2 files changed, 8 insertions, 8 deletions

diff --git a/recipes-security/refpolicy/refpolicy/0039-systemd-allow-systemd-tmpfiles-to-read-bin_t-symlink.patch b/recipes-security/refpolicy/refpolicy/0039-systemd-allow-systemd-tmpfiles-to-read-bin_t-symlink.patch
index d480089..1a16711 100644
--- a/recipes-security/refpolicy/refpolicy/0039-systemd-allow-systemd-tmpfiles-to-read-bin_t-symlink.patch
+++ b/recipes-security/refpolicy/refpolicy/0039-systemd-allow-systemd-tmpfiles-to-read-bin_t-symlink.patch
@@ -1,4 +1,4 @@
-From 496131601f622dabb953cf3f98c64dd726060d33 Mon Sep 17 00:00:00 2001
+From 40dae32ff55f82d4e4e9d309bc91c0216d616b51 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Tue, 18 Feb 2025 15:26:19 +0800
 Subject: [PATCH] systemd: allow systemd-tmpfiles to read bin_t symlink
@@ -23,7 +23,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  4 files changed, 23 insertions(+)
 
 diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 5fd532202..d51f266e5 100644
+index 0da8a2ddb..007341a65 100644
 --- a/policy/modules/kernel/corecommands.fc
 +++ b/policy/modules/kernel/corecommands.fc
 @@ -249,6 +249,7 @@ ifdef(`distro_gentoo',`
@@ -61,22 +61,22 @@ index 08ed91f19..0fa4cbf7d 100644
 +       read_lnk_files_pattern($1, bin_t, bin_t)
 +')
 diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 0d9ff59e2..da6a30470 100644
+index cc2709551..b67b78a69 100644
 --- a/policy/modules/system/systemd.if
 +++ b/policy/modules/system/systemd.if
-@@ -155,6 +155,7 @@ template(`systemd_role_template',`
-        userdom_exec_user_bin_files($1_systemd_t)
+@@ -156,6 +156,7 @@ template(`systemd_role_template',`
  
         # user systemd-tmpfiles rules
+        allow $1_systemd_tmpfiles_t self:process setfscreate;
 +       allow $1_systemd_tmpfiles_t self:capability net_admin;
         allow $1_systemd_tmpfiles_t $1_systemd_t:unix_stream_socket rw_socket_perms;
         domtrans_pattern($1_systemd_t, systemd_tmpfiles_exec_t, $1_systemd_tmpfiles_t)
         read_files_pattern($1_systemd_t, $1_systemd_tmpfiles_t, $1_systemd_tmpfiles_t)
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index b9af00ec8..e79dec101 100644
+index 1ae8e3a7d..e1cc0cfde 100644
 --- a/policy/modules/system/systemd.te
 +++ b/policy/modules/system/systemd.te
-@@ -2148,6 +2148,9 @@ kernel_getattr_proc(systemd_tmpfiles_t)
+@@ -2161,6 +2161,9 @@ kernel_getattr_proc(systemd_tmpfiles_t)
  kernel_read_kernel_sysctls(systemd_tmpfiles_t)
  kernel_read_network_state(systemd_tmpfiles_t)
  
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
index 4b2b186..28cc4a3 100644
--- a/recipes-security/refpolicy/refpolicy_git.inc
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -2,7 +2,7 @@ PV = "2.20260312+git"
 
 SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy"
 
-SRCREV_refpolicy = "cffa6e2c93e9f9be74ffbd65237f45ad6e9d7c55"
+SRCREV_refpolicy = "fbae939176fed7163730506878d92d3b1da433e4"
 
 UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"