Add shell execution to systemd initrc_t transition.
Update contrib.
Run grub(2)-mkconfig in bootloader domain

In order to write the grub configuration and perform the preliminary
checks, the grub-mkconfig command should run in the bootloader_t domain.
As such, update the file context definition to be bootloader_exec_t.
Add auth_pid_filetrans_pam_var_run
New sudo manages timestamp directory in /var/run/sudo

Allow sudo (1.8.9_p5 and higher) to handle /var/run/sudo/ts if it does
not exist (given the tmpfs nature of /var/run). This is done when sudo
is run in the user prefixed domain, and requires both the chown
capability as well as the proper file transition when /var/run/sudo is
created.
xfce4-notifyd is an executable
Mark f2fs as a SELinux capable file system

Since Linux kernel 3.11, F2FS supports XATTR and the security namespace.
See commit
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8ae8f1627f39bae505b90cade50cd8a911b8bda6
Add in LightDM contexts
Add gfisk and efibootmgr as fsadm_exec_t
Add /var/lib/racoon as runtime directory for ipsec
Create tmp directory when compiling a .mod.fc file in a modular way

When compiling modules using support/Makefile.devel (which is installed
in /usr/share/selinux/*/include/Makefile) with "make -j9", the build
fails because tmp/ does not exist.

Add the missing command to create tmp/ when running tmp/%.mod.fc target.

Gentoo bug: https://bugs.gentoo.org/show_bug.cgi?id=530178
Module version bump for misc fixes from Sven Vermeulen.
Update contrib.
Update policy for selinux userspace moving the policy store to /var/lib/selinux

With the new userspace, the only files in /var/lib/selinux are selinux
store related files, so label it and everything inside it as
semanage_store_t. semanage_var_lib_t is completely removed and now
aliases semanage_store_t for backwards compatibility. This differs from
the v2 patch in that it adds back the ability to manage
selinux_config_t, which is necessary to manage the old module store for
things like migrating from the old to new store and backwards
compatability.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
Module version bump for module store move from Steve Lawrence.
Bump module versions for release.
Update Changelog and VERSION for release.
Add tunable for tmpfiles to manage almost anything.
Additional init coverage.
Merge remote-tracking branch 'upstream/master'