Index: refpolicy-2.20260801/policy/modules/apps/docportal.if
===================================================================
--- /dev/null
+++ refpolicy-2.20260801/policy/modules/apps/docportal.if
@@ -0,0 +1,76 @@
+## <summary>Policy for Docportal, the portal frontend service for Flatpak, Snap, etc.</summary>
+
+########################################
+## <summary>
+##	Role access for docportal (user-service mode).
+##	Call this from unprivuser.te / staff.te etc
+## </summary>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user role (e.g., "user" for user_r).
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	User domain for the role (e.g., user_t).
+##	</summary>
+## </param>
+## <param name="systemd_exec_domain">
+##	<summary>
+##	systemd exec domain for execute and transition access
+##	(e.g., user_systemd_t).
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access (e.g., user_r).
+##	</summary>
+## </param>
+#
+template(`docportal_role',`
+	gen_require(`
+		type docportal_exec_t;
+		class dbus send_msg;
+		attribute docportal_domain;
+	')
+
+	type $1_docportal_t;
+	typeattribute $1_docportal_t docportal_domain;
+	role $4 types $1_docportal_t;
+	application_type($1_docportal_t)
+	domtrans_pattern($3, docportal_exec_t, $1_docportal_t)
+	domain_entry_file($1_docportal_t, docportal_exec_t)
+	allow $1_docportal_t $3:fd use;
+
+	ps_process_pattern($3, $1_docportal_t)
+	allow $3 $1_docportal_t:process { sigkill signal signull };
+
+	allow $1_docportal_t self:process signal;
+	allow $1_docportal_t self:fifo_file rw_fifo_file_perms;
+	allow $1_docportal_t $3:unix_stream_socket { read write };
+	allow $1_docportal_t $2:dbus send_msg;
+	allow $2 $1_docportal_t:dbus send_msg;
+	optional_policy(`
+		dbus_all_session_bus_client($1_docportal_t)
+	')
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run WirePlumber.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`docportal_domtrans',`
+	gen_require(`
+		type $1_docportal_t, docportal_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, docportal_exec_t, $1_docportal_t)
+')
+
Index: refpolicy-2.20260801/policy/modules/apps/docportal.te
===================================================================
--- /dev/null
+++ refpolicy-2.20260801/policy/modules/apps/docportal.te
@@ -0,0 +1,49 @@
+policy_module(docportal)
+
+########################################
+#
+# Declarations
+#
+
+type docportal_exec_t;
+application_executable_file(docportal_exec_t)
+
+attribute docportal_domain;
+
+storage_rw_fuse(docportal_domain)
+allow docportal_domain self:capability { setuid sys_admin dac_override dac_read_search };
+kernel_read_fs_sysctls(docportal_domain)
+kernel_read_system_state(docportal_domain)
+kernel_read_vm_overcommit_sysctl(docportal_domain)
+
+corecmd_search_bin(docportal_domain)
+
+files_mounton_root(docportal_domain)
+files_read_etc_files(docportal_domain)
+files_search_home(docportal_domain)
+
+fs_getattr_xattr_fs(docportal_domain)
+fs_getattr_tmpfs(docportal_domain)
+fs_mount_fusefs(docportal_domain)
+fs_list_fusefs(docportal_domain)
+fs_search_fusefs(docportal_domain)
+fs_unmount_fusefs(docportal_domain)
+ miscfiles_read_localization(docportal_domain)
+
+mount_exec(docportal_domain)
+mount_manage_runtime_files(docportal_domain)
+
+userdom_search_user_runtime_root(docportal_domain)
+userdom_search_user_runtime(docportal_domain)
+userdom_search_user_home_dirs(docportal_domain)
+userdom_list_user_tmp(docportal_domain)
+
+xdg_search_data_dirs(docportal_domain)
+
+userdom_mounton_user_tmp(docportal_domain)
+
+optional_policy(`
+	dbus_getattr_session_runtime_socket(docportal_domain)
+	dbus_write_session_runtime_socket(docportal_domain)
+	dbus_connect_all_session_bus(docportal_domain)
+')
Index: refpolicy-2.20260801/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20260801/policy/modules/system/systemd.if
@@ -240,6 +240,10 @@ template(`systemd_role_template',`
 	systemd_watch_passwd_runtime_dirs($3)
 
 	optional_policy(`
+		docportal_role($1, $3, $1_systemd_t, $2)
+	')
+
+	optional_policy(`
 		gpg_stream_connect_agent($1_systemd_t)
 	')
 
Index: refpolicy-2.20260801/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260801/policy/modules/system/userdomain.if
@@ -3064,6 +3064,27 @@ interface(`userdom_list_user_tmp',`
 
 ########################################
 ## <summary>
+##	mounton user temporary directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_mounton_user_tmp',`
+	gen_require(`
+		type user_tmp_t, user_runtime_t;
+	')
+
+	allow $1 user_tmp_t:dir { mounton write };
+	allow $1 user_runtime_t:dir list_dir_perms;
+	files_search_tmp($1)
+	userdom_search_user_runtime($1)
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to list user
 ##	temporary directories.
 ## </summary>
Index: refpolicy-2.20260801/policy/modules/apps/docportal.fc
===================================================================
--- /dev/null
+++ refpolicy-2.20260801/policy/modules/apps/docportal.fc
@@ -0,0 +1 @@
+/usr/libexec/xdg-document-portal	--	gen_context(system_u:object_r:docportal_exec_t,s0)
