From b66c2b8ce6c48c02dc3f04555e8bdcdb08e1762990137d47cbe257ccc1051068 Mon Sep 17 00:00:00 2001
From: Johannes Segitz <jsegitz@suse.com>
Date: Mon, 14 Nov 2022 08:27:42 +0000
Subject: [PATCH] Accepting request 1035580 from
 home:jsegitz:branches:security:SELinux

- Update to version 20221019. Refreshed:
  * distro_suse_to_distro_redhat.patch
  * fix_apache.patch
  * fix_chronyd.patch
  * fix_cron.patch
  * fix_init.patch
  * fix_kernel_sysctl.patch
  * fix_networkmanager.patch
  * fix_rpm.patch
  * fix_sysnetwork.patch
  * fix_systemd.patch
  * fix_systemd_watch.patch
  * fix_unconfined.patch
  * fix_unconfineduser.patch
  * fix_unprivuser.patch
  * fix_xserver.patch
- Dropped fix_cockpit.patch as this is now packaged with cockpit itself
- Remove the ipa module, freeip ships their own module
- Added fix_alsa.patch to allow reading of config files in home directories
- Extended fix_networkmanager.patch and fix_postfix.patch to account
  for SUSE systems
- Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc
  queries the running processes
- Updated fix_snapper.patch to allow snapper to talk to rpm via dbus

OBS-URL: https://build.opensuse.org/request/show/1035580
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=155
---
 distro_suse_to_distro_redhat.patch   | 128 +++++++++++++++------------
 dontaudit_interface_kmod_tmpfs.patch |  41 +++++++++
 fedora-policy-20220714.tar.bz2       |   3 -
 fedora-policy-20221019.tar.bz2       |   3 +
 fix_alsa.patch                       |  15 ++++
 fix_apache.patch                     |  10 +--
 fix_chronyd.patch                    |  14 +--
 fix_cockpit.patch                    |  47 ----------
 fix_cron.patch                       |  14 +--
 fix_init.patch                       |  31 +++----
 fix_kernel_sysctl.patch              |  14 +--
 fix_networkmanager.patch             |  48 +++++++---
 fix_postfix.patch                    |  25 ++++--
 fix_rpm.patch                        |  24 ++---
 fix_snapper.patch                    |  18 ++--
 fix_sysnetwork.patch                 |   8 +-
 fix_systemd.patch                    |  18 ++--
 fix_systemd_watch.patch              |   8 +-
 fix_unconfined.patch                 |   8 +-
 fix_unconfineduser.patch             |  10 +--
 fix_unprivuser.patch                 |   8 +-
 fix_xserver.patch                    |  18 ++--
 modules-minimum-contrib.conf         |  14 ---
 modules-targeted-contrib.conf        |  14 ---
 selinux-policy.changes               |  28 ++++++
 selinux-policy.spec                  |   6 +-
 26 files changed, 313 insertions(+), 262 deletions(-)
 create mode 100644 dontaudit_interface_kmod_tmpfs.patch
 delete mode 100644 fedora-policy-20220714.tar.bz2
 create mode 100644 fedora-policy-20221019.tar.bz2
 create mode 100644 fix_alsa.patch
 delete mode 100644 fix_cockpit.patch

diff --git a/distro_suse_to_distro_redhat.patch b/distro_suse_to_distro_redhat.patch
index c931eb5..c11814e 100644
--- a/distro_suse_to_distro_redhat.patch
+++ b/distro_suse_to_distro_redhat.patch
@@ -1,7 +1,8 @@
-diff -r -u fedora-policy-20220714/policy/modules/contrib/apache.fc fedora-policy-20220714_changed/policy/modules/contrib/apache.fc
---- fedora-policy-20220714/policy/modules/contrib/apache.fc	2022-07-14 10:41:34.267983097 +0200
-+++ fedora-policy-20220714_changed/policy/modules/contrib/apache.fc	2022-09-30 09:07:02.245313656 +0200
-@@ -74,7 +74,7 @@
+Index: fedora-policy-20221019/policy/modules/contrib/apache.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/contrib/apache.fc
++++ fedora-policy-20221019/policy/modules/contrib/apache.fc
+@@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*
  /usr/sbin/suexec		--	gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
  /usr/sbin/thttpd        -- gen_context(system_u:object_r:httpd_exec_t,s0)
  
@@ -10,10 +11,11 @@ diff -r -u fedora-policy-20220714/policy/modules/contrib/apache.fc fedora-policy
  /usr/sbin/httpd2-.*		--	gen_context(system_u:object_r:httpd_exec_t,s0)
  ')
  
-diff -r -u fedora-policy-20220714/policy/modules/contrib/cron.fc fedora-policy-20220714_changed/policy/modules/contrib/cron.fc
---- fedora-policy-20220714/policy/modules/contrib/cron.fc	2022-07-14 10:41:34.279983278 +0200
-+++ fedora-policy-20220714_changed/policy/modules/contrib/cron.fc	2022-09-30 09:07:01.465301514 +0200
-@@ -51,7 +51,7 @@
+Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc
++++ fedora-policy-20221019/policy/modules/contrib/cron.fc
+@@ -51,7 +51,7 @@ ifdef(`distro_gentoo',`
  /var/spool/cron/lastrun/[^/]*	--	<<none>>
  ')
  
@@ -22,7 +24,7 @@ diff -r -u fedora-policy-20220714/policy/modules/contrib/cron.fc fedora-policy-2
  /var/spool/cron/lastrun		-d	gen_context(system_u:object_r:crond_tmp_t,s0)
  /var/spool/cron/lastrun/[^/]*	--	<<none>>
  /var/spool/cron/tabs		-d	gen_context(system_u:object_r:cron_spool_t,s0)
-@@ -70,7 +70,7 @@
+@@ -70,7 +70,7 @@ ifdef(`distro_gentoo',`
  /var/spool/cron/lastrun/[^/]*	--	<<none>>
  ')
  
@@ -31,10 +33,11 @@ diff -r -u fedora-policy-20220714/policy/modules/contrib/cron.fc fedora-policy-2
  /var/spool/cron/lastrun		-d	gen_context(system_u:object_r:crond_tmp_t,s0)
  /var/spool/cron/lastrun/[^/]*	--	<<none>>
  /var/spool/cron/tabs		-d	gen_context(system_u:object_r:cron_spool_t,s0)
-diff -r -u fedora-policy-20220714/policy/modules/contrib/rpm.fc fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc
---- fedora-policy-20220714/policy/modules/contrib/rpm.fc	2022-07-14 10:41:34.315983821 +0200
-+++ fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc	2022-09-30 09:07:01.713305375 +0200
-@@ -79,7 +79,7 @@
+Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc
++++ fedora-policy-20221019/policy/modules/contrib/rpm.fc
+@@ -80,7 +80,7 @@ ifdef(`distro_redhat', `
  /var/run/PackageKit(/.*)?		gen_context(system_u:object_r:rpm_var_run_t,s0)
  
  # SuSE
@@ -43,10 +46,11 @@ diff -r -u fedora-policy-20220714/policy/modules/contrib/rpm.fc fedora-policy-20
  /usr/bin/online_update		--	gen_context(system_u:object_r:rpm_exec_t,s0)
  /sbin/yast2			--	gen_context(system_u:object_r:rpm_exec_t,s0)
  /var/lib/YaST2(/.*)?			gen_context(system_u:object_r:rpm_var_lib_t,s0)
-diff -r -u fedora-policy-20220714/policy/modules/kernel/corecommands.fc fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc
---- fedora-policy-20220714/policy/modules/kernel/corecommands.fc	2022-07-14 10:41:34.327984002 +0200
-+++ fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc	2022-09-30 09:07:01.273298522 +0200
-@@ -462,7 +462,7 @@
+Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/kernel/corecommands.fc
++++ fedora-policy-20221019/policy/modules/kernel/corecommands.fc
+@@ -462,7 +462,7 @@ ifdef(`distro_redhat', `
  /usr/share/texmf/texconfig/tcfmgr --	gen_context(system_u:object_r:bin_t,s0)
  ')
  
@@ -55,7 +59,7 @@ diff -r -u fedora-policy-20220714/policy/modules/kernel/corecommands.fc fedora-p
  /usr/lib/cron/run-crons		--	gen_context(system_u:object_r:bin_t,s0)
  /usr/lib/samba/classic/.*	--	gen_context(system_u:object_r:bin_t,s0)
  /usr/lib/ssh/.*			--	gen_context(system_u:object_r:bin_t,s0)
-@@ -491,7 +491,7 @@
+@@ -491,7 +491,7 @@ ifdef(`distro_suse', `
  /var/lib/glusterd/hooks/.*/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
  /var/lib/glusterd/hooks/.*/.*\.py -- gen_context(system_u:object_r:bin_t,s0)
  
@@ -64,9 +68,10 @@ diff -r -u fedora-policy-20220714/policy/modules/kernel/corecommands.fc fedora-p
  /var/lib/samba/bin/.+			gen_context(system_u:object_r:bin_t,s0)
  ')
  
-diff -r -u fedora-policy-20220714/policy/modules/kernel/devices.fc fedora-policy-20220714_changed/policy/modules/kernel/devices.fc
---- fedora-policy-20220714/policy/modules/kernel/devices.fc	2022-07-14 10:41:34.327984002 +0200
-+++ fedora-policy-20220714_changed/policy/modules/kernel/devices.fc	2022-09-30 09:07:01.265298397 +0200
+Index: fedora-policy-20221019/policy/modules/kernel/devices.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/kernel/devices.fc
++++ fedora-policy-20221019/policy/modules/kernel/devices.fc
 @@ -148,7 +148,7 @@
  /dev/usb.+		-c	gen_context(system_u:object_r:usb_device_t,s0)
  /dev/usblp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
@@ -76,10 +81,11 @@ diff -r -u fedora-policy-20220714/policy/modules/kernel/devices.fc fedora-policy
  /dev/usbscanner		-c	gen_context(system_u:object_r:scanner_device_t,s0)
  ')
  /dev/vmci       -c  gen_context(system_u:object_r:vmci_device_t,s0)
-diff -r -u fedora-policy-20220714/policy/modules/kernel/files.fc fedora-policy-20220714_changed/policy/modules/kernel/files.fc
---- fedora-policy-20220714/policy/modules/kernel/files.fc	2022-07-14 10:41:34.331984062 +0200
-+++ fedora-policy-20220714_changed/policy/modules/kernel/files.fc	2022-09-30 09:07:01.289298772 +0200
-@@ -22,7 +22,7 @@
+Index: fedora-policy-20221019/policy/modules/kernel/files.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
++++ fedora-policy-20221019/policy/modules/kernel/files.fc
+@@ -22,7 +22,7 @@ ifdef(`distro_redhat',`
  /[^/]+			--	gen_context(system_u:object_r:etc_runtime_t,s0)
  ')
  
@@ -88,7 +94,7 @@ diff -r -u fedora-policy-20220714/policy/modules/kernel/files.fc fedora-policy-2
  /success		--	gen_context(system_u:object_r:etc_runtime_t,s0)
  ')
  
-@@ -92,7 +92,7 @@
+@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
  /etc/env\.d/.*		--	gen_context(system_u:object_r:etc_runtime_t,s0)
  ')
  
@@ -97,10 +103,11 @@ diff -r -u fedora-policy-20220714/policy/modules/kernel/files.fc fedora-policy-2
  /etc/defkeymap\.map	--	gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
  ')
-diff -r -u fedora-policy-20220714/policy/modules/services/xserver.fc fedora-policy-20220714_changed/policy/modules/services/xserver.fc
---- fedora-policy-20220714/policy/modules/services/xserver.fc	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/services/xserver.fc	2022-09-30 09:07:02.689320566 +0200
-@@ -189,7 +189,7 @@
+Index: fedora-policy-20221019/policy/modules/services/xserver.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
++++ fedora-policy-20221019/policy/modules/services/xserver.fc
+@@ -189,7 +189,7 @@ ifndef(`distro_debian',`
  /var/run/xorg(/.*)?		gen_context(system_u:object_r:xserver_var_run_t,s0)
  /var/run/systemd/multi-session-x(/.*)?	gen_context(system_u:object_r:xdm_var_run_t,s0)
  
@@ -109,10 +116,11 @@ diff -r -u fedora-policy-20220714/policy/modules/services/xserver.fc fedora-poli
  /var/lib/pam_devperm/:0	--	gen_context(system_u:object_r:xdm_var_lib_t,s0)
  ')
  
-diff -r -u fedora-policy-20220714/policy/modules/system/authlogin.fc fedora-policy-20220714_changed/policy/modules/system/authlogin.fc
---- fedora-policy-20220714/policy/modules/system/authlogin.fc	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/authlogin.fc	2022-09-30 09:07:02.761321686 +0200
-@@ -31,7 +31,7 @@
+Index: fedora-policy-20221019/policy/modules/system/authlogin.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/authlogin.fc
++++ fedora-policy-20221019/policy/modules/system/authlogin.fc
+@@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~		gen_co
  /sbin/unix_chkpwd	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
  /sbin/unix_update	--	gen_context(system_u:object_r:updpwd_exec_t,s0)
  /sbin/unix_verify	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
@@ -121,10 +129,11 @@ diff -r -u fedora-policy-20220714/policy/modules/system/authlogin.fc fedora-poli
  /sbin/unix2_chkpwd	--	gen_context(system_u:object_r:chkpwd_exec_t,s0)
  ')
  
-diff -r -u fedora-policy-20220714/policy/modules/system/init.fc fedora-policy-20220714_changed/policy/modules/system/init.fc
---- fedora-policy-20220714/policy/modules/system/init.fc	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/init.fc	2022-09-30 09:07:02.701320753 +0200
-@@ -92,7 +92,7 @@
+Index: fedora-policy-20221019/policy/modules/system/init.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/init.fc
++++ fedora-policy-20221019/policy/modules/system/init.fc
+@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
  /var/run/svscan\.pid	--	gen_context(system_u:object_r:initrc_var_run_t,s0)
  ')
  
@@ -133,10 +142,11 @@ diff -r -u fedora-policy-20220714/policy/modules/system/init.fc fedora-policy-20
  /var/run/bootsplashctl	-p	gen_context(system_u:object_r:initrc_var_run_t,s0)
  /var/run/keymap		--	gen_context(system_u:object_r:initrc_var_run_t,s0)
  /var/run/numlock-on	--	gen_context(system_u:object_r:initrc_var_run_t,s0)
-diff -r -u fedora-policy-20220714/policy/modules/system/init.te fedora-policy-20220714_changed/policy/modules/system/init.te
---- fedora-policy-20220714/policy/modules/system/init.te	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/init.te	2022-09-30 09:07:02.725321126 +0200
-@@ -1330,7 +1330,7 @@
+Index: fedora-policy-20221019/policy/modules/system/init.te
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/init.te
++++ fedora-policy-20221019/policy/modules/system/init.te
+@@ -1334,7 +1334,7 @@ ifdef(`distro_redhat',`
  	')
  ')
  
@@ -145,10 +155,11 @@ diff -r -u fedora-policy-20220714/policy/modules/system/init.te fedora-policy-20
  	optional_policy(`
  		# set permissions on /tmp/.X11-unix
  		xserver_setattr_xdm_tmp_dirs(initrc_t)
-diff -r -u fedora-policy-20220714/policy/modules/system/libraries.fc fedora-policy-20220714_changed/policy/modules/system/libraries.fc
---- fedora-policy-20220714/policy/modules/system/libraries.fc	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/libraries.fc	2022-09-30 09:07:02.709320877 +0200
-@@ -329,7 +329,7 @@
+Index: fedora-policy-20221019/policy/modules/system/libraries.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/libraries.fc
++++ fedora-policy-20221019/policy/modules/system/libraries.fc
+@@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* 	--	gen_
  /var/lib/spamassassin/compiled/.*\.so.* --	gen_context(system_u:object_r:lib_t,s0)
  /usr/lib/xfce4/.*\.so.*			-- 	gen_context(system_u:object_r:lib_t,s0)
  
@@ -157,10 +168,11 @@ diff -r -u fedora-policy-20220714/policy/modules/system/libraries.fc fedora-poli
  /var/lib/samba/bin/.+\.so(\.[^/]*)*	-l	gen_context(system_u:object_r:lib_t,s0)
  ')
  
-diff -r -u fedora-policy-20220714/policy/modules/system/locallogin.te fedora-policy-20220714_changed/policy/modules/system/locallogin.te
---- fedora-policy-20220714/policy/modules/system/locallogin.te	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/locallogin.te	2022-09-30 09:07:02.757321625 +0200
-@@ -274,7 +274,7 @@
+Index: fedora-policy-20221019/policy/modules/system/locallogin.te
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/locallogin.te
++++ fedora-policy-20221019/policy/modules/system/locallogin.te
+@@ -274,7 +274,7 @@ ifdef(`enable_mls',`
  ')
  
  # suse and debian do not use pam with sulogin...
@@ -169,9 +181,10 @@ diff -r -u fedora-policy-20220714/policy/modules/system/locallogin.te fedora-pol
  ifdef(`distro_debian', `define(`sulogin_no_pam')')
  
  allow sulogin_t self:capability sys_tty_config;
-diff -r -u fedora-policy-20220714/policy/modules/system/logging.fc fedora-policy-20220714_changed/policy/modules/system/logging.fc
---- fedora-policy-20220714/policy/modules/system/logging.fc	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/logging.fc	2022-09-30 09:07:02.757321625 +0200
+Index: fedora-policy-20221019/policy/modules/system/logging.fc
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/logging.fc
++++ fedora-policy-20221019/policy/modules/system/logging.fc
 @@ -46,7 +46,7 @@
  /var/lib/r?syslog(/.*)?		gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh)
  /var/lib/syslog-ng.persist --	gen_context(system_u:object_r:syslogd_var_lib_t,s0)
@@ -181,10 +194,11 @@ diff -r -u fedora-policy-20220714/policy/modules/system/logging.fc fedora-policy
  /var/lib/stunnel/dev/log -s	gen_context(system_u:object_r:devlog_t,s0)
  ')
  
-diff -r -u fedora-policy-20220714/policy/modules/system/logging.te fedora-policy-20220714_changed/policy/modules/system/logging.te
---- fedora-policy-20220714/policy/modules/system/logging.te	2022-07-14 10:41:34.335984123 +0200
-+++ fedora-policy-20220714_changed/policy/modules/system/logging.te	2022-09-30 09:07:02.709320877 +0200
-@@ -674,7 +674,7 @@
+Index: fedora-policy-20221019/policy/modules/system/logging.te
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/logging.te
++++ fedora-policy-20221019/policy/modules/system/logging.te
+@@ -682,7 +682,7 @@ ifdef(`distro_gentoo',`
  	term_dontaudit_setattr_unallocated_ttys(syslogd_t)
  ')
  
diff --git a/dontaudit_interface_kmod_tmpfs.patch b/dontaudit_interface_kmod_tmpfs.patch
new file mode 100644
index 0000000..031ead4
--- /dev/null
+++ b/dontaudit_interface_kmod_tmpfs.patch
@@ -0,0 +1,41 @@
+Index: fedora-policy-20221019/policy/modules/services/xserver.te
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
++++ fedora-policy-20221019/policy/modules/services/xserver.te
+@@ -764,6 +764,10 @@ userdom_mounton_tmp_sockets(xdm_t)
+ userdom_nnp_transition_login_userdomain(xdm_t)
+ userdom_watch_user_home_dirs(xdm_t)
+ 
++# SUSE uses startproc to start the display manager. While checking for running processes
++# it goes over all running instances, triggering AVCs
++modutils_dontaudit_kmod_tmpfs_getattr(xdm_t)
++
+ #userdom_home_manager(xdm_t)
+ tunable_policy(`xdm_write_home',`
+     userdom_user_home_dir_filetrans(xdm_t, xdm_home_t, { file lnk_file })
+Index: fedora-policy-20221019/policy/modules/system/modutils.if
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/system/modutils.if
++++ fedora-policy-20221019/policy/modules/system/modutils.if
+@@ -507,3 +507,21 @@ interface(`modules_filetrans_named_conte
+ 	#files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols")
+ 	#files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols.bin")
+ ')
++
++#######################################
++## <summary>
++## Don't audit accesses to tmp file type.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`modutils_dontaudit_kmod_tmpfs_getattr',`
++    gen_require(`
++        type kmod_tmpfs_t;
++    ')
++
++    dontaudit $1 kmod_tmpfs_t:file { getattr };
++')
diff --git a/fedora-policy-20220714.tar.bz2 b/fedora-policy-20220714.tar.bz2
deleted file mode 100644
index e44436d..0000000
--- a/fedora-policy-20220714.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:dc7e16b718c4b36fc790d0e55a41fb18226a17e8b5e079afe127e611d16276a9
-size 731294
diff --git a/fedora-policy-20221019.tar.bz2 b/fedora-policy-20221019.tar.bz2
new file mode 100644
index 0000000..6fb0487
--- /dev/null
+++ b/fedora-policy-20221019.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e2cfe78d728e0b94dfbdc81413f6ede0a0f0e6064de4f6628fa7328d1f4d2ede
+size 733130
diff --git a/fix_alsa.patch b/fix_alsa.patch
new file mode 100644
index 0000000..0e6b04c
--- /dev/null
+++ b/fix_alsa.patch
@@ -0,0 +1,15 @@
+Index: fedora-policy-20221019/policy/modules/contrib/alsa.te
+===================================================================
+--- fedora-policy-20221019.orig/policy/modules/contrib/alsa.te
++++ fedora-policy-20221019/policy/modules/contrib/alsa.te
+@@ -104,6 +104,10 @@ userdom_manage_unpriv_user_semaphores(al
+ userdom_manage_unpriv_user_shared_mem(alsa_t)
+ userdom_search_user_home_dirs(alsa_t)
+ 
++optional_policy(`
++	gnome_read_home_config(alsa_t)
++')
++
+ ifdef(`distro_debian',`
+ 	term_dontaudit_use_unallocated_ttys(alsa_t)
+ 
diff --git a/fix_apache.patch b/fix_apache.patch
index 74a1c76..6b24b83 100644
--- a/fix_apache.patch
+++ b/fix_apache.patch
@@ -1,10 +1,10 @@
-Index: fedora-policy-20220428/policy/modules/contrib/apache.if
+Index: fedora-policy-20221019/policy/modules/contrib/apache.if
 ===================================================================
---- fedora-policy-20220428.orig/policy/modules/contrib/apache.if
-+++ fedora-policy-20220428/policy/modules/contrib/apache.if
-@@ -1989,3 +1989,25 @@ interface(`apache_ioctl_stream_sockets',
+--- fedora-policy-20221019.orig/policy/modules/contrib/apache.if
++++ fedora-policy-20221019/policy/modules/contrib/apache.if
+@@ -2007,3 +2007,25 @@ interface(`apache_read_semaphores',`
  
-     allow $1 httpd_t:unix_stream_socket ioctl;
+ 	allow $1 httpd_t:sem r_sem_perms;
  ')
 +
 +#######################################
diff --git a/fix_chronyd.patch b/fix_chronyd.patch
index a4daca5..beabc0d 100644
--- a/fix_chronyd.patch
+++ b/fix_chronyd.patch
@@ -1,8 +1,8 @@
-Index: fedora-policy-20220714/policy/modules/contrib/chronyd.te
+Index: fedora-policy-20221019/policy/modules/contrib/chronyd.te
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/chronyd.te
-+++ fedora-policy-20220714/policy/modules/contrib/chronyd.te
-@@ -141,6 +141,14 @@ systemd_exec_systemctl(chronyd_t)
+--- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.te
++++ fedora-policy-20221019/policy/modules/contrib/chronyd.te
+@@ -144,6 +144,14 @@ systemd_exec_systemctl(chronyd_t)
  userdom_dgram_send(chronyd_t)
  
  optional_policy(`
@@ -17,10 +17,10 @@ Index: fedora-policy-20220714/policy/modules/contrib/chronyd.te
      cron_dgram_send(chronyd_t)
  ')
  
-Index: fedora-policy-20220714/policy/modules/contrib/chronyd.fc
+Index: fedora-policy-20221019/policy/modules/contrib/chronyd.fc
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/chronyd.fc
-+++ fedora-policy-20220714/policy/modules/contrib/chronyd.fc
+--- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.fc
++++ fedora-policy-20221019/policy/modules/contrib/chronyd.fc
 @@ -6,6 +6,8 @@
  
  /usr/sbin/chronyd	--	gen_context(system_u:object_r:chronyd_exec_t,s0)
diff --git a/fix_cockpit.patch b/fix_cockpit.patch
deleted file mode 100644
index 99c363e..0000000
--- a/fix_cockpit.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From d63e6cf43bfe32d53b371b6920d4c09431647ddd Mon Sep 17 00:00:00 2001
-From: Ludwig Nussel <ludwig.nussel@suse.de>
-Date: Wed, 28 Apr 2021 17:09:49 +0200
-Subject: [PATCH] cockpit: allow cockpit socket to bind nodes
-
-Looks like this setting is implicit with kerberos enabled.
-cockpit.socket fails to start if kerberos_enabled=false
----
- policy/modules/contrib/cockpit.te | 2 ++
- 1 file changed, 2 insertions(+)
-
-Index: fedora-policy-20210716/policy/modules/contrib/cockpit.te
-===================================================================
---- fedora-policy-20210716.orig/policy/modules/contrib/cockpit.te
-+++ fedora-policy-20210716/policy/modules/contrib/cockpit.te
-@@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex
- dev_read_urand(cockpit_ws_t) # for authkey
- dev_read_rand(cockpit_ws_t)  # for libssh
- 
-+# cockpit-ws allows connections on websm port
- corenet_tcp_bind_websm_port(cockpit_ws_t)
-+corenet_tcp_bind_generic_node(cockpit_ws_t)
- 
- # cockpit-ws can connect to other hosts via ssh
- corenet_tcp_connect_ssh_port(cockpit_ws_t)
-Index: fedora-policy-20210716/policy/modules/contrib/cockpit.fc
-===================================================================
---- fedora-policy-20210716.orig/policy/modules/contrib/cockpit.fc
-+++ fedora-policy-20210716/policy/modules/contrib/cockpit.fc
-@@ -3,12 +3,12 @@
- /usr/lib/systemd/system/cockpit.*		--	gen_context(system_u:object_r:cockpit_unit_file_t,s0)
- /etc/systemd/system/cockpit.*	--	gen_context(system_u:object_r:cockpit_unit_file_t,s0)
- 
--/usr/libexec/cockpit-ws		--	gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
--/usr/libexec/cockpit-tls	--	gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
--/usr/libexec/cockpit-wsinstance-factory	--	gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
-+/usr/lib(exec)?/cockpit-ws		--	gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
-+/usr/lib(exec)?/cockpit-tls	--	gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
-+/usr/lib(exec)?/cockpit-wsinstance-factory	--	gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
- 
--/usr/libexec/cockpit-session	--	gen_context(system_u:object_r:cockpit_session_exec_t,s0)
--/usr/libexec/cockpit-ssh	--	gen_context(system_u:object_r:cockpit_session_exec_t,s0)
-+/usr/lib(exec)?/cockpit-session	--	gen_context(system_u:object_r:cockpit_session_exec_t,s0)
-+/usr/lib(exec)?/cockpit-ssh	--	gen_context(system_u:object_r:cockpit_session_exec_t,s0)
- 
- /usr/share/cockpit/motd/update-motd    -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
- 
diff --git a/fix_cron.patch b/fix_cron.patch
index 8b4135d..203162a 100644
--- a/fix_cron.patch
+++ b/fix_cron.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20220714/policy/modules/contrib/cron.fc
+Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/cron.fc
-+++ fedora-policy-20220714/policy/modules/contrib/cron.fc
+--- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc
++++ fedora-policy-20221019/policy/modules/contrib/cron.fc
 @@ -34,7 +34,7 @@
  
  /var/spool/cron			-d	gen_context(system_u:object_r:user_cron_spool_t,s0)
@@ -32,11 +32,11 @@ Index: fedora-policy-20220714/policy/modules/contrib/cron.fc
 -/var/spool/cron/lastrun/[^/]*	--	<<none>>
 -/var/spool/cron/tabs		-d	gen_context(system_u:object_r:cron_spool_t,s0)
 -')
-Index: fedora-policy-20220714/policy/modules/contrib/cron.if
+Index: fedora-policy-20221019/policy/modules/contrib/cron.if
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/cron.if
-+++ fedora-policy-20220714/policy/modules/contrib/cron.if
-@@ -1057,7 +1057,7 @@ interface(`cron_generic_log_filetrans_lo
+--- fedora-policy-20221019.orig/policy/modules/contrib/cron.if
++++ fedora-policy-20221019/policy/modules/contrib/cron.if
+@@ -1075,7 +1075,7 @@ interface(`cron_generic_log_filetrans_lo
  #
  interface(`cron_system_spool_entrypoint',`
  	gen_require(`
diff --git a/fix_init.patch b/fix_init.patch
index baf4749..29df1c9 100644
--- a/fix_init.patch
+++ b/fix_init.patch
@@ -1,17 +1,8 @@
-Index: fedora-policy-20220714/policy/modules/system/init.te
+Index: fedora-policy-20221019/policy/modules/system/init.te
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/system/init.te
-+++ fedora-policy-20220714/policy/modules/system/init.te
-@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
- # setuid (from /sbin/shutdown)
- # sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
- 
-+# bsc#1197610, find a better, generic solution
-+allow init_t self:file mounton;
- allow init_t self:fifo_file rw_fifo_file_perms;
- 
- allow init_t self:service manage_service_perms;
-@@ -267,6 +269,8 @@ corecmd_exec_bin(init_t)
+--- fedora-policy-20221019.orig/policy/modules/system/init.te
++++ fedora-policy-20221019/policy/modules/system/init.te
+@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t)
  corenet_all_recvfrom_netlabel(init_t)
  corenet_tcp_bind_all_ports(init_t)
  corenet_udp_bind_all_ports(init_t)
@@ -20,7 +11,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  
  dev_create_all_files(init_t)
  dev_create_all_chr_files(init_t)
-@@ -396,6 +400,7 @@ logging_manage_audit_config(init_t)
+@@ -398,6 +400,7 @@ logging_manage_audit_config(init_t)
  logging_create_syslog_netlink_audit_socket(init_t)
  logging_write_var_log_dirs(init_t)
  logging_manage_var_log_symlinks(init_t)
@@ -28,7 +19,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  
  seutil_read_config(init_t)
  seutil_read_login_config(init_t)
-@@ -448,9 +453,19 @@ ifdef(`distro_redhat',`
+@@ -450,9 +453,19 @@ ifdef(`distro_redhat',`
  corecmd_shell_domtrans(init_t, initrc_t)
  
  storage_raw_rw_fixed_disk(init_t)
@@ -48,7 +39,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  optional_policy(`
  	anaconda_stream_connect(init_t)
  	anaconda_create_unix_stream_sockets(init_t)
-@@ -581,10 +596,10 @@ tunable_policy(`init_audit_control',`
+@@ -584,10 +597,10 @@ tunable_policy(`init_audit_control',`
  allow init_t self:system all_system_perms;
  allow init_t self:system module_load;
  allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -61,7 +52,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  allow init_t self:netlink_selinux_socket create_socket_perms;
  allow init_t self:unix_dgram_socket lock;
  # Until systemd is fixed
-@@ -643,6 +658,7 @@ files_delete_all_spool_sockets(init_t)
+@@ -647,6 +660,7 @@ files_delete_all_spool_sockets(init_t)
  files_create_var_lib_dirs(init_t)
  files_create_var_lib_symlinks(init_t)
  files_read_var_lib_symlinks(init_t)
@@ -69,7 +60,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  files_manage_urandom_seed(init_t)
  files_list_locks(init_t)
  files_list_spool(init_t)
-@@ -680,7 +696,7 @@ fs_list_all(init_t)
+@@ -684,7 +698,7 @@ fs_list_all(init_t)
  fs_list_auto_mountpoints(init_t)
  fs_register_binary_executable_type(init_t)
  fs_relabel_tmpfs_sock_file(init_t)
@@ -78,7 +69,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  fs_relabel_cgroup_dirs(init_t)
  fs_search_cgroup_dirs(init_t)
  # for network namespaces
-@@ -736,6 +752,7 @@ systemd_write_inherited_logind_sessions_
+@@ -740,6 +754,7 @@ systemd_write_inherited_logind_sessions_
  create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
  
  create_dirs_pattern(init_t, var_log_t, var_log_t)
@@ -86,7 +77,7 @@ Index: fedora-policy-20220714/policy/modules/system/init.te
  
  auth_use_nsswitch(init_t)
  auth_rw_login_records(init_t)
-@@ -1590,6 +1607,8 @@ optional_policy(`
+@@ -1596,6 +1611,8 @@ optional_policy(`
  
  optional_policy(`
  	postfix_list_spool(initrc_t)
diff --git a/fix_kernel_sysctl.patch b/fix_kernel_sysctl.patch
index bd4527a..4769ca5 100644
--- a/fix_kernel_sysctl.patch
+++ b/fix_kernel_sysctl.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20220624/policy/modules/kernel/files.fc
+Index: fedora-policy-20221019/policy/modules/kernel/files.fc
 ===================================================================
---- fedora-policy-20220624.orig/policy/modules/kernel/files.fc
-+++ fedora-policy-20220624/policy/modules/kernel/files.fc
+--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
++++ fedora-policy-20221019/policy/modules/kernel/files.fc
 @@ -242,6 +242,8 @@ ifdef(`distro_redhat',`
  /usr/lib/ostree-boot(/.*)?                gen_context(system_u:object_r:usr_t,s0)
  /usr/lib/modules(/.*)/vmlinuz         -- 	gen_context(system_u:object_r:usr_t,s0)
@@ -11,11 +11,11 @@ Index: fedora-policy-20220624/policy/modules/kernel/files.fc
  
  /usr/doc(/.*)?/lib(/.*)?	gen_context(system_u:object_r:usr_t,s0)
  
-Index: fedora-policy-20220624/policy/modules/system/systemd.te
+Index: fedora-policy-20221019/policy/modules/system/systemd.te
 ===================================================================
---- fedora-policy-20220624.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20220624/policy/modules/system/systemd.te
-@@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t)
+--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
++++ fedora-policy-20221019/policy/modules/system/systemd.te
+@@ -1105,6 +1105,8 @@ init_stream_connect(systemd_sysctl_t)
  logging_send_syslog_msg(systemd_sysctl_t)
  
  systemd_read_efivarfs(systemd_sysctl_t)
diff --git a/fix_networkmanager.patch b/fix_networkmanager.patch
index 3553e85..91a7087 100644
--- a/fix_networkmanager.patch
+++ b/fix_networkmanager.patch
@@ -1,8 +1,8 @@
-Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te
+Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.te
-+++ fedora-policy-20220714/policy/modules/contrib/networkmanager.te
-@@ -276,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t
+--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.te
++++ fedora-policy-20221019/policy/modules/contrib/networkmanager.te
+@@ -275,6 +275,9 @@ userdom_read_home_certs(NetworkManager_t
  userdom_read_user_home_content_files(NetworkManager_t)
  userdom_dgram_send(NetworkManager_t)
  
@@ -12,7 +12,18 @@ Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te
  tunable_policy(`use_nfs_home_dirs',`
      fs_read_nfs_files(NetworkManager_t)
  ')
-@@ -293,6 +296,14 @@ optional_policy(`
+@@ -284,6 +287,10 @@ tunable_policy(`use_samba_home_dirs',`
+ ')
+ 
+ optional_policy(`
++    nis_systemctl_ypbind(NetworkManager_t)
++')
++
++optional_policy(`
+ 	avahi_domtrans(NetworkManager_t)
+ 	avahi_kill(NetworkManager_t)
+ 	avahi_signal(NetworkManager_t)
+@@ -292,6 +299,14 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -27,7 +38,7 @@ Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te
  	bind_domtrans(NetworkManager_t)
  	bind_manage_cache(NetworkManager_t)
  	bind_kill(NetworkManager_t)
-@@ -420,6 +431,8 @@ optional_policy(`
+@@ -419,6 +434,8 @@ optional_policy(`
  	nscd_kill(NetworkManager_t)
  	nscd_initrc_domtrans(NetworkManager_t)
  	nscd_systemctl(NetworkManager_t)
@@ -36,7 +47,7 @@ Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te
  ')
  
  optional_policy(`
-@@ -602,6 +615,7 @@ files_manage_etc_files(NetworkManager_di
+@@ -606,6 +623,7 @@ files_manage_etc_files(NetworkManager_di
  
  init_status(NetworkManager_dispatcher_cloud_t)
  init_status(NetworkManager_dispatcher_ddclient_t)
@@ -44,10 +55,21 @@ Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te
  init_append_stream_sockets(networkmanager_dispatcher_plugin)
  init_ioctl_stream_sockets(networkmanager_dispatcher_plugin)
  init_stream_connect(networkmanager_dispatcher_plugin)
-Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.if
+@@ -621,6 +639,10 @@ optional_policy(`
+ ')
+ 
+ optional_policy(`
++	nscd_shm_use(NetworkManager_dispatcher_chronyc_t)
++')
++
++optional_policy(`
+ 	cloudform_init_domtrans(NetworkManager_dispatcher_cloud_t)
+ ')
+ 
+Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.if
-+++ fedora-policy-20220714/policy/modules/contrib/networkmanager.if
+--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.if
++++ fedora-policy-20221019/policy/modules/contrib/networkmanager.if
 @@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
          init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
  ')
@@ -73,10 +95,10 @@ Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.if
  ########################################
  ## <summary>
  ##	Execute NetworkManager server in the NetworkManager domain.
-Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.fc
+Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.fc
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.fc
-+++ fedora-policy-20220714/policy/modules/contrib/networkmanager.fc
+--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.fc
++++ fedora-policy-20221019/policy/modules/contrib/networkmanager.fc
 @@ -24,6 +24,7 @@
  /usr/lib/NetworkManager/dispatcher\.d/04-iscsi	--	gen_context(system_u:object_r:NetworkManager_dispatcher_iscsid_script_t,s0)
  /usr/lib/NetworkManager/dispatcher\.d/10-sendmail	--	gen_context(system_u:object_r:NetworkManager_dispatcher_sendmail_script_t,s0)
diff --git a/fix_postfix.patch b/fix_postfix.patch
index e068681..9b7fb86 100644
--- a/fix_postfix.patch
+++ b/fix_postfix.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20220624/policy/modules/contrib/postfix.fc
+Index: fedora-policy-20221019/policy/modules/contrib/postfix.fc
 ===================================================================
---- fedora-policy-20220624.orig/policy/modules/contrib/postfix.fc
-+++ fedora-policy-20220624/policy/modules/contrib/postfix.fc
+--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.fc
++++ fedora-policy-20221019/policy/modules/contrib/postfix.fc
 @@ -1,37 +1,21 @@
  # postfix
 -/etc/rc\.d/init\.d/postfix    --  gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
@@ -75,11 +75,20 @@ Index: fedora-policy-20220624/policy/modules/contrib/postfix.fc
  /var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0)
  /var/spool/postfix/public(/.*)? gen_context(system_u:object_r:postfix_public_t,s0)
  /var/spool/postfix/bounce(/.*)? gen_context(system_u:object_r:postfix_spool_bounce_t,s0)
-Index: fedora-policy-20220624/policy/modules/contrib/postfix.te
+Index: fedora-policy-20221019/policy/modules/contrib/postfix.te
 ===================================================================
---- fedora-policy-20220624.orig/policy/modules/contrib/postfix.te
-+++ fedora-policy-20220624/policy/modules/contrib/postfix.te
-@@ -447,6 +447,14 @@ logging_send_syslog_msg(postfix_map_t)
+--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.te
++++ fedora-policy-20221019/policy/modules/contrib/postfix.te
+@@ -121,6 +121,8 @@ allow postfix_master_t self:udp_socket c
+ allow postfix_master_t postfix_etc_t:dir rw_dir_perms;
+ allow postfix_master_t postfix_etc_t:file rw_file_perms;
+ mta_filetrans_aliases(postfix_master_t, postfix_etc_t)
++# SUSE also runs this on /etc/alias
++mta_filetrans_aliases(postfix_master_t, etc_t)
+ 
+ can_exec(postfix_master_t, postfix_exec_t)
+ 
+@@ -447,6 +449,14 @@ logging_send_syslog_msg(postfix_map_t)
  
  userdom_use_inherited_user_ptys(postfix_map_t)
  
@@ -94,7 +103,7 @@ Index: fedora-policy-20220624/policy/modules/contrib/postfix.te
  optional_policy(`
  	locallogin_dontaudit_use_fds(postfix_map_t)
  ')
-@@ -687,6 +695,14 @@ corenet_tcp_connect_spamd_port(postfix_m
+@@ -687,6 +697,14 @@ corenet_tcp_connect_spamd_port(postfix_m
  files_search_all_mountpoints(postfix_smtp_t)
  
  optional_policy(`
diff --git a/fix_rpm.patch b/fix_rpm.patch
index e5d9b7c..67cf3c4 100644
--- a/fix_rpm.patch
+++ b/fix_rpm.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
+Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
 ===================================================================
---- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc
-+++ fedora-policy-20210628/policy/modules/contrib/rpm.fc
+--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc
++++ fedora-policy-20221019/policy/modules/contrib/rpm.fc
 @@ -18,6 +18,10 @@
  /usr/bin/repoquery		--	gen_context(system_u:object_r:rpm_exec_t,s0)		
  /usr/bin/zif 			--	gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -13,7 +13,7 @@ Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
  /usr/libexec/packagekitd	--	gen_context(system_u:object_r:rpm_exec_t,s0)
  /usr/libexec/yumDBUSBackend.py	--	gen_context(system_u:object_r:rpm_exec_t,s0)
  /usr/libexec/pegasus/pycmpiLMI_Software-cimprovagt  --  gen_context(system_u:object_r:rpm_exec_t,s0)
-@@ -55,6 +59,8 @@ ifdef(`distro_redhat', `
+@@ -56,6 +60,8 @@ ifdef(`distro_redhat', `
  /var/cache/yum(/.*)?			gen_context(system_u:object_r:rpm_var_cache_t,s0)
  /var/cache/dnf(/.*)?			gen_context(system_u:object_r:rpm_var_cache_t,s0)
  
@@ -22,11 +22,11 @@ Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
  /var/lib/alternatives(/.*)?		gen_context(system_u:object_r:rpm_var_lib_t,s0)
  /var/lib/PackageKit(/.*)?		gen_context(system_u:object_r:rpm_var_lib_t,s0)
  /var/lib/rpm(/.*)?			gen_context(system_u:object_r:rpm_var_lib_t,s0)
-Index: fedora-policy-20210628/policy/modules/contrib/rpm.if
+Index: fedora-policy-20221019/policy/modules/contrib/rpm.if
 ===================================================================
---- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if
-+++ fedora-policy-20210628/policy/modules/contrib/rpm.if
-@@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',`
+--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.if
++++ fedora-policy-20221019/policy/modules/contrib/rpm.if
+@@ -515,8 +515,10 @@ interface(`rpm_named_filetrans',`
  	logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
  	logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
  	logging_log_named_filetrans($1, rpm_log_t, file, "up2date")
@@ -37,11 +37,11 @@ Index: fedora-policy-20210628/policy/modules/contrib/rpm.if
  	files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
  	files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
  	files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
-Index: fedora-policy-20210628/policy/modules/kernel/files.fc
+Index: fedora-policy-20221019/policy/modules/kernel/files.fc
 ===================================================================
---- fedora-policy-20210628.orig/policy/modules/kernel/files.fc
-+++ fedora-policy-20210628/policy/modules/kernel/files.fc
-@@ -67,6 +67,7 @@ ifdef(`distro_suse',`
+--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
++++ fedora-policy-20221019/policy/modules/kernel/files.fc
+@@ -67,6 +67,7 @@ ifdef(`distro_redhat',`
  /etc/sysconfig/ipvsadm.*                --      gen_context(system_u:object_r:system_conf_t,s0)
  /etc/sysconfig/system-config-firewall.* --      gen_context(system_u:object_r:system_conf_t,s0)
  /etc/yum\.repos\.d(/.*)?                        gen_context(system_u:object_r:system_conf_t,s0)
diff --git a/fix_snapper.patch b/fix_snapper.patch
index e52343a..045bc12 100644
--- a/fix_snapper.patch
+++ b/fix_snapper.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy/policy/modules/contrib/snapper.te
+Index: fedora-policy-20221019/policy/modules/contrib/snapper.te
 ===================================================================
---- fedora-policy.orig/policy/modules/contrib/snapper.te
-+++ fedora-policy/policy/modules/contrib/snapper.te
+--- fedora-policy-20221019.orig/policy/modules/contrib/snapper.te
++++ fedora-policy-20221019/policy/modules/contrib/snapper.te
 @@ -18,6 +18,9 @@ files_config_file(snapperd_conf_t)
  type snapperd_data_t;
  files_type(snapperd_data_t)
@@ -23,21 +23,25 @@ Index: fedora-policy/policy/modules/contrib/snapper.te
  kernel_setsched(snapperd_t)
  
  domain_read_all_domains_state(snapperd_t)
-@@ -73,6 +80,10 @@ storage_raw_read_fixed_disk(snapperd_t)
+@@ -73,6 +80,14 @@ storage_raw_read_fixed_disk(snapperd_t)
  auth_use_nsswitch(snapperd_t)
  
  optional_policy(`
 +	packagekit_dbus_chat(snapperd_t)
 +')
 +
++optional_policy(`
++        rpm_dbus_chat(snapperd_t)
++')
++
 +optional_policy(`
      cron_system_entry(snapperd_t, snapperd_exec_t)
  ')
  
-Index: fedora-policy/policy/modules/contrib/snapper.fc
+Index: fedora-policy-20221019/policy/modules/contrib/snapper.fc
 ===================================================================
---- fedora-policy.orig/policy/modules/contrib/snapper.fc
-+++ fedora-policy/policy/modules/contrib/snapper.fc
+--- fedora-policy-20221019.orig/policy/modules/contrib/snapper.fc
++++ fedora-policy-20221019/policy/modules/contrib/snapper.fc
 @@ -7,9 +7,17 @@
  
  /var/log/snapper\.log.* --  gen_context(system_u:object_r:snapperd_log_t,s0)
diff --git a/fix_sysnetwork.patch b/fix_sysnetwork.patch
index 844d87f..b7f0b13 100644
--- a/fix_sysnetwork.patch
+++ b/fix_sysnetwork.patch
@@ -1,8 +1,8 @@
-Index: fedora-policy/policy/modules/system/sysnetwork.fc
+Index: fedora-policy-20221019/policy/modules/system/sysnetwork.fc
 ===================================================================
---- fedora-policy.orig/policy/modules/system/sysnetwork.fc
-+++ fedora-policy/policy/modules/system/sysnetwork.fc
-@@ -102,6 +102,8 @@ ifdef(`distro_debian',`
+--- fedora-policy-20221019.orig/policy/modules/system/sysnetwork.fc
++++ fedora-policy-20221019/policy/modules/system/sysnetwork.fc
+@@ -103,6 +103,8 @@ ifdef(`distro_debian',`
  /var/run/network(/.*)?	gen_context(system_u:object_r:net_conf_t,s0)
  ')
  
diff --git a/fix_systemd.patch b/fix_systemd.patch
index 867f7e0..1576754 100644
--- a/fix_systemd.patch
+++ b/fix_systemd.patch
@@ -1,8 +1,8 @@
-Index: fedora-policy-20220624/policy/modules/system/systemd.te
+Index: fedora-policy-20221019/policy/modules/system/systemd.te
 ===================================================================
---- fedora-policy-20220624.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20220624/policy/modules/system/systemd.te
-@@ -355,6 +355,10 @@ userdom_manage_user_tmp_chr_files(system
+--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
++++ fedora-policy-20221019/policy/modules/system/systemd.te
+@@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system
  xserver_dbus_chat(systemd_logind_t)
  
  optional_policy(`
@@ -13,8 +13,8 @@ Index: fedora-policy-20220624/policy/modules/system/systemd.te
  	apache_read_tmp_files(systemd_logind_t)
  ')
  
-@@ -882,6 +886,10 @@ optional_policy(`
- 	udev_read_pid_files(systemd_hostnamed_t)
+@@ -863,6 +867,10 @@ optional_policy(`
+ 	dbus_system_bus_client(systemd_localed_t)
  ')
  
 +optional_policy(`
@@ -23,8 +23,8 @@ Index: fedora-policy-20220624/policy/modules/system/systemd.te
 +
  #######################################
  #
- # rfkill policy
-@@ -1105,7 +1113,7 @@ systemd_read_efivarfs(systemd_hwdb_t)
+ # Hostnamed policy
+@@ -1158,7 +1166,7 @@ systemd_read_efivarfs(systemd_hwdb_t)
  # systemd_gpt_generator domain
  #
  
@@ -33,7 +33,7 @@ Index: fedora-policy-20220624/policy/modules/system/systemd.te
  allow systemd_gpt_generator_t self:netlink_kobject_uevent_socket create_socket_perms;
  
  dev_read_sysfs(systemd_gpt_generator_t)
-@@ -1127,6 +1135,8 @@ systemd_unit_file_filetrans(systemd_gpt_
+@@ -1185,6 +1193,8 @@ systemd_unit_file_filetrans(systemd_gpt_
  systemd_create_unit_file_dirs(systemd_gpt_generator_t)
  systemd_create_unit_file_lnk(systemd_gpt_generator_t)
  
diff --git a/fix_systemd_watch.patch b/fix_systemd_watch.patch
index 9c5f4ad..530f381 100644
--- a/fix_systemd_watch.patch
+++ b/fix_systemd_watch.patch
@@ -1,8 +1,8 @@
-Index: fedora-policy-20220714/policy/modules/system/systemd.te
+Index: fedora-policy-20221019/policy/modules/system/systemd.te
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20220714/policy/modules/system/systemd.te
-@@ -1447,6 +1447,12 @@ fstools_rw_swap_files(systemd_sleep_t)
+--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
++++ fedora-policy-20221019/policy/modules/system/systemd.te
+@@ -1508,6 +1508,12 @@ fstools_rw_swap_files(systemd_sleep_t)
  storage_getattr_fixed_disk_dev(systemd_sleep_t)
  storage_getattr_removable_dev(systemd_sleep_t)
  
diff --git a/fix_unconfined.patch b/fix_unconfined.patch
index a9b5b32..815055b 100644
--- a/fix_unconfined.patch
+++ b/fix_unconfined.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20211111/policy/modules/system/unconfined.te
+Index: fedora-policy-20221019/policy/modules/system/unconfined.te
 ===================================================================
---- fedora-policy-20211111.orig/policy/modules/system/unconfined.te
-+++ fedora-policy-20211111/policy/modules/system/unconfined.te
+--- fedora-policy-20221019.orig/policy/modules/system/unconfined.te
++++ fedora-policy-20221019/policy/modules/system/unconfined.te
 @@ -1,5 +1,10 @@
  policy_module(unconfined, 3.5.0)
  
@@ -13,7 +13,7 @@ Index: fedora-policy-20211111/policy/modules/system/unconfined.te
  ########################################
  #
  # Declarations
-@@ -39,3 +44,6 @@ optional_policy(`
+@@ -45,3 +50,6 @@ optional_policy(`
  optional_policy(`
  	container_runtime_domtrans(unconfined_service_t)
  ')
diff --git a/fix_unconfineduser.patch b/fix_unconfineduser.patch
index 82632fe..017c8f7 100644
--- a/fix_unconfineduser.patch
+++ b/fix_unconfineduser.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te
+Index: fedora-policy-20221019/policy/modules/roles/unconfineduser.te
 ===================================================================
---- fedora-policy-20220509.orig/policy/modules/roles/unconfineduser.te
-+++ fedora-policy-20220509/policy/modules/roles/unconfineduser.te
+--- fedora-policy-20221019.orig/policy/modules/roles/unconfineduser.te
++++ fedora-policy-20221019/policy/modules/roles/unconfineduser.te
 @@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all'
      domain_dyntrans(unconfined_t)
  ')
@@ -14,7 +14,7 @@ Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te
  optional_policy(`
  	gen_require(`
  		type unconfined_t;
-@@ -210,6 +215,10 @@ optional_policy(`
+@@ -214,6 +219,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -25,7 +25,7 @@ Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te
  	chrome_role_notrans(unconfined_r, unconfined_t)
  
  	tunable_policy(`unconfined_chrome_sandbox_transition',`
-@@ -244,6 +253,18 @@ optional_policy(`
+@@ -248,6 +257,18 @@ optional_policy(`
  	dbus_stub(unconfined_t)
  
  	optional_policy(`
diff --git a/fix_unprivuser.patch b/fix_unprivuser.patch
index 646fcde..70fe21e 100644
--- a/fix_unprivuser.patch
+++ b/fix_unprivuser.patch
@@ -1,8 +1,8 @@
-Index: fedora-policy-20220624/policy/modules/roles/unprivuser.te
+Index: fedora-policy-20221019/policy/modules/roles/unprivuser.te
 ===================================================================
---- fedora-policy-20220624.orig/policy/modules/roles/unprivuser.te
-+++ fedora-policy-20220624/policy/modules/roles/unprivuser.te
-@@ -296,6 +296,13 @@ ifndef(`distro_redhat',`
+--- fedora-policy-20221019.orig/policy/modules/roles/unprivuser.te
++++ fedora-policy-20221019/policy/modules/roles/unprivuser.te
+@@ -300,6 +300,13 @@ ifndef(`distro_redhat',`
  ')
  
  optional_policy(`
diff --git a/fix_xserver.patch b/fix_xserver.patch
index f969707..a8fd6e8 100644
--- a/fix_xserver.patch
+++ b/fix_xserver.patch
@@ -1,7 +1,7 @@
-Index: fedora-policy-20220714/policy/modules/services/xserver.fc
+Index: fedora-policy-20221019/policy/modules/services/xserver.fc
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/services/xserver.fc
-+++ fedora-policy-20220714/policy/modules/services/xserver.fc
+--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
++++ fedora-policy-20221019/policy/modules/services/xserver.fc
 @@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.*	--	gen_context(system_
  /etc/X11/[wxg]dm/Xsession --	gen_context(system_u:object_r:xsession_exec_t,s0)
  /etc/X11/wdm(/.*)?		gen_context(system_u:object_r:xdm_rw_etc_t,s0)
@@ -51,13 +51,13 @@ Index: fedora-policy-20220714/policy/modules/services/xserver.fc
  
  /var/run/video.rom	--	gen_context(system_u:object_r:xserver_var_run_t,s0)
  /var/run/xorg(/.*)?		gen_context(system_u:object_r:xserver_var_run_t,s0)
-Index: fedora-policy-20220714/policy/modules/services/xserver.te
+Index: fedora-policy-20221019/policy/modules/services/xserver.te
 ===================================================================
---- fedora-policy-20220714.orig/policy/modules/services/xserver.te
-+++ fedora-policy-20220714/policy/modules/services/xserver.te
-@@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x
- userdom_signull_unpriv_users(xdm_t)
- userdom_dontaudit_read_admin_home_lnk_files(xdm_t)
+--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
++++ fedora-policy-20221019/policy/modules/services/xserver.te
+@@ -475,6 +475,10 @@ userdom_dontaudit_read_admin_home_lnk_fi
+ 
+ kernel_read_vm_sysctls(xdm_t)
  
 +files_manage_generic_pids_symlinks(xdm_t)
 +userdom_manage_user_home_content_dirs(xdm_t)
diff --git a/modules-minimum-contrib.conf b/modules-minimum-contrib.conf
index 1be2194..cde391b 100644
--- a/modules-minimum-contrib.conf
+++ b/modules-minimum-contrib.conf
@@ -342,13 +342,6 @@ cmirrord = module
 # 
 cobbler = module
 
-# Layer: contrib
-# Module: cockpit
-#
-# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines.
-# 
-cockpit = module
-
 # Layer: services
 # Module: collectd
 #
@@ -2367,13 +2360,6 @@ minissdpd = module
 #
 freeipmi = module
 
-# Layer: contrib
-# Module: freeipmi
-# 
-# ipa policy module contain SELinux policies for IPA services
-#
-ipa = module
-
 # Layer: contrib
 # Module: mirrormanager
 # 
diff --git a/modules-targeted-contrib.conf b/modules-targeted-contrib.conf
index 9182671..54a2b38 100644
--- a/modules-targeted-contrib.conf
+++ b/modules-targeted-contrib.conf
@@ -342,13 +342,6 @@ cmirrord = module
 # 
 cobbler = module
 
-# Layer: contrib
-# Module: cockpit
-#
-# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines.
-# 
-cockpit = module
-
 # Layer: services
 # Module: collectd
 #
@@ -2381,13 +2374,6 @@ minissdpd = module
 #
 freeipmi = module
 
-# Layer: contrib
-# Module: freeipmi
-# 
-# ipa policy module contain SELinux policies for IPA services
-#
-ipa = module
-
 # Layer: contrib
 # Module: mirrormanager
 # 
diff --git a/selinux-policy.changes b/selinux-policy.changes
index adcc217..66c1d72 100644
--- a/selinux-policy.changes
+++ b/selinux-policy.changes
@@ -1,3 +1,31 @@
+-------------------------------------------------------------------
+Wed Oct 19 11:45:57 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
+
+- Update to version 20221019. Refreshed:
+  * distro_suse_to_distro_redhat.patch
+  * fix_apache.patch
+  * fix_chronyd.patch
+  * fix_cron.patch
+  * fix_init.patch
+  * fix_kernel_sysctl.patch
+  * fix_networkmanager.patch
+  * fix_rpm.patch
+  * fix_sysnetwork.patch
+  * fix_systemd.patch
+  * fix_systemd_watch.patch
+  * fix_unconfined.patch
+  * fix_unconfineduser.patch
+  * fix_unprivuser.patch
+  * fix_xserver.patch
+- Dropped fix_cockpit.patch as this is now packaged with cockpit itself
+- Remove the ipa module, freeip ships their own module
+- Added fix_alsa.patch to allow reading of config files in home directories
+- Extended fix_networkmanager.patch and fix_postfix.patch to account
+  for SUSE systems
+- Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc
+  queries the running processes
+- Updated fix_snapper.patch to allow snapper to talk to rpm via dbus
+
 -------------------------------------------------------------------
 Fri Sep 30 07:14:49 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
 
diff --git a/selinux-policy.spec b/selinux-policy.spec
index eb4bf37..5da319d 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -33,7 +33,7 @@ Summary:        SELinux policy configuration
 License:        GPL-2.0-or-later
 Group:          System/Management
 Name:           selinux-policy
-Version:        20220714
+Version:        20221019
 Release:        0
 Source:         fedora-policy-%{version}.tar.bz2
 Source1:        selinux-policy-rpmlintrc
@@ -132,7 +132,7 @@ Patch049:       fix_nis.patch
 Patch050:       fix_libraries.patch
 Patch051:       fix_dovecot.patch
 # https://github.com/cockpit-project/cockpit/pull/15758
-Patch052:       fix_cockpit.patch
+#Patch052:       fix_cockpit.patch
 Patch053:       fix_systemd_watch.patch
 # kernel specific sysctl.conf (boo#1184804)
 Patch054:       fix_kernel_sysctl.patch
@@ -144,6 +144,8 @@ Patch059:       systemd_domain_dyntrans_type.patch
 Patch060:       fix_dnsmasq.patch
 Patch061:       fix_userdomain.patch
 Patch062:       fix_cloudform.patch
+Patch063:       fix_alsa.patch
+Patch064:       dontaudit_interface_kmod_tmpfs.patch
 
 Patch100:       sedoctool.patch