Merge upstream

diff --cc policy/modules/admin/certwatch.te
Simple merge

diff --cc policy/modules/admin/firstboot.te
Simple merge

diff --cc policy/modules/roles/staff.te
index 06b7974c100ea82231ed2faef75d8aaca475f112,185400290c40d7caa142e0ff65ac5a0b8b3e2e2f..b0d95d4b1c7ae7f4fb7550be58d3c2ea59c17d0f
--- 1/policy/modules/roles/staff.te
--- 2/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@@ -57,25 -23,9 +57,38 @@@ optional_policy(
  ')
  
  optional_policy(`
-       auditadm_role_change(staff_r)
+       dbadm_role_change(staff_r)
  ')
  
-       dbadm_role_change(staff_r)
 +optional_policy(`
-       logadm_role_change(staff_r)
++      accountsd_dbus_chat(staff_t)
++      accountsd_read_lib_files(staff_t)
 +')
 +
 +optional_policy(`
-       webadm_role_change(staff_r)
++      gnomeclock_dbus_chat(staff_t)
 +')
 +
 +optional_policy(`
-       kerneloops_manage_tmp_files(staff_t)
++      firewallgui_dbus_chat(staff_t)
++')
++
++optional_policy(`
++      lpd_list_spool(staff_t)
 +')
 +
 +optional_policy(`
++      kerneloops_dbus_chat(staff_t)
++')
++
++optional_policy(`
++      logadm_role_change(staff_r)
++')
++
++optional_policy(`
++      mozilla_run_plugin(staff_t, staff_r)
 +')
 +
  optional_policy(`
        oident_manage_user_content(staff_t)
        oident_relabel_user_content(staff_t)
@@@ -85,38 -35,22 +98,63 @@@ optional_policy(
        postgresql_role(staff_r, staff_t)
  ')
  
-       secadm_role_change(staff_r)
 +optional_policy(`
-       unconfined_role_change(staff_r)
++      rtkit_scheduled(staff_t)
 +')
 +
 +optional_policy(`
++      rpm_dbus_chat(staff_usertype)
 +')
 +
  optional_policy(`
-       rtkit_scheduled(staff_t)
+       secadm_role_change(staff_r)
+ ')
+ 
+ optional_policy(`
 -      ssh_role_template(staff, staff_r, staff_t)
++      sandbox_transition(staff_t, staff_r)
  ')
  
  optional_policy(`
 -      sudo_role_template(staff, staff_r, staff_t)
 +      screen_role_template(staff, staff_r, staff_t)
  ')
  
-       sysadm_role_change(staff_r)
-       userdom_dontaudit_use_user_terminals(staff_t)
+ optional_policy(`
+       sysadm_role_change(staff_r)
+       userdom_dontaudit_use_user_terminals(staff_t)
+ ')
++optional_policy(`
++      setroubleshoot_stream_connect(staff_t)
++      setroubleshoot_dbus_chat(staff_t)
++      setroubleshoot_dbus_chat_fixit(staff_t)
++')
++
 +optional_policy(`
 +      ssh_role_template(staff, staff_r, staff_t)
 +')
 +
 +optional_policy(`
 +      sudo_role_template(staff, staff_r, staff_t)
 +')
 +
 +optional_policy(`
-       telepathy_dbus_session_role(staff_r, staff_t)
++      telepathy_dbus_session_role(staff_r, staff_t)
 +')
 +
 +optional_policy(`
++      userhelper_console_role_template(staff, staff_r, staff_usertype)
++')
++
++optional_policy(`
++      unconfined_role_change(staff_r)
++')
++
++optional_policy(`
++      virt_stream_connect(staff_t)
++')
++
++optional_policy(`
++      webadm_role_change(staff_r)
 +')
  
  optional_policy(`
        xserver_role(staff_r, staff_t)

diff --cc policy/modules/roles/unprivuser.te
index aac3fe1a09514db4a1ff110a9d7760b874eef67c,9b55b004712f443d12575c0e5d343c090857c62b..2932c133b22f822531166c986bdc1af7fc490a26
--- 1/policy/modules/roles/unprivuser.te
--- 2/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@@ -18,34 -16,15 +18,39 @@@ optional_policy(
        apache_role(user_r, user_t)
  ')
  
+ optional_policy(`
+       oident_manage_user_content(user_t)
+       oident_relabel_user_content(user_t)
+ ')
+ 
 +optional_policy(`
 +      mozilla_run_plugin(user_t, user_r)
 +')
 +
 +optional_policy(`
 +      rpm_dontaudit_dbus_chat(user_t)
 +')
 +
 +optional_policy(`
 +      rtkit_scheduled(user_t)
 +')
 +
 +optional_policy(`
 +      sandbox_transition(user_t, user_r)
 +')
 +
  optional_policy(`
        screen_role_template(user, user_r, user_t)
  ')
  
-       telepathy_dbus_session_role(user_r, user_t)
 +optional_policy(`
-       setroubleshoot_dontaudit_stream_connect(user_t)
++      setroubleshoot_dontaudit_stream_connect(user_t)
 +')
 +
 +optional_policy(`
++      telepathy_dbus_session_role(user_r, user_t)
 +')
 +
  optional_policy(`
        xserver_role(user_r, user_t)
  ')

diff --cc policy/modules/services/certmaster.te
Simple merge

diff --cc policy/modules/services/djbdns.te
Simple merge

diff --cc policy/modules/services/icecast.te
Simple merge

diff --cc policy/modules/services/postgresql.te
Simple merge