304 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Sun, 5 Apr 2020 22:03:45 +0800
>>   Subject: [PATCH] file_contexts.subs_dist: set aliase for /root directory
>> @@ -26,5 +26,5 @@ index 690007f22..f80499ebf 100644
>>   +# Add an aliase for it
>>   +/root /home/root
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch b/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
>> index f8a4cec..06b792a 100644
>> --- a/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
>> @@ -1,4 +1,4 @@
>> -From 9c676fe5ff2a14206f25bf8ed932c305f13dcfdc Mon Sep 17 00:00:00 2001
>> +From 2e9b42143ccb92f04d8d57430b3ae1e9f55eb00e Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] policy/modules/system/logging: add rules for the symlink of
>> @@ -30,7 +30,7 @@ index 4ff5f990a..dee26a9f4 100644
>>    /var/log/dmesg		--	gen_context(system_u:object_r:var_log_t,s0)
>>    /var/log/syslog		--	gen_context(system_u:object_r:var_log_t,s0)
>>   diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
>> -index 341763730..30d402c75 100644
>> +index cf7ef1721..b627cacb8 100644
>>   --- a/policy/modules/system/logging.if
>>   +++ b/policy/modules/system/logging.if
>>   @@ -1086,10 +1086,12 @@ interface(`logging_append_all_inherited_logs',`
>> @@ -100,5 +100,5 @@ index 341763730..30d402c75 100644
>>    
>>    ########################################
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch b/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
>> index a06b3f4..ecfc018 100644
>> --- a/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
>> @@ -1,4 +1,4 @@
>> -From c9759b1024873819cf594fe7ac3bf06bcf0d959d Mon Sep 17 00:00:00 2001
>> +From 26dc5529db7664ae248eba4dbc5d17915c371137 Mon Sep 17 00:00:00 2001
>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>   Date: Fri, 29 Mar 2019 10:33:18 -0400
>>   Subject: [PATCH] policy/modules/system/logging: add rules for syslogd symlink
>> @@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
>> -index 21e3285a9..abee7df9c 100644
>> +index abd61e6bd..90d8ccd31 100644
>>   --- a/policy/modules/system/logging.te
>>   +++ b/policy/modules/system/logging.te
>> -@@ -411,6 +411,7 @@ files_search_spool(syslogd_t)
>> +@@ -420,6 +420,7 @@ files_search_spool(syslogd_t)
>>    
>>    # Allow access for syslog-ng
>>    allow syslogd_t var_log_t:dir { create setattr };
>> @@ -30,5 +30,5 @@ index 21e3285a9..abee7df9c 100644
>>    # for systemd but can not be conditional
>>    files_runtime_filetrans(syslogd_t, syslogd_tmp_t, dir, "log")
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch b/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
>> index ffa78ac..48e8acf 100644
>> --- a/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
>> @@ -1,4 +1,4 @@
>> -From fd55f9f292617c7475c62c07ed6c478b4bd9eda5 Mon Sep 17 00:00:00 2001
>> +From 9052089dfc4f7466fcf304ab282c2e32933a5881 Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] policy/modules/kernel/files: add rules for the symlink of
>> @@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    2 files changed, 9 insertions(+)
>>   
>>   diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
>> -index 826722f4e..677ae96c3 100644
>> +index f6ff6b079..279df3d3c 100644
>>   --- a/policy/modules/kernel/files.fc
>>   +++ b/policy/modules/kernel/files.fc
>> -@@ -172,6 +172,7 @@ HOME_ROOT/lost\+found/.*	<<none>>
>> +@@ -170,6 +170,7 @@ HOME_ROOT/lost\+found/.*	<<none>>
>>    # /tmp
>>    #
>>    /tmp			-d	gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
>> @@ -30,10 +30,10 @@ index 826722f4e..677ae96c3 100644
>>    /tmp/\.journal			<<none>>
>>    
>>   diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
>> -index 495cbe2f4..b308eefd9 100644
>> +index f7217b226..451f302af 100644
>>   --- a/policy/modules/kernel/files.if
>>   +++ b/policy/modules/kernel/files.if
>> -@@ -4555,6 +4555,7 @@ interface(`files_search_tmp',`
>> +@@ -4750,6 +4750,7 @@ interface(`files_search_tmp',`
>>    	')
>>    
>>    	allow $1 tmp_t:dir search_dir_perms;
>> @@ -41,7 +41,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4591,6 +4592,7 @@ interface(`files_list_tmp',`
>> +@@ -4786,6 +4787,7 @@ interface(`files_list_tmp',`
>>    	')
>>    
>>    	allow $1 tmp_t:dir list_dir_perms;
>> @@ -49,7 +49,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4627,6 +4629,7 @@ interface(`files_delete_tmp_dir_entry',`
>> +@@ -4822,6 +4824,7 @@ interface(`files_delete_tmp_dir_entry',`
>>    	')
>>    
>>    	allow $1 tmp_t:dir del_entry_dir_perms;
>> @@ -57,7 +57,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4645,6 +4648,7 @@ interface(`files_read_generic_tmp_files',`
>> +@@ -4840,6 +4843,7 @@ interface(`files_read_generic_tmp_files',`
>>    	')
>>    
>>    	read_files_pattern($1, tmp_t, tmp_t)
>> @@ -65,7 +65,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4663,6 +4667,7 @@ interface(`files_manage_generic_tmp_dirs',`
>> +@@ -4858,6 +4862,7 @@ interface(`files_manage_generic_tmp_dirs',`
>>    	')
>>    
>>    	manage_dirs_pattern($1, tmp_t, tmp_t)
>> @@ -73,7 +73,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4699,6 +4704,7 @@ interface(`files_manage_generic_tmp_files',`
>> +@@ -4894,6 +4899,7 @@ interface(`files_manage_generic_tmp_files',`
>>    	')
>>    
>>    	manage_files_pattern($1, tmp_t, tmp_t)
>> @@ -81,7 +81,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4735,6 +4741,7 @@ interface(`files_rw_generic_tmp_sockets',`
>> +@@ -4930,6 +4936,7 @@ interface(`files_rw_generic_tmp_sockets',`
>>    	')
>>    
>>    	rw_sock_files_pattern($1, tmp_t, tmp_t)
>> @@ -89,7 +89,7 @@ index 495cbe2f4..b308eefd9 100644
>>    ')
>>    
>>    ########################################
>> -@@ -4942,6 +4949,7 @@ interface(`files_tmp_filetrans',`
>> +@@ -5137,6 +5144,7 @@ interface(`files_tmp_filetrans',`
>>    	')
>>    
>>    	filetrans_pattern($1, tmp_t, $2, $3, $4)
>> @@ -98,5 +98,5 @@ index 495cbe2f4..b308eefd9 100644
>>    
>>    ########################################
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch b/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
>> index 3f10d06..22ce8f2 100644
>> --- a/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
>> @@ -1,4 +1,4 @@
>> -From a196ae5e13b3f8e0d2e7ff27c8d481c9376b18e9 Mon Sep 17 00:00:00 2001
>> +From eed095029b270bbc49dc67d6b7b6b2fe9c3bca07 Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] policy/modules/system/logging: fix auditd startup failures
>> @@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
>> -index abee7df9c..cc530a2be 100644
>> +index 90d8ccd31..d3b06db7d 100644
>>   --- a/policy/modules/system/logging.te
>>   +++ b/policy/modules/system/logging.te
>> -@@ -161,6 +161,7 @@ dontaudit auditd_t auditd_etc_t:file map;
>> +@@ -169,6 +169,7 @@ dontaudit auditd_t auditd_etc_t:file map;
>>    manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
>>    allow auditd_t auditd_log_t:dir setattr;
>>    manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
>> @@ -28,7 +28,7 @@ index abee7df9c..cc530a2be 100644
>>    allow auditd_t var_log_t:dir search_dir_perms;
>>    
>>    manage_files_pattern(auditd_t, auditd_runtime_t, auditd_runtime_t)
>> -@@ -290,6 +291,7 @@ optional_policy(`
>> +@@ -298,6 +299,7 @@ optional_policy(`
>>    allow audisp_remote_t self:capability { setpcap setuid };
>>    allow audisp_remote_t self:process { getcap setcap };
>>    allow audisp_remote_t self:tcp_socket create_socket_perms;
>> @@ -37,5 +37,5 @@ index abee7df9c..cc530a2be 100644
>>    
>>    manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch b/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
>> index 3421a43..f62db74 100644
>> --- a/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
>> @@ -1,4 +1,4 @@
>> -From bfcb86c9c9ad6a9f10a8556320443d8c96adedc9 Mon Sep 17 00:00:00 2001
>> +From 3f24b88886fcd1a17248d8d674a02d01061d937a Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] policy/modules/kernel/terminal: don't audit tty_device_t in
>> @@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 3 insertions(+)
>>   
>>   diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
>> -index 55c18dffb..e8c0735eb 100644
>> +index e5645c7c5..6e9f654ac 100644
>>   --- a/policy/modules/kernel/terminal.if
>>   +++ b/policy/modules/kernel/terminal.if
>>   @@ -335,9 +335,12 @@ interface(`term_use_console',`
>> @@ -34,5 +34,5 @@ index 55c18dffb..e8c0735eb 100644
>>    
>>    ########################################
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch b/recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>> similarity index 52%
>> rename from recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>> rename to recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>> index f9aa158..0b00f5a 100644
>> --- a/recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>> @@ -1,4 +1,4 @@
>> -From d1352b688603b16eb6da7a30198d8b7abfc55d1e Mon Sep 17 00:00:00 2001
>> +From 9c84425bbcaef5913fb6e309b8811639134714ed Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Wed, 1 Jul 2020 08:44:07 +0800
>>   Subject: [PATCH] policy/modules/services/rpcbind: allow rpcbind_t to create
>> @@ -13,14 +13,14 @@ Upstream-Status: Inappropriate [embedded specific]
>>   
>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>   ---
>> - policy/modules/services/rpcbind.te | 5 +++--
>> - 1 file changed, 3 insertions(+), 2 deletions(-)
>> + policy/modules/services/rpcbind.te | 2 +-
>> + 1 file changed, 1 insertion(+), 1 deletion(-)
>>   
>>   diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
>> -index 168c28ca3..e1eb7d5fc 100644
>> +index 137c21ece..2a712192b 100644
>>   --- a/policy/modules/services/rpcbind.te
>>   +++ b/policy/modules/services/rpcbind.te
>> -@@ -25,16 +25,17 @@ files_type(rpcbind_var_lib_t)
>> +@@ -25,7 +25,7 @@ files_type(rpcbind_var_lib_t)
>>    # Local policy
>>    #
>>    
>> @@ -29,17 +29,6 @@ index 168c28ca3..e1eb7d5fc 100644
>>    # net_admin is for SO_SNDBUFFORCE
>>    dontaudit rpcbind_t self:capability net_admin;
>>    allow rpcbind_t self:fifo_file rw_fifo_file_perms;
>> - allow rpcbind_t self:unix_stream_socket { accept listen };
>> - allow rpcbind_t self:tcp_socket { accept listen };
>> -
>> -+manage_dirs_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
>> - manage_files_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
>> - manage_sock_files_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
>> --files_runtime_filetrans(rpcbind_t, rpcbind_runtime_t, { file sock_file })
>> -+files_runtime_filetrans(rpcbind_t, rpcbind_runtime_t, { file sock_file dir })
>> -
>> - manage_dirs_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t)
>> - manage_files_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch b/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
>> deleted file mode 100644
>> index e7ce388..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
>> +++ /dev/null
>> @@ -1,67 +0,0 @@
>> -From b3ff2e8572cd929c419775e57b547f309ba9d8fb Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Mon, 24 Aug 2020 11:29:09 +0800
>> -Subject: [PATCH] policy/modules/system/modutils: allow mod_t to access
>> - confidentiality of class lockdown
>> -
>> -The SELinux lockdown implementation was introduced since kernel 5.6 by
>> -commit 59438b46471ae6cdfb761afc8c9beaf1e428a331. We need to allow mod_t
>> -and udev_t to access confidentiality of class lockdown to mount tracefs.
>> -
>> -Fixes:
>> -kernel: Could not create tracefs 'iwlwifi_data/filter' entry
>> -kernel: Could not create tracefs 'enable' entry
>> -kernel: Could not create tracefs 'id' entry
>> -kernel: Could not create tracefs 'filter' entry
>> -kernel: Could not create tracefs 'trigger' entry
>> -kernel: Could not create tracefs 'format' entry
>> -
>> -audit[170]: AVC avc:  denied  { confidentiality } for  pid=170
>> -comm="modprobe" lockdown_reason="use of tracefs"
>> -scontext=system_u:system_r:kmod_t:s15:c0.c1023
>> -tcontext=system_u:system_r:kmod_t:s15:c0.c1023 tclass=lockdown
>> -permissive=0
>> -
>> -audit[190]: AVC avc:  denied  { confidentiality } for  pid=190
>> -comm="systemd-udevd" lockdown_reason="use of tracefs"
>> -scontext=system_u:system_r:udev_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=lockdown
>> -permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/modutils.te | 2 ++
>> - policy/modules/system/udev.te     | 2 ++
>> - 2 files changed, 4 insertions(+)
>> -
>> -diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
>> -index b0a419dc1..5b4f0aca1 100644
>> ---- a/policy/modules/system/modutils.te
>> -+++ b/policy/modules/system/modutils.te
>> -@@ -41,6 +41,8 @@ dontaudit kmod_t self:capability sys_admin;
>> - allow kmod_t self:udp_socket create_socket_perms;
>> - allow kmod_t self:rawip_socket create_socket_perms;
>> -
>> -+allow kmod_t self:lockdown confidentiality;
>> -+
>> - # Read module config and dependency information
>> - list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
>> - read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
>> -diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
>> -index c50ff68c1..4c5a690fb 100644
>> ---- a/policy/modules/system/udev.te
>> -+++ b/policy/modules/system/udev.te
>> -@@ -67,6 +67,8 @@ ifdef(`init_systemd',`
>> - # for systemd-udevd to rename interfaces
>> - allow udev_t self:netlink_route_socket nlmsg_write;
>> -
>> -+allow udev_t self:lockdown confidentiality;
>> -+
>> - can_exec(udev_t, udev_exec_t)
>> -
>> - allow udev_t udev_helper_exec_t:dir list_dir_perms;
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
>> deleted file mode 100644
>> index 0dfe0ee..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
>> +++ /dev/null
>> @@ -1,32 +0,0 @@
>> -From 175b493e7fe69de274388a7f251e74ec9cd56c41 Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Tue, 23 Jun 2020 08:39:44 +0800
>> -Subject: [PATCH] policy/modules/system/getty: allow getty_t to search tmpfs
>> -
>> -Fixes:
>> -avc:  denied  { search } for  pid=211 comm="agetty" name="/" dev="tmpfs"
>> -ino=1 scontext=system_u:system_r:getty_t
>> -tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/getty.te | 1 +
>> - 1 file changed, 1 insertion(+)
>> -
>> -diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
>> -index e6e76a93b..c704ddb82 100644
>> ---- a/policy/modules/system/getty.te
>> -+++ b/policy/modules/system/getty.te
>> -@@ -68,6 +68,7 @@ files_read_etc_runtime_files(getty_t)
>> - files_read_etc_files(getty_t)
>> - files_search_spool(getty_t)
>> - files_dontaudit_search_var_lib(getty_t)
>> -+fs_search_tmpfs(getty_t)
>> -
>> - fs_search_auto_mountpoints(getty_t)
>> - # for error condition handling
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
>> similarity index 91%
>> rename from recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch
>> rename to recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
>> index cc29c7b..43b2f4d 100644
>> --- a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
>> @@ -1,4 +1,4 @@
>> -From 93d4f198bd469a8728f5ce0cc51ff18f8a58b23b Mon Sep 17 00:00:00 2001
>> +From 6465e39b6dfe8daa88cab321e3cf44ccc9f1441d Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Thu, 4 Feb 2016 06:03:19 -0500
>>   Subject: [PATCH] policy/modules/system/systemd: enable support for
>> @@ -36,10 +36,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 5 insertions(+), 1 deletion(-)
>>   
>>   diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 3d9198342..31d28a0e3 100644
>> +index ef25974ac..362248d17 100644
>>   --- a/policy/modules/system/systemd.te
>>   +++ b/policy/modules/system/systemd.te
>> -@@ -10,7 +10,7 @@ policy_module(systemd, 1.12.6)
>> +@@ -10,7 +10,7 @@ policy_module(systemd)
>>    ## Enable support for systemd-tmpfiles to manage all non-security files.
>>    ## </p>
>>    ## </desc>
>> @@ -48,7 +48,7 @@ index 3d9198342..31d28a0e3 100644
>>    
>>    ## <desc>
>>    ## <p>
>> -@@ -1396,6 +1396,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
>> +@@ -1640,6 +1640,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
>>    files_relabelto_home(systemd_tmpfiles_t)
>>    files_relabelto_etc_dirs(systemd_tmpfiles_t)
>>    files_setattr_lock_dirs(systemd_tmpfiles_t)
>> @@ -60,5 +60,5 @@ index 3d9198342..31d28a0e3 100644
>>    files_manage_etc_symlinks(systemd_tmpfiles_t)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
>> similarity index 88%
>> rename from recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
>> rename to recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
>> index 49aa7a6..56b6119 100644
>> --- a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
>> @@ -1,4 +1,4 @@
>> -From 4e2df7ca542b6c94e74345daaecb33efc82d749a Mon Sep 17 00:00:00 2001
>> +From 2acb5ddbd04c578a420418e3bcb572bbd2dfbae6 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Sat, 18 Dec 2021 09:26:43 +0800
>>   Subject: [PATCH] policy/modules/system/systemd: allow systemd_logind_t to read
>> @@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 847895e63..1a83148c1 100644
>> +index 362248d17..4a1e06640 100644
>>   --- a/policy/modules/system/systemd.te
>>   +++ b/policy/modules/system/systemd.te
>> -@@ -721,6 +721,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
>> +@@ -920,6 +920,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
>>    userdom_relabelto_user_runtime_dirs(systemd_logind_t)
>>    userdom_setattr_user_ttys(systemd_logind_t)
>>    userdom_use_user_ttys(systemd_logind_t)
>> @@ -39,5 +39,5 @@ index 847895e63..1a83148c1 100644
>>    # Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
>>    # The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch b/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
>> deleted file mode 100644
>> index 9465a3e..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
>> +++ /dev/null
>> @@ -1,71 +0,0 @@
>> -From 07866ad826b299194c1bfd7978e5077dde72a68e Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Mon, 11 Oct 2021 10:10:10 +0800
>> -Subject: [PATCH] policy/modules/admin/usermanage: allow useradd to relabel
>> - user home files
>> -
>> -Fixes:
>> -avc: denied { relabelfrom } for pid=491 comm="useradd" name=".bashrc"
>> -dev="vda" ino=12641 scontext=root:sysadm_r:useradd_t
>> -tcontext=user_u:object_r:user_home_t tclass=file permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/admin/usermanage.te  |  2 ++
>> - policy/modules/system/userdomain.if | 18 ++++++++++++++++++
>> - 2 files changed, 20 insertions(+)
>> -
>> -diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
>> -index 98646b4b4..50c479498 100644
>> ---- a/policy/modules/admin/usermanage.te
>> -+++ b/policy/modules/admin/usermanage.te
>> -@@ -496,6 +496,7 @@ files_read_etc_runtime_files(useradd_t)
>> -
>> - fs_search_auto_mountpoints(useradd_t)
>> - fs_getattr_xattr_fs(useradd_t)
>> -+fs_search_tmpfs(useradd_t)
>> -
>> - mls_file_upgrade(useradd_t)
>> -
>> -@@ -541,6 +542,7 @@ userdom_home_filetrans_user_home_dir(useradd_t)
>> - userdom_manage_user_home_content_dirs(useradd_t)
>> - userdom_manage_user_home_content_files(useradd_t)
>> - userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
>> -+userdom_relabel_user_home_content_files(useradd_t)
>> -
>> - optional_policy(`
>> - 	mta_manage_spool(useradd_t)
>> -diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
>> -index 22b3c1bf7..ec625170d 100644
>> ---- a/policy/modules/system/userdomain.if
>> -+++ b/policy/modules/system/userdomain.if
>> -@@ -2362,6 +2362,24 @@ interface(`userdom_dontaudit_relabel_user_home_content_files',`
>> - 	dontaudit $1 user_home_t:file relabel_file_perms;
>> - ')
>> -
>> -+########################################
>> -+## <summary>
>> -+##	Relabel user home files.
>> -+## </summary>
>> -+## <param name="domain">
>> -+##	<summary>
>> -+##	Domain allowed access.
>> -+##	</summary>
>> -+## </param>
>> -+#
>> -+interface(`userdom_relabel_user_home_content_files',`
>> -+	gen_require(`
>> -+		type user_home_t;
>> -+	')
>> -+
>> -+	allow $1 user_home_t:file relabel_file_perms;
>> -+')
>> -+
>> - ########################################
>> - ## <summary>
>> - ##	Read user home subdirectory symbolic links.
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
>> new file mode 100644
>> index 0000000..78c4dc8
>> --- /dev/null
>> +++ b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
>> @@ -0,0 +1,36 @@
>> +From 51a7f8058fee569322c1a0597fccd36c318ad943 Mon Sep 17 00:00:00 2001
>> +From: Yi Zhao <yi.zhao@windriver.com>
>> +Date: Fri, 28 Oct 2022 11:56:09 +0800
>> +Subject: [PATCH] policy/modules/roles/sysadm: allow sysadm to use init file
>> + descriptors
>> +
>> +Root can not login via console without this.
>> +
>> +Fixes:
>> +avc: denied { use } for pid=323 comm="sh" path="/dev/tty1"
>> +dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t
>> +tcontext=system_u:system_r:init_t tclass=fd permissive=0
>> +
>> +Upstream-Status: Pending
>> +
>> +Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> +---
>> + policy/modules/roles/sysadm.te | 2 ++
>> + 1 file changed, 2 insertions(+)
>> +
>> +diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
>> +index bb715a847..088c954f5 100644
>> +--- a/policy/modules/roles/sysadm.te
>> ++++ b/policy/modules/roles/sysadm.te
>> +@@ -86,6 +86,8 @@ ifdef(`init_systemd',`
>> + 	# LookupDynamicUserByUID on org.freedesktop.systemd1.
>> + 	init_dbus_chat(sysadm_t)
>> +
>> ++	init_use_fds(sysadm_t)
>> ++
>> + 	# Allow sysadm to get the status of and set properties of other users,
>> + 	# sessions, and seats on the system.
>> + 	systemd_dbus_chat_logind(sysadm_t)
>> +--
>> +2.25.1
>> +
>> diff --git a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
>> new file mode 100644
>> index 0000000..85bb82b
>> --- /dev/null
>> +++ b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
>> @@ -0,0 +1,84 @@
>> +From 5b6f3fcb1ddabd0a66541959306e7b0adfe2b2b0 Mon Sep 17 00:00:00 2001
>> +From: Yi Zhao <yi.zhao@windriver.com>
>> +Date: Thu, 4 Feb 2021 10:48:54 +0800
>> +Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
>> +
>> +Fixes:
>> +systemctl[277]: Failed to connect to bus: No medium found
>> +
>> +avc: denied { mknod } for  pid=297 comm="systemd" capability=27
>> +scontext=root:sysadm_r:sysadm_systemd_t
>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>> +
>> +avc: denied { bpf } for pid=297 comm="systemd" capability=39
>> +scontext=root:sysadm_r:sysadm_systemd_t
>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
>> +
>> +avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
>> +scontext=root:sysadm_r:sysadm_systemd_t
>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>> +
>> +avc: denied { perfmon } for pid=297 comm="systemd" capability=38
>> +scontext=root:sysadm_r:sysadm_systemd_t
>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
>> +
>> +Upstream-Status: Inappropriate [embedded specific]
>> +
>> +Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> +---
>> + policy/modules/roles/sysadm.te   |  2 ++
>> + policy/modules/system/systemd.if | 21 ++++++++++++++++++++-
>> + 2 files changed, 22 insertions(+), 1 deletion(-)
>> +
>> +diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
>> +index 088c954f5..92f50fd5a 100644
>> +--- a/policy/modules/roles/sysadm.te
>> ++++ b/policy/modules/roles/sysadm.te
>> +@@ -98,6 +98,8 @@ ifdef(`init_systemd',`
>> +
>> + 	# Allow sysadm to follow logs in the journal, i.e. with podman logs -f
>> + 	systemd_watch_journal_dirs(sysadm_t)
>> ++
>> ++	systemd_sysadm_user(sysadm_t)
>> + ')
>> +
>> + tunable_policy(`allow_ptrace',`
>> +diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
>> +index 9dc91fbb7..325ca548b 100644
>> +--- a/policy/modules/system/systemd.if
>> ++++ b/policy/modules/system/systemd.if
>> +@@ -58,7 +58,7 @@ template(`systemd_role_template',`
>> + 	allow $1_systemd_t self:process { getsched signal };
>> + 	allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
>> + 	allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
>> +-	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms };
>> ++	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms noatsecure };
>> + 	corecmd_shell_domtrans($1_systemd_t, $3)
>> + 	corecmd_bin_domtrans($1_systemd_t, $3)
>> +
>> +@@ -2613,3 +2613,22 @@ interface(`systemd_use_inherited_machined_ptys', `
>> + 	allow $1 systemd_machined_t:fd use;
>> + 	allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
>> + ')
>> ++
>> ++#########################################
>> ++## <summary>
>> ++##	sysadm user for systemd --user
>> ++## </summary>
>> ++## <param name="role">
>> ++##	<summary>
>> ++##  Role allowed access.
>> ++##	</summary>
>> ++## </param>
>> ++#
>> ++interface(`systemd_sysadm_user',`
>> ++	gen_require(`
>> ++		type sysadm_systemd_t;
>> ++	')
>> ++
>> ++	allow sysadm_systemd_t self:capability { mknod sys_admin };
>> ++	allow sysadm_systemd_t self:capability2 { bpf perfmon };
>> ++')
>> +--
>> +2.25.1
>> +
>> diff --git a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>> similarity index 84%
>> rename from recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>> rename to recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>> index 4cae8c6..c3b4b55 100644
>> --- a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>> @@ -1,4 +1,4 @@
>> -From 705008ba8ef960cf2e4813b4b8c5a87b919d545f Mon Sep 17 00:00:00 2001
>> +From ccdd22cc2776b695f96faffc88699aa2b182e085 Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Sat, 15 Feb 2014 04:22:47 -0500
>>   Subject: [PATCH] policy/modules/system/mount: make mount_t domain MLS trusted
>> @@ -19,10 +19,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
>> -index e39ab41a8..3481f9294 100644
>> +index d028723ce..97f49e58e 100644
>>   --- a/policy/modules/system/mount.te
>>   +++ b/policy/modules/system/mount.te
>> -@@ -116,6 +116,7 @@ fs_dontaudit_write_all_image_files(mount_t)
>> +@@ -112,6 +112,7 @@ fs_dontaudit_write_all_image_files(mount_t)
>>    
>>    mls_file_read_all_levels(mount_t)
>>    mls_file_write_all_levels(mount_t)
>> @@ -31,5 +31,5 @@ index e39ab41a8..3481f9294 100644
>>    selinux_get_enforce_mode(mount_t)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
>> deleted file mode 100644
>> index ea8af31..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
>> +++ /dev/null
>> @@ -1,60 +0,0 @@
>> -From 99139408a7919282e97e1b2fcd5da33248386d73 Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Mon, 25 Jan 2021 14:14:59 +0800
>> -Subject: [PATCH] policy/modules/system/systemd: fix systemd-resolved startup
>> - failures
>> -
>> -* Allow systemd_resolved_t to manage systemd_resolved_runtime_t link
>> -  files
>> -* Allow systemd_resolved_t to send and recevie messages from dhcpc over
>> -  dbus
>> -
>> -Fixes:
>> -avc:  denied  { create } for  pid=329 comm="systemd-resolve"
>> -name=".#stub-resolv.conf53cb7f9d1e3aa72b"
>> -scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
>> -tcontext=system_u:object_r:systemd_resolved_runtime_t:s0 tclass=lnk_file
>> -permissive=0
>> -
>> -avc:  denied  { send_msg } for msgtype=method_call
>> -interface=org.freedesktop.resolve1.Manager member=RevertLink
>> -dest=org.freedesktop.resolve1 spid=340 tpid=345
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
>> -tclass=dbus permissive=0
>> -
>> -avc:  denied  { send_msg } for msgtype=method_return dest=:1.6 spid=345
>> -tpid=340 scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=dbus
>> -permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/systemd.te | 2 ++
>> - 1 file changed, 2 insertions(+)
>> -
>> -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 31d28a0e3..448905ff7 100644
>> ---- a/policy/modules/system/systemd.te
>> -+++ b/policy/modules/system/systemd.te
>> -@@ -1199,6 +1199,7 @@ allow systemd_resolved_t systemd_networkd_runtime_t:dir watch;
>> -
>> - manage_dirs_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>> - manage_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>> -+manage_lnk_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>> - manage_sock_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>> - init_runtime_filetrans(systemd_resolved_t, systemd_resolved_runtime_t, dir)
>> -
>> -@@ -1236,6 +1237,7 @@ optional_policy(`
>> - 	dbus_system_bus_client(systemd_resolved_t)
>> - 	dbus_watch_system_bus_runtime_dirs(systemd_resolved_t)
>> - 	dbus_watch_system_bus_runtime_named_sockets(systemd_resolved_t)
>> -+	sysnet_dbus_chat_dhcpc(systemd_resolved_t)
>> - ')
>> -
>> - #########################################
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>> similarity index 83%
>> rename from recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>> rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>> index 86317b3..d711612 100644
>> --- a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>> @@ -1,4 +1,4 @@
>> -From ef2b9196f3a51745a3644489d316bda7cd67f72d Mon Sep 17 00:00:00 2001
>> +From 64498d6cd30a0a65a24e3e7ab22cca5921c2db89 Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Mon, 28 Jan 2019 14:05:18 +0800
>>   Subject: [PATCH] policy/modules/roles/sysadm: MLS - sysadm rw to clearance
>> @@ -7,7 +7,7 @@ The two new rules make sysadm_t domain MLS trusted for:
>>    - reading from files at all levels.
>>    - writing to processes up to its clearance(s0-s15).
>>   
>> -With default MLS policy, root user would login in as sysadm_t:s0 by
>> +With default MLS policy, root user would login as sysadm_t:s0 by
>>   default. Most processes will run in sysadm_t:s0 because no
>>   domtrans/rangetrans rules, as a result, even root could not access
>>   high level files/processes.
>> @@ -23,10 +23,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
>> -index e1933a5bd..0682ed31a 100644
>> +index 92f50fd5a..8c154d474 100644
>>   --- a/policy/modules/roles/sysadm.te
>>   +++ b/policy/modules/roles/sysadm.te
>> -@@ -44,6 +44,8 @@ logging_watch_all_logs(sysadm_t)
>> +@@ -45,6 +45,8 @@ logging_watch_all_logs(sysadm_t)
>>    logging_watch_audit_log(sysadm_t)
>>    
>>    mls_process_read_all_levels(sysadm_t)
>> @@ -36,5 +36,5 @@ index e1933a5bd..0682ed31a 100644
>>    selinux_read_policy(sysadm_t)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
>> deleted file mode 100644
>> index 91588f1..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
>> +++ /dev/null
>> @@ -1,156 +0,0 @@
>> -From 81e63f86d6d030eaf0204796e32011c08e7b5e52 Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Tue, 28 Sep 2021 10:03:04 +0800
>> -Subject: [PATCH] policy/modules/system/systemd: allow systemd_*_t to get the
>> - attributes of tmpfs and cgroups
>> -
>> -Fixes:
>> -avc: denied { getattr } for pid=245 comm="systemd-network" name="/"
>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_networkd_t
>> -tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
>> -
>> -avc: denied { getattr } for pid=252 comm="systemd-resolve" name="/"
>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_resolved_t
>> -tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
>> -
>> -avc: denied { getattr } for pid=260 comm="systemd-user-se" name="/"
>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_sessions_t
>> -tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
>> -
>> -avc: denied { search } for pid=293 comm="systemd-user-ru" name="/"
>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_user_runtime_dir_t
>> -tcontext=system_u:object_r:cgroup_t tclass=dir permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/systemd.te | 35 ++++++++++++++++++++++++++++++++
>> - 1 file changed, 35 insertions(+)
>> -
>> -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 448905ff7..847895e63 100644
>> ---- a/policy/modules/system/systemd.te
>> -+++ b/policy/modules/system/systemd.te
>> -@@ -337,6 +337,10 @@ udev_read_runtime_files(systemd_backlight_t)
>> -
>> - files_search_var_lib(systemd_backlight_t)
>> -
>> -+fs_getattr_tmpfs(systemd_backlight_t)
>> -+fs_search_cgroup_dirs(systemd_backlight_t)
>> -+fs_getattr_cgroup(systemd_backlight_t)
>> -+
>> - #######################################
>> - #
>> - # Binfmt local policy
>> -@@ -447,6 +451,7 @@ files_list_usr(systemd_generator_t)
>> - fs_list_efivars(systemd_generator_t)
>> - fs_getattr_cgroup(systemd_generator_t)
>> - fs_getattr_xattr_fs(systemd_generator_t)
>> -+fs_getattr_tmpfs(systemd_generator_t)
>> -
>> - init_create_runtime_files(systemd_generator_t)
>> - init_manage_runtime_dirs(systemd_generator_t)
>> -@@ -515,6 +520,10 @@ systemd_log_parse_environment(systemd_hostnamed_t)
>> - # Allow reading /run/udev/data/+dmi:id
>> - udev_read_runtime_files(systemd_hostnamed_t)
>> -
>> -+fs_getattr_tmpfs(systemd_hostnamed_t)
>> -+fs_search_cgroup_dirs(systemd_hostnamed_t)
>> -+fs_getattr_cgroup(systemd_hostnamed_t)
>> -+
>> - optional_policy(`
>> - 	dbus_connect_system_bus(systemd_hostnamed_t)
>> - 	dbus_system_bus_client(systemd_hostnamed_t)
>> -@@ -835,6 +844,10 @@ dev_read_sysfs(systemd_modules_load_t)
>> - files_mmap_read_kernel_modules(systemd_modules_load_t)
>> - files_read_etc_files(systemd_modules_load_t)
>> -
>> -+fs_getattr_tmpfs(systemd_modules_load_t)
>> -+fs_search_cgroup_dirs(systemd_modules_load_t)
>> -+fs_getattr_cgroup(systemd_modules_load_t)
>> -+
>> - modutils_read_module_config(systemd_modules_load_t)
>> - modutils_read_module_deps(systemd_modules_load_t)
>> -
>> -@@ -885,6 +898,7 @@ files_watch_runtime_dirs(systemd_networkd_t)
>> - files_watch_root_dirs(systemd_networkd_t)
>> - files_list_runtime(systemd_networkd_t)
>> - fs_getattr_xattr_fs(systemd_networkd_t)
>> -+fs_getattr_tmpfs(systemd_networkd_t)
>> - fs_getattr_cgroup(systemd_networkd_t)
>> - fs_search_cgroup_dirs(systemd_networkd_t)
>> - fs_read_nsfs_files(systemd_networkd_t)
>> -@@ -1185,6 +1199,10 @@ udev_read_runtime_files(systemd_rfkill_t)
>> -
>> - systemd_log_parse_environment(systemd_rfkill_t)
>> -
>> -+fs_getattr_tmpfs(systemd_rfkill_t)
>> -+fs_search_cgroup_dirs(systemd_rfkill_t)
>> -+fs_getattr_cgroup(systemd_rfkill_t)
>> -+
>> - #########################################
>> - #
>> - # Resolved local policy
>> -@@ -1224,6 +1242,9 @@ auth_use_nsswitch(systemd_resolved_t)
>> - files_watch_root_dirs(systemd_resolved_t)
>> - files_watch_runtime_dirs(systemd_resolved_t)
>> - files_list_runtime(systemd_resolved_t)
>> -+fs_getattr_tmpfs(systemd_resolved_t)
>> -+fs_search_cgroup_dirs(systemd_resolved_t)
>> -+fs_getattr_cgroup(systemd_resolved_t)
>> -
>> - init_dgram_send(systemd_resolved_t)
>> -
>> -@@ -1288,6 +1309,10 @@ seutil_read_file_contexts(systemd_sessions_t)
>> -
>> - systemd_log_parse_environment(systemd_sessions_t)
>> -
>> -+fs_getattr_tmpfs(systemd_sessions_t)
>> -+fs_search_cgroup_dirs(systemd_sessions_t)
>> -+fs_getattr_cgroup(systemd_sessions_t)
>> -+
>> - ########################################
>> - #
>> - # sysctl local policy
>> -@@ -1304,6 +1329,9 @@ kernel_rw_all_sysctls(systemd_sysctl_t)
>> - kernel_dontaudit_getattr_proc(systemd_sysctl_t)
>> -
>> - files_read_etc_files(systemd_sysctl_t)
>> -+fs_getattr_tmpfs(systemd_sysctl_t)
>> -+fs_search_cgroup_dirs(systemd_sysctl_t)
>> -+fs_getattr_cgroup(systemd_sysctl_t)
>> -
>> - systemd_log_parse_environment(systemd_sysctl_t)
>> -
>> -@@ -1409,6 +1437,8 @@ fs_getattr_tmpfs(systemd_tmpfiles_t)
>> - fs_getattr_xattr_fs(systemd_tmpfiles_t)
>> - fs_list_tmpfs(systemd_tmpfiles_t)
>> - fs_relabelfrom_tmpfs_dirs(systemd_tmpfiles_t)
>> -+fs_search_cgroup_dirs(systemd_tmpfiles_t)
>> -+fs_getattr_cgroup(systemd_tmpfiles_t)
>> -
>> - selinux_get_fs_mount(systemd_tmpfiles_t)
>> - selinux_use_status_page(systemd_tmpfiles_t)
>> -@@ -1497,6 +1527,10 @@ allow systemd_update_done_t systemd_update_run_t:file manage_file_perms;
>> - files_etc_filetrans(systemd_update_done_t, systemd_update_run_t, file)
>> - files_var_filetrans(systemd_update_done_t, systemd_update_run_t, file)
>> -
>> -+fs_getattr_tmpfs(systemd_update_done_t)
>> -+fs_search_cgroup_dirs(systemd_update_done_t)
>> -+fs_getattr_cgroup(systemd_update_done_t)
>> -+
>> - kernel_read_kernel_sysctls(systemd_update_done_t)
>> -
>> - selinux_use_status_page(systemd_update_done_t)
>> -@@ -1601,6 +1635,7 @@ fs_unmount_tmpfs(systemd_user_runtime_dir_t)
>> - fs_relabelfrom_tmpfs_dirs(systemd_user_runtime_dir_t)
>> - fs_read_cgroup_files(systemd_user_runtime_dir_t)
>> - fs_getattr_cgroup(systemd_user_runtime_dir_t)
>> -+fs_search_cgroup_dirs(systemd_user_runtime_dir_t)
>> -
>> - kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
>> - kernel_dontaudit_getattr_proc(systemd_user_runtime_dir_t)
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>> similarity index 84%
>> rename from recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>> rename to recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>> index f659e7e..d22dacf 100644
>> --- a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>> @@ -1,4 +1,4 @@
>> -From 18ad027229a06fdcb833482dff0c2ae637d08e78 Mon Sep 17 00:00:00 2001
>> +From e82c43e60ef52ba00e8f2af5b46b2a6d49331209 Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Fri, 23 Aug 2013 12:01:53 +0800
>>   Subject: [PATCH] policy/modules/services/rpc: make nfsd_t domain MLS trusted
>> @@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    2 files changed, 7 insertions(+)
>>   
>>   diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
>> -index ca951cb44..a32c59eb1 100644
>> +index 5124ae016..a40db8507 100644
>>   --- a/policy/modules/kernel/kernel.te
>>   +++ b/policy/modules/kernel/kernel.te
>> -@@ -356,6 +356,8 @@ mls_process_read_all_levels(kernel_t)
>> +@@ -368,6 +368,8 @@ mls_process_read_all_levels(kernel_t)
>>    mls_process_write_all_levels(kernel_t)
>>    mls_file_write_all_levels(kernel_t)
>>    mls_file_read_all_levels(kernel_t)
>> @@ -28,7 +28,7 @@ index ca951cb44..a32c59eb1 100644
>>    ifdef(`distro_redhat',`
>>    	# Bugzilla 222337
>>   diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
>> -index e1eb7d5fc..da0994749 100644
>> +index 2a712192b..923e48db7 100644
>>   --- a/policy/modules/services/rpcbind.te
>>   +++ b/policy/modules/services/rpcbind.te
>>   @@ -73,6 +73,11 @@ logging_send_syslog_msg(rpcbind_t)
>> @@ -36,7 +36,7 @@ index e1eb7d5fc..da0994749 100644
>>    miscfiles_read_localization(rpcbind_t)
>>    
>>   +# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
>> -+# because the are running in different level. So add rules to allow this.
>> ++# because they are running in different level. So add rules to allow this.
>>   +mls_socket_read_all_levels(rpcbind_t)
>>   +mls_socket_write_all_levels(rpcbind_t)
>>   +
>> @@ -44,5 +44,5 @@ index e1eb7d5fc..da0994749 100644
>>    	term_dontaudit_use_unallocated_ttys(rpcbind_t)
>>    ')
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch b/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
>> deleted file mode 100644
>> index 2232d48..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
>> +++ /dev/null
>> @@ -1,55 +0,0 @@
>> -From dc2c9c91219311f6c4d985169dff6c5931a465d7 Mon Sep 17 00:00:00 2001
>> -From: Wenzong Fan <wenzong.fan@windriver.com>
>> -Date: Thu, 4 Feb 2016 02:10:15 -0500
>> -Subject: [PATCH] policy/modules/system/logging: fix syslogd failures for
>> - systemd
>> -
>> -Fixes:
>> -syslogd[243]: Error opening log file: /var/log/auth.log: Permission denied
>> -syslogd[243]: Error opening log file: /var/log/syslog: Permission denied
>> -syslogd[243]: Error opening log file: /var/log/kern.log: Permission denied
>> -syslogd[243]: Error opening log file: /var/log/mail.log: Permission denied
>> -syslogd[243]: Error opening log file: /var/log/mail.err: Permission denied
>> -syslogd[243]: Error opening log file: /var/log/messages: Permission denied
>> -
>> -avc:  denied  { search } for  pid=243 comm="syslogd" name="/"
>> -dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t
>> -tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
>> -
>> -avc:  denied  { write } for  pid=162 comm="systemd-journal"
>> -name="syslog" dev="tmpfs" ino=515 scontext=system_u:system_r:syslogd_t
>> -tcontext=system_u:object_r:syslogd_runtime_t tclass=sock_file
>> -permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/logging.te | 3 ++-
>> - 1 file changed, 2 insertions(+), 1 deletion(-)
>> -
>> -diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
>> -index cc530a2be..5b4b5ec5d 100644
>> ---- a/policy/modules/system/logging.te
>> -+++ b/policy/modules/system/logging.te
>> -@@ -431,7 +431,7 @@ files_search_var_lib(syslogd_t)
>> -
>> - # manage runtime files
>> - allow syslogd_t syslogd_runtime_t:dir create_dir_perms;
>> --allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink };
>> -+allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink write };
>> - allow syslogd_t syslogd_runtime_t:file map;
>> - manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
>> - files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
>> -@@ -495,6 +495,7 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
>> -
>> - fs_getattr_all_fs(syslogd_t)
>> - fs_search_auto_mountpoints(syslogd_t)
>> -+fs_search_tmpfs(syslogd_t)
>> -
>> - mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
>> -
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>> similarity index 90%
>> rename from recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>> rename to recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>> index ace056a..30c84f6 100644
>> --- a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>> @@ -1,4 +1,4 @@
>> -From b41a910654f5c5fe198b1695df18b6f6a1af7904 Mon Sep 17 00:00:00 2001
>> +From 9343914c0486b5aa6ff7cceeb8f6c399115e5fb3 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Tue, 30 Jun 2020 10:18:20 +0800
>>   Subject: [PATCH] policy/modules/admin/dmesg: make dmesg_t MLS trusted reading
>> @@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
>> -index f3421fdbb..d87ee5583 100644
>> +index f1da315a9..89478c38e 100644
>>   --- a/policy/modules/admin/dmesg.te
>>   +++ b/policy/modules/admin/dmesg.te
>>   @@ -52,6 +52,8 @@ miscfiles_read_localization(dmesg_t)
>> @@ -32,5 +32,5 @@ index f3421fdbb..d87ee5583 100644
>>    	seutil_sigchld_newrole(dmesg_t)
>>    ')
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch b/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
>> deleted file mode 100644
>> index 108f62f..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
>> +++ /dev/null
>> @@ -1,172 +0,0 @@
>> -From 20b2608718064a92f9255adb459a97d95fdbc22e Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Thu, 4 Feb 2021 10:48:54 +0800
>> -Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
>> -
>> -Fixes:
>> -systemctl[1598]: Failed to connect to bus: $DBUS_SESSION_BUS_ADDRESS and
>> -$XDG_RUNTIME_DIR not defined (consider using --machine=<user>@.host
>> ---user to connect to bus of other user)
>> -
>> -avc: denied { connectto } for  pid=293 comm="login"
>> -path="/run/systemd/userdb/io.systemd.Multiplexer"
>> -scontext=system_u:system_r:local_login_t
>> -tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
>> -permissive=0
>> -
>> -avc: denied { read } for  pid=293 comm="login" name="io.systemd.DropIn"
>> -dev="tmpfs" ino=44 scontext=system_u:system_r:local_login_t
>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>> -permissive=0
>> -
>> -avc: denied { read } for  pid=293 comm="login"
>> -name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
>> -scontext=system_u:system_r:local_login_t
>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>> -permissive=0
>> -
>> -avc: denied { connectto } for  pid=244 comm="systemd-logind"
>> -path="/run/systemd/userdb/io.systemd.Multiplexer"
>> -scontext=system_u:system_r:systemd_logind_t
>> -tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
>> -permissive=0
>> -
>> -avc: denied { read } for  pid=244 comm="systemd-logind"
>> -name="io.systemd.DropIn" dev="tmpfs" ino=44
>> -scontext=system_u:system_r:systemd_logind_t
>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>> -permissive=0
>> -
>> -avc: denied { read } for  pid=244 comm="systemd-logind"
>> -name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
>> -scontext=system_u:system_r:systemd_logind_t
>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>> -permissive=0
>> -
>> -avc: denied { mknod } for  pid=297 comm="systemd" capability=27
>> -scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>> -
>> -avc: denied { setrlimit } for pid=297 comm="systemd"
>> -scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=process permissive=0
>> -
>> -avc: denied { bpf } for pid=297 comm="systemd" capability=39
>> -scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
>> -
>> -avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
>> -scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>> -
>> -avc: denied { perfmon } for pid=297 comm="systemd" capability=38
>> -scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
>> -
>> -avc: denied { watch } for pid=297 comm="systemd" path="/etc" dev="vda"
>> -ino=173 scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=system_u:object_r:etc_t tclass=dir permissive=0
>> -
>> -avc: denied { getattr } for pid=297 comm="systemd" name="/" dev="vda"
>> -ino=2 scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
>> -
>> -avc: denied { read } for pid=297 comm="systemd" name="unix" dev="proc"
>> -ino=4026532057 scontext=root:sysadm_r:sysadm_systemd_t
>> -tcontext=system_u:object_r:proc_net_t tclass=file permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/roles/sysadm.te   |  2 ++
>> - policy/modules/system/init.if    |  1 +
>> - policy/modules/system/systemd.if | 27 ++++++++++++++++++++++++++-
>> - 3 files changed, 29 insertions(+), 1 deletion(-)
>> -
>> -diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
>> -index 46d3e2f0b..e1933a5bd 100644
>> ---- a/policy/modules/roles/sysadm.te
>> -+++ b/policy/modules/roles/sysadm.te
>> -@@ -92,6 +92,8 @@ ifdef(`init_systemd',`
>> - 	# Allow sysadm to query and set networking settings on the system.
>> - 	systemd_dbus_chat_networkd(sysadm_t)
>> - 	fs_read_nsfs_files(sysadm_t)
>> -+
>> -+	systemd_sysadm_user(sysadm_t)
>> - ')
>> -
>> - tunable_policy(`allow_ptrace',`
>> -diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
>> -index 0171ee299..8ca29f654 100644
>> ---- a/policy/modules/system/init.if
>> -+++ b/policy/modules/system/init.if
>> -@@ -959,6 +959,7 @@ interface(`init_unix_stream_socket_connectto',`
>> - 	')
>> -
>> - 	allow $1 init_t:unix_stream_socket connectto;
>> -+	allow $1 initrc_t:unix_stream_socket connectto;
>> - ')
>> -
>> - ########################################
>> -diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
>> -index 38adf050c..5c44d8d8a 100644
>> ---- a/policy/modules/system/systemd.if
>> -+++ b/policy/modules/system/systemd.if
>> -@@ -57,7 +57,7 @@ template(`systemd_role_template',`
>> - 	allow $1_systemd_t self:process { getsched signal };
>> - 	allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
>> - 	allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
>> --	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms };
>> -+	allow $1_systemd_t $3:process { setsched rlimitinh signal_perms noatsecure };
>> - 	corecmd_shell_domtrans($1_systemd_t, $3)
>> - 	corecmd_bin_domtrans($1_systemd_t, $3)
>> -
>> -@@ -88,8 +88,11 @@ template(`systemd_role_template',`
>> -
>> - 	fs_manage_cgroup_files($1_systemd_t)
>> - 	fs_watch_cgroup_files($1_systemd_t)
>> -+	files_watch_etc_dirs($1_systemd_t)
>> -+	fs_getattr_xattr_fs($1_systemd_t)
>> -
>> - 	kernel_dontaudit_getattr_proc($1_systemd_t)
>> -+	kernel_read_network_state($1_systemd_t)
>> -
>> - 	selinux_use_status_page($1_systemd_t)
>> -
>> -@@ -1052,6 +1055,7 @@ interface(`systemd_stream_connect_userdb', `
>> - 	init_search_runtime($1)
>> - 	allow $1 systemd_userdb_runtime_t:dir list_dir_perms;
>> - 	allow $1 systemd_userdb_runtime_t:sock_file write_sock_file_perms;
>> -+	allow $1 systemd_userdb_runtime_t:lnk_file read_lnk_file_perms;
>> - 	init_unix_stream_socket_connectto($1)
>> - ')
>> -
>> -@@ -2003,3 +2007,24 @@ interface(`systemd_use_inherited_machined_ptys', `
>> - 	allow $1 systemd_machined_t:fd use;
>> - 	allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
>> - ')
>> -+
>> -+#########################################
>> -+## <summary>
>> -+##	sysadm user for systemd --user
>> -+## </summary>
>> -+## <param name="role">
>> -+##	<summary>
>> -+##  Role allowed access.
>> -+##	</summary>
>> -+## </param>
>> -+#
>> -+interface(`systemd_sysadm_user',`
>> -+	gen_require(`
>> -+		type sysadm_systemd_t;
>> -+	')
>> -+
>> -+	allow sysadm_systemd_t self:capability { mknod sys_admin };
>> -+	allow sysadm_systemd_t self:capability2 { bpf perfmon };
>> -+	allow sysadm_systemd_t self:process setrlimit;
>> -+	allow $1 sysadm_systemd_t:system reload;
>> -+')
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> similarity index 94%
>> rename from recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> rename to recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> index 8b9f98c..932047a 100644
>> --- a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> @@ -1,4 +1,4 @@
>> -From c2e99e27acc1454d792b3e8d6f24d3a2a3be29e3 Mon Sep 17 00:00:00 2001
>> +From 057e4e6a6e2e87edcd6a93dd533620700b00b1c2 Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Fri, 13 Oct 2017 07:20:40 +0000
>>   Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
>> @@ -59,10 +59,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
>> -index a32c59eb1..1c53754ee 100644
>> +index a40db8507..40cd52825 100644
>>   --- a/policy/modules/kernel/kernel.te
>>   +++ b/policy/modules/kernel/kernel.te
>> -@@ -358,6 +358,8 @@ mls_file_write_all_levels(kernel_t)
>> +@@ -370,6 +370,8 @@ mls_file_write_all_levels(kernel_t)
>>    mls_file_read_all_levels(kernel_t)
>>    mls_socket_write_all_levels(kernel_t)
>>    mls_fd_use_all_levels(kernel_t)
>> @@ -72,5 +72,5 @@ index a32c59eb1..1c53754ee 100644
>>    ifdef(`distro_redhat',`
>>    	# Bugzilla 222337
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch b/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
>> deleted file mode 100644
>> index 504e028..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
>> +++ /dev/null
>> @@ -1,132 +0,0 @@
>> -From d1c159d4400722e783d12cc3684c1cf15004f7a9 Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Thu, 24 Sep 2020 14:05:52 +0800
>> -Subject: [PATCH] policy/modules/system/sysnetwork: support priviledge
>> - separation for dhcpcd
>> -
>> -Fixes:
>> -
>> -avc:  denied  { sys_chroot } for  pid=332 comm="dhcpcd" capability=18
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>> -permissive=0
>> -
>> -avc:  denied  { setgid } for  pid=332 comm="dhcpcd" capability=6
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>> -permissive=0
>> -
>> -avc:  denied  { setuid } for  pid=332 comm="dhcpcd" capability=7
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>> -permissive=0
>> -
>> -avc:  denied  { setrlimit } for  pid=332 comm="dhcpcd"
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=process
>> -permissive=0
>> -
>> -avc:  denied  { create } for  pid=330 comm="dhcpcd"
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tclass=netlink_kobject_uevent_socket permissive=0
>> -
>> -avc:  denied  { setopt } for  pid=330 comm="dhcpcd"
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tclass=netlink_kobject_uevent_socket permissive=0
>> -
>> -avc:  denied  { bind } for  pid=330 comm="dhcpcd"
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tclass=netlink_kobject_uevent_socket permissive=0
>> -
>> -avc:  denied  { getattr } for  pid=330 comm="dhcpcd"
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tclass=netlink_kobject_uevent_socket permissive=0
>> -
>> -avc:  denied  { read } for  pid=330 comm="dhcpcd" name="n1" dev="tmpfs"
>> -ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
>> -
>> -avc:  denied  { open } for  pid=330 comm="dhcpcd"
>> -path="/run/udev/data/n1" dev="tmpfs" ino=15616
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
>> -
>> -avc:  denied  { getattr } for  pid=330 comm="dhcpcd"
>> -path="/run/udev/data/n1" dev="tmpfs" ino=15616
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
>> -
>> -avc:  denied  { connectto } for  pid=1600 comm="dhcpcd"
>> -path="/run/dhcpcd/unpriv.sock"
>> -scontext=root:sysadm_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tclass=unix_stream_socket permissive=0
>> -
>> -avc:  denied  { kill } for  pid=314 comm="dhcpcd" capability=5
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>> -permissive=0
>> -
>> -avc:  denied  { getattr } for  pid=300 comm="dhcpcd"
>> -path="net:[4026532008]" dev="nsfs" ino=4026532008
>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>> -tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/sysnetwork.te | 7 ++++++-
>> - 1 file changed, 6 insertions(+), 1 deletion(-)
>> -
>> -diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
>> -index 4c317cc4c..05a9a52b8 100644
>> ---- a/policy/modules/system/sysnetwork.te
>> -+++ b/policy/modules/system/sysnetwork.te
>> -@@ -58,10 +58,11 @@ ifdef(`distro_debian',`
>> - # DHCP client local policy
>> - #
>> - allow dhcpc_t self:capability { dac_override fsetid net_admin net_bind_service net_raw setpcap sys_nice sys_resource sys_tty_config };
>> -+allow dhcpc_t self:capability { setgid setuid sys_chroot kill };
>> - dontaudit dhcpc_t self:capability { sys_ptrace sys_tty_config };
>> - # for access("/etc/bashrc", X_OK) on Red Hat
>> - dontaudit dhcpc_t self:capability { dac_read_search sys_module };
>> --allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms };
>> -+allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms setrlimit };
>> -
>> - allow dhcpc_t self:fifo_file rw_fifo_file_perms;
>> - allow dhcpc_t self:tcp_socket create_stream_socket_perms;
>> -@@ -69,8 +70,10 @@ allow dhcpc_t self:udp_socket create_socket_perms;
>> - allow dhcpc_t self:packet_socket create_socket_perms;
>> - allow dhcpc_t self:netlink_generic_socket create_socket_perms;
>> - allow dhcpc_t self:netlink_route_socket create_netlink_socket_perms;
>> -+allow dhcpc_t self:netlink_kobject_uevent_socket create_socket_perms;
>> - allow dhcpc_t self:rawip_socket create_socket_perms;
>> - allow dhcpc_t self:unix_dgram_socket { create_socket_perms sendto };
>> -+allow dhcpc_t self:unix_stream_socket connectto;
>> -
>> - allow dhcpc_t dhcp_etc_t:dir list_dir_perms;
>> - read_lnk_files_pattern(dhcpc_t, dhcp_etc_t, dhcp_etc_t)
>> -@@ -146,6 +149,7 @@ files_manage_var_files(dhcpc_t)
>> - fs_getattr_all_fs(dhcpc_t)
>> - fs_search_auto_mountpoints(dhcpc_t)
>> - fs_search_cgroup_dirs(dhcpc_t)
>> -+fs_read_nsfs_files(dhcpc_t)
>> -
>> - term_dontaudit_use_all_ttys(dhcpc_t)
>> - term_dontaudit_use_all_ptys(dhcpc_t)
>> -@@ -181,6 +185,7 @@ ifdef(`init_systemd',`
>> - 	init_stream_connect(dhcpc_t)
>> - 	init_get_all_units_status(dhcpc_t)
>> - 	init_search_units(dhcpc_t)
>> -+	udev_read_runtime_files(dhcpc_t)
>> - ')
>> -
>> - optional_policy(`
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> similarity index 89%
>> rename from recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> rename to recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> index b4da47d..9e52b7f 100644
>> --- a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> @@ -1,4 +1,4 @@
>> -From 7bcc117ea39532427df297299c10ca1d2948a70c Mon Sep 17 00:00:00 2001
>> +From c47e288e8950e7e92e3c90972ca7ef8ef9fc6a7f Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Fri, 15 Jan 2016 03:47:05 -0500
>>   Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
>> @@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 4 insertions(+)
>>   
>>   diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
>> -index 932d1f7b3..36becaa6e 100644
>> +index 97a75cf86..fee846cb5 100644
>>   --- a/policy/modules/system/init.te
>>   +++ b/policy/modules/system/init.te
>> -@@ -219,6 +219,10 @@ mls_process_write_all_levels(init_t)
>> +@@ -229,6 +229,10 @@ mls_process_write_all_levels(init_t)
>>    mls_fd_use_all_levels(init_t)
>>    mls_process_set_level(init_t)
>>    
>> @@ -42,5 +42,5 @@ index 932d1f7b3..36becaa6e 100644
>>    # otherwise the call fails and sysvinit tries to load the policy
>>    # again when using the initramfs
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
>> deleted file mode 100644
>> index 2f94974..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
>> +++ /dev/null
>> @@ -1,34 +0,0 @@
>> -From 8343ff97a265836ba1e1e2f4159f888c21e5cabe Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Tue, 9 Feb 2021 17:31:55 +0800
>> -Subject: [PATCH] policy/modules/system/modutils: allow kmod_t to write keys
>> -
>> -Fixes:
>> -kernel: cfg80211: Problem loading in-kernel X.509 certificate (-13)
>> -
>> -avc:  denied  { write } for  pid=219 comm="modprobe"
>> -scontext=system_u:system_r:kmod_t tcontext=system_u:system_r:kmod_t
>> -tclass=key permissive=0
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/modutils.te | 1 +
>> - 1 file changed, 1 insertion(+)
>> -
>> -diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
>> -index 5b4f0aca1..008f286a8 100644
>> ---- a/policy/modules/system/modutils.te
>> -+++ b/policy/modules/system/modutils.te
>> -@@ -42,6 +42,7 @@ allow kmod_t self:udp_socket create_socket_perms;
>> - allow kmod_t self:rawip_socket create_socket_perms;
>> -
>> - allow kmod_t self:lockdown confidentiality;
>> -+allow kmod_t self:key write;
>> -
>> - # Read module config and dependency information
>> - list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
>> ---
>> -2.17.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>> similarity index 92%
>> rename from recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>> rename to recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>> index 4b768e0..1bfbb16 100644
>> --- a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>> @@ -1,4 +1,4 @@
>> -From d965e6a02854a07c4783cf33e95bf3c7cf9f56f1 Mon Sep 17 00:00:00 2001
>> +From afd35f6c73551c674e5bfe7cc1832b6a0ea717a6 Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Thu, 4 Feb 2016 06:03:19 -0500
>>   Subject: [PATCH] policy/modules/system/systemd: make systemd-tmpfiles_t domain
>> @@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 5 insertions(+)
>>   
>>   diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 1a83148c1..736107fad 100644
>> +index 4a1e06640..b44b9b2d7 100644
>>   --- a/policy/modules/system/systemd.te
>>   +++ b/policy/modules/system/systemd.te
>> -@@ -1483,6 +1483,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
>> +@@ -1694,6 +1694,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
>>    
>>    systemd_log_parse_environment(systemd_tmpfiles_t)
>>    
>> @@ -59,5 +59,5 @@ index 1a83148c1..736107fad 100644
>>    userdom_relabel_user_runtime_root_dirs(systemd_tmpfiles_t)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
>> similarity index 82%
>> rename from recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
>> rename to recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
>> index 60f7dae..800439c 100644
>> --- a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
>> @@ -1,4 +1,4 @@
>> -From 71986d0c6775408a1c89415dd5d4e7ea03302248 Mon Sep 17 00:00:00 2001
>> +From 8aa70c13d63e093bff87ea938d35dcc76e5bdd56 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Thu, 18 Jun 2020 09:59:58 +0800
>>   Subject: [PATCH] policy/modules/system/systemd: systemd-*: make systemd_*_t
>> @@ -43,12 +43,12 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 12 insertions(+)
>>   
>>   diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 736107fad..8cea6baa1 100644
>> +index b44b9b2d7..7b717d3ba 100644
>>   --- a/policy/modules/system/systemd.te
>>   +++ b/policy/modules/system/systemd.te
>> -@@ -341,6 +341,9 @@ fs_getattr_tmpfs(systemd_backlight_t)
>> +@@ -373,6 +373,9 @@ files_search_var_lib(systemd_backlight_t)
>> + fs_getattr_all_fs(systemd_backlight_t)
>>    fs_search_cgroup_dirs(systemd_backlight_t)
>> - fs_getattr_cgroup(systemd_backlight_t)
>>    
>>   +mls_file_read_to_clearance(systemd_backlight_t)
>>   +mls_file_write_to_clearance(systemd_backlight_t)
>> @@ -56,9 +56,9 @@ index 736107fad..8cea6baa1 100644
>>    #######################################
>>    #
>>    # Binfmt local policy
>> -@@ -479,6 +482,9 @@ term_use_unallocated_ttys(systemd_generator_t)
>> +@@ -528,6 +531,9 @@ term_use_unallocated_ttys(systemd_generator_t)
>>    
>> - udev_search_runtime(systemd_generator_t)
>> + udev_read_runtime_files(systemd_generator_t)
>>    
>>   +mls_file_read_to_clearance(systemd_generator_t)
>>   +mls_file_write_to_clearance(systemd_generator_t)
>> @@ -66,19 +66,19 @@ index 736107fad..8cea6baa1 100644
>>    ifdef(`distro_gentoo',`
>>    	corecmd_shell_entry_type(systemd_generator_t)
>>    ')
>> -@@ -723,6 +729,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
>> +@@ -922,6 +928,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
>>    userdom_use_user_ttys(systemd_logind_t)
>>    domain_read_all_domains_state(systemd_logind_t)
>>    
>> -+mls_file_read_to_clearance(systemd_logind_t)
>> -+mls_file_write_to_clearance(systemd_logind_t)
>> ++mls_file_read_all_levels(systemd_logind_t)
>> ++mls_file_write_all_levels(systemd_logind_t)
>>   +
>>    # Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
>>    # The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
>>    # should fix the problem where user directories in /run/user/$UID/ are not getting the proper context
>> -@@ -1204,6 +1213,9 @@ fs_getattr_tmpfs(systemd_rfkill_t)
>> - fs_search_cgroup_dirs(systemd_rfkill_t)
>> - fs_getattr_cgroup(systemd_rfkill_t)
>> +@@ -1412,6 +1421,9 @@ udev_read_runtime_files(systemd_rfkill_t)
>> +
>> + systemd_log_parse_environment(systemd_rfkill_t)
>>    
>>   +mls_file_read_to_clearance(systemd_rfkill_t)
>>   +mls_file_write_to_clearance(systemd_rfkill_t)
>> @@ -87,5 +87,5 @@ index 736107fad..8cea6baa1 100644
>>    #
>>    # Resolved local policy
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>> similarity index 78%
>> rename from recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>> rename to recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>> index 75be11d..cb3894c 100644
>> --- a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>> @@ -1,4 +1,4 @@
>> -From 511f7fdad45a150f7ea3666eb51463573eabab0a Mon Sep 17 00:00:00 2001
>> +From 2afa5753f2ef8c7cee5ad0511c521d252bedf3e5 Mon Sep 17 00:00:00 2001
>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>   Subject: [PATCH] policy/modules/system/logging: add the syslogd_t to trusted
>> @@ -14,18 +14,17 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
>>   Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>   ---
>> - policy/modules/system/logging.te | 4 ++++
>> - 1 file changed, 4 insertions(+)
>> + policy/modules/system/logging.te | 3 +++
>> + 1 file changed, 3 insertions(+)
>>   
>>   diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
>> -index 5b4b5ec5d..e67c25a9e 100644
>> +index d3b06db7d..f63965d4d 100644
>>   --- a/policy/modules/system/logging.te
>>   +++ b/policy/modules/system/logging.te
>> -@@ -498,6 +498,10 @@ fs_search_auto_mountpoints(syslogd_t)
>> - fs_search_tmpfs(syslogd_t)
>> +@@ -505,6 +505,9 @@ fs_getattr_all_fs(syslogd_t)
>> + fs_search_auto_mountpoints(syslogd_t)
>>    
>>    mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
>> -+mls_file_read_all_levels(syslogd_t)
>>   +mls_socket_write_all_levels(syslogd_t) # Need to be able to sendto dgram
>>   +mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
>>   +mls_fd_use_all_levels(syslogd_t)
>> @@ -33,5 +32,5 @@ index 5b4b5ec5d..e67c25a9e 100644
>>    term_write_console(syslogd_t)
>>    # Allow syslog to a terminal
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> similarity index 85%
>> rename from recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> rename to recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> index 5c01ef4..16f0e4e 100644
>> --- a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>> @@ -1,4 +1,4 @@
>> -From 3f875fae6d9a4538b3e7d33f30dd2a98fc9ea2bd Mon Sep 17 00:00:00 2001
>> +From f87bb3cb0843af69f9aecaef0a4052e04b15a630 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Tue, 28 May 2019 16:41:37 +0800
>>   Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
>> @@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
>> -index 36becaa6e..9c0a98eb7 100644
>> +index fee846cb5..df7f87f17 100644
>>   --- a/policy/modules/system/init.te
>>   +++ b/policy/modules/system/init.te
>> -@@ -218,6 +218,7 @@ mls_file_write_all_levels(init_t)
>> +@@ -228,6 +228,7 @@ mls_file_write_all_levels(init_t)
>>    mls_process_write_all_levels(init_t)
>>    mls_fd_use_all_levels(init_t)
>>    mls_process_set_level(init_t)
>> @@ -29,5 +29,5 @@ index 36becaa6e..9c0a98eb7 100644
>>    # MLS trusted for lowering/raising the level of files
>>    mls_file_downgrade(init_t)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
>> similarity index 88%
>> rename from recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
>> rename to recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
>> index d3ddcd2..fb56eca 100644
>> --- a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
>> @@ -1,4 +1,4 @@
>> -From a59dae035b7d5063e0f25c4cf40b5b180ad69022 Mon Sep 17 00:00:00 2001
>> +From f3c0f18b647631fd2ffc1e86c9e3f51cbf74d60f Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Wed, 3 Feb 2016 04:16:06 -0500
>>   Subject: [PATCH] policy/modules/system/init: all init_t to read any level
>> @@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 3 insertions(+)
>>   
>>   diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
>> -index 9c0a98eb7..5a19f0e43 100644
>> +index df7f87f17..671b5aef3 100644
>>   --- a/policy/modules/system/init.te
>>   +++ b/policy/modules/system/init.te
>> -@@ -224,6 +224,9 @@ mls_key_write_all_levels(init_t)
>> +@@ -234,6 +234,9 @@ mls_key_write_all_levels(init_t)
>>    mls_file_downgrade(init_t)
>>    mls_file_upgrade(init_t)
>>    
>> @@ -36,5 +36,5 @@ index 9c0a98eb7..5a19f0e43 100644
>>    # otherwise the call fails and sysvinit tries to load the policy
>>    # again when using the initramfs
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>> similarity index 87%
>> rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>> rename to recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>> index 47328be..aa02eb1 100644
>> --- a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>> @@ -1,4 +1,4 @@
>> -From 96437ba860d352304246fbe3381030da0665f239 Mon Sep 17 00:00:00 2001
>> +From cb7a4ff6081f19d05b109512275ec9a537f2f6d2 Mon Sep 17 00:00:00 2001
>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>   Date: Thu, 25 Feb 2016 04:25:08 -0500
>>   Subject: [PATCH] policy/modules/system/logging: allow auditd_t to write socket
>> @@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
>> -index e67c25a9e..f8d8b73f0 100644
>> +index f63965d4d..7e41596f4 100644
>>   --- a/policy/modules/system/logging.te
>>   +++ b/policy/modules/system/logging.te
>> -@@ -215,6 +215,8 @@ miscfiles_read_localization(auditd_t)
>> +@@ -223,6 +223,8 @@ miscfiles_read_localization(auditd_t)
>>    
>>    mls_file_read_all_levels(auditd_t)
>>    mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
>> @@ -35,5 +35,5 @@ index e67c25a9e..f8d8b73f0 100644
>>    seutil_dontaudit_read_config(auditd_t)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> similarity index 83%
>> rename from recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> rename to recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> index ad92c7f..16bdf84 100644
>> --- a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>> @@ -1,4 +1,4 @@
>> -From 102255e89863c5a31d0d6c8df67b258d819b9a68 Mon Sep 17 00:00:00 2001
>> +From 023e7b92a805103c54aec06bbd9465e4fbf7a6f2 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Thu, 31 Oct 2019 17:35:59 +0800
>>   Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
>> @@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 1 insertion(+)
>>   
>>   diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
>> -index 1c53754ee..2031576e0 100644
>> +index 40cd52825..d08610543 100644
>>   --- a/policy/modules/kernel/kernel.te
>>   +++ b/policy/modules/kernel/kernel.te
>> -@@ -360,6 +360,7 @@ mls_socket_write_all_levels(kernel_t)
>> +@@ -372,6 +372,7 @@ mls_socket_write_all_levels(kernel_t)
>>    mls_fd_use_all_levels(kernel_t)
>>    # https://bugzilla.redhat.com/show_bug.cgi?id=667370
>>    mls_file_downgrade(kernel_t)
>> @@ -27,5 +27,5 @@ index 1c53754ee..2031576e0 100644
>>    ifdef(`distro_redhat',`
>>    	# Bugzilla 222337
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>> similarity index 83%
>> rename from recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>> rename to recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>> index 96d0588..b916084 100644
>> --- a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>> @@ -1,4 +1,4 @@
>> -From 5fa9e03a3b90f97e573a7724cd9d49b53730d083 Mon Sep 17 00:00:00 2001
>> +From 55fe90eba640e6d52bb269176f45a3a5e2c3ed80 Mon Sep 17 00:00:00 2001
>>   From: Roy Li <rongqing.li@windriver.com>
>>   Date: Sat, 22 Feb 2014 13:35:38 +0800
>>   Subject: [PATCH] policy/modules/system/setrans: allow setrans_t use fd at any
>> @@ -13,10 +13,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
>> -index 25aadfc5f..564e2d4d1 100644
>> +index 12e66aad9..5510f7fac 100644
>>   --- a/policy/modules/system/setrans.te
>>   +++ b/policy/modules/system/setrans.te
>> -@@ -73,6 +73,8 @@ mls_net_receive_all_levels(setrans_t)
>> +@@ -69,6 +69,8 @@ mls_net_receive_all_levels(setrans_t)
>>    mls_socket_write_all_levels(setrans_t)
>>    mls_process_read_all_levels(setrans_t)
>>    mls_socket_read_all_levels(setrans_t)
>> @@ -26,5 +26,5 @@ index 25aadfc5f..564e2d4d1 100644
>>    selinux_compute_access_vector(setrans_t)
>>    
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>> similarity index 88%
>> rename from recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>> rename to recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>> index 8bfe607..c4dc87b 100644
>> --- a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>> @@ -1,4 +1,4 @@
>> -From fe70aaf9a104b4b0c3439d2767eccb0136951f08 Mon Sep 17 00:00:00 2001
>> +From c9afe0dc30f51f7ad7b93b8878c88df1146272a0 Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Mon, 22 Feb 2021 11:28:12 +0800
>>   Subject: [PATCH] policy/modules/system/systemd: make *_systemd_t MLS trusted
>> @@ -24,10 +24,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 3 insertions(+)
>>   
>>   diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
>> -index 5c44d8d8a..5f2038f22 100644
>> +index 325ca548b..b23b9bb0a 100644
>>   --- a/policy/modules/system/systemd.if
>>   +++ b/policy/modules/system/systemd.if
>> -@@ -171,6 +171,9 @@ template(`systemd_role_template',`
>> +@@ -196,6 +196,9 @@ template(`systemd_role_template',`
>>    		xdg_read_config_files($1_systemd_t)
>>    		xdg_read_data_files($1_systemd_t)
>>    	')
>> @@ -38,5 +38,5 @@ index 5c44d8d8a..5f2038f22 100644
>>    
>>    ######################################
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
>> similarity index 84%
>> rename from recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
>> rename to recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
>> index 7bdc9d6..ab87039 100644
>> --- a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
>> +++ b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
>> @@ -1,4 +1,4 @@
>> -From f8a12b28b70689ab520e7ae94d306afe9dcbb556 Mon Sep 17 00:00:00 2001
>> +From 7a65c9f3636b43f3a29349ea1c045d5281efa5aa Mon Sep 17 00:00:00 2001
>>   From: Yi Zhao <yi.zhao@windriver.com>
>>   Date: Sat, 18 Dec 2021 17:31:45 +0800
>>   Subject: [PATCH] policy/modules/system/logging: make syslogd_runtime_t MLS
>> @@ -23,7 +23,7 @@ dev="tmpfs" ino=9854 scontext=system_u:system_r:rpcd_t:s0-s15:c0.c1023
>>   tcontext=system_u:object_r:syslogd_var_run_t:s15:c0.c1023 tclass=dir
>>   permissive=0
>>   
>> -Upstream-Status: Pending
>> +Upstream-Status: Inappropriate [embedded specific]
>>   
>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>   ---
>> @@ -31,18 +31,18 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>    1 file changed, 2 insertions(+)
>>   
>>   diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
>> -index f8d8b73f0..badf56f16 100644
>> +index 7e41596f4..0c25457d6 100644
>>   --- a/policy/modules/system/logging.te
>>   +++ b/policy/modules/system/logging.te
>> -@@ -438,6 +438,8 @@ allow syslogd_t syslogd_runtime_t:file map;
>> +@@ -447,6 +447,8 @@ allow syslogd_t syslogd_runtime_t:file map;
>>    manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
>>    files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
>>    
>>   +mls_trusted_object(syslogd_runtime_t)
>>   +
>> - kernel_read_crypto_sysctls(syslogd_t)
>>    kernel_read_system_state(syslogd_t)
>>    kernel_read_network_state(syslogd_t)
>> + kernel_read_kernel_sysctls(syslogd_t)
>>   --
>> -2.17.1
>> +2.25.1
>>   
>> diff --git a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch b/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
>> deleted file mode 100644
>> index e0db7d3..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
>> +++ /dev/null
>> @@ -1,33 +0,0 @@
>> -From 52a4222397f5d3b28ca15a45bb2ace209a4afc3e Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Thu, 31 Mar 2022 13:09:10 -0400
>> -Subject: [PATCH] systemd: systemd-resolved is linked to libselinux
>> -
>> -systemd-resolved as of systemd 250 fails to start with this error:
>> -
>> -Failed to initialize SELinux labeling handle: No such file or directory
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/3a22db2410de479e5baa88f3f668a7a4ac198950]
>> -
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/systemd.te | 1 +
>> - 1 file changed, 1 insertion(+)
>> -
>> -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index 8cea6baa1..beb301cc6 100644
>> ---- a/policy/modules/system/systemd.te
>> -+++ b/policy/modules/system/systemd.te
>> -@@ -1261,6 +1261,7 @@ fs_getattr_cgroup(systemd_resolved_t)
>> -
>> - init_dgram_send(systemd_resolved_t)
>> -
>> -+seutil_libselinux_linked(systemd_resolved_t)
>> - seutil_read_file_contexts(systemd_resolved_t)
>> -
>> - systemd_log_parse_environment(systemd_resolved_t)
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch b/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
>> deleted file mode 100644
>> index 63da7cd..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
>> +++ /dev/null
>> @@ -1,63 +0,0 @@
>> -From 1ba0911e157c64ea15636c5707f38f1bdc9a46c8 Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Wed, 27 Apr 2022 01:09:52 -0400
>> -Subject: [PATCH] sysnetwork, systemd: allow DNS resolution over
>> - io.systemd.Resolve
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/1a0acc9c0d8c7c49ad4ca2cabd44bc66450f45e0]
>> -
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/sysnetwork.if |  1 +
>> - policy/modules/system/systemd.if    | 21 +++++++++++++++++++++
>> - 2 files changed, 22 insertions(+)
>> -
>> -diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
>> -index 8664a67c8..140d48508 100644
>> ---- a/policy/modules/system/sysnetwork.if
>> -+++ b/policy/modules/system/sysnetwork.if
>> -@@ -844,6 +844,7 @@ interface(`sysnet_dns_name_resolve',`
>> - 	ifdef(`init_systemd',`
>> - 		optional_policy(`
>> - 			systemd_dbus_chat_resolved($1)
>> -+			systemd_stream_connect_resolved($1)
>> - 		')
>> - 		# This seems needed when the mymachines NSS module is used
>> - 		optional_policy(`
>> -diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
>> -index 5f2038f22..9143fb4c0 100644
>> ---- a/policy/modules/system/systemd.if
>> -+++ b/policy/modules/system/systemd.if
>> -@@ -1835,6 +1835,27 @@ interface(`systemd_tmpfilesd_managed',`
>> - 	')
>> - ')
>> -
>> -+#######################################
>> -+## <summary>
>> -+##	Connect to systemd resolved over
>> -+##	/run/systemd/resolve/io.systemd.Resolve .
>> -+## </summary>
>> -+## <param name="domain">
>> -+##	<summary>
>> -+##	Domain allowed access.
>> -+##	</summary>
>> -+## </param>
>> -+#
>> -+interface(`systemd_stream_connect_resolved',`
>> -+	gen_require(`
>> -+		type systemd_resolved_t;
>> -+		type systemd_resolved_runtime_t;
>> -+	')
>> -+
>> -+	files_search_runtime($1)
>> -+	stream_connect_pattern($1, systemd_resolved_runtime_t, systemd_resolved_runtime_t, systemd_resolved_t)
>> -+')
>> -+
>> - ########################################
>> - ## <summary>
>> - ##   Send and receive messages from
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch b/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
>> deleted file mode 100644
>> index 88f070d..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
>> +++ /dev/null
>> @@ -1,94 +0,0 @@
>> -From 50670946f04257cc2110facbc61884e2cf0d8327 Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Fri, 6 May 2022 21:16:29 -0400
>> -Subject: [PATCH] term, init: allow systemd to watch and watch reads on
>> - unallocated ttys
>> -
>> -As of systemd 250, systemd needs to be able to add a watch on and watch
>> -reads on unallocated ttys in order to start getty.
>> -
>> -systemd[55548]: getty@tty1.service: Failed to set up standard input: Permission denied
>> -systemd[55548]: getty@tty1.service: Failed at step STDIN spawning /sbin/agetty: Permission denied
>> -
>> -time->Fri May  6 21:17:58 2022
>> -type=PROCTITLE msg=audit(1651886278.452:1770): proctitle="(agetty)"
>> -type=PATH msg=audit(1651886278.452:1770): item=0 name="/dev/tty1" inode=18 dev=00:05 mode=020620 ouid=0 ogid=5 rdev=04:01 obj=system_u:object_r:tty_device_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
>> -type=CWD msg=audit(1651886278.452:1770): cwd="/"
>> -type=SYSCALL msg=audit(1651886278.452:1770): arch=c000003e syscall=254 success=no exit=-13 a0=3 a1=60ba5c21e020 a2=18 a3=23 items=1 ppid=1 pid=55551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(agetty)" exe="/lib/systemd/systemd" subj=system_u:system_r:init_t:s0 key=(null)
>> -type=AVC msg=audit(1651886278.452:1770): avc:  denied  { watch watch_reads } for  pid=55551 comm="(agetty)" path="/dev/tty1" dev="devtmpfs" ino=18 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file permissive=0
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/308ab9f69a4623f5dace8da151e70c6316f055a8]
>> -
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/kernel/terminal.if | 38 +++++++++++++++++++++++++++++++
>> - policy/modules/system/init.te     |  2 ++
>> - 2 files changed, 40 insertions(+)
>> -
>> -diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
>> -index e8c0735eb..6e9f654ac 100644
>> ---- a/policy/modules/kernel/terminal.if
>> -+++ b/policy/modules/kernel/terminal.if
>> -@@ -1287,6 +1287,44 @@ interface(`term_dontaudit_use_unallocated_ttys',`
>> - 	dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
>> - ')
>> -
>> -+########################################
>> -+## <summary>
>> -+##	Watch unallocated ttys.
>> -+## </summary>
>> -+## <param name="domain">
>> -+##	<summary>
>> -+##	Domain allowed access.
>> -+##	</summary>
>> -+## </param>
>> -+#
>> -+interface(`term_watch_unallocated_ttys',`
>> -+	gen_require(`
>> -+		type tty_device_t;
>> -+	')
>> -+
>> -+	dev_list_all_dev_nodes($1)
>> -+	allow $1 tty_device_t:chr_file watch;
>> -+')
>> -+
>> -+########################################
>> -+## <summary>
>> -+##	Watch reads on unallocated ttys.
>> -+## </summary>
>> -+## <param name="domain">
>> -+##	<summary>
>> -+##	Domain allowed access.
>> -+##	</summary>
>> -+## </param>
>> -+#
>> -+interface(`term_watch_reads_unallocated_ttys',`
>> -+	gen_require(`
>> -+		type tty_device_t;
>> -+	')
>> -+
>> -+	dev_list_all_dev_nodes($1)
>> -+	allow $1 tty_device_t:chr_file watch_reads;
>> -+')
>> -+
>> - ########################################
>> - ## <summary>
>> - ##	Get the attributes of all tty device nodes.
>> -diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
>> -index 5a19f0e43..24cef0924 100644
>> ---- a/policy/modules/system/init.te
>> -+++ b/policy/modules/system/init.te
>> -@@ -518,6 +518,8 @@ ifdef(`init_systemd',`
>> - 	term_create_devpts_dirs(init_t)
>> - 	term_create_ptmx(init_t)
>> - 	term_create_controlling_term(init_t)
>> -+	term_watch_unallocated_ttys(init_t)
>> -+	term_watch_reads_unallocated_ttys(init_t)
>> -
>> - 	# udevd is a "systemd kobject uevent socket activated daemon"
>> - 	udev_create_kobject_uevent_sockets(init_t)
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
>> deleted file mode 100644
>> index 1029490..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
>> +++ /dev/null
>> @@ -1,32 +0,0 @@
>> -From 6f8a8ecd8bafd6e8a3515b53db2a2982a02ff254 Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Thu, 31 Mar 2022 13:22:37 -0400
>> -Subject: [PATCH] systemd: add file transition for systemd-networkd runtime
>> -
>> -systemd-networkd creates the /run/systemd/network directory which should
>> -be labeled appropriately.
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/663b62f27cb12c22f056eba9326cf3f7f78d8a9e]
>> -
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/systemd.te | 1 +
>> - 1 file changed, 1 insertion(+)
>> -
>> -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
>> -index beb301cc6..654c6a42a 100644
>> ---- a/policy/modules/system/systemd.te
>> -+++ b/policy/modules/system/systemd.te
>> -@@ -917,6 +917,7 @@ auth_use_nsswitch(systemd_networkd_t)
>> -
>> - init_dgram_send(systemd_networkd_t)
>> - init_read_state(systemd_networkd_t)
>> -+init_runtime_filetrans(systemd_networkd_t, systemd_networkd_runtime_t, dir)
>> -
>> - logging_send_syslog_msg(systemd_networkd_t)
>> -
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch b/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
>> deleted file mode 100644
>> index f84eb4a..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
>> +++ /dev/null
>> @@ -1,29 +0,0 @@
>> -From 2e3f371b59bee343c42e4c69495df0f3719b6e24 Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Sat, 2 Apr 2022 15:44:01 -0400
>> -Subject: [PATCH] systemd: add missing file context for /run/systemd/network
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/f2fe1ae15485da7b6269b7d0d7dbed9a834f1876]
>> -
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/systemd.fc | 1 +
>> - 1 file changed, 1 insertion(+)
>> -
>> -diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
>> -index 34db8c034..d21914227 100644
>> ---- a/policy/modules/system/systemd.fc
>> -+++ b/policy/modules/system/systemd.fc
>> -@@ -85,6 +85,7 @@ HOME_DIR/\.local/share/systemd(/.*)?		gen_context(system_u:object_r:systemd_data
>> -
>> - /run/systemd/ask-password(/.*)?	gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
>> - /run/systemd/ask-password-block(/.*)?	gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
>> -+/run/systemd/network(/.*)?  gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
>> - /run/systemd/resolve(/.*)?  gen_context(system_u:object_r:systemd_resolved_runtime_t,s0)
>> - /run/systemd/seats(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
>> - /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch b/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
>> deleted file mode 100644
>> index 0aaf096..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
>> +++ /dev/null
>> @@ -1,38 +0,0 @@
>> -From 143d339b2e6611c56cd0210279757ebee9632731 Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Thu, 19 May 2022 11:42:51 -0400
>> -Subject: [PATCH] systemd: add file contexts for systemd-network-generator
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/73adba0a39b7409bc4bbfa0e962108c2b1e5f2a5]
>> -
>> -Thanks-To: Zhao Yi
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/systemd.fc | 2 ++
>> - 1 file changed, 2 insertions(+)
>> -
>> -diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
>> -index d21914227..1a35bd65c 100644
>> ---- a/policy/modules/system/systemd.fc
>> -+++ b/policy/modules/system/systemd.fc
>> -@@ -35,6 +35,7 @@
>> - /usr/lib/systemd/systemd-machined	--	gen_context(system_u:object_r:systemd_machined_exec_t,s0)
>> - /usr/lib/systemd/systemd-modules-load	--	gen_context(system_u:object_r:systemd_modules_load_exec_t,s0)
>> - /usr/lib/systemd/systemd-networkd	--	gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
>> -+/usr/lib/systemd/systemd-network-generator	--	gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
>> - /usr/lib/systemd/systemd-pstore		--	gen_context(system_u:object_r:systemd_pstore_exec_t,s0)
>> - /usr/lib/systemd/systemd-resolved	--	gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
>> - /usr/lib/systemd/systemd-rfkill		--	gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
>> -@@ -60,6 +61,7 @@ HOME_DIR/\.local/share/systemd(/.*)?		gen_context(system_u:object_r:systemd_data
>> - /usr/lib/systemd/system/systemd-backlight.*	--	gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
>> - /usr/lib/systemd/system/systemd-binfmt.*	--	gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
>> - /usr/lib/systemd/system/systemd-networkd.*		gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
>> -+/usr/lib/systemd/system/systemd-network-generator.*		gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
>> - /usr/lib/systemd/system/systemd-rfkill.*	--	gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
>> - /usr/lib/systemd/system/systemd-socket-proxyd\.service	--	gen_context(system_u:object_r:systemd_socket_proxyd_unit_file_t,s0)
>> -
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
>> deleted file mode 100644
>> index 259863c..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
>> +++ /dev/null
>> @@ -1,34 +0,0 @@
>> -From 6508bc8a3440525384fcfcd8ad55a4cd5c79b912 Mon Sep 17 00:00:00 2001
>> -From: Kenton Groombridge <me@concord.sh>
>> -Date: Thu, 19 May 2022 11:43:44 -0400
>> -Subject: [PATCH] systemd, udev: allow udev to read systemd-networkd runtime
>> -
>> -udev searches for .link files and applies custom udev rules to devices
>> -as they come up.
>> -
>> -Upstream-Status: Backport
>> -[https://github.com/SELinuxProject/refpolicy/commit/998ef975f38c70d57e7220b88ae5e62c88ebb770]
>> -
>> -Thanks-To: Zhao Yi
>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/udev.te | 2 ++
>> - 1 file changed, 2 insertions(+)
>> -
>> -diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
>> -index 4c5a690fb..8e243c0f2 100644
>> ---- a/policy/modules/system/udev.te
>> -+++ b/policy/modules/system/udev.te
>> -@@ -270,6 +270,8 @@ ifdef(`init_systemd',`
>> - 	systemd_read_hwdb(udev_t)
>> - 	systemd_read_logind_sessions_files(udev_t)
>> - 	systemd_read_logind_runtime_files(udev_t)
>> -+	# udev searches for .link files and applies custom udev rules
>> -+	systemd_read_networkd_runtime(udev_t)
>> -
>> - 	optional_policy(`
>> - 		init_dbus_chat(udev_t)
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch b/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
>> deleted file mode 100644
>> index 6535a4b..0000000
>> --- a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
>> +++ /dev/null
>> @@ -1,29 +0,0 @@
>> -From 3e3ec39659ae068d20efbb5f13054d90960c3c3f Mon Sep 17 00:00:00 2001
>> -From: Yi Zhao <yi.zhao@windriver.com>
>> -Date: Thu, 19 May 2022 16:51:49 +0800
>> -Subject: [PATCH] fc/fstools: apply policy to findfs alternative
>> -
>> -Add file context for findfs alternative which is provided by util-linux.
>> -
>> -Upstream-Status: Inappropriate [embedded specific]
>> -
>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>> ----
>> - policy/modules/system/fstools.fc | 1 +
>> - 1 file changed, 1 insertion(+)
>> -
>> -diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
>> -index bef711850..91be0ef3d 100644
>> ---- a/policy/modules/system/fstools.fc
>> -+++ b/policy/modules/system/fstools.fc
>> -@@ -77,6 +77,7 @@
>> - /usr/sbin/fdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> - /usr/sbin/fdisk\.util-linux			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> - /usr/sbin/findfs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> -+/usr/sbin/findfs\.util-linux		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> - /usr/sbin/fsck.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> - /usr/sbin/gdisk			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> - /usr/sbin/hdparm		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
>> ---
>> -2.25.1
>> -
>> diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
>> index bb0c0dd..a51312f 100644
>> --- a/recipes-security/refpolicy/refpolicy_common.inc
>> +++ b/recipes-security/refpolicy/refpolicy_common.inc
>> @@ -7,10 +7,10 @@ PROVIDES = "virtual/refpolicy"
>>   RPROVIDES:${PN} = "refpolicy"
>>   
>>   # Specific config files for Poky
>> -SRC_URI += "file://customizable_types  \
>> -	    file://setrans-mls.conf  \
>> -	    file://setrans-mcs.conf  \
>> -	   "
>> +SRC_URI += "file://customizable_types \
>> +            file://setrans-mls.conf \
>> +            file://setrans-mcs.conf \
>> +           "
>>   
>>   # Base patches applied to all Yocto-based platforms.  Your own version of
>>   # refpolicy should provide a version of these and place them in your own
>> @@ -49,64 +49,49 @@ SRC_URI += " \
>>           file://0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch \
>>           file://0032-policy-modules-system-logging-fix-auditd-startup-fai.patch \
>>           file://0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch \
>> -        file://0034-policy-modules-system-modutils-allow-mod_t-to-access.patch \
>> -        file://0035-policy-modules-system-getty-allow-getty_t-to-search-.patch \
>> -        file://0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
>> -        file://0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch \
>> -        file://0038-policy-modules-system-systemd-enable-support-for-sys.patch \
>> -        file://0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch \
>> -        file://0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch \
>> -        file://0041-policy-modules-system-logging-fix-syslogd-failures-f.patch \
>> -        file://0042-policy-modules-system-systemd-systemd-user-fixes.patch \
>> -        file://0043-policy-modules-system-sysnetwork-support-priviledge-.patch \
>> -        file://0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch \
>> -        file://0045-policy-modules-system-systemd-allow-systemd_logind_t.patch \
>> -        file://0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
>> -        file://0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
>> -        file://0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
>> -        file://0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
>> -        file://0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
>> -        file://0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
>> -        file://0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
>> -        file://0053-policy-modules-system-systemd-systemd-make-systemd_-.patch \
>> -        file://0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
>> -        file://0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
>> -        file://0056-policy-modules-system-init-all-init_t-to-read-any-le.patch \
>> -        file://0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
>> -        file://0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
>> -        file://0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
>> -        file://0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
>> -        file://0061-policy-modules-system-logging-make-syslogd_runtime_t.patch \
>> -        file://0062-systemd-systemd-resolved-is-linked-to-libselinux.patch \
>> -        file://0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch \
>> -        file://0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch \
>> -        file://0065-systemd-add-file-transition-for-systemd-networkd-run.patch \
>> -        file://0066-systemd-add-missing-file-context-for-run-systemd-net.patch \
>> -        file://0067-systemd-add-file-contexts-for-systemd-network-genera.patch \
>> -        file://0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch \
>> -        file://0069-fc-fstools-apply-policy-to-findfs-alternative.patch \
>> +        file://0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
>> +        file://0035-policy-modules-system-systemd-enable-support-for-sys.patch \
>> +        file://0036-policy-modules-system-systemd-allow-systemd_logind_t.patch \
>> +        file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
>> +        file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
>> +        file://0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
>> +        file://0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
>> +        file://0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
>> +        file://0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
>> +        file://0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
>> +        file://0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
>> +        file://0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
>> +        file://0046-policy-modules-system-systemd-systemd-make-systemd_-.patch \
>> +        file://0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
>> +        file://0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
>> +        file://0049-policy-modules-system-init-all-init_t-to-read-any-le.patch \
>> +        file://0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
>> +        file://0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
>> +        file://0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
>> +        file://0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
>> +        file://0054-policy-modules-system-logging-make-syslogd_runtime_t.patch \
>>           "
>>   
>>   S = "${WORKDIR}/refpolicy"
>>   
>> -CONFFILES:${PN} += "${sysconfdir}/selinux/config"
>> +CONFFILES:${PN} = "${sysconfdir}/selinux/config"
>>   FILES:${PN} += " \
>> -	${sysconfdir}/selinux/${POLICY_NAME}/ \
>> -	${datadir}/selinux/${POLICY_NAME}/*.pp \
>> -	${localstatedir}/lib/selinux/${POLICY_NAME}/ \
>> -	"
>> +    ${sysconfdir}/selinux/${POLICY_NAME}/ \
>> +    ${datadir}/selinux/${POLICY_NAME}/*.pp \
>> +    ${localstatedir}/lib/selinux/${POLICY_NAME}/ \
>> +    "
>>   FILES:${PN}-dev =+ " \
>> -        ${datadir}/selinux/${POLICY_NAME}/include/ \
>> -        ${sysconfdir}/selinux/sepolgen.conf \
>> -"
>> +    ${datadir}/selinux/${POLICY_NAME}/include/ \
>> +    ${sysconfdir}/selinux/sepolgen.conf \
>> +    "
>>   
>>   EXTRANATIVEPATH += "bzip2-native"
>>   
>> -DEPENDS += "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
>> +DEPENDS = "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
>>   
>> -RDEPENDS:${PN}-dev =+ " \
>> -        python3-core \
>> -"
>> +RDEPENDS:${PN}-dev = " \
>> +    python3-core \
>> +    "
>>   
>>   PACKAGE_ARCH = "${MACHINE_ARCH}"
>>   
>> @@ -129,83 +114,83 @@ POLICY_MLS_SENS ?= "16"
>>   POLICY_MLS_CATS ?= "1024"
>>   POLICY_MCS_CATS ?= "1024"
>>   
>> -EXTRA_OEMAKE += "NAME=${POLICY_NAME} \
>> -	TYPE=${POLICY_TYPE} \
>> -	DISTRO=${POLICY_DISTRO} \
>> -	UBAC=${POLICY_UBAC} \
>> -	UNK_PERMS=${POLICY_UNK_PERMS} \
>> -	DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
>> -	SYSTEMD=${POLICY_SYSTEMD} \
>> -	MONOLITHIC=${POLICY_MONOLITHIC} \
>> -	CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
>> -	QUIET=${POLICY_QUIET} \
>> -	MLS_SENS=${POLICY_MLS_SENS} \
>> -	MLS_CATS=${POLICY_MLS_CATS} \
>> -	MCS_CATS=${POLICY_MCS_CATS}"
>> +EXTRA_OEMAKE = "NAME=${POLICY_NAME} \
>> +    TYPE=${POLICY_TYPE} \
>> +    DISTRO=${POLICY_DISTRO} \
>> +    UBAC=${POLICY_UBAC} \
>> +    UNK_PERMS=${POLICY_UNK_PERMS} \
>> +    DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
>> +    SYSTEMD=${POLICY_SYSTEMD} \
>> +    MONOLITHIC=${POLICY_MONOLITHIC} \
>> +    CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
>> +    QUIET=${POLICY_QUIET} \
>> +    MLS_SENS=${POLICY_MLS_SENS} \
>> +    MLS_CATS=${POLICY_MLS_CATS} \
>> +    MCS_CATS=${POLICY_MCS_CATS}"
>>   
>>   EXTRA_OEMAKE += "tc_usrbindir=${STAGING_BINDIR_NATIVE}"
>>   EXTRA_OEMAKE += "OUTPUT_POLICY=`${STAGING_BINDIR_NATIVE}/checkpolicy -V | cut -d' ' -f1`"
>>   EXTRA_OEMAKE += "CC='${BUILD_CC}' CFLAGS='${BUILD_CFLAGS}' PYTHON='${PYTHON}'"
>>   
>> -python __anonymous () {
>> +python __anonymous() {
>>       import re
>>   
>> -    # make sure DEFAULT_ENFORCING is something sane
>> +    # Make sure DEFAULT_ENFORCING is something sane
>>       if not re.match('^(enforcing|permissive|disabled)$',
>>                       d.getVar('DEFAULT_ENFORCING'),
>>                       flags=0):
>>           d.setVar('DEFAULT_ENFORCING', 'permissive')
>>   }
>>   
>> -disable_policy_modules () {
>> -	for module in ${PURGE_POLICY_MODULES} ; do
>> -		sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" ${S}/policy/modules.conf
>> -	done
>> +disable_policy_modules() {
>> +    for module in ${PURGE_POLICY_MODULES} ; do
>> +        sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" ${S}/policy/modules.conf
>> +    done
>>   }
>>   
>>   do_compile() {
>> -	if [ -f "${WORKDIR}/modules.conf" ] ; then
>> -		cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
>> -	fi
>> -	oe_runmake conf
>> -	disable_policy_modules
>> -	oe_runmake policy
>> +    if [ -f "${WORKDIR}/modules.conf" ] ; then
>> +        cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
>> +    fi
>> +    oe_runmake conf
>> +    disable_policy_modules
>> +    oe_runmake policy
>>   }
>>   
>> -prepare_policy_store () {
>> -	oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>> -	POL_PRIORITY=100
>> -	POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>> -	POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>> -	POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>> -
>> -	# Prepare to create policy store
>> -	mkdir -p ${POL_STORE}
>> -	mkdir -p ${POL_ACTIVE_MODS}
>> -
>> -	# get hll type from suffix on base policy module
>> -	HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
>> -	HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>> -
>> -	for i in ${POL_SRC}/*.${HLL_TYPE}; do
>> -		MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
>> -		MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
>> -		mkdir -p ${MOD_DIR}
>> -		echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>> -		if ! bzip2 -t $i >/dev/null 2>&1; then
>> -			${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
>> -			bzip2 -f $i && mv -f $i.bz2 $i
>> -		else
>> -			bunzip2 --stdout $i | \
>> -				${HLL_BIN} | \
>> -				bzip2 --stdout > ${MOD_DIR}/cil
>> -		fi
>> -		cp $i ${MOD_DIR}/hll
>> -	done
>> +prepare_policy_store() {
>> +    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>> +    POL_PRIORITY=100
>> +    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>> +    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>> +    POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>> +
>> +    # Prepare to create policy store
>> +    mkdir -p ${POL_STORE}
>> +    mkdir -p ${POL_ACTIVE_MODS}
>> +
>> +    # Get hll type from suffix on base policy module
>> +    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
>> +    HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>> +
>> +    for i in ${POL_SRC}/*.${HLL_TYPE}; do
>> +        MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
>> +        MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
>> +        mkdir -p ${MOD_DIR}
>> +        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>> +        if ! bzip2 -t $i >/dev/null 2>&1; then
>> +            ${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
>> +            bzip2 -f $i && mv -f $i.bz2 $i
>> +        else
>> +            bunzip2 --stdout $i | \
>> +                ${HLL_BIN} | \
>> +                bzip2 --stdout > ${MOD_DIR}/cil
>> +        fi
>> +        cp $i ${MOD_DIR}/hll
>> +    done
>>   }
>>   
>> -rebuild_policy () {
>> -	cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
>> +rebuild_policy() {
>> +    cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
>>   module-store = direct
>>   [setfiles]
>>   path = ${STAGING_DIR_NATIVE}${base_sbindir_native}/setfiles
>> @@ -219,29 +204,29 @@ args = \$@
>>   policy-version = 33
>>   EOF
>>   
>> -	# Create policy store and build the policy
>> -	semodule -p ${D} -s ${POLICY_NAME} -n -B
>> -	rm -f ${D}${sysconfdir}/selinux/semanage.conf
>> -	# no need to leave final dir created by semanage laying around
>> -	rm -rf ${D}${localstatedir}/lib/selinux/final
>> +    # Create policy store and build the policy
>> +    semodule -p ${D} -s ${POLICY_NAME} -n -B
>> +    rm -f ${D}${sysconfdir}/selinux/semanage.conf
>> +    # No need to leave final dir created by semanage laying around
>> +    rm -rf ${D}${localstatedir}/lib/selinux/final
>>   }
>>   
>> -install_misc_files () {
>> -	cat ${WORKDIR}/customizable_types >> \
>> -		${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
>> +install_misc_files() {
>> +    cat ${WORKDIR}/customizable_types >> \
>> +        ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
>>   
>> -	# install setrans.conf for mls/mcs policy
>> -	if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
>> -		install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
>> -			${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
>> -	fi
>> +    # Install setrans.conf for mls/mcs policy
>> +    if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
>> +        install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
>> +            ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
>> +    fi
>>   
>> -	# install policy headers
>> -	oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
>> +    # Install policy headers
>> +    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
>>   }
>>   
>> -install_config () {
>> -	echo "\
>> +install_config() {
>> +    echo "\
>>   # This file controls the state of SELinux on the system.
>>   # SELINUX= can take one of these three values:
>>   #     enforcing - SELinux security policy is enforced.
>> @@ -256,22 +241,22 @@ SELINUX=${DEFAULT_ENFORCING}
>>   #     mcs - Multi Category Security protection.
>>   SELINUXTYPE=${POLICY_NAME}
>>   " > ${WORKDIR}/config
>> -	install -d ${D}/${sysconfdir}/selinux
>> -	install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
>> +    install -d ${D}/${sysconfdir}/selinux
>> +    install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
>>   }
>>   
>> -do_install () {
>> -	prepare_policy_store
>> -	rebuild_policy
>> -	install_misc_files
>> -	install_config
>> +do_install() {
>> +    prepare_policy_store
>> +    rebuild_policy
>> +    install_misc_files
>> +    install_config
>>   }
>>   
>> -do_install:append(){
>> -	# While building policies on target, Makefile will be searched from SELINUX_DEVEL_PATH
>> -	echo "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > ${D}${sysconfdir}/selinux/sepolgen.conf
>> +do_install:append() {
>> +    # While building policies on target, Makefile will be searched from SELINUX_DEVEL_PATH
>> +    echo "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > ${D}${sysconfdir}/selinux/sepolgen.conf
>>   }
>>   
>> -sysroot_stage_all:append () {
>> -	sysroot_stage_dir ${D}${sysconfdir} ${SYSROOT_DESTDIR}${sysconfdir}
>> +sysroot_stage_all:append() {
>> +    sysroot_stage_dir ${D}${sysconfdir} ${SYSROOT_DESTDIR}${sysconfdir}
>>   }
>> diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
>> index 9e78aed..54e0890 100644
>> --- a/recipes-security/refpolicy/refpolicy_git.inc
>> +++ b/recipes-security/refpolicy/refpolicy_git.inc
>> @@ -1,8 +1,8 @@
>> -PV = "2.20210908+git${SRCPV}"
>> +PV = "2.20221101+git${SRCPV}"
>>   
>>   SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=master;name=refpolicy;destsuffix=refpolicy"
>>   
>> -SRCREV_refpolicy ?= "23a8d103f379361cfe63a9ee064564624e108196"
>> +SRCREV_refpolicy ?= "03d486e306555da161b653c88e804ce23f3a0ea4"
>>   
>>   UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
>>   
>> -- 
>> 2.25.1
>>


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [yocto] [meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git
       [not found]     ` <17257B1B9EFC9AB1.28792@lists.yoctoproject.org>
@ 2022-11-09  3:47       ` Yi Zhao
  0 siblings, 0 replies; 6+ messages in thread
From: Yi Zhao @ 2022-11-09  3:47 UTC (permalink / raw)
  To: Joe MacDonald; +Cc: yocto, joe_macdonald, joe


On 11/8/22 10:29, Yi Zhao wrote:
>
> On 11/8/22 03:33, Joe MacDonald wrote:
>> Hi Yi,
>>
>> Can you explain the reason for moving the dbus module to the list of
>> always-on modules and out of the systemd conditional for
>> refpolicy-minimum_git.bb?
>
>
> This is introduced by commit e1cdd5a94493db1da7d4a815760453a54c45f11c 
> in refpolicy:
>
> commit e1cdd5a94493db1da7d4a815760453a54c45f11c
> Author: Kenton Groombridge <me@concord.sh>
> Date:   Sun Oct 2 19:07:08 2022 -0400
>
>     dbus, init, mount, rpc: minor fixes for mount.nfs
>
>     mount.nfs will attempt to start the rpc-statd.service unit but 
> will fall
>     back to executing start-statd directly. Dontaudit attempts to 
> start the
>     unit and perform a domain transition to start-statd from mount.
>
>     Signed-off-by: Kenton Groombridge <me@concord.sh>
>
>
> diff --git a/policy/modules/system/mount.te 
> b/policy/modules/system/mount.te
> index e75a9eeed..d028723ce 100644
> --- a/policy/modules/system/mount.te
> +++ b/policy/modules/system/mount.te
> [snip]
> @@ -141,6 +145,8 @@ selinux_getattr_fs(mount_t)
>
>  userdom_use_all_users_fds(mount_t)
>
> +dbus_dontaudit_write_system_bus_runtime_named_sockets(mount_t)
> +
>  ifdef(`distro_redhat',`
>         optional_policy(`
>                 auth_read_pam_console_data(mount_t)
> @@ -210,6 +216,10 @@ optional_policy(`
>         puppet_rw_tmp(mount_t)
>  ')
> [snip]
>
>
> Now dbus module is required by mount module.


Hi Joe,


We could make this interface optional by optional_policy. I think it's 
better than adding dbus to core module.

I will send V2.


//Yi


>
>
> //Yi
>
>
>>
>> Thanks,
>> -Joe.
>>
>> [[meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 
>> 20221101+git] On 22.11.02 (Wed 15:30) Yi Zhao wrote:
>>
>>> * Update to latest git rev.
>>> * Drop obsolete and useless patches.
>>> * Rebase patches.
>>>
>>> Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ---
>>>   .../refpolicy/refpolicy-minimum_git.bb        |  93 +++----
>>>   .../refpolicy/refpolicy-targeted_git.bb       |   1 -
>>>   ...tile-alias-common-var-volatile-paths.patch |   4 +-
>>>   ...inimum-make-sysadmin-module-optional.patch |  12 +-
>>>   ...ed-make-unconfined_u-the-default-sel.patch |  12 +-
>>>   ...box-set-aliases-for-bin-sbin-and-usr.patch |   4 +-
>>>   ...icy-minimum-make-xdg-module-optional.patch |   8 +-
>>>   ...ed-add-capability2-bpf-and-perfmon-f.patch |  52 ----
>>>   ...y-policy-to-common-yocto-hostname-al.patch |   4 +-
>>>   ...efpolicy-minimum-enable-nscd_use_shm.patch |  35 ---
>>>   ...sr-bin-bash-context-to-bin-bash.bash.patch |   6 +-
>>>   ...abel-resolv.conf-in-var-run-properly.patch |   4 +-
>>>   ...-apply-login-context-to-login.shadow.patch |   4 +-
>>>   ...-fc-hwclock-add-hwclock-alternatives.patch |   4 +-
>>>   ...g-apply-policy-to-dmesg-alternatives.patch |   4 +-
>>>   ...ssh-apply-policy-to-ssh-alternatives.patch |   8 +-
>>>   ...ply-policy-to-network-commands-alter.patch |   4 +-
>>>   ...v-apply-policy-to-udevadm-in-libexec.patch |   4 +-
>>>   ...ply-rpm_exec-policy-to-cpio-binaries.patch |   8 +-
>>>   ...c-su-apply-policy-to-su-alternatives.patch |   4 +-
>>>   ...fc-fstools-fix-real-path-for-fstools.patch |  17 +-
>>>   ...fix-update-alternatives-for-sysvinit.patch |  10 +-
>>>   ...l-apply-policy-to-brctl-alternatives.patch |   4 +-
>>>   ...apply-policy-to-nologin-alternatives.patch |   8 +-
>>>   ...apply-policy-to-sulogin-alternatives.patch |   4 +-
>>>   ...tp-apply-policy-to-ntpd-alternatives.patch |   4 +-
>>>   ...pply-policy-to-kerberos-alternatives.patch |   4 +-
>>>   ...ap-apply-policy-to-ldap-alternatives.patch |   4 +-
>>>   ...ply-policy-to-postgresql-alternative.patch |   4 +-
>>>   ...-apply-policy-to-screen-alternatives.patch |   4 +-
>>>   ...ply-policy-to-usermanage-alternative.patch |  26 +-
>>>   ...etty-add-file-context-to-start_getty.patch |   4 +-
>>>   ...k-apply-policy-to-vlock-alternatives.patch |   4 +-
>>>   ...for-init-scripts-and-systemd-service.patch |   8 +-
>>>   ...bs_dist-set-aliase-for-root-director.patch |   4 +-
>>>   ...ystem-logging-add-rules-for-the-syml.patch |   6 +-
>>>   ...ystem-logging-add-rules-for-syslogd-.patch |   8 +-
>>>   ...ernel-files-add-rules-for-the-symlin.patch |  26 +-
>>>   ...ystem-logging-fix-auditd-startup-fai.patch |  10 +-
>>>   ...ernel-terminal-don-t-audit-tty_devic.patch |   6 +-
>>>   ...rvices-rpcbind-allow-rpcbind_t-to-c.patch} |  23 +-
>>>   ...ystem-modutils-allow-mod_t-to-access.patch |  67 -----
>>>   ...ystem-getty-allow-getty_t-to-search-.patch |  32 ---
>>>   ...stem-systemd-enable-support-for-sys.patch} |  10 +-
>>>   ...stem-systemd-allow-systemd_logind_t.patch} |   8 +-
>>>   ...dmin-usermanage-allow-useradd-to-rel.patch |  71 -----
>>>   ...oles-sysadm-allow-sysadm-to-use-init.patch |  36 +++
>>>   ...es-system-systemd-systemd-user-fixes.patch |  84 ++++++
>>>   ...stem-mount-make-mount_t-domain-MLS-.patch} |   8 +-
>>>   ...ystem-systemd-fix-systemd-resolved-s.patch |  60 ----
>>>   ...les-sysadm-MLS-sysadm-rw-to-clearan.patch} |  10 +-
>>>   ...ystem-systemd-allow-systemd_-_t-to-g.patch | 156 -----------
>>>   ...rvices-rpc-make-nfsd_t-domain-MLS-t.patch} |  12 +-
>>>   ...ystem-logging-fix-syslogd-failures-f.patch |  55 ----
>>>   ...min-dmesg-make-dmesg_t-MLS-trusted-.patch} |   6 +-
>>>   ...es-system-systemd-systemd-user-fixes.patch | 172 ------------
>>>   ...rnel-kernel-make-kernel_t-MLS-trust.patch} |   8 +-
>>>   ...ystem-sysnetwork-support-priviledge-.patch | 132 ---------
>>>   ...stem-init-make-init_t-MLS-trusted-f.patch} |   8 +-
>>>   ...ystem-modutils-allow-kmod_t-to-write.patch |  34 ---
>>>   ...stem-systemd-make-systemd-tmpfiles_.patch} |   8 +-
>>>   ...stem-systemd-systemd-make-systemd_-.patch} |  26 +-
>>>   ...stem-logging-add-the-syslogd_t-to-t.patch} |  15 +-
>>>   ...stem-init-make-init_t-MLS-trusted-f.patch} |   8 +-
>>>   ...stem-init-all-init_t-to-read-any-le.patch} |   8 +-
>>>   ...stem-logging-allow-auditd_t-to-writ.patch} |   8 +-
>>>   ...rnel-kernel-make-kernel_t-MLS-trust.patch} |   8 +-
>>>   ...stem-setrans-allow-setrans_t-use-fd.patch} |   8 +-
>>>   ...stem-systemd-make-_systemd_t-MLS-tr.patch} |   8 +-
>>>   ...stem-logging-make-syslogd_runtime_t.patch} |  12 +-
>>>   ...emd-resolved-is-linked-to-libselinux.patch |  33 ---
>>>   ...md-allow-DNS-resolution-over-io.syst.patch |  63 -----
>>>   ...systemd-to-watch-and-watch-reads-on-.patch |  94 -------
>>>   ...-transition-for-systemd-networkd-run.patch |  32 ---
>>>   ...ing-file-context-for-run-systemd-net.patch |  29 --
>>>   ...-contexts-for-systemd-network-genera.patch |  38 ---
>>>   ...ow-udev-to-read-systemd-networkd-run.patch |  34 ---
>>>   ...s-apply-policy-to-findfs-alternative.patch |  29 --
>>>   .../refpolicy/refpolicy_common.inc            | 261 
>>> +++++++++---------
>>>   recipes-security/refpolicy/refpolicy_git.inc  |   4 +-
>>>   80 files changed, 521 insertions(+), 1637 deletions(-)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch 
>>> => 0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch} 
>>> (52%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0038-policy-modules-system-systemd-enable-support-for-sys.patch 
>>> => 0035-policy-modules-system-systemd-enable-support-for-sys.patch} 
>>> (91%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0045-policy-modules-system-systemd-allow-systemd_logind_t.patch 
>>> => 0036-policy-modules-system-systemd-allow-systemd_logind_t.patch} 
>>> (88%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
>>>   create mode 100644 
>>> recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
>>>   create mode 100644 
>>> recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch 
>>> => 0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch} 
>>> (84%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch 
>>> => 0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch} 
>>> (83%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch 
>>> => 0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch} 
>>> (84%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch 
>>> => 0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch} 
>>> (90%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> => 0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch} 
>>> (94%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> => 0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch} 
>>> (89%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch 
>>> => 0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch} 
>>> (92%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0053-policy-modules-system-systemd-systemd-make-systemd_-.patch 
>>> => 0046-policy-modules-system-systemd-systemd-make-systemd_-.patch} 
>>> (82%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch 
>>> => 0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch} 
>>> (78%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> => 0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch} 
>>> (85%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0056-policy-modules-system-init-all-init_t-to-read-any-le.patch 
>>> => 0049-policy-modules-system-init-all-init_t-to-read-any-le.patch} 
>>> (88%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch 
>>> => 0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch} 
>>> (87%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> => 0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch} 
>>> (83%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch 
>>> => 0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch} 
>>> (83%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch 
>>> => 0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch} 
>>> (88%)
>>>   rename 
>>> recipes-security/refpolicy/refpolicy/{0061-policy-modules-system-logging-make-syslogd_runtime_t.patch 
>>> => 0054-policy-modules-system-logging-make-syslogd_runtime_t.patch} 
>>> (84%)
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
>>>   delete mode 100644 
>>> recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
>>>
>>> diff --git a/recipes-security/refpolicy/refpolicy-minimum_git.bb 
>>> b/recipes-security/refpolicy/refpolicy-minimum_git.bb
>>> index 2e95b9f..5940ce2 100644
>>> --- a/recipes-security/refpolicy/refpolicy-minimum_git.bb
>>> +++ b/recipes-security/refpolicy/refpolicy-minimum_git.bb
>>> @@ -14,29 +14,29 @@ domains are unconfined. \
>>>   SRC_URI += " \
>>> file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
>>> file://0002-refpolicy-minimum-make-xdg-module-optional.patch \
>>> - file://0003-refpolicy-minimum-enable-nscd_use_shm.patch \
>>>           "
>>>     POLICY_NAME = "minimum"
>>>     CORE_POLICY_MODULES = "unconfined \
>>> -    selinuxutil \
>>> -    storage \
>>> -    sysnetwork \
>>> -    application \
>>> -    libraries \
>>> -    miscfiles \
>>> -    logging \
>>> -    userdomain \
>>> -    init \
>>> -    mount \
>>> -    modutils \
>>> -    getty \
>>> -    authlogin \
>>> -    locallogin \
>>> -    "
>>> -#systemd dependent policy modules
>>> -CORE_POLICY_MODULES += "${@bb.utils.contains('DISTRO_FEATURES', 
>>> 'systemd', 'clock systemd udev fstools dbus', '', d)}"
>>> +    selinuxutil \
>>> +    storage \
>>> +    sysnetwork \
>>> +    application \
>>> +    libraries \
>>> +    miscfiles \
>>> +    logging \
>>> +    userdomain \
>>> +    init \
>>> +    mount \
>>> +    modutils \
>>> +    getty \
>>> +    authlogin \
>>> +    locallogin \
>>> +    dbus \
>>> +    "
>>> +# systemd dependent policy modules
>>> +CORE_POLICY_MODULES += "${@bb.utils.contains('DISTRO_FEATURES', 
>>> 'systemd', 'clock systemd udev fstools', '', d)}"
>>>     # nscd caches libc-issued requests to the name service.
>>>   # Without nscd.pp, commands want to use these caches will be blocked.
>>> @@ -60,39 +60,38 @@ EXTRA_POLICY_MODULES += "modutils consoletype 
>>> hostname netutils"
>>>   #
>>>   # PURGE_POLICY_MODULES += "xdg xen"
>>>   -
>>>   POLICY_MODULES_MIN = "${CORE_POLICY_MODULES} ${EXTRA_POLICY_MODULES}"
>>>   -# re-write the same func from refpolicy_common.inc
>>> -prepare_policy_store () {
>>> -    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>>> -    POL_PRIORITY=100
>>> -    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>>> -    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>>> - POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>>> +# Re-write the same func from refpolicy_common.inc
>>> +prepare_policy_store() {
>>> +    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>>> +    POL_PRIORITY=100
>>> +    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>>> +    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>>> + POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>>>   -    # Prepare to create policy store
>>> -    mkdir -p ${POL_STORE}
>>> -    mkdir -p ${POL_ACTIVE_MODS}
>>> +    # Prepare to create policy store
>>> +    mkdir -p ${POL_STORE}
>>> +    mkdir -p ${POL_ACTIVE_MODS}
>>>   -    # get hll type from suffix on base policy module
>>> -    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print 
>>> $NF}}')
>>> - 
>>> HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>>> +    # Get hll type from suffix on base policy module
>>> +    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print 
>>> $NF}}')
>>> + 
>>> HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>>>   -    for i in base ${POLICY_MODULES_MIN}; do
>>> -        MOD_FILE=${POL_SRC}/${i}.${HLL_TYPE}
>>> -        MOD_DIR=${POL_ACTIVE_MODS}/${i}
>>> -        mkdir -p ${MOD_DIR}
>>> -        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>>> +    for i in base ${POLICY_MODULES_MIN}; do
>>> +        MOD_FILE=${POL_SRC}/${i}.${HLL_TYPE}
>>> +        MOD_DIR=${POL_ACTIVE_MODS}/${i}
>>> +        mkdir -p ${MOD_DIR}
>>> +        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>>>   -        if ! bzip2 -t ${MOD_FILE} >/dev/null 2>&1; then
>>> -            ${HLL_BIN} ${MOD_FILE} | bzip2 --stdout > ${MOD_DIR}/cil
>>> -            bzip2 -f ${MOD_FILE} && mv -f ${MOD_FILE}.bz2 ${MOD_FILE}
>>> -        else
>>> -            bunzip2 --stdout ${MOD_FILE} | \
>>> -                ${HLL_BIN} | \
>>> -                bzip2 --stdout > ${MOD_DIR}/cil
>>> -        fi
>>> -        cp ${MOD_FILE} ${MOD_DIR}/hll
>>> -    done
>>> +        if ! bzip2 -t ${MOD_FILE} >/dev/null 2>&1; then
>>> +            ${HLL_BIN} ${MOD_FILE} | bzip2 --stdout > ${MOD_DIR}/cil
>>> +            bzip2 -f ${MOD_FILE} && mv -f ${MOD_FILE}.bz2 ${MOD_FILE}
>>> +        else
>>> +            bunzip2 --stdout ${MOD_FILE} | \
>>> +                ${HLL_BIN} | \
>>> +                bzip2 --stdout > ${MOD_DIR}/cil
>>> +        fi
>>> +        cp ${MOD_FILE} ${MOD_DIR}/hll
>>> +    done
>>>   }
>>> diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb 
>>> b/recipes-security/refpolicy/refpolicy-targeted_git.bb
>>> index 15226db..de81d46 100644
>>> --- a/recipes-security/refpolicy/refpolicy-targeted_git.bb
>>> +++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb
>>> @@ -14,5 +14,4 @@ include refpolicy_${PV}.inc
>>>     SRC_URI += " \
>>> file://0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch 
>>> \
>>> - 
>>> file://0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch 
>>> \
>>>           "
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch 
>>> b/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch 
>>>
>>> index c3a03f3..1605d90 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
>>> @@ -1,4 +1,4 @@
>>> -From d39f2ddbfcfd6e224a50bf327a7bd0031d74d0c6 Mon Sep 17 00:00:00 2001
>>> +From ee66387c393af77b88c833f5d271efe48036112c Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Thu, 28 Mar 2019 16:14:09 -0400
>>>   Subject: [PATCH] fc/subs/volatile: alias common /var/volatile paths
>>> @@ -29,5 +29,5 @@ index ba22ce7e7..23d4328f7 100644
>>>   +/var/volatile/log /var/log
>>>   +/var/volatile/tmp /var/tmp
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch 
>>> b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch 
>>>
>>> index f607cbb..657c5cd 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
>>> @@ -1,4 +1,4 @@
>>> -From 669293ddf351f231b34979a7d708601ccbd11930 Mon Sep 17 00:00:00 2001
>>> +From 0e3b79ae0ae468640d7092c9a91a91d258d07645 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Fri, 5 Apr 2019 11:53:28 -0400
>>>   Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
>>> @@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    2 files changed, 11 insertions(+), 7 deletions(-)
>>>     diff --git a/policy/modules/system/init.te 
>>> b/policy/modules/system/init.te
>>> -index 5a19f0e43..1f4a671dc 100644
>>> +index 671b5aef3..8ce3d5956 100644
>>>   --- a/policy/modules/system/init.te
>>>   +++ b/policy/modules/system/init.te
>>> -@@ -556,13 +556,15 @@ ifdef(`init_systemd',`
>>> +@@ -615,13 +615,15 @@ ifdef(`init_systemd',`
>>>            unconfined_write_keys(init_t)
>>>        ')
>>>    ',`
>>> @@ -48,10 +48,10 @@ index 5a19f0e43..1f4a671dc 100644
>>>        ')
>>>    ')
>>>   diff --git a/policy/modules/system/locallogin.te 
>>> b/policy/modules/system/locallogin.te
>>> -index 109980e79..313112371 100644
>>> +index 7728de804..a8ff403dd 100644
>>>   --- a/policy/modules/system/locallogin.te
>>>   +++ b/policy/modules/system/locallogin.te
>>> -@@ -265,7 +265,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
>>> +@@ -274,7 +274,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
>>>    userdom_search_user_home_dirs(sulogin_t)
>>>    userdom_use_user_ptys(sulogin_t)
>>>    @@ -63,5 +63,5 @@ index 109980e79..313112371 100644
>>>    # by default, sulogin does not use pam...
>>>    # sulogin_pam might need to be defined otherwise
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch 
>>> b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch 
>>>
>>> index 9939b59..64e658e 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
>>> @@ -1,14 +1,14 @@
>>> -From bf7b74e7c38b546e162eb5a3bd4774e3d84d593d Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> +From 60b4e5ea5668a71b2a0660461daecea66fd11d51 Mon Sep 17 00:00:00 2001
>>> +From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Mon, 20 Apr 2020 11:50:03 +0800
>>>   Subject: [PATCH] refpolicy-targeted: make unconfined_u the default 
>>> selinux
>>>    user
>>>     For targeted policy type, we define unconfined_u as the default 
>>> selinux
>>> -user for root and normal users, so users could login in and run most
>>> +user for root and normal users, so users could login and run most
>>>   commands and services on unconfined domains.
>>>   -Upstream-Status: Inappropriate [configuration]
>>> +Upstream-Status: Inappropriate [embedded specific]
>>>     Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
>>> @@ -38,7 +38,7 @@ index ce614b41b..c0903d98b 100644
>>>   +root:unconfined_u:s0-mcs_systemhigh
>>>   +__default__:unconfined_u:s0
>>>   diff --git a/policy/modules/system/unconfined.te 
>>> b/policy/modules/system/unconfined.te
>>> -index 4972094cb..b6d769412 100644
>>> +index d116a1b9b..32720f68f 100644
>>>   --- a/policy/modules/system/unconfined.te
>>>   +++ b/policy/modules/system/unconfined.te
>>>   @@ -20,6 +20,11 @@ type unconfined_execmem_t alias ada_t;
>>> @@ -77,5 +77,5 @@ index ca203758c..e737cd9cc 100644
>>>   +    gen_user(root, sysadm, unconfined_r sysadm_r staff_r 
>>> ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, 
>>> mcs_allcats)
>>>    ')
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch 
>>> b/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch 
>>>
>>> index d2b8139..ef00602 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
>>> @@ -1,4 +1,4 @@
>>> -From 974befcafcee1377e122f19a4182f74eea757158 Mon Sep 17 00:00:00 2001
>>> +From 8fa6c5b7b99a50b09e9dffd142c066fa41319750 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Thu, 28 Mar 2019 20:48:10 -0400
>>>   Subject: [PATCH] fc/subs/busybox: set aliases for bin, sbin and usr
>>> @@ -29,5 +29,5 @@ index 23d4328f7..690007f22 100644
>>>   +/usr/lib/busybox/sbin /usr/sbin
>>>   +/usr/lib/busybox/usr /usr
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch 
>>> b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch 
>>>
>>> index 84764e5..25afa3b 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
>>> @@ -1,4 +1,4 @@
>>> -From 1ff0e212ce737bba59d90977a58a15250bc84ea9 Mon Sep 17 00:00:00 2001
>>> +From 9a8d6b634d4f714fc63125be5e23228c565d1aaf Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Wed, 29 Sep 2021 11:08:49 +0800
>>>   Subject: [PATCH] refpolicy-minimum: make xdg module optional
>>> @@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 6 insertions(+), 2 deletions(-)
>>>     diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 8cea6baa1..218834495 100644
>>> +index 7b717d3ba..3b07b368d 100644
>>>   --- a/policy/modules/system/systemd.te
>>>   +++ b/policy/modules/system/systemd.te
>>> -@@ -276,10 +276,14 @@ files_type(systemd_update_run_t)
>>> +@@ -298,10 +298,14 @@ init_unit_file(systemd_user_manager_unit_t)
>>>       type systemd_conf_home_t;
>>>    init_unit_file(systemd_conf_home_t)
>>> @@ -36,5 +36,5 @@ index 8cea6baa1..218834495 100644
>>>    type systemd_user_runtime_notify_t;
>>>    userdom_user_runtime_content(systemd_user_runtime_notify_t)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch 
>>> b/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch 
>>>
>>> deleted file mode 100644
>>> index e4c081d..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0002-refpolicy-targeted-add-capability2-bpf-and-perfmon-f.patch
>>> +++ /dev/null
>>> @@ -1,52 +0,0 @@
>>> -From b46903aaf7e52f9c4c51a2fa7fe7a85190da98b1 Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Wed, 29 Sep 2021 16:43:54 +0800
>>> -Subject: [PATCH] refpolicy-targeted: add capability2 bpf and 
>>> perfmon for
>>> - unconfined_t
>>> -
>>> -Fixes:
>>> -avc: denied { bpf } for pid=433 comm="systemd" capability=39
>>> -scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>> -tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>> -tclass=capability2 permissive=0
>>> -
>>> -avc: denied { perfmon } for pid=433 comm="systemd" capability=38
>>> -scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>> -tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>> -tclass=capability2 permissive=0
>>> -
>>> -type=USER_AVC msg=audit(1632901631.693:86): pid=433 uid=0 auid=0 ses=3
>>> -subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='avc:
>>> -denied { reload } for auid=n/a uid=0 gid=0 cmdline=""
>>> -scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>> -tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>>> -tclass=system permissive=0  exe="/lib/systemd/systemd" sauid=0
>>> -hostname=? addr=? terminal=?'UID="root" AUID="root" AUID="root"
>>> -UID="root" GID="root" SAUID="root"
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/unconfined.if | 5 +++++
>>> - 1 file changed, 5 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/unconfined.if 
>>> b/policy/modules/system/unconfined.if
>>> -index a139cfe78..807e959c3 100644
>>> ---- a/policy/modules/system/unconfined.if
>>> -+++ b/policy/modules/system/unconfined.if
>>> -@@ -66,6 +66,11 @@ interface(`unconfined_domain_noaudit',`
>>> -     files_start_etc_service($1)
>>> -     files_stop_etc_service($1)
>>> -
>>> -+    ifdef(`init_systemd',`
>>> -+        allow $1 self:capability2 { bpf perfmon };
>>> -+        allow $1 self:system reload;
>>> -+    ')
>>> -+
>>> -     tunable_policy(`allow_execheap',`
>>> -         # Allow making the stack executable via mprotect.
>>> -         allow $1 self:process execheap;
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch 
>>> b/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch 
>>>
>>> index 6596e76..94ac31b 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
>>> @@ -1,4 +1,4 @@
>>> -From 9c6f3c5acc01607a67277f69faa67e34dc98232b Mon Sep 17 00:00:00 2001
>>> +From 5a0bbd1920205f488b6a4565f7217b9d0825067b Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] fc/hostname: apply policy to common yocto hostname
>>> @@ -22,5 +22,5 @@ index 83ddeb573..cf523bc4c 100644
>>>   +/usr/bin/hostname\.net-tools    -- 
>>> gen_context(system_u:object_r:hostname_exec_t,s0)
>>>   +/usr/bin/hostname\.coreutils    -- 
>>> gen_context(system_u:object_r:hostname_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch 
>>> b/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch 
>>>
>>> deleted file mode 100644
>>> index edf9caa..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0003-refpolicy-minimum-enable-nscd_use_shm.patch
>>> +++ /dev/null
>>> @@ -1,35 +0,0 @@
>>> -From 5f992b59a74cc6cde8fd20162a11065dc30fd7ab Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Fri, 26 Feb 2021 09:13:23 +0800
>>> -Subject: [PATCH] refpolicy-minimum: enable nscd_use_shm
>>> -
>>> -Fixes:
>>> -avc: denied { listen } for pid=199 comm="systemd-resolve"
>>> -path="/run/systemd/resolve/io.systemd.Resolve"
>>> -scontext=system_u:system_r:systemd_resolved_t:s0
>>> -tcontext=system_u:system_r:systemd_resolved_t:s0
>>> -tclass=unix_stream_socket permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/services/nscd.te | 2 +-
>>> - 1 file changed, 1 insertion(+), 1 deletion(-)
>>> -
>>> -diff --git a/policy/modules/services/nscd.te 
>>> b/policy/modules/services/nscd.te
>>> -index ada67edb1..9801fc228 100644
>>> ---- a/policy/modules/services/nscd.te
>>> -+++ b/policy/modules/services/nscd.te
>>> -@@ -15,7 +15,7 @@ gen_require(`
>>> - ##    can use nscd shared memory.
>>> - ##    </p>
>>> - ## </desc>
>>> --gen_tunable(nscd_use_shm, false)
>>> -+gen_tunable(nscd_use_shm, true)
>>> -
>>> - attribute_role nscd_roles;
>>> -
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch 
>>> b/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch 
>>>
>>> index cf333f1..eff0255 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
>>> @@ -1,4 +1,4 @@
>>> -From bbc8b58fe5fe709dfadbffc86e17ebd2d76a257c Mon Sep 17 00:00:00 2001
>>> +From c9219d2f7be1e641b3866b770a9b570c12333b93 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Thu, 28 Mar 2019 21:37:32 -0400
>>>   Subject: [PATCH] fc/bash: apply /usr/bin/bash context to 
>>> /bin/bash.bash
>>> @@ -15,7 +15,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/kernel/corecommands.fc 
>>> b/policy/modules/kernel/corecommands.fc
>>> -index 4c18154ce..9187e50af 100644
>>> +index 0c05c693d..b70940928 100644
>>>   --- a/policy/modules/kernel/corecommands.fc
>>>   +++ b/policy/modules/kernel/corecommands.fc
>>>   @@ -142,6 +142,7 @@ ifdef(`distro_gentoo',`
>>> @@ -27,5 +27,5 @@ index 4c18154ce..9187e50af 100644
>>>    /usr/bin/fish            -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>>    /usr/bin/git-shell        -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch 
>>> b/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch 
>>>
>>> index 078c246..06c8087 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
>>> @@ -1,4 +1,4 @@
>>> -From 3cccdec2aaa273ca09100ca957f4968a25f4f3a3 Mon Sep 17 00:00:00 2001
>>> +From 51631a7eaaea1fab4b36a2488497cf725317ce6e Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Thu, 4 Apr 2019 10:45:03 -0400
>>>   Subject: [PATCH] fc/resolv.conf: label resolv.conf in var/run/ 
>>> properly
>>> @@ -25,5 +25,5 @@ index 14505efe9..c9ec4e5ab 100644
>>>    ifdef(`distro_gentoo',`
>>>    /var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch 
>>> b/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch 
>>>
>>> index b4747f7..70c5566 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
>>> @@ -1,4 +1,4 @@
>>> -From 9a1e1c7b65cb3f5ab97ce05463ca02a3eaa57d86 Mon Sep 17 00:00:00 2001
>>> +From 1c61b10d21a22d4110bc880b23477295f6cd9efb Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Thu, 28 Mar 2019 21:43:53 -0400
>>>   Subject: [PATCH] fc/login: apply login context to login.shadow
>>> @@ -24,5 +24,5 @@ index 50efcff7b..5cb48882c 100644
>>>    /usr/bin/pam_timestamp_check    -- 
>>> gen_context(system_u:object_r:pam_exec_t,s0)
>>>    /usr/bin/tcb_convert        -- 
>>> gen_context(system_u:object_r:updpwd_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch 
>>>
>>> index 33f6a10..2f9f703 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 73716015ab28a9474912902e9467f2d2a864ecd0 Mon Sep 17 00:00:00 2001
>>> +From e4d7d9fb1cb157bf205874e1a81d5719017866a1 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Thu, 28 Mar 2019 21:59:18 -0400
>>>   Subject: [PATCH] fc/hwclock: add hwclock alternatives
>>> @@ -21,5 +21,5 @@ index 301965892..139485835 100644
>>>    /usr/sbin/hwclock    -- 
>>> gen_context(system_u:object_r:hwclock_exec_t,s0)
>>>   +/usr/sbin/hwclock\.util-linux    -- 
>>> gen_context(system_u:object_r:hwclock_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch 
>>>
>>> index 5f2ffdf..6e576a8 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 504e8429500ab0984adfd52bb09a3e993b87f2f1 Mon Sep 17 00:00:00 2001
>>> +From ac6536f04674ccc051744e6eb3644e68fe38da33 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Fri, 29 Mar 2019 08:26:55 -0400
>>>   Subject: [PATCH] fc/dmesg: apply policy to dmesg alternatives
>>> @@ -19,5 +19,5 @@ index e52fdfcf8..526b92ed2 100644
>>>    /usr/bin/dmesg        -- 
>>> gen_context(system_u:object_r:dmesg_exec_t,s0)
>>>   +/usr/bin/dmesg\.util-linux        -- 
>>> gen_context(system_u:object_r:dmesg_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch 
>>>
>>> index 585850b..611c0d3 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 8ad451ceff2ba4ea26290a7ba9918406a90bb10f Mon Sep 17 00:00:00 2001
>>> +From a56887ca448b60ad6715348b2cfe533e8109a040 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Fri, 29 Mar 2019 09:20:58 -0400
>>>   Subject: [PATCH] fc/ssh: apply policy to ssh alternatives
>>> @@ -12,11 +12,11 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/services/ssh.fc 
>>> b/policy/modules/services/ssh.fc
>>> -index 60060c35c..518043a9b 100644
>>> +index 5c512e972..0448c1877 100644
>>>   --- a/policy/modules/services/ssh.fc
>>>   +++ b/policy/modules/services/ssh.fc
>>>   @@ -4,6 +4,7 @@ HOME_DIR/\.ssh(/.*)? 
>>> gen_context(system_u:object_r:ssh_home_t,s0)
>>> - /etc/ssh/ssh_host.*_key        -- 
>>> gen_context(system_u:object_r:sshd_key_t,s0)
>>> + /etc/ssh/ssh_host.*_key(\.pub)?    -- 
>>> gen_context(system_u:object_r:sshd_key_t,s0)
>>>       /usr/bin/ssh            -- 
>>> gen_context(system_u:object_r:ssh_exec_t,s0)
>>>   +/usr/bin/ssh\.openssh    -- 
>>> gen_context(system_u:object_r:ssh_exec_t,s0)
>>> @@ -24,5 +24,5 @@ index 60060c35c..518043a9b 100644
>>>    /usr/bin/ssh-keygen        -- 
>>> gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
>>>    /usr/bin/sshd            -- 
>>> gen_context(system_u:object_r:sshd_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch 
>>> b/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch 
>>>
>>> index 0621923..7af147d 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
>>> @@ -1,4 +1,4 @@
>>> -From c85fd7d9c45770b31de44bb35521e2251882df10 Mon Sep 17 00:00:00 2001
>>> +From 47a5e9a0bd4960534998798ab1a5ab62e77b2b61 Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Tue, 9 Jun 2015 21:22:52 +0530
>>>   Subject: [PATCH] fc/sysnetwork: apply policy to network commands 
>>> alternatives
>>> @@ -43,5 +43,5 @@ index c9ec4e5ab..4ca151524 100644
>>>    /usr/sbin/tc            -- 
>>> gen_context(system_u:object_r:ifconfig_exec_t,s0)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch 
>>> b/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch 
>>>
>>> index cc3e529..434fc1d 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0011-fc-udev-apply-policy-to-udevadm-in-libexec.patch
>>> @@ -1,4 +1,4 @@
>>> -From aa2635a54f9c36205ebc469f799a56ece01ac610 Mon Sep 17 00:00:00 2001
>>> +From bbc6eb20e9509a61236051df7a5fa552a8f2654d Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Fri, 29 Mar 2019 09:36:08 -0400
>>>   Subject: [PATCH] fc/udev: apply policy to udevadm in libexec
>>> @@ -25,5 +25,5 @@ index 7898ff01c..bc717e60c 100644
>>>    /usr/sbin/start_udev -- 
>>> gen_context(system_u:object_r:udev_exec_t,s0)
>>>    ')
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch 
>>> b/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch 
>>>
>>> index b039f53..bf562d6 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0012-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
>>> @@ -1,4 +1,4 @@
>>> -From faf757c732c9a022499b584cea64ce1fcc78e118 Mon Sep 17 00:00:00 2001
>>> +From 00533fded8e2264f8bdc68c8ed79644a10e4e2ad Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Fri, 29 Mar 2019 09:54:07 -0400
>>>   Subject: [PATCH] fc/rpm: apply rpm_exec policy to cpio binaries
>>> @@ -12,10 +12,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/admin/rpm.fc 
>>> b/policy/modules/admin/rpm.fc
>>> -index aaf530c2b..618b18cec 100644
>>> +index 3f842f942..12973ac8b 100644
>>>   --- a/policy/modules/admin/rpm.fc
>>>   +++ b/policy/modules/admin/rpm.fc
>>> -@@ -66,4 +66,6 @@ ifdef(`distro_redhat',`
>>> +@@ -71,4 +71,6 @@ ifdef(`distro_redhat',`
>>>       ifdef(`enable_mls',`
>>>    /usr/sbin/cpio    -- gen_context(system_u:object_r:rpm_exec_t,s0)
>>> @@ -23,5 +23,5 @@ index aaf530c2b..618b18cec 100644
>>>   +/usr/bin/cpio\.cpio    -- 
>>> gen_context(system_u:object_r:rpm_exec_t,s0)
>>>    ')
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch 
>>>
>>> index 14c7d5b..32d38f1 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0013-fc-su-apply-policy-to-su-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 52853ae9ee13038c5ffae8616858c442d412a2b8 Mon Sep 17 00:00:00 2001
>>> +From 4b202554e646a60000c1acad7bbdfae1078bdc10 Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Thu, 13 Feb 2014 00:33:07 -0500
>>>   Subject: [PATCH] fc/su: apply policy to su alternatives
>>> @@ -23,5 +23,5 @@ index 3375c9692..a9868cd58 100644
>>>   +/usr/bin/su\.shadow        -- 
>>> gen_context(system_u:object_r:su_exec_t,s0)
>>>   +/usr/bin/su\.util-linux        -- 
>>> gen_context(system_u:object_r:su_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch 
>>> b/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch 
>>>
>>> index c2e0ca8..de0aad7 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0014-fc-fstools-fix-real-path-for-fstools.patch
>>> @@ -1,4 +1,4 @@
>>> -From 4f3a637c0385204c0b87806d158e106fb9f88972 Mon Sep 17 00:00:00 2001
>>> +From f64a5d6a2f2e72ae6c5122220eb759117b6384c8 Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Mon, 27 Jan 2014 03:54:01 -0500
>>>   Subject: [PATCH] fc/fstools: fix real path for fstools
>>> @@ -10,14 +10,14 @@ Signed-off-by: Shrikant Bobade 
>>> <shrikant_bobade@mentor.com>
>>>   Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>   ---
>>> - policy/modules/system/fstools.fc | 10 ++++++++++
>>> - 1 file changed, 10 insertions(+)
>>> + policy/modules/system/fstools.fc | 11 +++++++++++
>>> + 1 file changed, 11 insertions(+)
>>>     diff --git a/policy/modules/system/fstools.fc 
>>> b/policy/modules/system/fstools.fc
>>> -index d871294e8..bef711850 100644
>>> +index 8fbd5ce44..2842afbcc 100644
>>>   --- a/policy/modules/system/fstools.fc
>>>   +++ b/policy/modules/system/fstools.fc
>>> -@@ -59,7 +59,9 @@
>>> +@@ -58,7 +58,9 @@
>>>    /usr/sbin/addpart        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/badblocks        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/blkid            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> @@ -27,12 +27,13 @@ index d871294e8..bef711850 100644
>>>    /usr/sbin/cfdisk        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/clubufflush        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/delpart        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> -@@ -73,10 +75,12 @@
>>> +@@ -72,10 +74,13 @@
>>>    /usr/sbin/efibootmgr        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/fatsort        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/fdisk            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>   +/usr/sbin/fdisk\.util-linux            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/findfs        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> ++/usr/sbin/findfs\.util-linux        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/fsck.*        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/gdisk            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/hdparm        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> @@ -40,7 +41,7 @@ index d871294e8..bef711850 100644
>>>    /usr/sbin/install-mbr        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/jfs_.*        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/losetup.*        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> -@@ -84,24 +88,30 @@
>>> +@@ -83,24 +88,30 @@
>>>    /usr/sbin/make_reiser4        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/mkdosfs        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/mke2fs        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> @@ -72,5 +73,5 @@ index d871294e8..bef711850 100644
>>>    /usr/sbin/zhack            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>    /usr/sbin/zinject        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch 
>>> b/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch 
>>>
>>> index b3ab0cc..5e9c197 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0015-fc-init-fix-update-alternatives-for-sysvinit.patch
>>> @@ -1,4 +1,4 @@
>>> -From e1439aa43af6ef15b35eac3cdbf0cea561768362 Mon Sep 17 00:00:00 2001
>>> +From 6d2a96abd1e292d0c34ff77501e618cfc193655f Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] fc/init: fix update-alternatives for sysvinit
>>> @@ -26,7 +26,7 @@ index bf51c103f..91ed72be0 100644
>>>       /run/shutdown\.pid    -- 
>>> gen_context(system_u:object_r:shutdown_runtime_t,s0)
>>>   diff --git a/policy/modules/kernel/corecommands.fc 
>>> b/policy/modules/kernel/corecommands.fc
>>> -index 9187e50af..0ecabe34e 100644
>>> +index b70940928..e6077fd5b 100644
>>>   --- a/policy/modules/kernel/corecommands.fc
>>>   +++ b/policy/modules/kernel/corecommands.fc
>>>   @@ -151,6 +151,8 @@ ifdef(`distro_gentoo',`
>>> @@ -39,10 +39,10 @@ index 9187e50af..0ecabe34e 100644
>>>    /usr/bin/sash            -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>>    /usr/bin/sesh            -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>>   diff --git a/policy/modules/system/init.fc 
>>> b/policy/modules/system/init.fc
>>> -index 63cf195e6..5268bddb2 100644
>>> +index 1a99e5824..7f0b7c699 100644
>>>   --- a/policy/modules/system/init.fc
>>>   +++ b/policy/modules/system/init.fc
>>> -@@ -40,6 +40,7 @@ ifdef(`distro_gentoo',`
>>> +@@ -41,6 +41,7 @@ ifdef(`distro_gentoo',`
>>>    /usr/libexec/dcc/stop-.* -- 
>>> gen_context(system_u:object_r:initrc_exec_t,s0)
>>>       /usr/sbin/init(ng)?    -- 
>>> gen_context(system_u:object_r:init_exec_t,s0)
>>> @@ -51,5 +51,5 @@ index 63cf195e6..5268bddb2 100644
>>>    /usr/sbin/upstart    -- 
>>> gen_context(system_u:object_r:init_exec_t,s0)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch 
>>>
>>> index b9812b7..b0ba609 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0016-fc-brctl-apply-policy-to-brctl-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 274066b3397b53d63134aee94a0148d9c7d1886d Mon Sep 17 00:00:00 2001
>>> +From 2e9c22ee83b7d4fea7b177ca8111c06e69338db9 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 10:19:54 +0800
>>>   Subject: [PATCH] fc/brctl: apply policy to brctl alternatives
>>> @@ -20,5 +20,5 @@ index ed472f095..2a852b0fd 100644
>>>    /usr/sbin/brctl    -- gen_context(system_u:object_r:brctl_exec_t,s0)
>>>   +/usr/sbin/brctl\.bridge-utils    -- 
>>> gen_context(system_u:object_r:brctl_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch 
>>>
>>> index e0ddc5e..58ac463 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0017-fc-corecommands-apply-policy-to-nologin-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From ab0267f77e38bcda797cfe00ba6fa49ba89e334a Mon Sep 17 00:00:00 2001
>>> +From c43f2d7ddf1d0c2185796e0297dd9f85b9663aaf Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 10:21:51 +0800
>>>   Subject: [PATCH] fc/corecommands: apply policy to nologin 
>>> alternatives
>>> @@ -11,10 +11,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/kernel/corecommands.fc 
>>> b/policy/modules/kernel/corecommands.fc
>>> -index 0ecabe34e..e27e701ef 100644
>>> +index e6077fd5b..0df59e837 100644
>>>   --- a/policy/modules/kernel/corecommands.fc
>>>   +++ b/policy/modules/kernel/corecommands.fc
>>> -@@ -304,6 +304,8 @@ ifdef(`distro_debian',`
>>> +@@ -306,6 +306,8 @@ ifdef(`distro_debian',`
>>>    /usr/sbin/insmod_ksymoops_clean    -- 
>>> gen_context(system_u:object_r:bin_t,s0)
>>>    /usr/sbin/mkfs\.cramfs        -- 
>>> gen_context(system_u:object_r:bin_t,s0)
>>>    /usr/sbin/nologin        -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>> @@ -24,5 +24,5 @@ index 0ecabe34e..e27e701ef 100644
>>>    /usr/sbin/sesh            -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>>    /usr/sbin/smrsh            -- 
>>> gen_context(system_u:object_r:shell_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch 
>>>
>>> index 2fe3740..3c43254 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0018-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From cfb86acce9fe9da9b88c853c0b22d48d99602fbb Mon Sep 17 00:00:00 2001
>>> +From 11c95928e325aea7e4c41a9cdf969f9bdd306611 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 10:43:28 +0800
>>>   Subject: [PATCH] fc/locallogin: apply policy to sulogin alternatives
>>> @@ -21,5 +21,5 @@ index fc8d58507..59e6e9601 100644
>>>   +/usr/sbin/sulogin\.util-linux    -- 
>>> gen_context(system_u:object_r:sulogin_exec_t,s0)
>>>    /usr/sbin/sushell    -- 
>>> gen_context(system_u:object_r:sulogin_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch 
>>>
>>> index 4b046ce..cbae4c5 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0019-fc-ntp-apply-policy-to-ntpd-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From e159e70b533b500390337ec666d678c7424afb90 Mon Sep 17 00:00:00 2001
>>> +From 5841a5bd25e6017b6ccff4f56628ad6e950eadad Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 10:45:23 +0800
>>>   Subject: [PATCH] fc/ntp: apply policy to ntpd alternatives
>>> @@ -23,5 +23,5 @@ index cd69ea5d5..49ffe6f68 100644
>>>    /usr/sbin/sntp                -- 
>>> gen_context(system_u:object_r:ntpdate_exec_t,s0)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch 
>>>
>>> index 9d2e6fa..76e7fe9 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0020-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 95797c20fb68558b9f37ded3f1cc9a4ef09717f9 Mon Sep 17 00:00:00 2001
>>> +From 8126ec521e5a0f72da098f5d90b5b5b392006b7c Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 10:55:05 +0800
>>>   Subject: [PATCH] fc/kerberos: apply policy to kerberos alternatives
>>> @@ -46,5 +46,5 @@ index df21fcc78..ce0166edd 100644
>>>    /var/log/kadmin\.log.*    -- 
>>> gen_context(system_u:object_r:kadmind_log_t,s0)
>>>    /var/log/kadmind\.log.*    -- 
>>> gen_context(system_u:object_r:kadmind_log_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch 
>>>
>>> index e0b7b9e..a46c9c9 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0021-fc-ldap-apply-policy-to-ldap-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 6b43af067ec45bce1b7059fc549e246f53311d3a Mon Sep 17 00:00:00 2001
>>> +From c71ea08245069001b56aadd7bb0af28e019f45e4 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 11:06:13 +0800
>>>   Subject: [PATCH] fc/ldap: apply policy to ldap alternatives
>>> @@ -36,5 +36,5 @@ index 0a1d08d0f..65b202962 100644
>>>    /run/openldap(/.*)? 
>>> gen_context(system_u:object_r:slapd_runtime_t,s0)
>>>    /run/slapd.*    -s gen_context(system_u:object_r:slapd_runtime_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch 
>>> b/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch 
>>>
>>> index 4a1a2dc..0a0464f 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0022-fc-postgresql-apply-policy-to-postgresql-alternative.patch
>>> @@ -1,4 +1,4 @@
>>> -From 5f664c3a38853129fa1703032822c203dbeaf0a6 Mon Sep 17 00:00:00 2001
>>> +From 72726c1bc51628e6eb56e758f1e334f9b9a0f17e Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 11:13:16 +0800
>>>   Subject: [PATCH] fc/postgresql: apply policy to postgresql 
>>> alternatives
>>> @@ -33,5 +33,5 @@ index f31a52cf8..f9bf46870 100644
>>>    /usr/share/jonas/pgsql(/.*)? 
>>> gen_context(system_u:object_r:postgresql_db_t,s0)
>>>    ')
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch 
>>>
>>> index 9ae9435..e95cb3c 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0023-fc-screen-apply-policy-to-screen-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 2d1634127f8f5c9ec98f866711b8d15b7df815d1 Mon Sep 17 00:00:00 2001
>>> +From 003a22f73563ef7b8b4ab6a6a0cb4a920a43570f Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 11:15:33 +0800
>>>   Subject: [PATCH] fc/screen: apply policy to screen alternatives
>>> @@ -21,5 +21,5 @@ index e51e01d97..238dc263e 100644
>>>   +/usr/bin/screen-.*        -- 
>>> gen_context(system_u:object_r:screen_exec_t,s0)
>>>    /usr/bin/tmux        -- 
>>> gen_context(system_u:object_r:screen_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch 
>>> b/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch 
>>>
>>> index 2dbdcf4..a92b809 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0024-fc-usermanage-apply-policy-to-usermanage-alternative.patch
>>> @@ -1,4 +1,4 @@
>>> -From 2323a6ab69c4a74ab127c16e38f14616a289b3d1 Mon Sep 17 00:00:00 2001
>>> +From fdf7c2d27b6ecf08c88bb98e52a7d8284ac828af Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 11:25:34 +0800
>>>   Subject: [PATCH] fc/usermanage: apply policy to usermanage 
>>> alternatives
>>> @@ -7,26 +7,28 @@ Upstream-Status: Inappropriate [embedded specific]
>>>     Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>   ---
>>> - policy/modules/admin/usermanage.fc | 6 ++++++
>>> - 1 file changed, 6 insertions(+)
>>> + policy/modules/admin/usermanage.fc | 8 ++++++++
>>> + 1 file changed, 8 insertions(+)
>>>     diff --git a/policy/modules/admin/usermanage.fc 
>>> b/policy/modules/admin/usermanage.fc
>>> -index 620eefc6f..bf1ff09ab 100644
>>> +index 7209a8dd0..c9dc1f000 100644
>>>   --- a/policy/modules/admin/usermanage.fc
>>>   +++ b/policy/modules/admin/usermanage.fc
>>> -@@ -4,7 +4,11 @@ ifdef(`distro_debian',`
>>> +@@ -4,8 +4,13 @@ ifdef(`distro_debian',`
>>>       /usr/bin/chage        -- 
>>> gen_context(system_u:object_r:passwd_exec_t,s0)
>>>    /usr/bin/chfn        -- 
>>> gen_context(system_u:object_r:chfn_exec_t,s0)
>>>   +/usr/bin/chfn\.shadow        -- 
>>> gen_context(system_u:object_r:chfn_exec_t,s0)
>>>   +/usr/bin/chfn\.util-linux        -- 
>>> gen_context(system_u:object_r:chfn_exec_t,s0)
>>> + /usr/bin/chpasswd    -- 
>>> gen_context(system_u:object_r:passwd_exec_t,s0)
>>> ++/usr/bin/chpasswd\.shadow    -- 
>>> gen_context(system_u:object_r:passwd_exec_t,s0)
>>>    /usr/bin/chsh        -- 
>>> gen_context(system_u:object_r:chfn_exec_t,s0)
>>>   +/usr/bin/chsh\.shadow        -- 
>>> gen_context(system_u:object_r:chfn_exec_t,s0)
>>>   +/usr/bin/chsh\.util-linux        -- 
>>> gen_context(system_u:object_r:chfn_exec_t,s0)
>>>    /usr/bin/crack_[a-z]*    -- 
>>> gen_context(system_u:object_r:crack_exec_t,s0)
>>>    /usr/bin/cracklib-[a-z]* -- 
>>> gen_context(system_u:object_r:crack_exec_t,s0)
>>>    /usr/bin/gpasswd    -- 
>>> gen_context(system_u:object_r:groupadd_exec_t,s0)
>>> -@@ -14,6 +18,7 @@ ifdef(`distro_debian',`
>>> +@@ -15,6 +20,7 @@ ifdef(`distro_debian',`
>>>    /usr/bin/grpconv    -- 
>>> gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>>    /usr/bin/grpunconv    -- 
>>> gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>>    /usr/bin/passwd        -- 
>>> gen_context(system_u:object_r:passwd_exec_t,s0)
>>> @@ -34,7 +36,15 @@ index 620eefc6f..bf1ff09ab 100644
>>>    /usr/bin/pwconv        -- 
>>> gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>>    /usr/bin/pwunconv    -- 
>>> gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>>    /usr/bin/useradd    -- 
>>> gen_context(system_u:object_r:useradd_exec_t,s0)
>>> -@@ -39,6 +44,7 @@ ifdef(`distro_debian',`
>>> +@@ -26,6 +32,7 @@ ifdef(`distro_debian',`
>>> + /usr/lib/cracklib_dict.* -- 
>>> gen_context(system_u:object_r:crack_db_t,s0)
>>> +
>>> + /usr/sbin/chpasswd    -- 
>>> gen_context(system_u:object_r:passwd_exec_t,s0)
>>> ++/usr/sbin/chpasswd\.shadow    -- 
>>> gen_context(system_u:object_r:passwd_exec_t,s0)
>>> + /usr/sbin/crack_[a-z]*    -- 
>>> gen_context(system_u:object_r:crack_exec_t,s0)
>>> + /usr/sbin/cracklib-[a-z]* -- 
>>> gen_context(system_u:object_r:crack_exec_t,s0)
>>> + /usr/sbin/gpasswd    -- 
>>> gen_context(system_u:object_r:groupadd_exec_t,s0)
>>> +@@ -41,6 +48,7 @@ ifdef(`distro_debian',`
>>>    /usr/sbin/usermod    -- 
>>> gen_context(system_u:object_r:useradd_exec_t,s0)
>>>    /usr/sbin/vigr        -- 
>>> gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>>    /usr/sbin/vipw        -- 
>>> gen_context(system_u:object_r:admin_passwd_exec_t,s0)
>>> @@ -43,5 +53,5 @@ index 620eefc6f..bf1ff09ab 100644
>>>    /usr/share/cracklib(/.*)? 
>>> gen_context(system_u:object_r:crack_db_t,s0)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch 
>>> b/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch 
>>>
>>> index c0d9cf4..f6fa8a0 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0025-fc-getty-add-file-context-to-start_getty.patch
>>> @@ -1,4 +1,4 @@
>>> -From dbd399143d6fbda828cfc9f2546bc730e0da584c Mon Sep 17 00:00:00 2001
>>> +From 863ece4fd9815997486c04ce89180707435669e4 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Fri, 15 Nov 2019 16:07:30 +0800
>>>   Subject: [PATCH] fc/getty: add file context to start_getty
>>> @@ -23,5 +23,5 @@ index 116ea6421..53ff6137b 100644
>>>    /usr/sbin/.*getty    -- 
>>> gen_context(system_u:object_r:getty_exec_t,s0)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch 
>>> b/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch 
>>>
>>> index 71521e8..7f63b14 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0026-fc-vlock-apply-policy-to-vlock-alternatives.patch
>>> @@ -1,4 +1,4 @@
>>> -From 0280f05e2c9665f094d7098cd03e11d75908bcdb Mon Sep 17 00:00:00 2001
>>> +From 5bb33b7d9d7915399cca7d8c6fbdd9c0e27c1cd8 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Wed, 18 Dec 2019 15:04:41 +0800
>>>   Subject: [PATCH] fc/vlock: apply policy to vlock alternatives
>>> @@ -21,5 +21,5 @@ index f668cde9c..c4bc50984 100644
>>>       /usr/sbin/vlock-main    -- 
>>> gen_context(system_u:object_r:vlock_exec_t,s0)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch 
>>> b/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch 
>>>
>>> index ca9b644..cfb2fd5 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0027-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
>>> @@ -1,4 +1,4 @@
>>> -From 7f8b07b7af0c3cd8bbec49082b42011ac433df45 Mon Sep 17 00:00:00 2001
>>> +From 574df1810c8f32bbf24b223f72f6622b0df7e82c Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Tue, 30 Jun 2020 10:45:57 +0800
>>>   Subject: [PATCH] fc: add fcontext for init scripts and systemd 
>>> service files
>>> @@ -34,7 +34,7 @@ index 382c067f9..0ecc5acc4 100644
>>>    /usr/bin/rngd    -- gen_context(system_u:object_r:rngd_exec_t,s0)
>>>      diff --git a/policy/modules/services/rpc.fc 
>>> b/policy/modules/services/rpc.fc
>>> -index 88d2acaf0..d9c0a4aa7 100644
>>> +index 75c2f0617..fa881ba2e 100644
>>>   --- a/policy/modules/services/rpc.fc
>>>   +++ b/policy/modules/services/rpc.fc
>>>   @@ -1,7 +1,9 @@
>>> @@ -46,7 +46,7 @@ index 88d2acaf0..d9c0a4aa7 100644
>>>   +/etc/rc\.d/init\.d/nfscommon    -- 
>>> gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
>>>    /etc/rc\.d/init\.d/rpcidmapd    -- 
>>> gen_context(system_u:object_r:rpcd_initrc_exec_t,s0)
>>>    - /usr/bin/rpc\..*    -- 
>>> gen_context(system_u:object_r:rpcd_exec_t,s0)
>>> + /usr/bin/nfsdcld    -- gen_context(system_u:object_r:rpcd_exec_t,s0)
>>>   diff --git a/policy/modules/system/logging.fc 
>>> b/policy/modules/system/logging.fc
>>>   index 5681acb51..4ff5f990a 100644
>>>   --- a/policy/modules/system/logging.fc
>>> @@ -60,5 +60,5 @@ index 5681acb51..4ff5f990a 100644
>>>    /usr/lib/systemd/systemd-kmsg-syslogd    -- 
>>> gen_context(system_u:object_r:syslogd_exec_t,s0)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch 
>>> b/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch 
>>>
>>> index dc10350..82b4708 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0028-file_contexts.subs_dist-set-aliase-for-root-director.patch
>>> @@ -1,4 +1,4 @@
>>> -From 0bb081084a2d12f9041bfae195481d898b5a0ba1 Mon Sep 17 00:00:00 2001
>>> +From 01f57c996e09fb68daf3d97805c46c27a6d34304 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Sun, 5 Apr 2020 22:03:45 +0800
>>>   Subject: [PATCH] file_contexts.subs_dist: set aliase for /root 
>>> directory
>>> @@ -26,5 +26,5 @@ index 690007f22..f80499ebf 100644
>>>   +# Add an aliase for it
>>>   +/root /home/root
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch 
>>> b/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch 
>>>
>>> index f8a4cec..06b792a 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-the-syml.patch
>>> @@ -1,4 +1,4 @@
>>> -From 9c676fe5ff2a14206f25bf8ed932c305f13dcfdc Mon Sep 17 00:00:00 2001
>>> +From 2e9b42143ccb92f04d8d57430b3ae1e9f55eb00e Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] policy/modules/system/logging: add rules for the 
>>> symlink of
>>> @@ -30,7 +30,7 @@ index 4ff5f990a..dee26a9f4 100644
>>>    /var/log/dmesg        -- gen_context(system_u:object_r:var_log_t,s0)
>>>    /var/log/syslog        -- 
>>> gen_context(system_u:object_r:var_log_t,s0)
>>>   diff --git a/policy/modules/system/logging.if 
>>> b/policy/modules/system/logging.if
>>> -index 341763730..30d402c75 100644
>>> +index cf7ef1721..b627cacb8 100644
>>>   --- a/policy/modules/system/logging.if
>>>   +++ b/policy/modules/system/logging.if
>>>   @@ -1086,10 +1086,12 @@ 
>>> interface(`logging_append_all_inherited_logs',`
>>> @@ -100,5 +100,5 @@ index 341763730..30d402c75 100644
>>>       ########################################
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch 
>>>
>>> index a06b3f4..ecfc018 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0030-policy-modules-system-logging-add-rules-for-syslogd-.patch
>>> @@ -1,4 +1,4 @@
>>> -From c9759b1024873819cf594fe7ac3bf06bcf0d959d Mon Sep 17 00:00:00 2001
>>> +From 26dc5529db7664ae248eba4dbc5d17915c371137 Mon Sep 17 00:00:00 2001
>>>   From: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Date: Fri, 29 Mar 2019 10:33:18 -0400
>>>   Subject: [PATCH] policy/modules/system/logging: add rules for 
>>> syslogd symlink
>>> @@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/system/logging.te 
>>> b/policy/modules/system/logging.te
>>> -index 21e3285a9..abee7df9c 100644
>>> +index abd61e6bd..90d8ccd31 100644
>>>   --- a/policy/modules/system/logging.te
>>>   +++ b/policy/modules/system/logging.te
>>> -@@ -411,6 +411,7 @@ files_search_spool(syslogd_t)
>>> +@@ -420,6 +420,7 @@ files_search_spool(syslogd_t)
>>>       # Allow access for syslog-ng
>>>    allow syslogd_t var_log_t:dir { create setattr };
>>> @@ -30,5 +30,5 @@ index 21e3285a9..abee7df9c 100644
>>>    # for systemd but can not be conditional
>>>    files_runtime_filetrans(syslogd_t, syslogd_tmp_t, dir, "log")
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch 
>>> b/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch 
>>>
>>> index ffa78ac..48e8acf 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch
>>> @@ -1,4 +1,4 @@
>>> -From fd55f9f292617c7475c62c07ed6c478b4bd9eda5 Mon Sep 17 00:00:00 2001
>>> +From 9052089dfc4f7466fcf304ab282c2e32933a5881 Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] policy/modules/kernel/files: add rules for the 
>>> symlink of
>>> @@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    2 files changed, 9 insertions(+)
>>>     diff --git a/policy/modules/kernel/files.fc 
>>> b/policy/modules/kernel/files.fc
>>> -index 826722f4e..677ae96c3 100644
>>> +index f6ff6b079..279df3d3c 100644
>>>   --- a/policy/modules/kernel/files.fc
>>>   +++ b/policy/modules/kernel/files.fc
>>> -@@ -172,6 +172,7 @@ HOME_ROOT/lost\+found/.* <<none>>
>>> +@@ -170,6 +170,7 @@ HOME_ROOT/lost\+found/.* <<none>>
>>>    # /tmp
>>>    #
>>>    /tmp            -d 
>>> gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
>>> @@ -30,10 +30,10 @@ index 826722f4e..677ae96c3 100644
>>>    /tmp/\.journal            <<none>>
>>>      diff --git a/policy/modules/kernel/files.if 
>>> b/policy/modules/kernel/files.if
>>> -index 495cbe2f4..b308eefd9 100644
>>> +index f7217b226..451f302af 100644
>>>   --- a/policy/modules/kernel/files.if
>>>   +++ b/policy/modules/kernel/files.if
>>> -@@ -4555,6 +4555,7 @@ interface(`files_search_tmp',`
>>> +@@ -4750,6 +4750,7 @@ interface(`files_search_tmp',`
>>>        ')
>>>           allow $1 tmp_t:dir search_dir_perms;
>>> @@ -41,7 +41,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4591,6 +4592,7 @@ interface(`files_list_tmp',`
>>> +@@ -4786,6 +4787,7 @@ interface(`files_list_tmp',`
>>>        ')
>>>           allow $1 tmp_t:dir list_dir_perms;
>>> @@ -49,7 +49,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4627,6 +4629,7 @@ interface(`files_delete_tmp_dir_entry',`
>>> +@@ -4822,6 +4824,7 @@ interface(`files_delete_tmp_dir_entry',`
>>>        ')
>>>           allow $1 tmp_t:dir del_entry_dir_perms;
>>> @@ -57,7 +57,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4645,6 +4648,7 @@ interface(`files_read_generic_tmp_files',`
>>> +@@ -4840,6 +4843,7 @@ interface(`files_read_generic_tmp_files',`
>>>        ')
>>>           read_files_pattern($1, tmp_t, tmp_t)
>>> @@ -65,7 +65,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4663,6 +4667,7 @@ interface(`files_manage_generic_tmp_dirs',`
>>> +@@ -4858,6 +4862,7 @@ interface(`files_manage_generic_tmp_dirs',`
>>>        ')
>>>           manage_dirs_pattern($1, tmp_t, tmp_t)
>>> @@ -73,7 +73,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4699,6 +4704,7 @@ interface(`files_manage_generic_tmp_files',`
>>> +@@ -4894,6 +4899,7 @@ interface(`files_manage_generic_tmp_files',`
>>>        ')
>>>           manage_files_pattern($1, tmp_t, tmp_t)
>>> @@ -81,7 +81,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4735,6 +4741,7 @@ interface(`files_rw_generic_tmp_sockets',`
>>> +@@ -4930,6 +4936,7 @@ interface(`files_rw_generic_tmp_sockets',`
>>>        ')
>>>           rw_sock_files_pattern($1, tmp_t, tmp_t)
>>> @@ -89,7 +89,7 @@ index 495cbe2f4..b308eefd9 100644
>>>    ')
>>>       ########################################
>>> -@@ -4942,6 +4949,7 @@ interface(`files_tmp_filetrans',`
>>> +@@ -5137,6 +5144,7 @@ interface(`files_tmp_filetrans',`
>>>        ')
>>>           filetrans_pattern($1, tmp_t, $2, $3, $4)
>>> @@ -98,5 +98,5 @@ index 495cbe2f4..b308eefd9 100644
>>>       ########################################
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch 
>>> b/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch 
>>>
>>> index 3f10d06..22ce8f2 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0032-policy-modules-system-logging-fix-auditd-startup-fai.patch
>>> @@ -1,4 +1,4 @@
>>> -From a196ae5e13b3f8e0d2e7ff27c8d481c9376b18e9 Mon Sep 17 00:00:00 2001
>>> +From eed095029b270bbc49dc67d6b7b6b2fe9c3bca07 Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] policy/modules/system/logging: fix auditd startup 
>>> failures
>>> @@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/system/logging.te 
>>> b/policy/modules/system/logging.te
>>> -index abee7df9c..cc530a2be 100644
>>> +index 90d8ccd31..d3b06db7d 100644
>>>   --- a/policy/modules/system/logging.te
>>>   +++ b/policy/modules/system/logging.te
>>> -@@ -161,6 +161,7 @@ dontaudit auditd_t auditd_etc_t:file map;
>>> +@@ -169,6 +169,7 @@ dontaudit auditd_t auditd_etc_t:file map;
>>>    manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
>>>    allow auditd_t auditd_log_t:dir setattr;
>>>    manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
>>> @@ -28,7 +28,7 @@ index abee7df9c..cc530a2be 100644
>>>    allow auditd_t var_log_t:dir search_dir_perms;
>>>       manage_files_pattern(auditd_t, auditd_runtime_t, 
>>> auditd_runtime_t)
>>> -@@ -290,6 +291,7 @@ optional_policy(`
>>> +@@ -298,6 +299,7 @@ optional_policy(`
>>>    allow audisp_remote_t self:capability { setpcap setuid };
>>>    allow audisp_remote_t self:process { getcap setcap };
>>>    allow audisp_remote_t self:tcp_socket create_socket_perms;
>>> @@ -37,5 +37,5 @@ index abee7df9c..cc530a2be 100644
>>>       manage_dirs_pattern(audisp_remote_t, audit_spool_t, 
>>> audit_spool_t)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch 
>>> b/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch 
>>>
>>> index 3421a43..f62db74 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
>>> @@ -1,4 +1,4 @@
>>> -From bfcb86c9c9ad6a9f10a8556320443d8c96adedc9 Mon Sep 17 00:00:00 2001
>>> +From 3f24b88886fcd1a17248d8d674a02d01061d937a Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] policy/modules/kernel/terminal: don't audit 
>>> tty_device_t in
>>> @@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 3 insertions(+)
>>>     diff --git a/policy/modules/kernel/terminal.if 
>>> b/policy/modules/kernel/terminal.if
>>> -index 55c18dffb..e8c0735eb 100644
>>> +index e5645c7c5..6e9f654ac 100644
>>>   --- a/policy/modules/kernel/terminal.if
>>>   +++ b/policy/modules/kernel/terminal.if
>>>   @@ -335,9 +335,12 @@ interface(`term_use_console',`
>>> @@ -34,5 +34,5 @@ index 55c18dffb..e8c0735eb 100644
>>>       ########################################
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch 
>>> b/recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch 
>>>
>>> similarity index 52%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>>> index f9aa158..0b00f5a 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch
>>> @@ -1,4 +1,4 @@
>>> -From d1352b688603b16eb6da7a30198d8b7abfc55d1e Mon Sep 17 00:00:00 2001
>>> +From 9c84425bbcaef5913fb6e309b8811639134714ed Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Wed, 1 Jul 2020 08:44:07 +0800
>>>   Subject: [PATCH] policy/modules/services/rpcbind: allow rpcbind_t 
>>> to create
>>> @@ -13,14 +13,14 @@ Upstream-Status: Inappropriate [embedded specific]
>>>     Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>   ---
>>> - policy/modules/services/rpcbind.te | 5 +++--
>>> - 1 file changed, 3 insertions(+), 2 deletions(-)
>>> + policy/modules/services/rpcbind.te | 2 +-
>>> + 1 file changed, 1 insertion(+), 1 deletion(-)
>>>     diff --git a/policy/modules/services/rpcbind.te 
>>> b/policy/modules/services/rpcbind.te
>>> -index 168c28ca3..e1eb7d5fc 100644
>>> +index 137c21ece..2a712192b 100644
>>>   --- a/policy/modules/services/rpcbind.te
>>>   +++ b/policy/modules/services/rpcbind.te
>>> -@@ -25,16 +25,17 @@ files_type(rpcbind_var_lib_t)
>>> +@@ -25,7 +25,7 @@ files_type(rpcbind_var_lib_t)
>>>    # Local policy
>>>    #
>>>    @@ -29,17 +29,6 @@ index 168c28ca3..e1eb7d5fc 100644
>>>    # net_admin is for SO_SNDBUFFORCE
>>>    dontaudit rpcbind_t self:capability net_admin;
>>>    allow rpcbind_t self:fifo_file rw_fifo_file_perms;
>>> - allow rpcbind_t self:unix_stream_socket { accept listen };
>>> - allow rpcbind_t self:tcp_socket { accept listen };
>>> -
>>> -+manage_dirs_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
>>> - manage_files_pattern(rpcbind_t, rpcbind_runtime_t, rpcbind_runtime_t)
>>> - manage_sock_files_pattern(rpcbind_t, rpcbind_runtime_t, 
>>> rpcbind_runtime_t)
>>> --files_runtime_filetrans(rpcbind_t, rpcbind_runtime_t, { file 
>>> sock_file })
>>> -+files_runtime_filetrans(rpcbind_t, rpcbind_runtime_t, { file 
>>> sock_file dir })
>>> -
>>> - manage_dirs_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t)
>>> - manage_files_pattern(rpcbind_t, rpcbind_var_lib_t, rpcbind_var_lib_t)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch 
>>> b/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch 
>>>
>>> deleted file mode 100644
>>> index e7ce388..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0034-policy-modules-system-modutils-allow-mod_t-to-access.patch
>>> +++ /dev/null
>>> @@ -1,67 +0,0 @@
>>> -From b3ff2e8572cd929c419775e57b547f309ba9d8fb Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Mon, 24 Aug 2020 11:29:09 +0800
>>> -Subject: [PATCH] policy/modules/system/modutils: allow mod_t to access
>>> - confidentiality of class lockdown
>>> -
>>> -The SELinux lockdown implementation was introduced since kernel 5.6 by
>>> -commit 59438b46471ae6cdfb761afc8c9beaf1e428a331. We need to allow 
>>> mod_t
>>> -and udev_t to access confidentiality of class lockdown to mount 
>>> tracefs.
>>> -
>>> -Fixes:
>>> -kernel: Could not create tracefs 'iwlwifi_data/filter' entry
>>> -kernel: Could not create tracefs 'enable' entry
>>> -kernel: Could not create tracefs 'id' entry
>>> -kernel: Could not create tracefs 'filter' entry
>>> -kernel: Could not create tracefs 'trigger' entry
>>> -kernel: Could not create tracefs 'format' entry
>>> -
>>> -audit[170]: AVC avc:  denied  { confidentiality } for pid=170
>>> -comm="modprobe" lockdown_reason="use of tracefs"
>>> -scontext=system_u:system_r:kmod_t:s15:c0.c1023
>>> -tcontext=system_u:system_r:kmod_t:s15:c0.c1023 tclass=lockdown
>>> -permissive=0
>>> -
>>> -audit[190]: AVC avc:  denied  { confidentiality } for pid=190
>>> -comm="systemd-udevd" lockdown_reason="use of tracefs"
>>> -scontext=system_u:system_r:udev_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:udev_t:s0-s15:c0.c1023 tclass=lockdown
>>> -permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/modutils.te | 2 ++
>>> - policy/modules/system/udev.te     | 2 ++
>>> - 2 files changed, 4 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/modutils.te 
>>> b/policy/modules/system/modutils.te
>>> -index b0a419dc1..5b4f0aca1 100644
>>> ---- a/policy/modules/system/modutils.te
>>> -+++ b/policy/modules/system/modutils.te
>>> -@@ -41,6 +41,8 @@ dontaudit kmod_t self:capability sys_admin;
>>> - allow kmod_t self:udp_socket create_socket_perms;
>>> - allow kmod_t self:rawip_socket create_socket_perms;
>>> -
>>> -+allow kmod_t self:lockdown confidentiality;
>>> -+
>>> - # Read module config and dependency information
>>> - list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
>>> - read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
>>> -diff --git a/policy/modules/system/udev.te 
>>> b/policy/modules/system/udev.te
>>> -index c50ff68c1..4c5a690fb 100644
>>> ---- a/policy/modules/system/udev.te
>>> -+++ b/policy/modules/system/udev.te
>>> -@@ -67,6 +67,8 @@ ifdef(`init_systemd',`
>>> - # for systemd-udevd to rename interfaces
>>> - allow udev_t self:netlink_route_socket nlmsg_write;
>>> -
>>> -+allow udev_t self:lockdown confidentiality;
>>> -+
>>> - can_exec(udev_t, udev_exec_t)
>>> -
>>> - allow udev_t udev_helper_exec_t:dir list_dir_perms;
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch 
>>>
>>> deleted file mode 100644
>>> index 0dfe0ee..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-getty-allow-getty_t-to-search-.patch
>>> +++ /dev/null
>>> @@ -1,32 +0,0 @@
>>> -From 175b493e7fe69de274388a7f251e74ec9cd56c41 Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Tue, 23 Jun 2020 08:39:44 +0800
>>> -Subject: [PATCH] policy/modules/system/getty: allow getty_t to 
>>> search tmpfs
>>> -
>>> -Fixes:
>>> -avc:  denied  { search } for  pid=211 comm="agetty" name="/" 
>>> dev="tmpfs"
>>> -ino=1 scontext=system_u:system_r:getty_t
>>> -tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/getty.te | 1 +
>>> - 1 file changed, 1 insertion(+)
>>> -
>>> -diff --git a/policy/modules/system/getty.te 
>>> b/policy/modules/system/getty.te
>>> -index e6e76a93b..c704ddb82 100644
>>> ---- a/policy/modules/system/getty.te
>>> -+++ b/policy/modules/system/getty.te
>>> -@@ -68,6 +68,7 @@ files_read_etc_runtime_files(getty_t)
>>> - files_read_etc_files(getty_t)
>>> - files_search_spool(getty_t)
>>> - files_dontaudit_search_var_lib(getty_t)
>>> -+fs_search_tmpfs(getty_t)
>>> -
>>> - fs_search_auto_mountpoints(getty_t)
>>> - # for error condition handling
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch 
>>> b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch 
>>>
>>> similarity index 91%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
>>> index cc29c7b..43b2f4d 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-enable-support-for-sys.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-enable-support-for-sys.patch
>>> @@ -1,4 +1,4 @@
>>> -From 93d4f198bd469a8728f5ce0cc51ff18f8a58b23b Mon Sep 17 00:00:00 2001
>>> +From 6465e39b6dfe8daa88cab321e3cf44ccc9f1441d Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Thu, 4 Feb 2016 06:03:19 -0500
>>>   Subject: [PATCH] policy/modules/system/systemd: enable support for
>>> @@ -36,10 +36,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 5 insertions(+), 1 deletion(-)
>>>     diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 3d9198342..31d28a0e3 100644
>>> +index ef25974ac..362248d17 100644
>>>   --- a/policy/modules/system/systemd.te
>>>   +++ b/policy/modules/system/systemd.te
>>> -@@ -10,7 +10,7 @@ policy_module(systemd, 1.12.6)
>>> +@@ -10,7 +10,7 @@ policy_module(systemd)
>>>    ## Enable support for systemd-tmpfiles to manage all non-security 
>>> files.
>>>    ## </p>
>>>    ## </desc>
>>> @@ -48,7 +48,7 @@ index 3d9198342..31d28a0e3 100644
>>>       ## <desc>
>>>    ## <p>
>>> -@@ -1396,6 +1396,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
>>> +@@ -1640,6 +1640,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
>>>    files_relabelto_home(systemd_tmpfiles_t)
>>>    files_relabelto_etc_dirs(systemd_tmpfiles_t)
>>>    files_setattr_lock_dirs(systemd_tmpfiles_t)
>>> @@ -60,5 +60,5 @@ index 3d9198342..31d28a0e3 100644
>>>    files_manage_etc_symlinks(systemd_tmpfiles_t)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch 
>>> b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch 
>>>
>>> similarity index 88%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
>>> index 49aa7a6..56b6119 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
>>> @@ -1,4 +1,4 @@
>>> -From 4e2df7ca542b6c94e74345daaecb33efc82d749a Mon Sep 17 00:00:00 2001
>>> +From 2acb5ddbd04c578a420418e3bcb572bbd2dfbae6 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Sat, 18 Dec 2021 09:26:43 +0800
>>>   Subject: [PATCH] policy/modules/system/systemd: allow 
>>> systemd_logind_t to read
>>> @@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 847895e63..1a83148c1 100644
>>> +index 362248d17..4a1e06640 100644
>>>   --- a/policy/modules/system/systemd.te
>>>   +++ b/policy/modules/system/systemd.te
>>> -@@ -721,6 +721,7 @@ 
>>> userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
>>> +@@ -920,6 +920,7 @@ 
>>> userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
>>>    userdom_relabelto_user_runtime_dirs(systemd_logind_t)
>>>    userdom_setattr_user_ttys(systemd_logind_t)
>>>    userdom_use_user_ttys(systemd_logind_t)
>>> @@ -39,5 +39,5 @@ index 847895e63..1a83148c1 100644
>>>    # Needed to work around patch not yet merged into the 
>>> systemd-logind supported on RHEL 7.x
>>>    # The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 
>>> 4b51966cf6c06250036e428608da92f8640beb96
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch 
>>> b/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch 
>>>
>>> deleted file mode 100644
>>> index 9465a3e..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
>>> +++ /dev/null
>>> @@ -1,71 +0,0 @@
>>> -From 07866ad826b299194c1bfd7978e5077dde72a68e Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Mon, 11 Oct 2021 10:10:10 +0800
>>> -Subject: [PATCH] policy/modules/admin/usermanage: allow useradd to 
>>> relabel
>>> - user home files
>>> -
>>> -Fixes:
>>> -avc: denied { relabelfrom } for pid=491 comm="useradd" name=".bashrc"
>>> -dev="vda" ino=12641 scontext=root:sysadm_r:useradd_t
>>> -tcontext=user_u:object_r:user_home_t tclass=file permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/admin/usermanage.te  |  2 ++
>>> - policy/modules/system/userdomain.if | 18 ++++++++++++++++++
>>> - 2 files changed, 20 insertions(+)
>>> -
>>> -diff --git a/policy/modules/admin/usermanage.te 
>>> b/policy/modules/admin/usermanage.te
>>> -index 98646b4b4..50c479498 100644
>>> ---- a/policy/modules/admin/usermanage.te
>>> -+++ b/policy/modules/admin/usermanage.te
>>> -@@ -496,6 +496,7 @@ files_read_etc_runtime_files(useradd_t)
>>> -
>>> - fs_search_auto_mountpoints(useradd_t)
>>> - fs_getattr_xattr_fs(useradd_t)
>>> -+fs_search_tmpfs(useradd_t)
>>> -
>>> - mls_file_upgrade(useradd_t)
>>> -
>>> -@@ -541,6 +542,7 @@ userdom_home_filetrans_user_home_dir(useradd_t)
>>> - userdom_manage_user_home_content_dirs(useradd_t)
>>> - userdom_manage_user_home_content_files(useradd_t)
>>> - userdom_user_home_dir_filetrans_user_home_content(useradd_t, 
>>> notdevfile_class_set)
>>> -+userdom_relabel_user_home_content_files(useradd_t)
>>> -
>>> - optional_policy(`
>>> -     mta_manage_spool(useradd_t)
>>> -diff --git a/policy/modules/system/userdomain.if 
>>> b/policy/modules/system/userdomain.if
>>> -index 22b3c1bf7..ec625170d 100644
>>> ---- a/policy/modules/system/userdomain.if
>>> -+++ b/policy/modules/system/userdomain.if
>>> -@@ -2362,6 +2362,24 @@ 
>>> interface(`userdom_dontaudit_relabel_user_home_content_files',`
>>> -     dontaudit $1 user_home_t:file relabel_file_perms;
>>> - ')
>>> -
>>> -+########################################
>>> -+## <summary>
>>> -+##    Relabel user home files.
>>> -+## </summary>
>>> -+## <param name="domain">
>>> -+##    <summary>
>>> -+##    Domain allowed access.
>>> -+##    </summary>
>>> -+## </param>
>>> -+#
>>> -+interface(`userdom_relabel_user_home_content_files',`
>>> -+    gen_require(`
>>> -+        type user_home_t;
>>> -+    ')
>>> -+
>>> -+    allow $1 user_home_t:file relabel_file_perms;
>>> -+')
>>> -+
>>> - ########################################
>>> - ## <summary>
>>> - ##    Read user home subdirectory symbolic links.
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch 
>>> b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch 
>>>
>>> new file mode 100644
>>> index 0000000..78c4dc8
>>> --- /dev/null
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
>>> @@ -0,0 +1,36 @@
>>> +From 51a7f8058fee569322c1a0597fccd36c318ad943 Mon Sep 17 00:00:00 2001
>>> +From: Yi Zhao <yi.zhao@windriver.com>
>>> +Date: Fri, 28 Oct 2022 11:56:09 +0800
>>> +Subject: [PATCH] policy/modules/roles/sysadm: allow sysadm to use 
>>> init file
>>> + descriptors
>>> +
>>> +Root can not login via console without this.
>>> +
>>> +Fixes:
>>> +avc: denied { use } for pid=323 comm="sh" path="/dev/tty1"
>>> +dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t
>>> +tcontext=system_u:system_r:init_t tclass=fd permissive=0
>>> +
>>> +Upstream-Status: Pending
>>> +
>>> +Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> +---
>>> + policy/modules/roles/sysadm.te | 2 ++
>>> + 1 file changed, 2 insertions(+)
>>> +
>>> +diff --git a/policy/modules/roles/sysadm.te 
>>> b/policy/modules/roles/sysadm.te
>>> +index bb715a847..088c954f5 100644
>>> +--- a/policy/modules/roles/sysadm.te
>>> ++++ b/policy/modules/roles/sysadm.te
>>> +@@ -86,6 +86,8 @@ ifdef(`init_systemd',`
>>> +     # LookupDynamicUserByUID on org.freedesktop.systemd1.
>>> +     init_dbus_chat(sysadm_t)
>>> +
>>> ++    init_use_fds(sysadm_t)
>>> ++
>>> +     # Allow sysadm to get the status of and set properties of 
>>> other users,
>>> +     # sessions, and seats on the system.
>>> +     systemd_dbus_chat_logind(sysadm_t)
>>> +--
>>> +2.25.1
>>> +
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch 
>>> b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch 
>>>
>>> new file mode 100644
>>> index 0000000..85bb82b
>>> --- /dev/null
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
>>> @@ -0,0 +1,84 @@
>>> +From 5b6f3fcb1ddabd0a66541959306e7b0adfe2b2b0 Mon Sep 17 00:00:00 2001
>>> +From: Yi Zhao <yi.zhao@windriver.com>
>>> +Date: Thu, 4 Feb 2021 10:48:54 +0800
>>> +Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
>>> +
>>> +Fixes:
>>> +systemctl[277]: Failed to connect to bus: No medium found
>>> +
>>> +avc: denied { mknod } for  pid=297 comm="systemd" capability=27
>>> +scontext=root:sysadm_r:sysadm_systemd_t
>>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>>> +
>>> +avc: denied { bpf } for pid=297 comm="systemd" capability=39
>>> +scontext=root:sysadm_r:sysadm_systemd_t
>>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 
>>> permissive=0
>>> +
>>> +avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
>>> +scontext=root:sysadm_r:sysadm_systemd_t
>>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>>> +
>>> +avc: denied { perfmon } for pid=297 comm="systemd" capability=38
>>> +scontext=root:sysadm_r:sysadm_systemd_t
>>> +tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 
>>> permissive=0
>>> +
>>> +Upstream-Status: Inappropriate [embedded specific]
>>> +
>>> +Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> +---
>>> + policy/modules/roles/sysadm.te   |  2 ++
>>> + policy/modules/system/systemd.if | 21 ++++++++++++++++++++-
>>> + 2 files changed, 22 insertions(+), 1 deletion(-)
>>> +
>>> +diff --git a/policy/modules/roles/sysadm.te 
>>> b/policy/modules/roles/sysadm.te
>>> +index 088c954f5..92f50fd5a 100644
>>> +--- a/policy/modules/roles/sysadm.te
>>> ++++ b/policy/modules/roles/sysadm.te
>>> +@@ -98,6 +98,8 @@ ifdef(`init_systemd',`
>>> +
>>> +     # Allow sysadm to follow logs in the journal, i.e. with podman 
>>> logs -f
>>> +     systemd_watch_journal_dirs(sysadm_t)
>>> ++
>>> ++    systemd_sysadm_user(sysadm_t)
>>> + ')
>>> +
>>> + tunable_policy(`allow_ptrace',`
>>> +diff --git a/policy/modules/system/systemd.if 
>>> b/policy/modules/system/systemd.if
>>> +index 9dc91fbb7..325ca548b 100644
>>> +--- a/policy/modules/system/systemd.if
>>> ++++ b/policy/modules/system/systemd.if
>>> +@@ -58,7 +58,7 @@ template(`systemd_role_template',`
>>> +     allow $1_systemd_t self:process { getsched signal };
>>> +     allow $1_systemd_t self:netlink_kobject_uevent_socket 
>>> create_socket_perms;
>>> +     allow $1_systemd_t self:unix_stream_socket 
>>> create_stream_socket_perms;
>>> +-    allow $1_systemd_t $3:process { setsched rlimitinh 
>>> signal_perms };
>>> ++    allow $1_systemd_t $3:process { setsched rlimitinh 
>>> signal_perms noatsecure };
>>> +     corecmd_shell_domtrans($1_systemd_t, $3)
>>> +     corecmd_bin_domtrans($1_systemd_t, $3)
>>> +
>>> +@@ -2613,3 +2613,22 @@ 
>>> interface(`systemd_use_inherited_machined_ptys', `
>>> +     allow $1 systemd_machined_t:fd use;
>>> +     allow $1 systemd_machined_devpts_t:chr_file 
>>> rw_inherited_term_perms;
>>> + ')
>>> ++
>>> ++#########################################
>>> ++## <summary>
>>> ++##    sysadm user for systemd --user
>>> ++## </summary>
>>> ++## <param name="role">
>>> ++##    <summary>
>>> ++##  Role allowed access.
>>> ++##    </summary>
>>> ++## </param>
>>> ++#
>>> ++interface(`systemd_sysadm_user',`
>>> ++    gen_require(`
>>> ++        type sysadm_systemd_t;
>>> ++    ')
>>> ++
>>> ++    allow sysadm_systemd_t self:capability { mknod sys_admin };
>>> ++    allow sysadm_systemd_t self:capability2 { bpf perfmon };
>>> ++')
>>> +--
>>> +2.25.1
>>> +
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch 
>>>
>>> similarity index 84%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>>> index 4cae8c6..c3b4b55 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
>>> @@ -1,4 +1,4 @@
>>> -From 705008ba8ef960cf2e4813b4b8c5a87b919d545f Mon Sep 17 00:00:00 2001
>>> +From ccdd22cc2776b695f96faffc88699aa2b182e085 Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Sat, 15 Feb 2014 04:22:47 -0500
>>>   Subject: [PATCH] policy/modules/system/mount: make mount_t domain 
>>> MLS trusted
>>> @@ -19,10 +19,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/system/mount.te 
>>> b/policy/modules/system/mount.te
>>> -index e39ab41a8..3481f9294 100644
>>> +index d028723ce..97f49e58e 100644
>>>   --- a/policy/modules/system/mount.te
>>>   +++ b/policy/modules/system/mount.te
>>> -@@ -116,6 +116,7 @@ fs_dontaudit_write_all_image_files(mount_t)
>>> +@@ -112,6 +112,7 @@ fs_dontaudit_write_all_image_files(mount_t)
>>>       mls_file_read_all_levels(mount_t)
>>>    mls_file_write_all_levels(mount_t)
>>> @@ -31,5 +31,5 @@ index e39ab41a8..3481f9294 100644
>>>    selinux_get_enforce_mode(mount_t)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch 
>>> b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch 
>>>
>>> deleted file mode 100644
>>> index ea8af31..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
>>> +++ /dev/null
>>> @@ -1,60 +0,0 @@
>>> -From 99139408a7919282e97e1b2fcd5da33248386d73 Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Mon, 25 Jan 2021 14:14:59 +0800
>>> -Subject: [PATCH] policy/modules/system/systemd: fix 
>>> systemd-resolved startup
>>> - failures
>>> -
>>> -* Allow systemd_resolved_t to manage systemd_resolved_runtime_t link
>>> -  files
>>> -* Allow systemd_resolved_t to send and recevie messages from dhcpc 
>>> over
>>> -  dbus
>>> -
>>> -Fixes:
>>> -avc:  denied  { create } for  pid=329 comm="systemd-resolve"
>>> -name=".#stub-resolv.conf53cb7f9d1e3aa72b"
>>> -scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
>>> -tcontext=system_u:object_r:systemd_resolved_runtime_t:s0 
>>> tclass=lnk_file
>>> -permissive=0
>>> -
>>> -avc:  denied  { send_msg } for msgtype=method_call
>>> -interface=org.freedesktop.resolve1.Manager member=RevertLink
>>> -dest=org.freedesktop.resolve1 spid=340 tpid=345
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
>>> -tclass=dbus permissive=0
>>> -
>>> -avc:  denied  { send_msg } for msgtype=method_return dest=:1.6 
>>> spid=345
>>> -tpid=340 scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=dbus
>>> -permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/systemd.te | 2 ++
>>> - 1 file changed, 2 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 31d28a0e3..448905ff7 100644
>>> ---- a/policy/modules/system/systemd.te
>>> -+++ b/policy/modules/system/systemd.te
>>> -@@ -1199,6 +1199,7 @@ allow systemd_resolved_t 
>>> systemd_networkd_runtime_t:dir watch;
>>> -
>>> - manage_dirs_pattern(systemd_resolved_t, 
>>> systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>>> - manage_files_pattern(systemd_resolved_t, 
>>> systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>>> -+manage_lnk_files_pattern(systemd_resolved_t, 
>>> systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>>> - manage_sock_files_pattern(systemd_resolved_t, 
>>> systemd_resolved_runtime_t, systemd_resolved_runtime_t)
>>> - init_runtime_filetrans(systemd_resolved_t, 
>>> systemd_resolved_runtime_t, dir)
>>> -
>>> -@@ -1236,6 +1237,7 @@ optional_policy(`
>>> -     dbus_system_bus_client(systemd_resolved_t)
>>> -     dbus_watch_system_bus_runtime_dirs(systemd_resolved_t)
>>> - dbus_watch_system_bus_runtime_named_sockets(systemd_resolved_t)
>>> -+    sysnet_dbus_chat_dhcpc(systemd_resolved_t)
>>> - ')
>>> -
>>> - #########################################
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch 
>>> b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch 
>>>
>>> similarity index 83%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>>> index 86317b3..d711612 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
>>> @@ -1,4 +1,4 @@
>>> -From ef2b9196f3a51745a3644489d316bda7cd67f72d Mon Sep 17 00:00:00 2001
>>> +From 64498d6cd30a0a65a24e3e7ab22cca5921c2db89 Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Mon, 28 Jan 2019 14:05:18 +0800
>>>   Subject: [PATCH] policy/modules/roles/sysadm: MLS - sysadm rw to 
>>> clearance
>>> @@ -7,7 +7,7 @@ The two new rules make sysadm_t domain MLS trusted for:
>>>    - reading from files at all levels.
>>>    - writing to processes up to its clearance(s0-s15).
>>>   -With default MLS policy, root user would login in as sysadm_t:s0 by
>>> +With default MLS policy, root user would login as sysadm_t:s0 by
>>>   default. Most processes will run in sysadm_t:s0 because no
>>>   domtrans/rangetrans rules, as a result, even root could not access
>>>   high level files/processes.
>>> @@ -23,10 +23,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/roles/sysadm.te 
>>> b/policy/modules/roles/sysadm.te
>>> -index e1933a5bd..0682ed31a 100644
>>> +index 92f50fd5a..8c154d474 100644
>>>   --- a/policy/modules/roles/sysadm.te
>>>   +++ b/policy/modules/roles/sysadm.te
>>> -@@ -44,6 +44,8 @@ logging_watch_all_logs(sysadm_t)
>>> +@@ -45,6 +45,8 @@ logging_watch_all_logs(sysadm_t)
>>>    logging_watch_audit_log(sysadm_t)
>>>       mls_process_read_all_levels(sysadm_t)
>>> @@ -36,5 +36,5 @@ index e1933a5bd..0682ed31a 100644
>>>    selinux_read_policy(sysadm_t)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch 
>>> b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch 
>>>
>>> deleted file mode 100644
>>> index 91588f1..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
>>> +++ /dev/null
>>> @@ -1,156 +0,0 @@
>>> -From 81e63f86d6d030eaf0204796e32011c08e7b5e52 Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Tue, 28 Sep 2021 10:03:04 +0800
>>> -Subject: [PATCH] policy/modules/system/systemd: allow systemd_*_t 
>>> to get the
>>> - attributes of tmpfs and cgroups
>>> -
>>> -Fixes:
>>> -avc: denied { getattr } for pid=245 comm="systemd-network" name="/"
>>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_networkd_t
>>> -tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
>>> -
>>> -avc: denied { getattr } for pid=252 comm="systemd-resolve" name="/"
>>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_resolved_t
>>> -tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
>>> -
>>> -avc: denied { getattr } for pid=260 comm="systemd-user-se" name="/"
>>> -dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_sessions_t
>>> -tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
>>> -
>>> -avc: denied { search } for pid=293 comm="systemd-user-ru" name="/"
>>> -dev="tmpfs" ino=1 
>>> scontext=system_u:system_r:systemd_user_runtime_dir_t
>>> -tcontext=system_u:object_r:cgroup_t tclass=dir permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/systemd.te | 35 
>>> ++++++++++++++++++++++++++++++++
>>> - 1 file changed, 35 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 448905ff7..847895e63 100644
>>> ---- a/policy/modules/system/systemd.te
>>> -+++ b/policy/modules/system/systemd.te
>>> -@@ -337,6 +337,10 @@ udev_read_runtime_files(systemd_backlight_t)
>>> -
>>> - files_search_var_lib(systemd_backlight_t)
>>> -
>>> -+fs_getattr_tmpfs(systemd_backlight_t)
>>> -+fs_search_cgroup_dirs(systemd_backlight_t)
>>> -+fs_getattr_cgroup(systemd_backlight_t)
>>> -+
>>> - #######################################
>>> - #
>>> - # Binfmt local policy
>>> -@@ -447,6 +451,7 @@ files_list_usr(systemd_generator_t)
>>> - fs_list_efivars(systemd_generator_t)
>>> - fs_getattr_cgroup(systemd_generator_t)
>>> - fs_getattr_xattr_fs(systemd_generator_t)
>>> -+fs_getattr_tmpfs(systemd_generator_t)
>>> -
>>> - init_create_runtime_files(systemd_generator_t)
>>> - init_manage_runtime_dirs(systemd_generator_t)
>>> -@@ -515,6 +520,10 @@ 
>>> systemd_log_parse_environment(systemd_hostnamed_t)
>>> - # Allow reading /run/udev/data/+dmi:id
>>> - udev_read_runtime_files(systemd_hostnamed_t)
>>> -
>>> -+fs_getattr_tmpfs(systemd_hostnamed_t)
>>> -+fs_search_cgroup_dirs(systemd_hostnamed_t)
>>> -+fs_getattr_cgroup(systemd_hostnamed_t)
>>> -+
>>> - optional_policy(`
>>> -     dbus_connect_system_bus(systemd_hostnamed_t)
>>> -     dbus_system_bus_client(systemd_hostnamed_t)
>>> -@@ -835,6 +844,10 @@ dev_read_sysfs(systemd_modules_load_t)
>>> - files_mmap_read_kernel_modules(systemd_modules_load_t)
>>> - files_read_etc_files(systemd_modules_load_t)
>>> -
>>> -+fs_getattr_tmpfs(systemd_modules_load_t)
>>> -+fs_search_cgroup_dirs(systemd_modules_load_t)
>>> -+fs_getattr_cgroup(systemd_modules_load_t)
>>> -+
>>> - modutils_read_module_config(systemd_modules_load_t)
>>> - modutils_read_module_deps(systemd_modules_load_t)
>>> -
>>> -@@ -885,6 +898,7 @@ files_watch_runtime_dirs(systemd_networkd_t)
>>> - files_watch_root_dirs(systemd_networkd_t)
>>> - files_list_runtime(systemd_networkd_t)
>>> - fs_getattr_xattr_fs(systemd_networkd_t)
>>> -+fs_getattr_tmpfs(systemd_networkd_t)
>>> - fs_getattr_cgroup(systemd_networkd_t)
>>> - fs_search_cgroup_dirs(systemd_networkd_t)
>>> - fs_read_nsfs_files(systemd_networkd_t)
>>> -@@ -1185,6 +1199,10 @@ udev_read_runtime_files(systemd_rfkill_t)
>>> -
>>> - systemd_log_parse_environment(systemd_rfkill_t)
>>> -
>>> -+fs_getattr_tmpfs(systemd_rfkill_t)
>>> -+fs_search_cgroup_dirs(systemd_rfkill_t)
>>> -+fs_getattr_cgroup(systemd_rfkill_t)
>>> -+
>>> - #########################################
>>> - #
>>> - # Resolved local policy
>>> -@@ -1224,6 +1242,9 @@ auth_use_nsswitch(systemd_resolved_t)
>>> - files_watch_root_dirs(systemd_resolved_t)
>>> - files_watch_runtime_dirs(systemd_resolved_t)
>>> - files_list_runtime(systemd_resolved_t)
>>> -+fs_getattr_tmpfs(systemd_resolved_t)
>>> -+fs_search_cgroup_dirs(systemd_resolved_t)
>>> -+fs_getattr_cgroup(systemd_resolved_t)
>>> -
>>> - init_dgram_send(systemd_resolved_t)
>>> -
>>> -@@ -1288,6 +1309,10 @@ seutil_read_file_contexts(systemd_sessions_t)
>>> -
>>> - systemd_log_parse_environment(systemd_sessions_t)
>>> -
>>> -+fs_getattr_tmpfs(systemd_sessions_t)
>>> -+fs_search_cgroup_dirs(systemd_sessions_t)
>>> -+fs_getattr_cgroup(systemd_sessions_t)
>>> -+
>>> - ########################################
>>> - #
>>> - # sysctl local policy
>>> -@@ -1304,6 +1329,9 @@ kernel_rw_all_sysctls(systemd_sysctl_t)
>>> - kernel_dontaudit_getattr_proc(systemd_sysctl_t)
>>> -
>>> - files_read_etc_files(systemd_sysctl_t)
>>> -+fs_getattr_tmpfs(systemd_sysctl_t)
>>> -+fs_search_cgroup_dirs(systemd_sysctl_t)
>>> -+fs_getattr_cgroup(systemd_sysctl_t)
>>> -
>>> - systemd_log_parse_environment(systemd_sysctl_t)
>>> -
>>> -@@ -1409,6 +1437,8 @@ fs_getattr_tmpfs(systemd_tmpfiles_t)
>>> - fs_getattr_xattr_fs(systemd_tmpfiles_t)
>>> - fs_list_tmpfs(systemd_tmpfiles_t)
>>> - fs_relabelfrom_tmpfs_dirs(systemd_tmpfiles_t)
>>> -+fs_search_cgroup_dirs(systemd_tmpfiles_t)
>>> -+fs_getattr_cgroup(systemd_tmpfiles_t)
>>> -
>>> - selinux_get_fs_mount(systemd_tmpfiles_t)
>>> - selinux_use_status_page(systemd_tmpfiles_t)
>>> -@@ -1497,6 +1527,10 @@ allow systemd_update_done_t 
>>> systemd_update_run_t:file manage_file_perms;
>>> - files_etc_filetrans(systemd_update_done_t, systemd_update_run_t, 
>>> file)
>>> - files_var_filetrans(systemd_update_done_t, systemd_update_run_t, 
>>> file)
>>> -
>>> -+fs_getattr_tmpfs(systemd_update_done_t)
>>> -+fs_search_cgroup_dirs(systemd_update_done_t)
>>> -+fs_getattr_cgroup(systemd_update_done_t)
>>> -+
>>> - kernel_read_kernel_sysctls(systemd_update_done_t)
>>> -
>>> - selinux_use_status_page(systemd_update_done_t)
>>> -@@ -1601,6 +1635,7 @@ fs_unmount_tmpfs(systemd_user_runtime_dir_t)
>>> - fs_relabelfrom_tmpfs_dirs(systemd_user_runtime_dir_t)
>>> - fs_read_cgroup_files(systemd_user_runtime_dir_t)
>>> - fs_getattr_cgroup(systemd_user_runtime_dir_t)
>>> -+fs_search_cgroup_dirs(systemd_user_runtime_dir_t)
>>> -
>>> - kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
>>> - kernel_dontaudit_getattr_proc(systemd_user_runtime_dir_t)
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch 
>>> b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch 
>>>
>>> similarity index 84%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>>> index f659e7e..d22dacf 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
>>> @@ -1,4 +1,4 @@
>>> -From 18ad027229a06fdcb833482dff0c2ae637d08e78 Mon Sep 17 00:00:00 2001
>>> +From e82c43e60ef52ba00e8f2af5b46b2a6d49331209 Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Fri, 23 Aug 2013 12:01:53 +0800
>>>   Subject: [PATCH] policy/modules/services/rpc: make nfsd_t domain 
>>> MLS trusted
>>> @@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    2 files changed, 7 insertions(+)
>>>     diff --git a/policy/modules/kernel/kernel.te 
>>> b/policy/modules/kernel/kernel.te
>>> -index ca951cb44..a32c59eb1 100644
>>> +index 5124ae016..a40db8507 100644
>>>   --- a/policy/modules/kernel/kernel.te
>>>   +++ b/policy/modules/kernel/kernel.te
>>> -@@ -356,6 +356,8 @@ mls_process_read_all_levels(kernel_t)
>>> +@@ -368,6 +368,8 @@ mls_process_read_all_levels(kernel_t)
>>>    mls_process_write_all_levels(kernel_t)
>>>    mls_file_write_all_levels(kernel_t)
>>>    mls_file_read_all_levels(kernel_t)
>>> @@ -28,7 +28,7 @@ index ca951cb44..a32c59eb1 100644
>>>    ifdef(`distro_redhat',`
>>>        # Bugzilla 222337
>>>   diff --git a/policy/modules/services/rpcbind.te 
>>> b/policy/modules/services/rpcbind.te
>>> -index e1eb7d5fc..da0994749 100644
>>> +index 2a712192b..923e48db7 100644
>>>   --- a/policy/modules/services/rpcbind.te
>>>   +++ b/policy/modules/services/rpcbind.te
>>>   @@ -73,6 +73,11 @@ logging_send_syslog_msg(rpcbind_t)
>>> @@ -36,7 +36,7 @@ index e1eb7d5fc..da0994749 100644
>>>    miscfiles_read_localization(rpcbind_t)
>>>      +# nfsd_t would not be allowed to send unix_stream_socket to 
>>> rpcbind_t,
>>> -+# because the are running in different level. So add rules to 
>>> allow this.
>>> ++# because they are running in different level. So add rules to 
>>> allow this.
>>>   +mls_socket_read_all_levels(rpcbind_t)
>>>   +mls_socket_write_all_levels(rpcbind_t)
>>>   +
>>> @@ -44,5 +44,5 @@ index e1eb7d5fc..da0994749 100644
>>>        term_dontaudit_use_unallocated_ttys(rpcbind_t)
>>>    ')
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch 
>>> b/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch 
>>>
>>> deleted file mode 100644
>>> index 2232d48..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
>>> +++ /dev/null
>>> @@ -1,55 +0,0 @@
>>> -From dc2c9c91219311f6c4d985169dff6c5931a465d7 Mon Sep 17 00:00:00 2001
>>> -From: Wenzong Fan <wenzong.fan@windriver.com>
>>> -Date: Thu, 4 Feb 2016 02:10:15 -0500
>>> -Subject: [PATCH] policy/modules/system/logging: fix syslogd 
>>> failures for
>>> - systemd
>>> -
>>> -Fixes:
>>> -syslogd[243]: Error opening log file: /var/log/auth.log: Permission 
>>> denied
>>> -syslogd[243]: Error opening log file: /var/log/syslog: Permission 
>>> denied
>>> -syslogd[243]: Error opening log file: /var/log/kern.log: Permission 
>>> denied
>>> -syslogd[243]: Error opening log file: /var/log/mail.log: Permission 
>>> denied
>>> -syslogd[243]: Error opening log file: /var/log/mail.err: Permission 
>>> denied
>>> -syslogd[243]: Error opening log file: /var/log/messages: Permission 
>>> denied
>>> -
>>> -avc:  denied  { search } for  pid=243 comm="syslogd" name="/"
>>> -dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t
>>> -tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
>>> -
>>> -avc:  denied  { write } for  pid=162 comm="systemd-journal"
>>> -name="syslog" dev="tmpfs" ino=515 scontext=system_u:system_r:syslogd_t
>>> -tcontext=system_u:object_r:syslogd_runtime_t tclass=sock_file
>>> -permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/logging.te | 3 ++-
>>> - 1 file changed, 2 insertions(+), 1 deletion(-)
>>> -
>>> -diff --git a/policy/modules/system/logging.te 
>>> b/policy/modules/system/logging.te
>>> -index cc530a2be..5b4b5ec5d 100644
>>> ---- a/policy/modules/system/logging.te
>>> -+++ b/policy/modules/system/logging.te
>>> -@@ -431,7 +431,7 @@ files_search_var_lib(syslogd_t)
>>> -
>>> - # manage runtime files
>>> - allow syslogd_t syslogd_runtime_t:dir create_dir_perms;
>>> --allow syslogd_t syslogd_runtime_t:sock_file { create setattr 
>>> unlink };
>>> -+allow syslogd_t syslogd_runtime_t:sock_file { create setattr 
>>> unlink write };
>>> - allow syslogd_t syslogd_runtime_t:file map;
>>> - manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
>>> - files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
>>> -@@ -495,6 +495,7 @@ files_var_lib_filetrans(syslogd_t, 
>>> syslogd_var_lib_t, { file dir })
>>> -
>>> - fs_getattr_all_fs(syslogd_t)
>>> - fs_search_auto_mountpoints(syslogd_t)
>>> -+fs_search_tmpfs(syslogd_t)
>>> -
>>> - mls_file_write_all_levels(syslogd_t) # Need to be able to write to 
>>> /var/run/ and /var/log directories
>>> -
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch 
>>>
>>> similarity index 90%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>>> index ace056a..30c84f6 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
>>> @@ -1,4 +1,4 @@
>>> -From b41a910654f5c5fe198b1695df18b6f6a1af7904 Mon Sep 17 00:00:00 2001
>>> +From 9343914c0486b5aa6ff7cceeb8f6c399115e5fb3 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Tue, 30 Jun 2020 10:18:20 +0800
>>>   Subject: [PATCH] policy/modules/admin/dmesg: make dmesg_t MLS 
>>> trusted reading
>>> @@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/admin/dmesg.te 
>>> b/policy/modules/admin/dmesg.te
>>> -index f3421fdbb..d87ee5583 100644
>>> +index f1da315a9..89478c38e 100644
>>>   --- a/policy/modules/admin/dmesg.te
>>>   +++ b/policy/modules/admin/dmesg.te
>>>   @@ -52,6 +52,8 @@ miscfiles_read_localization(dmesg_t)
>>> @@ -32,5 +32,5 @@ index f3421fdbb..d87ee5583 100644
>>>        seutil_sigchld_newrole(dmesg_t)
>>>    ')
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch 
>>> b/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch 
>>>
>>> deleted file mode 100644
>>> index 108f62f..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
>>> +++ /dev/null
>>> @@ -1,172 +0,0 @@
>>> -From 20b2608718064a92f9255adb459a97d95fdbc22e Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Thu, 4 Feb 2021 10:48:54 +0800
>>> -Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
>>> -
>>> -Fixes:
>>> -systemctl[1598]: Failed to connect to bus: 
>>> $DBUS_SESSION_BUS_ADDRESS and
>>> -$XDG_RUNTIME_DIR not defined (consider using --machine=<user>@.host
>>> ---user to connect to bus of other user)
>>> -
>>> -avc: denied { connectto } for  pid=293 comm="login"
>>> -path="/run/systemd/userdb/io.systemd.Multiplexer"
>>> -scontext=system_u:system_r:local_login_t
>>> -tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
>>> -permissive=0
>>> -
>>> -avc: denied { read } for  pid=293 comm="login" 
>>> name="io.systemd.DropIn"
>>> -dev="tmpfs" ino=44 scontext=system_u:system_r:local_login_t
>>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>>> -permissive=0
>>> -
>>> -avc: denied { read } for  pid=293 comm="login"
>>> -name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
>>> -scontext=system_u:system_r:local_login_t
>>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>>> -permissive=0
>>> -
>>> -avc: denied { connectto } for  pid=244 comm="systemd-logind"
>>> -path="/run/systemd/userdb/io.systemd.Multiplexer"
>>> -scontext=system_u:system_r:systemd_logind_t
>>> -tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
>>> -permissive=0
>>> -
>>> -avc: denied { read } for  pid=244 comm="systemd-logind"
>>> -name="io.systemd.DropIn" dev="tmpfs" ino=44
>>> -scontext=system_u:system_r:systemd_logind_t
>>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>>> -permissive=0
>>> -
>>> -avc: denied { read } for  pid=244 comm="systemd-logind"
>>> -name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
>>> -scontext=system_u:system_r:systemd_logind_t
>>> -tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
>>> -permissive=0
>>> -
>>> -avc: denied { mknod } for  pid=297 comm="systemd" capability=27
>>> -scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>>> -
>>> -avc: denied { setrlimit } for pid=297 comm="systemd"
>>> -scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=process permissive=0
>>> -
>>> -avc: denied { bpf } for pid=297 comm="systemd" capability=39
>>> -scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 
>>> permissive=0
>>> -
>>> -avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
>>> -scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
>>> -
>>> -avc: denied { perfmon } for pid=297 comm="systemd" capability=38
>>> -scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 
>>> permissive=0
>>> -
>>> -avc: denied { watch } for pid=297 comm="systemd" path="/etc" dev="vda"
>>> -ino=173 scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=system_u:object_r:etc_t tclass=dir permissive=0
>>> -
>>> -avc: denied { getattr } for pid=297 comm="systemd" name="/" dev="vda"
>>> -ino=2 scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
>>> -
>>> -avc: denied { read } for pid=297 comm="systemd" name="unix" dev="proc"
>>> -ino=4026532057 scontext=root:sysadm_r:sysadm_systemd_t
>>> -tcontext=system_u:object_r:proc_net_t tclass=file permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/roles/sysadm.te   |  2 ++
>>> - policy/modules/system/init.if    |  1 +
>>> - policy/modules/system/systemd.if | 27 ++++++++++++++++++++++++++-
>>> - 3 files changed, 29 insertions(+), 1 deletion(-)
>>> -
>>> -diff --git a/policy/modules/roles/sysadm.te 
>>> b/policy/modules/roles/sysadm.te
>>> -index 46d3e2f0b..e1933a5bd 100644
>>> ---- a/policy/modules/roles/sysadm.te
>>> -+++ b/policy/modules/roles/sysadm.te
>>> -@@ -92,6 +92,8 @@ ifdef(`init_systemd',`
>>> -     # Allow sysadm to query and set networking settings on the 
>>> system.
>>> -     systemd_dbus_chat_networkd(sysadm_t)
>>> -     fs_read_nsfs_files(sysadm_t)
>>> -+
>>> -+    systemd_sysadm_user(sysadm_t)
>>> - ')
>>> -
>>> - tunable_policy(`allow_ptrace',`
>>> -diff --git a/policy/modules/system/init.if 
>>> b/policy/modules/system/init.if
>>> -index 0171ee299..8ca29f654 100644
>>> ---- a/policy/modules/system/init.if
>>> -+++ b/policy/modules/system/init.if
>>> -@@ -959,6 +959,7 @@ interface(`init_unix_stream_socket_connectto',`
>>> -     ')
>>> -
>>> -     allow $1 init_t:unix_stream_socket connectto;
>>> -+    allow $1 initrc_t:unix_stream_socket connectto;
>>> - ')
>>> -
>>> - ########################################
>>> -diff --git a/policy/modules/system/systemd.if 
>>> b/policy/modules/system/systemd.if
>>> -index 38adf050c..5c44d8d8a 100644
>>> ---- a/policy/modules/system/systemd.if
>>> -+++ b/policy/modules/system/systemd.if
>>> -@@ -57,7 +57,7 @@ template(`systemd_role_template',`
>>> -     allow $1_systemd_t self:process { getsched signal };
>>> -     allow $1_systemd_t self:netlink_kobject_uevent_socket 
>>> create_socket_perms;
>>> -     allow $1_systemd_t self:unix_stream_socket 
>>> create_stream_socket_perms;
>>> --    allow $1_systemd_t $3:process { setsched rlimitinh 
>>> signal_perms };
>>> -+    allow $1_systemd_t $3:process { setsched rlimitinh 
>>> signal_perms noatsecure };
>>> -     corecmd_shell_domtrans($1_systemd_t, $3)
>>> -     corecmd_bin_domtrans($1_systemd_t, $3)
>>> -
>>> -@@ -88,8 +88,11 @@ template(`systemd_role_template',`
>>> -
>>> -     fs_manage_cgroup_files($1_systemd_t)
>>> -     fs_watch_cgroup_files($1_systemd_t)
>>> -+    files_watch_etc_dirs($1_systemd_t)
>>> -+    fs_getattr_xattr_fs($1_systemd_t)
>>> -
>>> -     kernel_dontaudit_getattr_proc($1_systemd_t)
>>> -+    kernel_read_network_state($1_systemd_t)
>>> -
>>> -     selinux_use_status_page($1_systemd_t)
>>> -
>>> -@@ -1052,6 +1055,7 @@ interface(`systemd_stream_connect_userdb', `
>>> -     init_search_runtime($1)
>>> -     allow $1 systemd_userdb_runtime_t:dir list_dir_perms;
>>> -     allow $1 systemd_userdb_runtime_t:sock_file 
>>> write_sock_file_perms;
>>> -+    allow $1 systemd_userdb_runtime_t:lnk_file read_lnk_file_perms;
>>> -     init_unix_stream_socket_connectto($1)
>>> - ')
>>> -
>>> -@@ -2003,3 +2007,24 @@ 
>>> interface(`systemd_use_inherited_machined_ptys', `
>>> -     allow $1 systemd_machined_t:fd use;
>>> -     allow $1 systemd_machined_devpts_t:chr_file 
>>> rw_inherited_term_perms;
>>> - ')
>>> -+
>>> -+#########################################
>>> -+## <summary>
>>> -+##    sysadm user for systemd --user
>>> -+## </summary>
>>> -+## <param name="role">
>>> -+##    <summary>
>>> -+##  Role allowed access.
>>> -+##    </summary>
>>> -+## </param>
>>> -+#
>>> -+interface(`systemd_sysadm_user',`
>>> -+    gen_require(`
>>> -+        type sysadm_systemd_t;
>>> -+    ')
>>> -+
>>> -+    allow sysadm_systemd_t self:capability { mknod sys_admin };
>>> -+    allow sysadm_systemd_t self:capability2 { bpf perfmon };
>>> -+    allow sysadm_systemd_t self:process setrlimit;
>>> -+    allow $1 sysadm_systemd_t:system reload;
>>> -+')
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>>
>>> similarity index 94%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> index 8b9f98c..932047a 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> @@ -1,4 +1,4 @@
>>> -From c2e99e27acc1454d792b3e8d6f24d3a2a3be29e3 Mon Sep 17 00:00:00 2001
>>> +From 057e4e6a6e2e87edcd6a93dd533620700b00b1c2 Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Fri, 13 Oct 2017 07:20:40 +0000
>>>   Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS 
>>> trusted for
>>> @@ -59,10 +59,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/kernel/kernel.te 
>>> b/policy/modules/kernel/kernel.te
>>> -index a32c59eb1..1c53754ee 100644
>>> +index a40db8507..40cd52825 100644
>>>   --- a/policy/modules/kernel/kernel.te
>>>   +++ b/policy/modules/kernel/kernel.te
>>> -@@ -358,6 +358,8 @@ mls_file_write_all_levels(kernel_t)
>>> +@@ -370,6 +370,8 @@ mls_file_write_all_levels(kernel_t)
>>>    mls_file_read_all_levels(kernel_t)
>>>    mls_socket_write_all_levels(kernel_t)
>>>    mls_fd_use_all_levels(kernel_t)
>>> @@ -72,5 +72,5 @@ index a32c59eb1..1c53754ee 100644
>>>    ifdef(`distro_redhat',`
>>>        # Bugzilla 222337
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch 
>>>
>>> deleted file mode 100644
>>> index 504e028..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
>>> +++ /dev/null
>>> @@ -1,132 +0,0 @@
>>> -From d1c159d4400722e783d12cc3684c1cf15004f7a9 Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Thu, 24 Sep 2020 14:05:52 +0800
>>> -Subject: [PATCH] policy/modules/system/sysnetwork: support priviledge
>>> - separation for dhcpcd
>>> -
>>> -Fixes:
>>> -
>>> -avc:  denied  { sys_chroot } for  pid=332 comm="dhcpcd" capability=18
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>>> -permissive=0
>>> -
>>> -avc:  denied  { setgid } for  pid=332 comm="dhcpcd" capability=6
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>>> -permissive=0
>>> -
>>> -avc:  denied  { setuid } for  pid=332 comm="dhcpcd" capability=7
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>>> -permissive=0
>>> -
>>> -avc:  denied  { setrlimit } for  pid=332 comm="dhcpcd"
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=process
>>> -permissive=0
>>> -
>>> -avc:  denied  { create } for  pid=330 comm="dhcpcd"
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tclass=netlink_kobject_uevent_socket permissive=0
>>> -
>>> -avc:  denied  { setopt } for  pid=330 comm="dhcpcd"
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tclass=netlink_kobject_uevent_socket permissive=0
>>> -
>>> -avc:  denied  { bind } for  pid=330 comm="dhcpcd"
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tclass=netlink_kobject_uevent_socket permissive=0
>>> -
>>> -avc:  denied  { getattr } for  pid=330 comm="dhcpcd"
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tclass=netlink_kobject_uevent_socket permissive=0
>>> -
>>> -avc:  denied  { read } for  pid=330 comm="dhcpcd" name="n1" 
>>> dev="tmpfs"
>>> -ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
>>> -
>>> -avc:  denied  { open } for  pid=330 comm="dhcpcd"
>>> -path="/run/udev/data/n1" dev="tmpfs" ino=15616
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
>>> -
>>> -avc:  denied  { getattr } for  pid=330 comm="dhcpcd"
>>> -path="/run/udev/data/n1" dev="tmpfs" ino=15616
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
>>> -
>>> -avc:  denied  { connectto } for  pid=1600 comm="dhcpcd"
>>> -path="/run/dhcpcd/unpriv.sock"
>>> -scontext=root:sysadm_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tclass=unix_stream_socket permissive=0
>>> -
>>> -avc:  denied  { kill } for  pid=314 comm="dhcpcd" capability=5
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
>>> -permissive=0
>>> -
>>> -avc:  denied  { getattr } for  pid=300 comm="dhcpcd"
>>> -path="net:[4026532008]" dev="nsfs" ino=4026532008
>>> -scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
>>> -tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/sysnetwork.te | 7 ++++++-
>>> - 1 file changed, 6 insertions(+), 1 deletion(-)
>>> -
>>> -diff --git a/policy/modules/system/sysnetwork.te 
>>> b/policy/modules/system/sysnetwork.te
>>> -index 4c317cc4c..05a9a52b8 100644
>>> ---- a/policy/modules/system/sysnetwork.te
>>> -+++ b/policy/modules/system/sysnetwork.te
>>> -@@ -58,10 +58,11 @@ ifdef(`distro_debian',`
>>> - # DHCP client local policy
>>> - #
>>> - allow dhcpc_t self:capability { dac_override fsetid net_admin 
>>> net_bind_service net_raw setpcap sys_nice sys_resource 
>>> sys_tty_config };
>>> -+allow dhcpc_t self:capability { setgid setuid sys_chroot kill };
>>> - dontaudit dhcpc_t self:capability { sys_ptrace sys_tty_config };
>>> - # for access("/etc/bashrc", X_OK) on Red Hat
>>> - dontaudit dhcpc_t self:capability { dac_read_search sys_module };
>>> --allow dhcpc_t self:process { getsched getcap setcap setfscreate 
>>> ptrace signal_perms };
>>> -+allow dhcpc_t self:process { getsched getcap setcap setfscreate 
>>> ptrace signal_perms setrlimit };
>>> -
>>> - allow dhcpc_t self:fifo_file rw_fifo_file_perms;
>>> - allow dhcpc_t self:tcp_socket create_stream_socket_perms;
>>> -@@ -69,8 +70,10 @@ allow dhcpc_t self:udp_socket create_socket_perms;
>>> - allow dhcpc_t self:packet_socket create_socket_perms;
>>> - allow dhcpc_t self:netlink_generic_socket create_socket_perms;
>>> - allow dhcpc_t self:netlink_route_socket create_netlink_socket_perms;
>>> -+allow dhcpc_t self:netlink_kobject_uevent_socket create_socket_perms;
>>> - allow dhcpc_t self:rawip_socket create_socket_perms;
>>> - allow dhcpc_t self:unix_dgram_socket { create_socket_perms sendto };
>>> -+allow dhcpc_t self:unix_stream_socket connectto;
>>> -
>>> - allow dhcpc_t dhcp_etc_t:dir list_dir_perms;
>>> - read_lnk_files_pattern(dhcpc_t, dhcp_etc_t, dhcp_etc_t)
>>> -@@ -146,6 +149,7 @@ files_manage_var_files(dhcpc_t)
>>> - fs_getattr_all_fs(dhcpc_t)
>>> - fs_search_auto_mountpoints(dhcpc_t)
>>> - fs_search_cgroup_dirs(dhcpc_t)
>>> -+fs_read_nsfs_files(dhcpc_t)
>>> -
>>> - term_dontaudit_use_all_ttys(dhcpc_t)
>>> - term_dontaudit_use_all_ptys(dhcpc_t)
>>> -@@ -181,6 +185,7 @@ ifdef(`init_systemd',`
>>> -     init_stream_connect(dhcpc_t)
>>> -     init_get_all_units_status(dhcpc_t)
>>> -     init_search_units(dhcpc_t)
>>> -+    udev_read_runtime_files(dhcpc_t)
>>> - ')
>>> -
>>> - optional_policy(`
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>>
>>> similarity index 89%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> index b4da47d..9e52b7f 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> @@ -1,4 +1,4 @@
>>> -From 7bcc117ea39532427df297299c10ca1d2948a70c Mon Sep 17 00:00:00 2001
>>> +From c47e288e8950e7e92e3c90972ca7ef8ef9fc6a7f Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Fri, 15 Jan 2016 03:47:05 -0500
>>>   Subject: [PATCH] policy/modules/system/init: make init_t MLS 
>>> trusted for
>>> @@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 4 insertions(+)
>>>     diff --git a/policy/modules/system/init.te 
>>> b/policy/modules/system/init.te
>>> -index 932d1f7b3..36becaa6e 100644
>>> +index 97a75cf86..fee846cb5 100644
>>>   --- a/policy/modules/system/init.te
>>>   +++ b/policy/modules/system/init.te
>>> -@@ -219,6 +219,10 @@ mls_process_write_all_levels(init_t)
>>> +@@ -229,6 +229,10 @@ mls_process_write_all_levels(init_t)
>>>    mls_fd_use_all_levels(init_t)
>>>    mls_process_set_level(init_t)
>>>    @@ -42,5 +42,5 @@ index 932d1f7b3..36becaa6e 100644
>>>    # otherwise the call fails and sysvinit tries to load the policy
>>>    # again when using the initramfs
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch 
>>> b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch 
>>>
>>> deleted file mode 100644
>>> index 2f94974..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
>>> +++ /dev/null
>>> @@ -1,34 +0,0 @@
>>> -From 8343ff97a265836ba1e1e2f4159f888c21e5cabe Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Tue, 9 Feb 2021 17:31:55 +0800
>>> -Subject: [PATCH] policy/modules/system/modutils: allow kmod_t to 
>>> write keys
>>> -
>>> -Fixes:
>>> -kernel: cfg80211: Problem loading in-kernel X.509 certificate (-13)
>>> -
>>> -avc:  denied  { write } for  pid=219 comm="modprobe"
>>> -scontext=system_u:system_r:kmod_t tcontext=system_u:system_r:kmod_t
>>> -tclass=key permissive=0
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/modutils.te | 1 +
>>> - 1 file changed, 1 insertion(+)
>>> -
>>> -diff --git a/policy/modules/system/modutils.te 
>>> b/policy/modules/system/modutils.te
>>> -index 5b4f0aca1..008f286a8 100644
>>> ---- a/policy/modules/system/modutils.te
>>> -+++ b/policy/modules/system/modutils.te
>>> -@@ -42,6 +42,7 @@ allow kmod_t self:udp_socket create_socket_perms;
>>> - allow kmod_t self:rawip_socket create_socket_perms;
>>> -
>>> - allow kmod_t self:lockdown confidentiality;
>>> -+allow kmod_t self:key write;
>>> -
>>> - # Read module config and dependency information
>>> - list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
>>> ---
>>> -2.17.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch 
>>> b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch 
>>>
>>> similarity index 92%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>>> index 4b768e0..1bfbb16 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
>>> @@ -1,4 +1,4 @@
>>> -From d965e6a02854a07c4783cf33e95bf3c7cf9f56f1 Mon Sep 17 00:00:00 2001
>>> +From afd35f6c73551c674e5bfe7cc1832b6a0ea717a6 Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Thu, 4 Feb 2016 06:03:19 -0500
>>>   Subject: [PATCH] policy/modules/system/systemd: make 
>>> systemd-tmpfiles_t domain
>>> @@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 5 insertions(+)
>>>     diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 1a83148c1..736107fad 100644
>>> +index 4a1e06640..b44b9b2d7 100644
>>>   --- a/policy/modules/system/systemd.te
>>>   +++ b/policy/modules/system/systemd.te
>>> -@@ -1483,6 +1483,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
>>> +@@ -1694,6 +1694,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
>>>       systemd_log_parse_environment(systemd_tmpfiles_t)
>>>    @@ -59,5 +59,5 @@ index 1a83148c1..736107fad 100644
>>>    userdom_relabel_user_runtime_root_dirs(systemd_tmpfiles_t)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch 
>>>
>>> similarity index 82%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
>>> index 60f7dae..800439c 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
>>> @@ -1,4 +1,4 @@
>>> -From 71986d0c6775408a1c89415dd5d4e7ea03302248 Mon Sep 17 00:00:00 2001
>>> +From 8aa70c13d63e093bff87ea938d35dcc76e5bdd56 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Thu, 18 Jun 2020 09:59:58 +0800
>>>   Subject: [PATCH] policy/modules/system/systemd: systemd-*: make 
>>> systemd_*_t
>>> @@ -43,12 +43,12 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 12 insertions(+)
>>>     diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 736107fad..8cea6baa1 100644
>>> +index b44b9b2d7..7b717d3ba 100644
>>>   --- a/policy/modules/system/systemd.te
>>>   +++ b/policy/modules/system/systemd.te
>>> -@@ -341,6 +341,9 @@ fs_getattr_tmpfs(systemd_backlight_t)
>>> +@@ -373,6 +373,9 @@ files_search_var_lib(systemd_backlight_t)
>>> + fs_getattr_all_fs(systemd_backlight_t)
>>>    fs_search_cgroup_dirs(systemd_backlight_t)
>>> - fs_getattr_cgroup(systemd_backlight_t)
>>>      +mls_file_read_to_clearance(systemd_backlight_t)
>>>   +mls_file_write_to_clearance(systemd_backlight_t)
>>> @@ -56,9 +56,9 @@ index 736107fad..8cea6baa1 100644
>>>    #######################################
>>>    #
>>>    # Binfmt local policy
>>> -@@ -479,6 +482,9 @@ term_use_unallocated_ttys(systemd_generator_t)
>>> +@@ -528,6 +531,9 @@ term_use_unallocated_ttys(systemd_generator_t)
>>>    - udev_search_runtime(systemd_generator_t)
>>> + udev_read_runtime_files(systemd_generator_t)
>>>      +mls_file_read_to_clearance(systemd_generator_t)
>>>   +mls_file_write_to_clearance(systemd_generator_t)
>>> @@ -66,19 +66,19 @@ index 736107fad..8cea6baa1 100644
>>>    ifdef(`distro_gentoo',`
>>>        corecmd_shell_entry_type(systemd_generator_t)
>>>    ')
>>> -@@ -723,6 +729,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
>>> +@@ -922,6 +928,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
>>>    userdom_use_user_ttys(systemd_logind_t)
>>>    domain_read_all_domains_state(systemd_logind_t)
>>>    -+mls_file_read_to_clearance(systemd_logind_t)
>>> -+mls_file_write_to_clearance(systemd_logind_t)
>>> ++mls_file_read_all_levels(systemd_logind_t)
>>> ++mls_file_write_all_levels(systemd_logind_t)
>>>   +
>>>    # Needed to work around patch not yet merged into the 
>>> systemd-logind supported on RHEL 7.x
>>>    # The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 
>>> 4b51966cf6c06250036e428608da92f8640beb96
>>>    # should fix the problem where user directories in 
>>> /run/user/$UID/ are not getting the proper context
>>> -@@ -1204,6 +1213,9 @@ fs_getattr_tmpfs(systemd_rfkill_t)
>>> - fs_search_cgroup_dirs(systemd_rfkill_t)
>>> - fs_getattr_cgroup(systemd_rfkill_t)
>>> +@@ -1412,6 +1421,9 @@ udev_read_runtime_files(systemd_rfkill_t)
>>> +
>>> + systemd_log_parse_environment(systemd_rfkill_t)
>>>      +mls_file_read_to_clearance(systemd_rfkill_t)
>>>   +mls_file_write_to_clearance(systemd_rfkill_t)
>>> @@ -87,5 +87,5 @@ index 736107fad..8cea6baa1 100644
>>>    #
>>>    # Resolved local policy
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch 
>>> b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch 
>>>
>>> similarity index 78%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>>> index 75be11d..cb3894c 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
>>> @@ -1,4 +1,4 @@
>>> -From 511f7fdad45a150f7ea3666eb51463573eabab0a Mon Sep 17 00:00:00 2001
>>> +From 2afa5753f2ef8c7cee5ad0511c521d252bedf3e5 Mon Sep 17 00:00:00 2001
>>>   From: Xin Ouyang <Xin.Ouyang@windriver.com>
>>>   Date: Thu, 22 Aug 2013 13:37:23 +0800
>>>   Subject: [PATCH] policy/modules/system/logging: add the syslogd_t 
>>> to trusted
>>> @@ -14,18 +14,17 @@ Signed-off-by: Xin Ouyang 
>>> <Xin.Ouyang@windriver.com>
>>>   Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
>>>   Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>   ---
>>> - policy/modules/system/logging.te | 4 ++++
>>> - 1 file changed, 4 insertions(+)
>>> + policy/modules/system/logging.te | 3 +++
>>> + 1 file changed, 3 insertions(+)
>>>     diff --git a/policy/modules/system/logging.te 
>>> b/policy/modules/system/logging.te
>>> -index 5b4b5ec5d..e67c25a9e 100644
>>> +index d3b06db7d..f63965d4d 100644
>>>   --- a/policy/modules/system/logging.te
>>>   +++ b/policy/modules/system/logging.te
>>> -@@ -498,6 +498,10 @@ fs_search_auto_mountpoints(syslogd_t)
>>> - fs_search_tmpfs(syslogd_t)
>>> +@@ -505,6 +505,9 @@ fs_getattr_all_fs(syslogd_t)
>>> + fs_search_auto_mountpoints(syslogd_t)
>>>       mls_file_write_all_levels(syslogd_t) # Need to be able to 
>>> write to /var/run/ and /var/log directories
>>> -+mls_file_read_all_levels(syslogd_t)
>>>   +mls_socket_write_all_levels(syslogd_t) # Need to be able to 
>>> sendto dgram
>>>   +mls_trusted_object(syslogd_t) # Other process need to have the 
>>> right to connectto/sendto /dev/log
>>>   +mls_fd_use_all_levels(syslogd_t)
>>> @@ -33,5 +32,5 @@ index 5b4b5ec5d..e67c25a9e 100644
>>>    term_write_console(syslogd_t)
>>>    # Allow syslog to a terminal
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>>
>>> similarity index 85%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> index 5c01ef4..16f0e4e 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
>>> @@ -1,4 +1,4 @@
>>> -From 3f875fae6d9a4538b3e7d33f30dd2a98fc9ea2bd Mon Sep 17 00:00:00 2001
>>> +From f87bb3cb0843af69f9aecaef0a4052e04b15a630 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Tue, 28 May 2019 16:41:37 +0800
>>>   Subject: [PATCH] policy/modules/system/init: make init_t MLS 
>>> trusted for
>>> @@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/system/init.te 
>>> b/policy/modules/system/init.te
>>> -index 36becaa6e..9c0a98eb7 100644
>>> +index fee846cb5..df7f87f17 100644
>>>   --- a/policy/modules/system/init.te
>>>   +++ b/policy/modules/system/init.te
>>> -@@ -218,6 +218,7 @@ mls_file_write_all_levels(init_t)
>>> +@@ -228,6 +228,7 @@ mls_file_write_all_levels(init_t)
>>>    mls_process_write_all_levels(init_t)
>>>    mls_fd_use_all_levels(init_t)
>>>    mls_process_set_level(init_t)
>>> @@ -29,5 +29,5 @@ index 36becaa6e..9c0a98eb7 100644
>>>    # MLS trusted for lowering/raising the level of files
>>>    mls_file_downgrade(init_t)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch 
>>> b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch 
>>>
>>> similarity index 88%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
>>> index d3ddcd2..fb56eca 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
>>> @@ -1,4 +1,4 @@
>>> -From a59dae035b7d5063e0f25c4cf40b5b180ad69022 Mon Sep 17 00:00:00 2001
>>> +From f3c0f18b647631fd2ffc1e86c9e3f51cbf74d60f Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Wed, 3 Feb 2016 04:16:06 -0500
>>>   Subject: [PATCH] policy/modules/system/init: all init_t to read 
>>> any level
>>> @@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 3 insertions(+)
>>>     diff --git a/policy/modules/system/init.te 
>>> b/policy/modules/system/init.te
>>> -index 9c0a98eb7..5a19f0e43 100644
>>> +index df7f87f17..671b5aef3 100644
>>>   --- a/policy/modules/system/init.te
>>>   +++ b/policy/modules/system/init.te
>>> -@@ -224,6 +224,9 @@ mls_key_write_all_levels(init_t)
>>> +@@ -234,6 +234,9 @@ mls_key_write_all_levels(init_t)
>>>    mls_file_downgrade(init_t)
>>>    mls_file_upgrade(init_t)
>>>    @@ -36,5 +36,5 @@ index 9c0a98eb7..5a19f0e43 100644
>>>    # otherwise the call fails and sysvinit tries to load the policy
>>>    # again when using the initramfs
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch 
>>> b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch 
>>>
>>> similarity index 87%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>>> index 47328be..aa02eb1 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
>>> @@ -1,4 +1,4 @@
>>> -From 96437ba860d352304246fbe3381030da0665f239 Mon Sep 17 00:00:00 2001
>>> +From cb7a4ff6081f19d05b109512275ec9a537f2f6d2 Mon Sep 17 00:00:00 2001
>>>   From: Wenzong Fan <wenzong.fan@windriver.com>
>>>   Date: Thu, 25 Feb 2016 04:25:08 -0500
>>>   Subject: [PATCH] policy/modules/system/logging: allow auditd_t to 
>>> write socket
>>> @@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/system/logging.te 
>>> b/policy/modules/system/logging.te
>>> -index e67c25a9e..f8d8b73f0 100644
>>> +index f63965d4d..7e41596f4 100644
>>>   --- a/policy/modules/system/logging.te
>>>   +++ b/policy/modules/system/logging.te
>>> -@@ -215,6 +215,8 @@ miscfiles_read_localization(auditd_t)
>>> +@@ -223,6 +223,8 @@ miscfiles_read_localization(auditd_t)
>>>       mls_file_read_all_levels(auditd_t)
>>>    mls_file_write_all_levels(auditd_t) # Need to be able to write to 
>>> /var/run/ directory
>>> @@ -35,5 +35,5 @@ index e67c25a9e..f8d8b73f0 100644
>>>    seutil_dontaudit_read_config(auditd_t)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>>
>>> similarity index 83%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> index ad92c7f..16bdf84 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
>>> @@ -1,4 +1,4 @@
>>> -From 102255e89863c5a31d0d6c8df67b258d819b9a68 Mon Sep 17 00:00:00 2001
>>> +From 023e7b92a805103c54aec06bbd9465e4fbf7a6f2 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Thu, 31 Oct 2019 17:35:59 +0800
>>>   Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS 
>>> trusted for
>>> @@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 1 insertion(+)
>>>     diff --git a/policy/modules/kernel/kernel.te 
>>> b/policy/modules/kernel/kernel.te
>>> -index 1c53754ee..2031576e0 100644
>>> +index 40cd52825..d08610543 100644
>>>   --- a/policy/modules/kernel/kernel.te
>>>   +++ b/policy/modules/kernel/kernel.te
>>> -@@ -360,6 +360,7 @@ mls_socket_write_all_levels(kernel_t)
>>> +@@ -372,6 +372,7 @@ mls_socket_write_all_levels(kernel_t)
>>>    mls_fd_use_all_levels(kernel_t)
>>>    # https://bugzilla.redhat.com/show_bug.cgi?id=667370
>>>    mls_file_downgrade(kernel_t)
>>> @@ -27,5 +27,5 @@ index 1c53754ee..2031576e0 100644
>>>    ifdef(`distro_redhat',`
>>>        # Bugzilla 222337
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch 
>>> b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch 
>>>
>>> similarity index 83%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>>> index 96d0588..b916084 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
>>> @@ -1,4 +1,4 @@
>>> -From 5fa9e03a3b90f97e573a7724cd9d49b53730d083 Mon Sep 17 00:00:00 2001
>>> +From 55fe90eba640e6d52bb269176f45a3a5e2c3ed80 Mon Sep 17 00:00:00 2001
>>>   From: Roy Li <rongqing.li@windriver.com>
>>>   Date: Sat, 22 Feb 2014 13:35:38 +0800
>>>   Subject: [PATCH] policy/modules/system/setrans: allow setrans_t 
>>> use fd at any
>>> @@ -13,10 +13,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/system/setrans.te 
>>> b/policy/modules/system/setrans.te
>>> -index 25aadfc5f..564e2d4d1 100644
>>> +index 12e66aad9..5510f7fac 100644
>>>   --- a/policy/modules/system/setrans.te
>>>   +++ b/policy/modules/system/setrans.te
>>> -@@ -73,6 +73,8 @@ mls_net_receive_all_levels(setrans_t)
>>> +@@ -69,6 +69,8 @@ mls_net_receive_all_levels(setrans_t)
>>>    mls_socket_write_all_levels(setrans_t)
>>>    mls_process_read_all_levels(setrans_t)
>>>    mls_socket_read_all_levels(setrans_t)
>>> @@ -26,5 +26,5 @@ index 25aadfc5f..564e2d4d1 100644
>>>    selinux_compute_access_vector(setrans_t)
>>>      --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch 
>>> b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch 
>>>
>>> similarity index 88%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>>> index 8bfe607..c4dc87b 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
>>> @@ -1,4 +1,4 @@
>>> -From fe70aaf9a104b4b0c3439d2767eccb0136951f08 Mon Sep 17 00:00:00 2001
>>> +From c9afe0dc30f51f7ad7b93b8878c88df1146272a0 Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Mon, 22 Feb 2021 11:28:12 +0800
>>>   Subject: [PATCH] policy/modules/system/systemd: make *_systemd_t 
>>> MLS trusted
>>> @@ -24,10 +24,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 3 insertions(+)
>>>     diff --git a/policy/modules/system/systemd.if 
>>> b/policy/modules/system/systemd.if
>>> -index 5c44d8d8a..5f2038f22 100644
>>> +index 325ca548b..b23b9bb0a 100644
>>>   --- a/policy/modules/system/systemd.if
>>>   +++ b/policy/modules/system/systemd.if
>>> -@@ -171,6 +171,9 @@ template(`systemd_role_template',`
>>> +@@ -196,6 +196,9 @@ template(`systemd_role_template',`
>>>            xdg_read_config_files($1_systemd_t)
>>>            xdg_read_data_files($1_systemd_t)
>>>        ')
>>> @@ -38,5 +38,5 @@ index 5c44d8d8a..5f2038f22 100644
>>>       ######################################
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch 
>>> b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch 
>>>
>>> similarity index 84%
>>> rename from 
>>> recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
>>> rename to 
>>> recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
>>> index 7bdc9d6..ab87039 100644
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
>>> +++ 
>>> b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
>>> @@ -1,4 +1,4 @@
>>> -From f8a12b28b70689ab520e7ae94d306afe9dcbb556 Mon Sep 17 00:00:00 2001
>>> +From 7a65c9f3636b43f3a29349ea1c045d5281efa5aa Mon Sep 17 00:00:00 2001
>>>   From: Yi Zhao <yi.zhao@windriver.com>
>>>   Date: Sat, 18 Dec 2021 17:31:45 +0800
>>>   Subject: [PATCH] policy/modules/system/logging: make 
>>> syslogd_runtime_t MLS
>>> @@ -23,7 +23,7 @@ dev="tmpfs" ino=9854 
>>> scontext=system_u:system_r:rpcd_t:s0-s15:c0.c1023
>>>   tcontext=system_u:object_r:syslogd_var_run_t:s15:c0.c1023 tclass=dir
>>>   permissive=0
>>>   -Upstream-Status: Pending
>>> +Upstream-Status: Inappropriate [embedded specific]
>>>     Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>   ---
>>> @@ -31,18 +31,18 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>>    1 file changed, 2 insertions(+)
>>>     diff --git a/policy/modules/system/logging.te 
>>> b/policy/modules/system/logging.te
>>> -index f8d8b73f0..badf56f16 100644
>>> +index 7e41596f4..0c25457d6 100644
>>>   --- a/policy/modules/system/logging.te
>>>   +++ b/policy/modules/system/logging.te
>>> -@@ -438,6 +438,8 @@ allow syslogd_t syslogd_runtime_t:file map;
>>> +@@ -447,6 +447,8 @@ allow syslogd_t syslogd_runtime_t:file map;
>>>    manage_files_pattern(syslogd_t, syslogd_runtime_t, 
>>> syslogd_runtime_t)
>>>    files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
>>>      +mls_trusted_object(syslogd_runtime_t)
>>>   +
>>> - kernel_read_crypto_sysctls(syslogd_t)
>>>    kernel_read_system_state(syslogd_t)
>>>    kernel_read_network_state(syslogd_t)
>>> + kernel_read_kernel_sysctls(syslogd_t)
>>>   --
>>> -2.17.1
>>> +2.25.1
>>>   diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch 
>>> b/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch 
>>>
>>> deleted file mode 100644
>>> index e0db7d3..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
>>> +++ /dev/null
>>> @@ -1,33 +0,0 @@
>>> -From 52a4222397f5d3b28ca15a45bb2ace209a4afc3e Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Thu, 31 Mar 2022 13:09:10 -0400
>>> -Subject: [PATCH] systemd: systemd-resolved is linked to libselinux
>>> -
>>> -systemd-resolved as of systemd 250 fails to start with this error:
>>> -
>>> -Failed to initialize SELinux labeling handle: No such file or 
>>> directory
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/3a22db2410de479e5baa88f3f668a7a4ac198950] 
>>>
>>> -
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/systemd.te | 1 +
>>> - 1 file changed, 1 insertion(+)
>>> -
>>> -diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index 8cea6baa1..beb301cc6 100644
>>> ---- a/policy/modules/system/systemd.te
>>> -+++ b/policy/modules/system/systemd.te
>>> -@@ -1261,6 +1261,7 @@ fs_getattr_cgroup(systemd_resolved_t)
>>> -
>>> - init_dgram_send(systemd_resolved_t)
>>> -
>>> -+seutil_libselinux_linked(systemd_resolved_t)
>>> - seutil_read_file_contexts(systemd_resolved_t)
>>> -
>>> - systemd_log_parse_environment(systemd_resolved_t)
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch 
>>> b/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch 
>>>
>>> deleted file mode 100644
>>> index 63da7cd..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
>>> +++ /dev/null
>>> @@ -1,63 +0,0 @@
>>> -From 1ba0911e157c64ea15636c5707f38f1bdc9a46c8 Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Wed, 27 Apr 2022 01:09:52 -0400
>>> -Subject: [PATCH] sysnetwork, systemd: allow DNS resolution over
>>> - io.systemd.Resolve
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/1a0acc9c0d8c7c49ad4ca2cabd44bc66450f45e0] 
>>>
>>> -
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/sysnetwork.if |  1 +
>>> - policy/modules/system/systemd.if    | 21 +++++++++++++++++++++
>>> - 2 files changed, 22 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/sysnetwork.if 
>>> b/policy/modules/system/sysnetwork.if
>>> -index 8664a67c8..140d48508 100644
>>> ---- a/policy/modules/system/sysnetwork.if
>>> -+++ b/policy/modules/system/sysnetwork.if
>>> -@@ -844,6 +844,7 @@ interface(`sysnet_dns_name_resolve',`
>>> -     ifdef(`init_systemd',`
>>> -         optional_policy(`
>>> -             systemd_dbus_chat_resolved($1)
>>> -+            systemd_stream_connect_resolved($1)
>>> -         ')
>>> -         # This seems needed when the mymachines NSS module is used
>>> -         optional_policy(`
>>> -diff --git a/policy/modules/system/systemd.if 
>>> b/policy/modules/system/systemd.if
>>> -index 5f2038f22..9143fb4c0 100644
>>> ---- a/policy/modules/system/systemd.if
>>> -+++ b/policy/modules/system/systemd.if
>>> -@@ -1835,6 +1835,27 @@ interface(`systemd_tmpfilesd_managed',`
>>> -     ')
>>> - ')
>>> -
>>> -+#######################################
>>> -+## <summary>
>>> -+##    Connect to systemd resolved over
>>> -+##    /run/systemd/resolve/io.systemd.Resolve .
>>> -+## </summary>
>>> -+## <param name="domain">
>>> -+##    <summary>
>>> -+##    Domain allowed access.
>>> -+##    </summary>
>>> -+## </param>
>>> -+#
>>> -+interface(`systemd_stream_connect_resolved',`
>>> -+    gen_require(`
>>> -+        type systemd_resolved_t;
>>> -+        type systemd_resolved_runtime_t;
>>> -+    ')
>>> -+
>>> -+    files_search_runtime($1)
>>> -+    stream_connect_pattern($1, systemd_resolved_runtime_t, 
>>> systemd_resolved_runtime_t, systemd_resolved_t)
>>> -+')
>>> -+
>>> - ########################################
>>> - ## <summary>
>>> - ##   Send and receive messages from
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch 
>>> b/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch 
>>>
>>> deleted file mode 100644
>>> index 88f070d..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
>>> +++ /dev/null
>>> @@ -1,94 +0,0 @@
>>> -From 50670946f04257cc2110facbc61884e2cf0d8327 Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Fri, 6 May 2022 21:16:29 -0400
>>> -Subject: [PATCH] term, init: allow systemd to watch and watch reads on
>>> - unallocated ttys
>>> -
>>> -As of systemd 250, systemd needs to be able to add a watch on and 
>>> watch
>>> -reads on unallocated ttys in order to start getty.
>>> -
>>> -systemd[55548]: getty@tty1.service: Failed to set up standard 
>>> input: Permission denied
>>> -systemd[55548]: getty@tty1.service: Failed at step STDIN spawning 
>>> /sbin/agetty: Permission denied
>>> -
>>> -time->Fri May  6 21:17:58 2022
>>> -type=PROCTITLE msg=audit(1651886278.452:1770): proctitle="(agetty)"
>>> -type=PATH msg=audit(1651886278.452:1770): item=0 name="/dev/tty1" 
>>> inode=18 dev=00:05 mode=020620 ouid=0 ogid=5 rdev=04:01 
>>> obj=system_u:object_r:tty_device_t:s0 nametype=NORMAL cap_fp=0 
>>> cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
>>> -type=CWD msg=audit(1651886278.452:1770): cwd="/"
>>> -type=SYSCALL msg=audit(1651886278.452:1770): arch=c000003e 
>>> syscall=254 success=no exit=-13 a0=3 a1=60ba5c21e020 a2=18 a3=23 
>>> items=1 ppid=1 pid=55551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 
>>> fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 
>>> comm="(agetty)" exe="/lib/systemd/systemd" 
>>> subj=system_u:system_r:init_t:s0 key=(null)
>>> -type=AVC msg=audit(1651886278.452:1770): avc:  denied  { watch 
>>> watch_reads } for  pid=55551 comm="(agetty)" path="/dev/tty1" 
>>> dev="devtmpfs" ino=18 scontext=system_u:system_r:init_t:s0 
>>> tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file permissive=0
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/308ab9f69a4623f5dace8da151e70c6316f055a8] 
>>>
>>> -
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/kernel/terminal.if | 38 
>>> +++++++++++++++++++++++++++++++
>>> - policy/modules/system/init.te     |  2 ++
>>> - 2 files changed, 40 insertions(+)
>>> -
>>> -diff --git a/policy/modules/kernel/terminal.if 
>>> b/policy/modules/kernel/terminal.if
>>> -index e8c0735eb..6e9f654ac 100644
>>> ---- a/policy/modules/kernel/terminal.if
>>> -+++ b/policy/modules/kernel/terminal.if
>>> -@@ -1287,6 +1287,44 @@ 
>>> interface(`term_dontaudit_use_unallocated_ttys',`
>>> -     dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
>>> - ')
>>> -
>>> -+########################################
>>> -+## <summary>
>>> -+##    Watch unallocated ttys.
>>> -+## </summary>
>>> -+## <param name="domain">
>>> -+##    <summary>
>>> -+##    Domain allowed access.
>>> -+##    </summary>
>>> -+## </param>
>>> -+#
>>> -+interface(`term_watch_unallocated_ttys',`
>>> -+    gen_require(`
>>> -+        type tty_device_t;
>>> -+    ')
>>> -+
>>> -+    dev_list_all_dev_nodes($1)
>>> -+    allow $1 tty_device_t:chr_file watch;
>>> -+')
>>> -+
>>> -+########################################
>>> -+## <summary>
>>> -+##    Watch reads on unallocated ttys.
>>> -+## </summary>
>>> -+## <param name="domain">
>>> -+##    <summary>
>>> -+##    Domain allowed access.
>>> -+##    </summary>
>>> -+## </param>
>>> -+#
>>> -+interface(`term_watch_reads_unallocated_ttys',`
>>> -+    gen_require(`
>>> -+        type tty_device_t;
>>> -+    ')
>>> -+
>>> -+    dev_list_all_dev_nodes($1)
>>> -+    allow $1 tty_device_t:chr_file watch_reads;
>>> -+')
>>> -+
>>> - ########################################
>>> - ## <summary>
>>> - ##    Get the attributes of all tty device nodes.
>>> -diff --git a/policy/modules/system/init.te 
>>> b/policy/modules/system/init.te
>>> -index 5a19f0e43..24cef0924 100644
>>> ---- a/policy/modules/system/init.te
>>> -+++ b/policy/modules/system/init.te
>>> -@@ -518,6 +518,8 @@ ifdef(`init_systemd',`
>>> -     term_create_devpts_dirs(init_t)
>>> -     term_create_ptmx(init_t)
>>> -     term_create_controlling_term(init_t)
>>> -+    term_watch_unallocated_ttys(init_t)
>>> -+    term_watch_reads_unallocated_ttys(init_t)
>>> -
>>> -     # udevd is a "systemd kobject uevent socket activated daemon"
>>> -     udev_create_kobject_uevent_sockets(init_t)
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch 
>>> b/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch 
>>>
>>> deleted file mode 100644
>>> index 1029490..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
>>> +++ /dev/null
>>> @@ -1,32 +0,0 @@
>>> -From 6f8a8ecd8bafd6e8a3515b53db2a2982a02ff254 Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Thu, 31 Mar 2022 13:22:37 -0400
>>> -Subject: [PATCH] systemd: add file transition for systemd-networkd 
>>> runtime
>>> -
>>> -systemd-networkd creates the /run/systemd/network directory which 
>>> should
>>> -be labeled appropriately.
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/663b62f27cb12c22f056eba9326cf3f7f78d8a9e] 
>>>
>>> -
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/systemd.te | 1 +
>>> - 1 file changed, 1 insertion(+)
>>> -
>>> -diff --git a/policy/modules/system/systemd.te 
>>> b/policy/modules/system/systemd.te
>>> -index beb301cc6..654c6a42a 100644
>>> ---- a/policy/modules/system/systemd.te
>>> -+++ b/policy/modules/system/systemd.te
>>> -@@ -917,6 +917,7 @@ auth_use_nsswitch(systemd_networkd_t)
>>> -
>>> - init_dgram_send(systemd_networkd_t)
>>> - init_read_state(systemd_networkd_t)
>>> -+init_runtime_filetrans(systemd_networkd_t, 
>>> systemd_networkd_runtime_t, dir)
>>> -
>>> - logging_send_syslog_msg(systemd_networkd_t)
>>> -
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch 
>>> b/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch 
>>>
>>> deleted file mode 100644
>>> index f84eb4a..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
>>> +++ /dev/null
>>> @@ -1,29 +0,0 @@
>>> -From 2e3f371b59bee343c42e4c69495df0f3719b6e24 Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Sat, 2 Apr 2022 15:44:01 -0400
>>> -Subject: [PATCH] systemd: add missing file context for 
>>> /run/systemd/network
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/f2fe1ae15485da7b6269b7d0d7dbed9a834f1876] 
>>>
>>> -
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/systemd.fc | 1 +
>>> - 1 file changed, 1 insertion(+)
>>> -
>>> -diff --git a/policy/modules/system/systemd.fc 
>>> b/policy/modules/system/systemd.fc
>>> -index 34db8c034..d21914227 100644
>>> ---- a/policy/modules/system/systemd.fc
>>> -+++ b/policy/modules/system/systemd.fc
>>> -@@ -85,6 +85,7 @@ HOME_DIR/\.local/share/systemd(/.*)? 
>>> gen_context(system_u:object_r:systemd_data
>>> -
>>> - /run/systemd/ask-password(/.*)? 
>>> gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
>>> - /run/systemd/ask-password-block(/.*)? 
>>> gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
>>> -+/run/systemd/network(/.*)? 
>>> gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
>>> - /run/systemd/resolve(/.*)? 
>>> gen_context(system_u:object_r:systemd_resolved_runtime_t,s0)
>>> - /run/systemd/seats(/.*)? 
>>> gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
>>> - /run/systemd/sessions(/.*)? 
>>> gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch 
>>> b/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch 
>>>
>>> deleted file mode 100644
>>> index 0aaf096..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
>>> +++ /dev/null
>>> @@ -1,38 +0,0 @@
>>> -From 143d339b2e6611c56cd0210279757ebee9632731 Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Thu, 19 May 2022 11:42:51 -0400
>>> -Subject: [PATCH] systemd: add file contexts for 
>>> systemd-network-generator
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/73adba0a39b7409bc4bbfa0e962108c2b1e5f2a5] 
>>>
>>> -
>>> -Thanks-To: Zhao Yi
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/systemd.fc | 2 ++
>>> - 1 file changed, 2 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/systemd.fc 
>>> b/policy/modules/system/systemd.fc
>>> -index d21914227..1a35bd65c 100644
>>> ---- a/policy/modules/system/systemd.fc
>>> -+++ b/policy/modules/system/systemd.fc
>>> -@@ -35,6 +35,7 @@
>>> - /usr/lib/systemd/systemd-machined    -- 
>>> gen_context(system_u:object_r:systemd_machined_exec_t,s0)
>>> - /usr/lib/systemd/systemd-modules-load    -- 
>>> gen_context(system_u:object_r:systemd_modules_load_exec_t,s0)
>>> - /usr/lib/systemd/systemd-networkd    -- 
>>> gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
>>> -+/usr/lib/systemd/systemd-network-generator    -- 
>>> gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
>>> - /usr/lib/systemd/systemd-pstore        -- 
>>> gen_context(system_u:object_r:systemd_pstore_exec_t,s0)
>>> - /usr/lib/systemd/systemd-resolved    -- 
>>> gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
>>> - /usr/lib/systemd/systemd-rfkill        -- 
>>> gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
>>> -@@ -60,6 +61,7 @@ HOME_DIR/\.local/share/systemd(/.*)? 
>>> gen_context(system_u:object_r:systemd_data
>>> - /usr/lib/systemd/system/systemd-backlight.*    -- 
>>> gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
>>> - /usr/lib/systemd/system/systemd-binfmt.*    -- 
>>> gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
>>> - /usr/lib/systemd/system/systemd-networkd.* 
>>> gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
>>> -+/usr/lib/systemd/system/systemd-network-generator.* 
>>> gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
>>> - /usr/lib/systemd/system/systemd-rfkill.*    -- 
>>> gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
>>> - /usr/lib/systemd/system/systemd-socket-proxyd\.service -- 
>>> gen_context(system_u:object_r:systemd_socket_proxyd_unit_file_t,s0)
>>> -
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch 
>>> b/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch 
>>>
>>> deleted file mode 100644
>>> index 259863c..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
>>> +++ /dev/null
>>> @@ -1,34 +0,0 @@
>>> -From 6508bc8a3440525384fcfcd8ad55a4cd5c79b912 Mon Sep 17 00:00:00 2001
>>> -From: Kenton Groombridge <me@concord.sh>
>>> -Date: Thu, 19 May 2022 11:43:44 -0400
>>> -Subject: [PATCH] systemd, udev: allow udev to read systemd-networkd 
>>> runtime
>>> -
>>> -udev searches for .link files and applies custom udev rules to devices
>>> -as they come up.
>>> -
>>> -Upstream-Status: Backport
>>> -[https://github.com/SELinuxProject/refpolicy/commit/998ef975f38c70d57e7220b88ae5e62c88ebb770] 
>>>
>>> -
>>> -Thanks-To: Zhao Yi
>>> -Signed-off-by: Kenton Groombridge <me@concord.sh>
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/udev.te | 2 ++
>>> - 1 file changed, 2 insertions(+)
>>> -
>>> -diff --git a/policy/modules/system/udev.te 
>>> b/policy/modules/system/udev.te
>>> -index 4c5a690fb..8e243c0f2 100644
>>> ---- a/policy/modules/system/udev.te
>>> -+++ b/policy/modules/system/udev.te
>>> -@@ -270,6 +270,8 @@ ifdef(`init_systemd',`
>>> -     systemd_read_hwdb(udev_t)
>>> -     systemd_read_logind_sessions_files(udev_t)
>>> -     systemd_read_logind_runtime_files(udev_t)
>>> -+    # udev searches for .link files and applies custom udev rules
>>> -+    systemd_read_networkd_runtime(udev_t)
>>> -
>>> -     optional_policy(`
>>> -         init_dbus_chat(udev_t)
>>> ---
>>> -2.25.1
>>> -
>>> diff --git 
>>> a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch 
>>> b/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch 
>>>
>>> deleted file mode 100644
>>> index 6535a4b..0000000
>>> --- 
>>> a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
>>> +++ /dev/null
>>> @@ -1,29 +0,0 @@
>>> -From 3e3ec39659ae068d20efbb5f13054d90960c3c3f Mon Sep 17 00:00:00 2001
>>> -From: Yi Zhao <yi.zhao@windriver.com>
>>> -Date: Thu, 19 May 2022 16:51:49 +0800
>>> -Subject: [PATCH] fc/fstools: apply policy to findfs alternative
>>> -
>>> -Add file context for findfs alternative which is provided by 
>>> util-linux.
>>> -
>>> -Upstream-Status: Inappropriate [embedded specific]
>>> -
>>> -Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
>>> ----
>>> - policy/modules/system/fstools.fc | 1 +
>>> - 1 file changed, 1 insertion(+)
>>> -
>>> -diff --git a/policy/modules/system/fstools.fc 
>>> b/policy/modules/system/fstools.fc
>>> -index bef711850..91be0ef3d 100644
>>> ---- a/policy/modules/system/fstools.fc
>>> -+++ b/policy/modules/system/fstools.fc
>>> -@@ -77,6 +77,7 @@
>>> - /usr/sbin/fdisk            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> - /usr/sbin/fdisk\.util-linux            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> - /usr/sbin/findfs        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> -+/usr/sbin/findfs\.util-linux        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> - /usr/sbin/fsck.*        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> - /usr/sbin/gdisk            -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> - /usr/sbin/hdparm        -- 
>>> gen_context(system_u:object_r:fsadm_exec_t,s0)
>>> ---
>>> -2.25.1
>>> -
>>> diff --git a/recipes-security/refpolicy/refpolicy_common.inc 
>>> b/recipes-security/refpolicy/refpolicy_common.inc
>>> index bb0c0dd..a51312f 100644
>>> --- a/recipes-security/refpolicy/refpolicy_common.inc
>>> +++ b/recipes-security/refpolicy/refpolicy_common.inc
>>> @@ -7,10 +7,10 @@ PROVIDES = "virtual/refpolicy"
>>>   RPROVIDES:${PN} = "refpolicy"
>>>     # Specific config files for Poky
>>> -SRC_URI += "file://customizable_types  \
>>> -        file://setrans-mls.conf  \
>>> -        file://setrans-mcs.conf  \
>>> -       "
>>> +SRC_URI += "file://customizable_types \
>>> +            file://setrans-mls.conf \
>>> +            file://setrans-mcs.conf \
>>> +           "
>>>     # Base patches applied to all Yocto-based platforms.  Your own 
>>> version of
>>>   # refpolicy should provide a version of these and place them in 
>>> your own
>>> @@ -49,64 +49,49 @@ SRC_URI += " \
>>> file://0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch 
>>> \
>>> file://0032-policy-modules-system-logging-fix-auditd-startup-fai.patch 
>>> \
>>> file://0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch 
>>> \
>>> - 
>>> file://0034-policy-modules-system-modutils-allow-mod_t-to-access.patch 
>>> \
>>> - 
>>> file://0035-policy-modules-system-getty-allow-getty_t-to-search-.patch 
>>> \
>>> - 
>>> file://0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch 
>>> \
>>> - 
>>> file://0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch 
>>> \
>>> - 
>>> file://0038-policy-modules-system-systemd-enable-support-for-sys.patch 
>>> \
>>> - 
>>> file://0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch 
>>> \
>>> - 
>>> file://0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch 
>>> \
>>> - 
>>> file://0041-policy-modules-system-logging-fix-syslogd-failures-f.patch 
>>> \
>>> - file://0042-policy-modules-system-systemd-systemd-user-fixes.patch \
>>> - 
>>> file://0043-policy-modules-system-sysnetwork-support-priviledge-.patch 
>>> \
>>> - 
>>> file://0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch 
>>> \
>>> - 
>>> file://0045-policy-modules-system-systemd-allow-systemd_logind_t.patch 
>>> \
>>> - 
>>> file://0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch 
>>> \
>>> - 
>>> file://0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch 
>>> \
>>> - 
>>> file://0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch 
>>> \
>>> - 
>>> file://0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch 
>>> \
>>> - 
>>> file://0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> \
>>> - 
>>> file://0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> \
>>> - 
>>> file://0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch 
>>> \
>>> - 
>>> file://0053-policy-modules-system-systemd-systemd-make-systemd_-.patch 
>>> \
>>> - 
>>> file://0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch 
>>> \
>>> - 
>>> file://0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> \
>>> - 
>>> file://0056-policy-modules-system-init-all-init_t-to-read-any-le.patch 
>>> \
>>> - 
>>> file://0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch 
>>> \
>>> - 
>>> file://0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> \
>>> - 
>>> file://0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch 
>>> \
>>> - 
>>> file://0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch 
>>> \
>>> - 
>>> file://0061-policy-modules-system-logging-make-syslogd_runtime_t.patch 
>>> \
>>> - file://0062-systemd-systemd-resolved-is-linked-to-libselinux.patch \
>>> - 
>>> file://0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch 
>>> \
>>> - 
>>> file://0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch 
>>> \
>>> - 
>>> file://0065-systemd-add-file-transition-for-systemd-networkd-run.patch 
>>> \
>>> - 
>>> file://0066-systemd-add-missing-file-context-for-run-systemd-net.patch 
>>> \
>>> - 
>>> file://0067-systemd-add-file-contexts-for-systemd-network-genera.patch 
>>> \
>>> - 
>>> file://0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch 
>>> \
>>> - file://0069-fc-fstools-apply-policy-to-findfs-alternative.patch \
>>> + 
>>> file://0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch 
>>> \
>>> + 
>>> file://0035-policy-modules-system-systemd-enable-support-for-sys.patch 
>>> \
>>> + 
>>> file://0036-policy-modules-system-systemd-allow-systemd_logind_t.patch 
>>> \
>>> + 
>>> file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch 
>>> \
>>> + file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
>>> + 
>>> file://0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch 
>>> \
>>> + 
>>> file://0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch 
>>> \
>>> + 
>>> file://0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch 
>>> \
>>> + 
>>> file://0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch 
>>> \
>>> + 
>>> file://0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> \
>>> + 
>>> file://0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> \
>>> + 
>>> file://0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch 
>>> \
>>> + 
>>> file://0046-policy-modules-system-systemd-systemd-make-systemd_-.patch 
>>> \
>>> + 
>>> file://0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch 
>>> \
>>> + 
>>> file://0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch 
>>> \
>>> + 
>>> file://0049-policy-modules-system-init-all-init_t-to-read-any-le.patch 
>>> \
>>> + 
>>> file://0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch 
>>> \
>>> + 
>>> file://0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch 
>>> \
>>> + 
>>> file://0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch 
>>> \
>>> + 
>>> file://0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch 
>>> \
>>> + 
>>> file://0054-policy-modules-system-logging-make-syslogd_runtime_t.patch 
>>> \
>>>           "
>>>     S = "${WORKDIR}/refpolicy"
>>>   -CONFFILES:${PN} += "${sysconfdir}/selinux/config"
>>> +CONFFILES:${PN} = "${sysconfdir}/selinux/config"
>>>   FILES:${PN} += " \
>>> -    ${sysconfdir}/selinux/${POLICY_NAME}/ \
>>> -    ${datadir}/selinux/${POLICY_NAME}/*.pp \
>>> -    ${localstatedir}/lib/selinux/${POLICY_NAME}/ \
>>> -    "
>>> +    ${sysconfdir}/selinux/${POLICY_NAME}/ \
>>> +    ${datadir}/selinux/${POLICY_NAME}/*.pp \
>>> +    ${localstatedir}/lib/selinux/${POLICY_NAME}/ \
>>> +    "
>>>   FILES:${PN}-dev =+ " \
>>> -        ${datadir}/selinux/${POLICY_NAME}/include/ \
>>> -        ${sysconfdir}/selinux/sepolgen.conf \
>>> -"
>>> +    ${datadir}/selinux/${POLICY_NAME}/include/ \
>>> +    ${sysconfdir}/selinux/sepolgen.conf \
>>> +    "
>>>     EXTRANATIVEPATH += "bzip2-native"
>>>   -DEPENDS += "bzip2-replacement-native checkpolicy-native 
>>> policycoreutils-native semodule-utils-native m4-native"
>>> +DEPENDS = "bzip2-replacement-native checkpolicy-native 
>>> policycoreutils-native semodule-utils-native m4-native"
>>>   -RDEPENDS:${PN}-dev =+ " \
>>> -        python3-core \
>>> -"
>>> +RDEPENDS:${PN}-dev = " \
>>> +    python3-core \
>>> +    "
>>>     PACKAGE_ARCH = "${MACHINE_ARCH}"
>>>   @@ -129,83 +114,83 @@ POLICY_MLS_SENS ?= "16"
>>>   POLICY_MLS_CATS ?= "1024"
>>>   POLICY_MCS_CATS ?= "1024"
>>>   -EXTRA_OEMAKE += "NAME=${POLICY_NAME} \
>>> -    TYPE=${POLICY_TYPE} \
>>> -    DISTRO=${POLICY_DISTRO} \
>>> -    UBAC=${POLICY_UBAC} \
>>> -    UNK_PERMS=${POLICY_UNK_PERMS} \
>>> -    DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
>>> -    SYSTEMD=${POLICY_SYSTEMD} \
>>> -    MONOLITHIC=${POLICY_MONOLITHIC} \
>>> -    CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
>>> -    QUIET=${POLICY_QUIET} \
>>> -    MLS_SENS=${POLICY_MLS_SENS} \
>>> -    MLS_CATS=${POLICY_MLS_CATS} \
>>> -    MCS_CATS=${POLICY_MCS_CATS}"
>>> +EXTRA_OEMAKE = "NAME=${POLICY_NAME} \
>>> +    TYPE=${POLICY_TYPE} \
>>> +    DISTRO=${POLICY_DISTRO} \
>>> +    UBAC=${POLICY_UBAC} \
>>> +    UNK_PERMS=${POLICY_UNK_PERMS} \
>>> +    DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
>>> +    SYSTEMD=${POLICY_SYSTEMD} \
>>> +    MONOLITHIC=${POLICY_MONOLITHIC} \
>>> +    CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
>>> +    QUIET=${POLICY_QUIET} \
>>> +    MLS_SENS=${POLICY_MLS_SENS} \
>>> +    MLS_CATS=${POLICY_MLS_CATS} \
>>> +    MCS_CATS=${POLICY_MCS_CATS}"
>>>     EXTRA_OEMAKE += "tc_usrbindir=${STAGING_BINDIR_NATIVE}"
>>>   EXTRA_OEMAKE += 
>>> "OUTPUT_POLICY=`${STAGING_BINDIR_NATIVE}/checkpolicy -V | cut -d' ' 
>>> -f1`"
>>>   EXTRA_OEMAKE += "CC='${BUILD_CC}' CFLAGS='${BUILD_CFLAGS}' 
>>> PYTHON='${PYTHON}'"
>>>   -python __anonymous () {
>>> +python __anonymous() {
>>>       import re
>>>   -    # make sure DEFAULT_ENFORCING is something sane
>>> +    # Make sure DEFAULT_ENFORCING is something sane
>>>       if not re.match('^(enforcing|permissive|disabled)$',
>>>                       d.getVar('DEFAULT_ENFORCING'),
>>>                       flags=0):
>>>           d.setVar('DEFAULT_ENFORCING', 'permissive')
>>>   }
>>>   -disable_policy_modules () {
>>> -    for module in ${PURGE_POLICY_MODULES} ; do
>>> -        sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" 
>>> ${S}/policy/modules.conf
>>> -    done
>>> +disable_policy_modules() {
>>> +    for module in ${PURGE_POLICY_MODULES} ; do
>>> +        sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" 
>>> ${S}/policy/modules.conf
>>> +    done
>>>   }
>>>     do_compile() {
>>> -    if [ -f "${WORKDIR}/modules.conf" ] ; then
>>> -        cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
>>> -    fi
>>> -    oe_runmake conf
>>> -    disable_policy_modules
>>> -    oe_runmake policy
>>> +    if [ -f "${WORKDIR}/modules.conf" ] ; then
>>> +        cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
>>> +    fi
>>> +    oe_runmake conf
>>> +    disable_policy_modules
>>> +    oe_runmake policy
>>>   }
>>>   -prepare_policy_store () {
>>> -    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>>> -    POL_PRIORITY=100
>>> -    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>>> -    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>>> - POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>>> -
>>> -    # Prepare to create policy store
>>> -    mkdir -p ${POL_STORE}
>>> -    mkdir -p ${POL_ACTIVE_MODS}
>>> -
>>> -    # get hll type from suffix on base policy module
>>> -    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print 
>>> $NF}}')
>>> - 
>>> HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>>> -
>>> -    for i in ${POL_SRC}/*.${HLL_TYPE}; do
>>> -        MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
>>> -        MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
>>> -        mkdir -p ${MOD_DIR}
>>> -        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>>> -        if ! bzip2 -t $i >/dev/null 2>&1; then
>>> -            ${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
>>> -            bzip2 -f $i && mv -f $i.bz2 $i
>>> -        else
>>> -            bunzip2 --stdout $i | \
>>> -                ${HLL_BIN} | \
>>> -                bzip2 --stdout > ${MOD_DIR}/cil
>>> -        fi
>>> -        cp $i ${MOD_DIR}/hll
>>> -    done
>>> +prepare_policy_store() {
>>> +    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
>>> +    POL_PRIORITY=100
>>> +    POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
>>> +    POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
>>> + POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
>>> +
>>> +    # Prepare to create policy store
>>> +    mkdir -p ${POL_STORE}
>>> +    mkdir -p ${POL_ACTIVE_MODS}
>>> +
>>> +    # Get hll type from suffix on base policy module
>>> +    HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print 
>>> $NF}}')
>>> + 
>>> HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
>>> +
>>> +    for i in ${POL_SRC}/*.${HLL_TYPE}; do
>>> +        MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
>>> +        MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
>>> +        mkdir -p ${MOD_DIR}
>>> +        echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
>>> +        if ! bzip2 -t $i >/dev/null 2>&1; then
>>> +            ${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
>>> +            bzip2 -f $i && mv -f $i.bz2 $i
>>> +        else
>>> +            bunzip2 --stdout $i | \
>>> +                ${HLL_BIN} | \
>>> +                bzip2 --stdout > ${MOD_DIR}/cil
>>> +        fi
>>> +        cp $i ${MOD_DIR}/hll
>>> +    done
>>>   }
>>>   -rebuild_policy () {
>>> -    cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
>>> +rebuild_policy() {
>>> +    cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
>>>   module-store = direct
>>>   [setfiles]
>>>   path = ${STAGING_DIR_NATIVE}${base_sbindir_native}/setfiles
>>> @@ -219,29 +204,29 @@ args = \$@
>>>   policy-version = 33
>>>   EOF
>>>   -    # Create policy store and build the policy
>>> -    semodule -p ${D} -s ${POLICY_NAME} -n -B
>>> -    rm -f ${D}${sysconfdir}/selinux/semanage.conf
>>> -    # no need to leave final dir created by semanage laying around
>>> -    rm -rf ${D}${localstatedir}/lib/selinux/final
>>> +    # Create policy store and build the policy
>>> +    semodule -p ${D} -s ${POLICY_NAME} -n -B
>>> +    rm -f ${D}${sysconfdir}/selinux/semanage.conf
>>> +    # No need to leave final dir created by semanage laying around
>>> +    rm -rf ${D}${localstatedir}/lib/selinux/final
>>>   }
>>>   -install_misc_files () {
>>> -    cat ${WORKDIR}/customizable_types >> \
>>> - ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
>>> +install_misc_files() {
>>> +    cat ${WORKDIR}/customizable_types >> \
>>> + ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
>>>   -    # install setrans.conf for mls/mcs policy
>>> -    if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
>>> -        install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
>>> - ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
>>> -    fi
>>> +    # Install setrans.conf for mls/mcs policy
>>> +    if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
>>> +        install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
>>> + ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
>>> +    fi
>>>   -    # install policy headers
>>> -    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
>>> +    # Install policy headers
>>> +    oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
>>>   }
>>>   -install_config () {
>>> -    echo "\
>>> +install_config() {
>>> +    echo "\
>>>   # This file controls the state of SELinux on the system.
>>>   # SELINUX= can take one of these three values:
>>>   #     enforcing - SELinux security policy is enforced.
>>> @@ -256,22 +241,22 @@ SELINUX=${DEFAULT_ENFORCING}
>>>   #     mcs - Multi Category Security protection.
>>>   SELINUXTYPE=${POLICY_NAME}
>>>   " > ${WORKDIR}/config
>>> -    install -d ${D}/${sysconfdir}/selinux
>>> -    install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
>>> +    install -d ${D}/${sysconfdir}/selinux
>>> +    install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
>>>   }
>>>   -do_install () {
>>> -    prepare_policy_store
>>> -    rebuild_policy
>>> -    install_misc_files
>>> -    install_config
>>> +do_install() {
>>> +    prepare_policy_store
>>> +    rebuild_policy
>>> +    install_misc_files
>>> +    install_config
>>>   }
>>>   -do_install:append(){
>>> -    # While building policies on target, Makefile will be searched 
>>> from SELINUX_DEVEL_PATH
>>> -    echo 
>>> "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > 
>>> ${D}${sysconfdir}/selinux/sepolgen.conf
>>> +do_install:append() {
>>> +    # While building policies on target, Makefile will be searched 
>>> from SELINUX_DEVEL_PATH
>>> +    echo 
>>> "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > 
>>> ${D}${sysconfdir}/selinux/sepolgen.conf
>>>   }
>>>   -sysroot_stage_all:append () {
>>> -    sysroot_stage_dir ${D}${sysconfdir} 
>>> ${SYSROOT_DESTDIR}${sysconfdir}
>>> +sysroot_stage_all:append() {
>>> +    sysroot_stage_dir ${D}${sysconfdir} 
>>> ${SYSROOT_DESTDIR}${sysconfdir}
>>>   }
>>> diff --git a/recipes-security/refpolicy/refpolicy_git.inc 
>>> b/recipes-security/refpolicy/refpolicy_git.inc
>>> index 9e78aed..54e0890 100644
>>> --- a/recipes-security/refpolicy/refpolicy_git.inc
>>> +++ b/recipes-security/refpolicy/refpolicy_git.inc
>>> @@ -1,8 +1,8 @@
>>> -PV = "2.20210908+git${SRCPV}"
>>> +PV = "2.20221101+git${SRCPV}"
>>>     SRC_URI = 
>>> "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=master;name=refpolicy;destsuffix=refpolicy"
>>>   -SRCREV_refpolicy ?= "23a8d103f379361cfe63a9ee064564624e108196"
>>> +SRCREV_refpolicy ?= "03d486e306555da161b653c88e804ce23f3a0ea4"
>>>     UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
>>>   --
>>> 2.25.1
>>>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#58521): https://lists.yoctoproject.org/g/yocto/message/58521
> Mute This Topic: https://lists.yoctoproject.org/mt/94729417/3616783
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [yi.zhao@windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>


^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2022-11-09  3:48 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-02  7:30 [meta-selinux][PATCH 1/4] SELinux-FAQ: remove references to poky-selinux distro Yi Zhao
2022-11-02  7:30 ` [meta-selinux][PATCH 2/4] base-files: set correct label for /var/volatile Yi Zhao
2022-11-02  7:30 ` [meta-selinux][PATCH 3/4] libsepol: fix build failure for refpolicy-mls Yi Zhao
2022-11-02  7:30 ` [meta-selinux][PATCH 4/4] refpolicy: upgrade 20210908+git -> 20221101+git Yi Zhao
     [not found]   ` <20221107193343.jrkm4tdey75dwev6@siemens.com>
2022-11-08  2:29     ` Yi Zhao
     [not found]     ` <17257B1B9EFC9AB1.28792@lists.yoctoproject.org>
2022-11-09  3:47       ` [yocto] " Yi Zhao

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox