Index: refpolicy-2.20260801/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20260801/policy/modules/system/systemd.if
@@ -60,7 +60,7 @@ template(`systemd_role_template',`
 	# This domain is per-role because of the below transitions.
 	# See the systemd --user section of systemd.te for the
 	# remainder of the rules.
-	allow $1_systemd_t self:process { getsched signal };
+	allow $1_systemd_t self:process { getsched signal signull };
 	allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
 	allow $1_systemd_t self:netlink_route_socket r_netlink_socket_perms;
 	allow $1_systemd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -68,10 +68,18 @@ template(`systemd_role_template',`
 	allow $1_systemd_t $3:process { rlimitinh setsched signal_perms };
 	corecmd_shell_domtrans($1_systemd_t, $3)
 	corecmd_bin_domtrans($1_systemd_t, $3)
+	allow $1_systemd_t $3:process noatsecure;
+	allow $1_systemd_t $3:process2 nnp_transition;
+	ps_process_pattern($3, $1_systemd_t)
+	allow $1_systemd_t self:unix_dgram_socket sendto;
+	allow $1_systemd_t self:netlink_route_socket { bind create getattr getopt nlmsg_read read setopt write };
 
 	allow $3 $1_systemd_t:dbus send_msg;
 	allow $1_systemd_t $3:dbus send_msg;
 
+	# for gnome-session-binary
+	allow $3 $1_systemd_t:unix_dgram_socket sendto;
+
 	# systemctl --user rules
 	allow $1_systemd_t systemd_user_unix_stream_activated_socket_type:unix_stream_socket { create_socket_perms listen };
 	allow $1_systemd_t systemd_user_activated_sock_file_type:dir manage_dir_perms;
@@ -97,13 +105,34 @@ template(`systemd_role_template',`
 	allow $1_systemd_t $3:file read_file_perms;
 	allow $1_systemd_t $3:lnk_file read_lnk_file_perms;
 
+	allow $1_systemd_t $3:unix_stream_socket { connectto getattr accept getopt read };
+
+	dev_getattr_fs($1_systemd_t)
 	dev_getattr_sound_dev($1_systemd_t)
 	dev_read_urand($1_systemd_t)
+
+
+	# for systemd-run
+	userdom_use_inherited_user_terminals($1_systemd_t)
+	allow $1_systemd_t $3:fd use;
+
+	clock_read_adjtime($1_systemd_t)
+
 	storage_getattr_removable_dev($1_systemd_t)
 	term_dontaudit_getattr_unallocated_ttys($1_systemd_t)
+	term_getattr_pty_dirs($1_systemd_t)
+	term_getattr_pty_fs($1_systemd_t)
 
-	files_search_home($1_systemd_t)
+	files_exec_usr_files($1_systemd_t)
+	files_read_usr_files($1_systemd_t)
+	files_list_home($1_systemd_t)
+	files_watch_home($1_systemd_t)
 	files_watch_etc_dirs($1_systemd_t)
+	files_watch_root_dirs($1_systemd_t)
+	files_list_var($1_systemd_t)
+	files_watch_var_dirs($1_systemd_t)
+	files_list_var_lib($1_systemd_t)
+	files_watch_var_lib_dirs($1_systemd_t)
 
 	fs_getattr_xattr_fs($1_systemd_t)
 	fs_getattr_nsfs_files($1_systemd_t)
@@ -111,7 +140,9 @@ template(`systemd_role_template',`
 	fs_watch_cgroup_files($1_systemd_t)
 
 	kernel_dontaudit_getattr_proc($1_systemd_t)
+	kernel_getattr_proc($1_systemd_t)
 	kernel_read_psi($1_systemd_t)
+	kernel_read_network_state_symlinks($1_systemd_t)
 
 	# if systemd exists in the initrd, the journal socket stays labeled kernel_t
 	# without this access, user services cannot log to the journal
@@ -125,12 +156,23 @@ template(`systemd_role_template',`
 	# container engines will move container processes to different slices
 	init_dbus_chat($1_systemd_t)
 
+	# for services run by init such as /run/systemd/oom/io.system.ManagedOOM
+	init_unix_stream_socket_connectto($1_systemd_t)
+
 	# the user@.service unit is restarted when containers are created
 	systemd_get_user_manager_units_status($1_systemd_t)
 	systemd_start_user_manager_units($1_systemd_t)
 	systemd_stop_user_manager_units($1_systemd_t)
 	systemd_reload_user_manager_units($1_systemd_t)
 
+	systemd_list_userdb_runtime_dirs($1_systemd_t)
+	systemd_stream_connect_homed($1_systemd_t)
+
+	# for wireplumber
+	systemd_read_logind_runtime_files($3)
+	systemd_watch_logind_runtime_dirs($3)
+
+	miscfiles_read_fonts($1_systemd_t)
 	miscfiles_watch_localization($1_systemd_t)
 
 	mount_read_runtime_files($1_systemd_t)
@@ -140,12 +182,18 @@ template(`systemd_role_template',`
 	seutil_search_default_contexts($1_systemd_t)
 	seutil_read_file_contexts($1_systemd_t)
 
+	userdom_list_user_home_dirs($1_systemd_t)
+	userdom_watch_user_home_dirs($1_systemd_t)
+	userdom_list_user_home_content($1_systemd_t)
+	userdom_write_user_tmp_sockets($1_systemd_t)
+
 	systemd_manage_conf_home_content($1_systemd_t)
 	systemd_manage_data_home_content($1_systemd_t)
 
 	systemd_search_user_runtime_unit_dirs($1_systemd_t)
 	systemd_search_user_transient_unit_dirs($1_systemd_t)
 	systemd_read_user_units_files($1_systemd_t)
+	systemd_read_logind_state($1_systemd_t)
 	systemd_write_notify_socket($1_systemd_t)
 
 	dbus_system_bus_client($1_systemd_t)
@@ -153,6 +201,7 @@ template(`systemd_role_template',`
 	dbus_connect_spec_session_bus($1, $1_systemd_t)
 
 	userdom_exec_user_bin_files($1_systemd_t)
+	userdom_list_user_tmp($1_systemd_t)
 
 	# user systemd-tmpfiles rules
 	allow $1_systemd_tmpfiles_t self:process setfscreate;
@@ -202,6 +251,7 @@ template(`systemd_role_template',`
 	systemd_dbus_chat_machined($3)
 
 	allow $3 systemd_user_runtime_notify_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
+	allow $1_systemd_t systemd_user_runtime_notify_t:sock_file unlink;
 
 	allow $3 systemd_user_unit_t:service { reload start status stop };
 	allow $3 systemd_conf_home_t:service { reload start status stop };
@@ -244,6 +294,14 @@ template(`systemd_role_template',`
 	')
 
 	optional_policy(`
+		bluetooth_dbus_chat($1_systemd_t)
+	')
+
+	optional_policy(`
+		dirmngr_tmp_dir_search($1_systemd_t)
+	')
+
+	optional_policy(`
 		gpg_stream_connect_agent($1_systemd_t)
 	')
 
@@ -252,8 +310,13 @@ template(`systemd_role_template',`
 	')
 
 	optional_policy(`
+		obex_role_template($1, $1_r, $1_systemd_t)
+	')
+
+	optional_policy(`
 		pulseaudio_domtrans($1_systemd_t)
 		pulseaudio_manage_tmp_dirs($1_systemd_t)
+		pulseaudio_stream_connect($1_systemd_t)
 	')
 
 	optional_policy(`
@@ -267,6 +330,7 @@ template(`systemd_role_template',`
 		xdg_read_cache_files($1_systemd_t)
 		xdg_read_config_files($1_systemd_t)
 		xdg_read_data_files($1_systemd_t)
+		xdg_watch_cache_dirs($1_systemd_t)
 	')
 
 	ifelse(`$1', sysadm, `
@@ -384,6 +448,25 @@ interface(`systemd_write_notify_socket',
 	allow $1 systemd_runtime_notify_t:sock_file write_sock_file_perms;
 ')
 
+#######################################
+## <summary>
+##  Allow the specified domain to stat the
+##  systemd-notify socket
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_getattr_notify_socket',`
+	gen_require(`
+		type systemd_runtime_notify_t;
+	')
+
+	allow $1 systemd_runtime_notify_t:sock_file getattr;
+')
+
 ######################################
 ## <summary>
 ##	Allow the target domain the permissions necessary
@@ -415,6 +498,29 @@ template(`systemd_user_send_systemd_noti
 
 ######################################
 ## <summary>
+##   Allow the target domain to have unix stream sockets created for it
+## </summary>
+## <param name="prefix">
+##	<summary>
+##	Prefix for the user domain.
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain to allow the systemd user instance to monitor.
+##	</summary>
+## </param>
+#
+template(`systemd_user_create_unix_stream_socket',`
+	gen_require(`
+		type $1_systemd_t;
+	')
+
+	allow $1_systemd_t $2:unix_stream_socket { create setopt bind listen };
+')
+
+######################################
+## <summary>
 ##   Allow the target domain to be monitored and have its output
 ##   captured by the specified systemd user instance domain.
 ## </summary>
@@ -3135,6 +3241,83 @@ interface(`systemd_status_all_user_sessi
 
 ########################################
 ## <summary>
+##    allow systemd --user to create stream sockets for a process
+## </summary>
+## <param name="domain">
+##    <summary>
+##    Domain to own the socket
+##    </summary>
+## </param>
+#
+interface(`systemd_user_sessions_create_stream_socket',`
+	gen_require(`
+		attribute systemd_user_session_type;
+	')
+
+	allow systemd_user_session_type $1:unix_stream_socket { create setopt bind listen };
+')
+
+########################################
+## <summary>
+##    allow systemd --user to create stream socket file
+## </summary>
+## <param name="type">
+##    <summary>
+##    type of the socket file
+##    </summary>
+## </param>
+#
+interface(`systemd_user_sessions_create_sock_file',`
+	gen_require(`
+		attribute systemd_user_session_type;
+	')
+
+	allow systemd_user_session_type $1:sock_file { create getattr write };
+')
+
+########################################
+## <summary>
+##    allow systemd --user to manage stream socket file
+## </summary>
+## <param name="type">
+##    <summary>
+##    type of the socket file
+##    </summary>
+## </param>
+#
+interface(`systemd_user_sessions_manage_sock_file',`
+	gen_require(`
+		attribute systemd_user_session_type;
+	')
+
+	allow systemd_user_session_type $1:sock_file manage_sock_file_perms;
+')
+
+########################################
+## <summary>
+##    Unlink user runtime entries
+## </summary>
+## <param name="type">
+##    <summary>
+##    Type to unlink
+##    </summary>
+## </param>
+## <param name="class">
+##    <summary>
+##    class to unlink
+##    </summary>
+## </param>
+#
+interface(`systemd_user_runtime_dir_unlink',`
+	gen_require(`
+		type systemd_user_runtime_dir_t;
+	')
+
+	allow systemd_user_runtime_dir_t $1:$2 unlink;
+')
+
+########################################
+## <summary>
 ##  Execute systemd-sysusers in the
 ##  systemd sysusers domain.
 ## </summary>
@@ -3197,3 +3380,91 @@ interface(`systemd_use_inherited_machine
 	allow $1 systemd_machined_t:fd use;
 	allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
 ')
+
+########################################
+## <summary>
+##  run systemd-nspawn in systemd_nspawn_t domain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##      <summary>
+##      The role  of the object to create.
+##      </summary>
+## </param>
+## <param name="boolean">
+##      <summary>
+##      boolean to allow this
+##      </summary>
+## </param>
+#
+interface(`systemd_run_nspawn', `
+	gen_require(`
+		type systemd_nspawn_t, systemd_nspawn_exec_t;
+	')
+
+	role $2 types systemd_nspawn_t;
+	tunable_policy(`$3', `
+		domtrans_pattern($1, systemd_nspawn_exec_t, systemd_nspawn_t)
+	')
+')
+
+########################################
+## <summary>
+##  run backlighthelper in systemd_backlight_t domain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_run_backlight', `
+	gen_require(`
+		type systemd_nspawn_t, systemd_nspawn_exec_t;
+	')
+
+	domtrans_pattern($1, systemd_backlight_exec_t, systemd_backlight_t)
+')
+
+########################################
+## <summary>
+##   Send and receive messages from
+##   systemd backlight over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_dbus_chat_backlight',`
+	gen_require(`
+		type systemd_backlight_t;
+		class dbus send_msg;
+	')
+
+	allow $1 systemd_backlight_t:dbus send_msg;
+	allow systemd_backlight_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##  send datagrams to systemd_nspawn_t
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_dgram_nspawn', `
+	gen_require(`
+		type systemd_nspawn_t, systemd_nspawn_var_run_t;
+	')
+
+	dgram_send_pattern($1, systemd_nspawn_var_run_t, systemd_nspawn_var_run_t, systemd_nspawn_t)
+')
Index: refpolicy-2.20260801/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20260801/policy/modules/system/systemd.te
@@ -424,6 +424,7 @@ userdom_use_inherited_user_terminals(sys
 #
 
 allow systemd_backlight_t self:unix_dgram_socket { connect connected_socket_perms };
+allow systemd_backlight_t self:process { getsched };
 
 allow systemd_backlight_t systemd_backlight_var_lib_t:dir manage_dir_perms;
 init_var_lib_filetrans(systemd_backlight_t, systemd_backlight_var_lib_t, dir)
@@ -565,7 +566,7 @@ files_search_var_lib(systemd_coredump_t)
 files_mounton_root(systemd_coredump_t)
 
 fs_getattr_all_fs(systemd_coredump_t)
-fs_getattr_nsfs_files(systemd_coredump_t)
+fs_read_nsfs_files(systemd_coredump_t)
 fs_list_cgroup_dirs(systemd_coredump_t)
 fs_search_tmpfs(systemd_coredump_t)
 fs_read_nsfs_files(systemd_coredump_t)
@@ -1193,6 +1194,8 @@ userdom_delete_user_tmp_symlinks(systemd
 userdom_delete_user_tmp_named_pipes(systemd_logind_t)
 userdom_delete_user_tmp_named_sockets(systemd_logind_t)
 userdom_delete_user_tmpfs_files(systemd_logind_t)
+userdom_destroy_all_users_sem(systemd_logind_t)
+userdom_destroy_all_users_shm(systemd_logind_t)
 
 # user_tmp_t is for the dbus-1 directory
 userdom_list_user_tmp(systemd_logind_t)
@@ -1369,6 +1372,7 @@ optional_policy(`
 
 dontaudit systemd_machine_id_setup_t self:capability net_admin;
 allow systemd_machine_id_setup_t self:capability { dac_override setgid sys_admin sys_chroot };
+allow systemd_machine_id_setup_t self:process getcap;
 allow systemd_machine_id_setup_t self:unix_dgram_socket create;
 
 allow systemd_machine_id_setup_t self:unix_dgram_socket { connect getopt setopt };
@@ -1378,6 +1382,8 @@ files_mounton_root(systemd_machine_id_se
 files_rw_etc_runtime_files(systemd_machine_id_setup_t)
 
 fs_getattr_cgroup(systemd_machine_id_setup_t)
+fs_getattr_nsfs(systemd_machine_id_setup_t)
+fs_getattr_xattr_fs(systemd_machine_id_setup_t)
 fs_search_cgroup_dirs(systemd_machine_id_setup_t)
 fs_getattr_tmpfs(systemd_machine_id_setup_t)
 fs_read_nsfs_files(systemd_machine_id_setup_t)
@@ -1398,6 +1404,10 @@ optional_policy(`
 	policykit_dbus_chat(systemd_machined_t)
 ')
 
+optional_policy(`
+	policykit_dbus_chat(systemd_machined_t)
+')
+
 ########################################
 #
 # modules-load local policy
@@ -1967,6 +1977,7 @@ dev_read_sysfs(systemd_resolved_t)
 
 kernel_read_kernel_sysctls(systemd_resolved_t)
 kernel_read_net_sysctls(systemd_resolved_t)
+kernel_read_network_state_symlinks(systemd_resolved_t)
 kernel_dontaudit_getattr_proc(systemd_resolved_t)
 
 corenet_tcp_bind_generic_node(systemd_resolved_t)
@@ -2252,6 +2263,7 @@ init_read_state(systemd_tmpfiles_t)
 init_relabel_utmp(systemd_tmpfiles_t)
 init_relabel_var_lib_dirs(systemd_tmpfiles_t)
 init_read_runtime_files(systemd_tmpfiles_t)
+init_stream_connect(systemd_tmpfiles_t)
 
 kernel_relabelfrom_unlabeled_dirs(systemd_tmpfiles_t)
 kernel_relabelfrom_unlabeled_files(systemd_tmpfiles_t)
@@ -2507,6 +2519,8 @@ fs_search_cgroup_dirs(systemd_user_runti
 fs_getattr_xattr_fs(systemd_user_runtime_dir_t)
 fs_getattr_nsfs_files(systemd_user_runtime_dir_t)
 
+init_unix_stream_socket_connectto(systemd_user_runtime_dir_t)
+
 kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
 kernel_getattr_proc(systemd_user_runtime_dir_t)
 
@@ -2514,6 +2528,7 @@ selinux_use_status_page(systemd_user_run
 
 systemd_log_parse_environment(systemd_user_runtime_dir_t)
 systemd_dbus_chat_logind(systemd_user_runtime_dir_t)
+systemd_stream_connect_homed(systemd_user_runtime_dir_t)
 
 seutil_read_file_contexts(systemd_user_runtime_dir_t)
 seutil_libselinux_linked(systemd_user_runtime_dir_t)
Index: refpolicy-2.20260801/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20260801/policy/modules/roles/sysadm.te
@@ -24,6 +24,13 @@ gen_tunable(allow_ptrace, false)
 ## </desc>
 gen_tunable(sysadm_allow_rw_inherited_fifo, false)
 
+## <desc>
+## <p>
+## Allow sysadm to run systemd-nspawn directly
+## </p>
+## </desc>
+gen_tunable(sysadm_run_nspawn, false)
+
 #role sysadm_r;
 
 userdom_admin_user_template(sysadm)
@@ -123,6 +130,10 @@ ifdef(`init_systemd',`
 	systemd_dbus_chat_networkd(sysadm_t)
 	fs_read_nsfs_files(sysadm_t)
 
+	systemd_run_nspawn(sysadm_t, sysadm_r, sysadm_run_nspawn)
+	systemd_run_passwd_agent(sysadm_t, sysadm_r)
+	systemd_watch_passwd_runtime_dirs(sysadm_t)
+
 	# Allow sysadm to follow logs in the journal, i.e. with podman logs -f
 	systemd_watch_journal_dirs(sysadm_t)
 ')
Index: refpolicy-2.20260801/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20260801/policy/modules/services/devicekit.te
@@ -202,6 +202,12 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_read_logind_sessions_files(devicekit_disk_t)
+	systemd_use_logind_fds(devicekit_disk_t)
+	systemd_write_inherited_logind_inhibit_pipes(devicekit_disk_t)
+')
+
+optional_policy(`
 	udev_domtrans_udevadm(devicekit_disk_t)
 	udev_read_runtime_files(devicekit_disk_t)
 ')
Index: refpolicy-2.20260801/policy/modules/services/ssh.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/ssh.te
+++ refpolicy-2.20260801/policy/modules/services/ssh.te
@@ -192,6 +192,11 @@ tunable_policy(`allow_ssh_keysign',`
 	domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
 ')
 
+ifdef(`init_systemd',`
+	systemd_user_runtime_dir_unlink(ssh_agent_tmp_t, sock_file)
+	systemd_user_sessions_manage_sock_file(ssh_agent_tmp_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(ssh_t)
 	fs_manage_nfs_files(ssh_t)
@@ -289,7 +294,11 @@ ifdef(`init_systemd',`
 	# dynamic users
 	init_stream_connect(sshd_t)
 	init_rw_stream_sockets(sshd_t)
+	systemd_connectto_logind(sshd_t)
+	systemd_dgram_nspawn(sshd_t)
 	systemd_write_inherited_logind_sessions_pipes(sshd_t)
+	systemd_link_all_user_keys(sshd_t)
+	systemd_search_all_user_keys(sshd_t)
 
 	optional_policy(`
 		auth_use_pam_systemd(sshd_t)
@@ -395,6 +404,7 @@ logging_send_syslog_msg(ssh_keygen_t)
 
 miscfiles_read_localization(ssh_keygen_t)
 
+userdom_manage_all_users_keys(sshd_t)
 userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
 
 optional_policy(`
Index: refpolicy-2.20260801/policy/modules/services/dirmngr.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/dirmngr.if
+++ refpolicy-2.20260801/policy/modules/services/dirmngr.if
@@ -130,6 +130,24 @@ interface(`dirmngr_stream_connect',`
 
 ########################################
 ## <summary>
+##	Search dirmngr_tmp_t dirs
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dirmngr_tmp_dir_search',`
+	gen_require(`
+		type dirmngr_tmp_t;
+	')
+
+	allow $1 dirmngr_tmp_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
 ##	All of the rules required to
 ##	administrate an dirmngr environment.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/system/logging.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/logging.te
+++ refpolicy-2.20260801/policy/modules/system/logging.te
@@ -420,6 +420,7 @@ allow syslogd_t syslog_conf_t:dir list_d
 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
 files_runtime_filetrans(syslogd_t, devlog_t, sock_file)
 init_runtime_filetrans(syslogd_t, devlog_t, sock_file, "dev-log")
+filetrans_pattern(syslogd_t, syslogd_runtime_t, devlog_t, sock_file, "io.systemd.journal")
 
 # create/append log files.
 manage_files_pattern(syslogd_t, var_log_t, var_log_t)
@@ -556,6 +557,8 @@ ifdef(`init_systemd',`
 	logging_send_syslog_msg(syslogd_t)
 
 	systemd_manage_journal_files(syslogd_t)
+	systemd_read_logind_sessions_files(syslogd_t)
+	systemd_search_user_runtime(syslogd_t)
 	systemd_watch_journal_dirs(syslogd_t)
 	systemd_relabelfrom_journal_files(syslogd_t)
 	systemd_relabelto_journal_files(syslogd_t)
Index: refpolicy-2.20260801/policy/modules/kernel/terminal.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/terminal.if
+++ refpolicy-2.20260801/policy/modules/kernel/terminal.if
@@ -320,6 +320,24 @@ interface(`term_write_console',`
 
 ########################################
 ## <summary>
+##	watch reads on console device
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`term_watch_reads_console',`
+	gen_require(`
+		type console_device_t;
+	')
+
+	allow $1 console_device_t:chr_file watch_reads;
+')
+
+########################################
+## <summary>
 ##	Read from the console.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260801/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/init.te
+++ refpolicy-2.20260801/policy/modules/system/init.te
@@ -549,6 +549,7 @@ ifdef(`init_systemd',`
 
 	sysnet_read_config(init_t)
 
+	systemd_connectto_logind(init_t)
 	systemd_getattr_updated_runtime(init_t)
 	systemd_manage_passwd_runtime_symlinks(init_t)
 	systemd_use_passwd_agent(init_t)
@@ -571,6 +572,7 @@ ifdef(`init_systemd',`
 	term_setattr_unallocated_ttys(init_t)
 	term_watch_unallocated_ttys(init_t)
 	term_watch_reads_unallocated_ttys(init_t)
+	term_watch_reads_console(init_t)
 
 	# udevd is a "systemd kobject uevent socket activated daemon"
 	udev_create_kobject_uevent_sockets(init_t)
@@ -1613,6 +1615,8 @@ ifdef(`init_systemd',`
 	# Cannot deny writes or it breaks.
 	allow init_domain_type init_tmpfs_t:file rw_inherited_file_perms;
 
+	allow init_domain_type initrc_t:unix_stream_socket { read write };
+
 	fs_search_cgroup_dirs(init_domain_type)
 
 	# for /run/systemd/private
Index: refpolicy-2.20260801/policy/modules/system/fstools.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/fstools.fc
+++ refpolicy-2.20260801/policy/modules/system/fstools.fc
@@ -1,3 +1,4 @@
+/usr/lib/systemd/systemd-fsckd	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/addpart		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/badblocks		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/blkid			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
Index: refpolicy-2.20260801/policy/modules/services/dbus.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/dbus.te
+++ refpolicy-2.20260801/policy/modules/services/dbus.te
@@ -93,6 +93,7 @@ ifdef(`enable_mls',`
 ')
 
 optional_policy(`
+	systemd_run_backlight(system_dbusd_t)
 	systemd_use_logind_fds(system_dbusd_t)
 ')
 
@@ -199,8 +200,12 @@ seutil_read_default_contexts(system_dbus
 # for machinectl shell
 term_use_ptmx(system_dbusd_t)
 
-userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)
 userdom_dontaudit_search_user_home_dirs(system_dbusd_t)
+
+# for systemd-run
+userdom_use_inherited_user_terminals(system_dbusd_t)
+userdom_use_unpriv_users_fds(system_dbusd_t)
+
 # read a file in ~/.local/share
 userdom_read_user_home_content_files(system_dbusd_t)
 
Index: refpolicy-2.20260801/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260801/policy/modules/apps/wm.if
@@ -144,6 +144,7 @@ template(`wm_role_template',`
 
 	optional_policy(`
 		systemd_read_logind_state($1_wm_t)
+		systemd_use_logind_fds($1_wm_t)
 		systemd_user_app_status($1, $1_wm_t)
 		systemd_write_inherited_logind_inhibit_pipes($1_wm_t)
 	')
Index: refpolicy-2.20260801/policy/modules/services/xserver.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/xserver.if
+++ refpolicy-2.20260801/policy/modules/services/xserver.if
@@ -114,6 +114,9 @@ template(`xserver_restricted_role',`
 	xserver_read_xdm_runtime_files($2)
 	# gnome-session creates socket under /tmp/.ICE-unix/
 	xserver_create_xdm_tmp_sockets($2)
+	# if we allow xserver_create_xdm_tmp_sockets and we use wayland then
+	# we need to unlink as well.  Maybe should use a different type.
+	allow $2 xdm_tmp_t:sock_file { unlink };
 	# Needed for escd, remove if we get escd policy
 	xserver_manage_xdm_tmp_files($2)
 
Index: refpolicy-2.20260801/policy/modules/system/unconfined.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/unconfined.if
+++ refpolicy-2.20260801/policy/modules/system/unconfined.if
@@ -133,6 +133,10 @@ interface(`unconfined_domain_noaudit',`
 	')
 
 	optional_policy(`
+		systemd_dbus_chat_locale($1)
+	')
+
+	optional_policy(`
 		xserver_unconfined($1)
 	')
 ')
Index: refpolicy-2.20260801/policy/modules/services/docker.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/docker.te
+++ refpolicy-2.20260801/policy/modules/services/docker.te
@@ -84,6 +84,7 @@ ifdef(`init_systemd',`
 	init_stop_system(dockerd_t)
 	init_get_system_status(dockerd_t)
 	init_stop_generic_units(dockerd_t)
+	systemd_connect_machined(dockerd_t)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260801/policy/modules/services/mysql.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/mysql.te
+++ refpolicy-2.20260801/policy/modules/services/mysql.te
@@ -127,6 +127,7 @@ fs_getattr_all_fs(mysqld_t)
 fs_search_auto_mountpoints(mysqld_t)
 fs_search_tmpfs(mysqld_t)
 fs_rw_hugetlbfs_files(mysqld_t)
+fs_watch_memory_pressure(mysqld_t)
 
 files_read_etc_runtime_files(mysqld_t)
 files_read_usr_files(mysqld_t)
@@ -141,6 +142,10 @@ miscfiles_read_localization(mysqld_t)
 userdom_search_user_home_dirs(mysqld_t)
 userdom_dontaudit_use_unpriv_user_fds(mysqld_t)
 
+ifdef(`init_systemd',`
+	systemd_connect_machined(mysqld_t)
+')
+
 tunable_policy(`mysql_connect_any',`
 	corenet_sendrecv_all_client_packets(mysqld_t)
 	corenet_tcp_connect_all_ports(mysqld_t)
Index: refpolicy-2.20260801/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20260801/policy/modules/system/unconfined.te
@@ -70,6 +70,9 @@ ifdef(`init_systemd',`
 	init_pgm_spec_user_daemon_domain(unconfined_t)
 	allow unconfined_t self:system { reload start status stop };
 
+	systemd_use_logind_fds(unconfined_t)
+	systemd_use_passwd_agent_fds(unconfined_t)
+
 	optional_policy(`
 		systemd_dbus_chat_resolved(unconfined_t)
 		systemd_filetrans_passwd_runtime_dirs(unconfined_t)
Index: refpolicy-2.20260801/policy/modules/services/ssh.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/ssh.if
+++ refpolicy-2.20260801/policy/modules/services/ssh.if
@@ -236,7 +236,7 @@ template(`ssh_server_template', `
 	corenet_tcp_connect_all_ports($1_t)
 	corenet_sendrecv_ssh_server_packets($1_t)
 
-	fs_dontaudit_getattr_all_fs($1_t)
+	fs_getattr_xattr_fs($1_t)
 
 	auth_rw_login_records($1_t)
 	auth_rw_faillog($1_t)
@@ -289,6 +289,7 @@ template(`ssh_server_template', `
 	')
 
 	optional_policy(`
+		systemd_getattr_notify_socket($1_t)
 		systemd_read_logind_sessions_files($1_t)
 		systemd_stream_connect_userdb($1_t)
 	')
@@ -371,6 +372,7 @@ template(`ssh_role_template',`
 
 	optional_policy(`
 		systemd_user_app_status($1, ssh_t)
+		systemd_user_create_unix_stream_socket($1, $1_ssh_agent_t)
 	')
 
 	##############################
Index: refpolicy-2.20260801/policy/modules/system/systemd.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.fc
+++ refpolicy-2.20260801/policy/modules/system/systemd.fc
@@ -26,6 +26,8 @@
 /usr/lib/systemd/user-generators/.*								--	gen_context(system_u:object_r:systemd_generator_exec_t,s0)
 /usr/libexec/podman/quadlet										--	gen_context(system_u:object_r:systemd_generator_exec_t,s0)
 
+/usr/lib/kf6/kauth/libexec/backlighthelper	--	gen_context(system_u:object_r:systemd_backlight_exec_t,s0)
+/usr/lib/kauth/libexec/backlighthelper	--	gen_context(system_u:object_r:systemd_backlight_exec_t,s0)
 /usr/lib/systemd/systemd-activate	--	gen_context(system_u:object_r:systemd_activate_exec_t,s0)
 /usr/lib/systemd/systemd-backlight	--	gen_context(system_u:object_r:systemd_backlight_exec_t,s0)
 /usr/lib/systemd/systemd-binfmt		--	gen_context(system_u:object_r:systemd_binfmt_exec_t,s0)
Index: refpolicy-2.20260801/policy/modules/services/ntp.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/ntp.te
+++ refpolicy-2.20260801/policy/modules/services/ntp.te
@@ -160,6 +160,8 @@ ifdef(`init_systemd',`
 	allow ntpd_t self:capability { fowner setpcap };
 	init_read_state(ntpd_t)
 	init_reload(ntpd_t)
+	init_start_generic_units(ntpd_t)
+	init_stop_generic_units(ntpd_t)
 	init_watch_runtime_dirs(ntpd_t)
 	fs_watch_memory_pressure(ntpd_t)
 
Index: refpolicy-2.20260801/policy/modules/services/policykit.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/policykit.te
+++ refpolicy-2.20260801/policy/modules/services/policykit.te
@@ -111,6 +111,8 @@ userdom_read_all_users_state(policykit_t
 optional_policy(`
 	dbus_system_domain(policykit_t, policykit_exec_t)
 	init_dbus_chat(policykit_t)
+	init_get_transient_units_status(policykit_t)
+	init_get_system_status(policykit_t)
 
 	userdom_dbus_send_all_users(policykit_t)
 
Index: refpolicy-2.20260801/policy/modules/kernel/files.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/files.fc
+++ refpolicy-2.20260801/policy/modules/kernel/files.fc
@@ -70,6 +70,7 @@ ifdef(`distro_suse',`
 
 /etc/ipsec\.d/examples(/.*)?	gen_context(system_u:object_r:etc_t,s0)
 
+/etc/kernel/entry-token --	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/network/ifstate	--	gen_context(system_u:object_r:etc_runtime_t,s0)
 
 /etc/ptal/ptal-printd-like -- 	gen_context(system_u:object_r:etc_runtime_t,s0)
Index: refpolicy-2.20260801/policy/modules/apps/gpg.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/gpg.te
+++ refpolicy-2.20260801/policy/modules/apps/gpg.te
@@ -183,6 +183,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_user_sessions_create_stream_socket(gpg_t)
+')
+
+optional_policy(`
 	xserver_use_xdm_fds(gpg_t)
 	xserver_rw_xdm_pipes(gpg_t)
 ')
@@ -305,6 +309,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_user_sessions_create_sock_file(gpg_runtime_t)
+')
+
+optional_policy(`
 	xserver_sigchld_xdm(gpg_agent_t)
 	xserver_read_user_xauth(gpg_agent_t)
 ')
Index: refpolicy-2.20260801/policy/modules/system/logging.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/logging.fc
+++ refpolicy-2.20260801/policy/modules/system/logging.fc
@@ -76,6 +76,7 @@ ifdef(`distro_gentoo',`
 /run/syslog-ng\.pid	--	gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
 /run/syslog-ng(/.*)?	gen_context(system_u:object_r:syslogd_runtime_t,s0)
 /run/systemd/journal(\.[^/]*)?(/.*)?	gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
+/run/systemd/journal(\.[^/]*)?/io.systemd.journal -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
 /run/systemd/journal(\.[^/]*)?/socket -s	gen_context(system_u:object_r:devlog_t,mls_systemhigh)
 /run/systemd/journal(\.[^/]*)?/stdout -s	gen_context(system_u:object_r:devlog_t,mls_systemhigh)
 /run/systemd/journal(\.[^/]*)?/syslog -s	gen_context(system_u:object_r:devlog_t,mls_systemhigh)
Index: refpolicy-2.20260801/policy/modules/system/logging.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/logging.if
+++ refpolicy-2.20260801/policy/modules/system/logging.if
@@ -683,7 +683,7 @@ interface(`logging_send_syslog_msg',`
 
 	allow $1 devlog_t:sock_file write_sock_file_perms;
 
-	# systemd journal socket is in /run/systemd/journal/dev-log
+	# systemd journal socket is in /run/systemd/journal/dev-log and /run/systemd/journal/io.systemd.journal
 	init_search_run($1)
 	allow $1 syslogd_runtime_t:dir search_dir_perms;
 
Index: refpolicy-2.20260801/policy/modules/kernel/selinux.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/selinux.te
+++ refpolicy-2.20260801/policy/modules/kernel/selinux.te
@@ -131,3 +131,8 @@ if (!secure_mode_policyload && !secure_m
 } else {
 	dontaudit selinux_unconfined_type boolean_type:file write_file_perms;
 }
+
+optional_policy(`
+	# for /sys/kernel/security/ima/binary_runtime_measurements for the tpm-udev package
+	systemd_tmpfilesd_managed(security_t)
+')
Index: refpolicy-2.20260801/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260801/policy/modules/system/userdomain.if
@@ -843,6 +843,7 @@ template(`userdom_common_user_template',
 		')
 
 		optional_policy(`
+			systemd_dbus_chat_backlight($1_t)
 			systemd_role_template($1, $1_r, $1_t)
 			systemd_user_app_socket_create($1, $1_t, user_runtime_t)
 		')
@@ -5241,6 +5242,24 @@ interface(`userdom_create_all_users_keys
 
 ########################################
 ## <summary>
+##	link keys for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_link_all_users_keys',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:key link;
+')
+
+########################################
+## <summary>
 ##	Manage keys for all user domains.
 ## </summary>
 ## <param name="domain">
@@ -5258,6 +5277,42 @@ interface(`userdom_manage_all_users_keys
 ')
 
 ########################################
+## <summary>
+##	destroy semaphores for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_destroy_all_users_sem',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:sem destroy;
+')
+
+########################################
+## <summary>
+##	destroy shared memory for all user domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_destroy_all_users_shm',`
+	gen_require(`
+		attribute userdomain;
+	')
+
+	allow $1 userdomain:shm destroy;
+')
+
+########################################
 ## <summary>
 ##	Send a dbus message to all user domains.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/services/rtkit.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/services/rtkit.te
+++ refpolicy-2.20260801/policy/modules/services/rtkit.te
@@ -54,5 +54,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	systemd_dbus_chat_logind(rtkit_daemon_t)
+	systemd_use_logind_fds(rtkit_daemon_t)
+	systemd_write_inherited_logind_inhibit_pipes(rtkit_daemon_t)
+')
+
+optional_policy(`
 	xserver_setsched_xdm(rtkit_daemon_t)
 ')
