Index: refpolicy-2.20260728/policy/modules/apps/pipewire.te
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/pipewire.te
+++ refpolicy-2.20260728/policy/modules/apps/pipewire.te
@@ -10,8 +10,8 @@ attribute_role pipewire_roles;
 #
 # pipewire_t — the PipeWire multimedia daemon.
 #
-type pipewire_t;
-type pipewire_exec_t;
+type pipewire_t alias { alsa_t pulseaudio_t };
+type pipewire_exec_t alias { alsa_exec_t pulseaudio_exec_t };
 
 # Run PipeWire as a system-wide daemon launched by the systemd system
 # instance.  When false (default), PipeWire runs as a per-user session
@@ -35,13 +35,13 @@ type pipewire_client_exec_t;
 userdom_user_application_domain(pipewire_client_t, pipewire_client_exec_t)
 role pipewire_roles types pipewire_client_t;
 
-type pipewire_home_t alias pipewire_var_lib_t;
+type pipewire_home_t alias { pipewire_var_lib_t alsa_etc_t alsa_home_t alsa_runtime_t alsa_var_lib_t alsa_var_lock_t pulseaudio_home_t pulseaudio_xdg_config_t pulseaudio_xdg_cache_t pulseaudio_var_lib_t pulseaudio_runtime_t pulseaudio_tmp_t alsa_tmp_t };
 userdom_user_home_content(pipewire_home_t)
 
 type pipewire_runtime_t;
 files_runtime_file(pipewire_runtime_t)
 
-type pipewire_tmpfs_t;
+type pipewire_tmpfs_t alias { alsa_tmpfs_t pulseaudio_tmpfs_t };
 userdom_user_tmpfs_file(pipewire_tmpfs_t)
 
 ########################################
@@ -154,6 +154,7 @@ ifndef(`pipewire_system_service',`
 
 	# Runtime socket directory transition under $XDG_RUNTIME_DIR/pipewire.
 	userdom_user_runtime_filetrans(pipewire_t, pipewire_runtime_t, dir, "pipewire")
+	userdom_user_runtime_filetrans(pipewire_t, pipewire_runtime_t, file)
 
 	# Session D-Bus (register org.PipeWire.* on the per-user session bus).
 	optional_policy(`
Index: refpolicy-2.20260728/policy/modules/apps/wm.if
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/wm.if
+++ refpolicy-2.20260728/policy/modules/apps/wm.if
@@ -114,6 +114,11 @@ template(`wm_role_template',`
 	')
 
 	optional_policy(`
+		pipewire_read_home_files($1_wm_t)
+		pipewire_stream_connect($1_wm_t)
+	')
+
+	optional_policy(`
 		policykit_run_auth($1_wm_t, $4)
 		policykit_signal_auth($1_wm_t)
 	')
Index: refpolicy-2.20260728/policy/modules/apps/wm.fc
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/wm.fc
+++ refpolicy-2.20260728/policy/modules/apps/wm.fc
@@ -1,6 +1,6 @@
 /usr/bin/gnome-shell	--	gen_context(system_u:object_r:wm_exec_t,s0)
 /usr/bin/openbox	--	gen_context(system_u:object_r:wm_exec_t,s0)
-/usr/bin/kwin_((wayland)|(x11))	--	gen_context(system_u:object_r:wm_exec_t,s0)
+/usr/bin/kwin_((wayland)|(x11))(_wrapper)?	--	gen_context(system_u:object_r:wm_exec_t,s0)
 /usr/bin/maliit-keyboard --	gen_context(system_u:object_r:wm_exec_t,s0)
 /usr/bin/metacity	--	gen_context(system_u:object_r:wm_exec_t,s0)
 /usr/bin/mutter		--	gen_context(system_u:object_r:wm_exec_t,s0)
Index: refpolicy-2.20260728/policy/modules/apps/pipewire.if
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/pipewire.if
+++ refpolicy-2.20260728/policy/modules/apps/pipewire.if
@@ -113,6 +113,46 @@ interface(`pipewire_domtrans_client',`
 
 ########################################
 ## <summary>
+##	Create pipewire user socket /run/user/$UID/pipewire-0
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pipewire_socket_user_create',`
+	gen_require(`
+		type pipewire_runtime_t;
+	')
+
+	userdom_user_runtime_filetrans($1, pipewire_runtime_t, sock_file, "pipewire-0")
+	userdom_user_runtime_filetrans($1, pipewire_runtime_t, sock_file, "pipewire-0-manager")
+	userdom_user_runtime_filetrans($1, pipewire_runtime_t, dir, "pulse")
+	allow $1 pipewire_runtime_t:dir manage_dir_perms;
+')
+
+########################################
+## <summary>
+##	unlink pipewire user socket /run/user/$UID/pipewire-0
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pipewire_socket_user_unlink',`
+	gen_require(`
+		type pipewire_runtime_t;
+	')
+
+	userdom_rw_user_runtime($1)
+	allow $1 pipewire_runtime_t:sock_file unlink;
+')
+
+########################################
+## <summary>
 ##	Connect to the PipeWire daemon over a Unix stream socket.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260728/policy/modules/system/systemd.if
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/system/systemd.if
+++ refpolicy-2.20260728/policy/modules/system/systemd.if
@@ -253,6 +253,11 @@ template(`systemd_role_template',`
 	')
 
 	optional_policy(`
+		pipewire_socket_user_create($1_systemd_t)
+		pipewire_socket_user_unlink($1_systemd_t)
+	')
+
+	optional_policy(`
 		xdg_config_filetrans($1_systemd_t, systemd_conf_home_t, dir, "systemd")
 		xdg_data_filetrans($1_systemd_t, systemd_data_home_t, dir, "systemd")
 		xdg_read_cache_files($1_systemd_t)
@@ -296,6 +301,7 @@ template(`systemd_user_daemon_domain',`
 
 	domtrans_pattern($1_systemd_t, $2, $3)
 	allow $1_systemd_t $3:process noatsecure;
+	allow $1_systemd_t $3:process2 nnp_transition;
 
 	systemd_user_app_status($1, $3)
 ')
Index: refpolicy-2.20260728/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20260728/policy/modules/system/systemd.te
@@ -2559,6 +2559,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	pipewire_socket_user_unlink(systemd_user_runtime_dir_t)
+')
+
+optional_policy(`
 	pulseaudio_manage_tmp_dirs(systemd_user_runtime_dir_t)
 ')
 
Index: refpolicy-2.20260728/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260728/policy/modules/system/userdomain.if
@@ -3676,6 +3676,25 @@ interface(`userdom_search_user_runtime',
 
 ########################################
 ## <summary>
+##	rw users runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_rw_user_runtime',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir rw_dir_perms;
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
 ##	Search user runtime root directories.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20260728/policy/modules/apps/wireplumber.te
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/wireplumber.te
+++ refpolicy-2.20260728/policy/modules/apps/wireplumber.te
@@ -42,13 +42,13 @@ userdom_user_tmpfs_file(wireplumber_tmpf
 #
 
 allow wireplumber_t self:capability sys_nice;
-allow wireplumber_t self:process { getsched setsched signal signull };
+allow wireplumber_t self:process { getsched setsched signal signull setrlimit };
 allow wireplumber_t self:fifo_file rw_fifo_file_perms;
 allow wireplumber_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow wireplumber_t self:unix_dgram_socket create_socket_perms;
 
 # Bluetooth socket for BlueZ audio routing (A2DP/HFP profile management).
-allow wireplumber_t self:bluetooth_socket create_socket_perms;
+allow wireplumber_t self:bluetooth_socket { listen create_socket_perms };
 
 # netlink kobject uevent socket for udev device monitoring.
 allow wireplumber_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -64,11 +64,15 @@ auth_use_nsswitch(wireplumber_t)
 dev_getattr_fs(wireplumber_t)
 
 # Device enumeration via sysfs.
+dev_getattr_sysfs(wireplumber_t)
 dev_read_sysfs(wireplumber_t)
 
 # /dev/snd inotify watch for ALSA device add/remove events.
 dev_watch_dev_dirs(wireplumber_t)
 
+dev_read_sound(wireplumber_t)
+dev_write_sound(wireplumber_t)
+
 # Suppress harmless /proc/<pid>/status probes during client enumeration.
 domain_dontaudit_read_all_domains_state(wireplumber_t)
 
@@ -93,11 +97,25 @@ miscfiles_read_localization(wireplumber_
 udev_read_runtime_files(wireplumber_t)
 udev_search_runtime(wireplumber_t)
 
+xdg_search_config_dirs(wireplumber_t)
+xdg_search_data_dirs(wireplumber_t)
+xdg_manage_data(wireplumber_t)
+
 # D-Bus communication with BlueZ (Bluetooth audio routing).
 optional_policy(`
 	bluetooth_dbus_chat(wireplumber_t)
 ')
 
+optional_policy(`
+	dbus_list_system_bus_runtime(wireplumber_t)
+	dbus_write_session_runtime_socket(wireplumber_t)
+	dbus_system_bus_client(wireplumber_t)
+')
+
+optional_policy(`
+	devicekit_dbus_chat_power(wireplumber_t)
+')
+
 # D-Bus communication with ModemManager (telephony audio routing).
 optional_policy(`
 	modemmanager_dbus_chat(wireplumber_t)
@@ -124,6 +142,8 @@ optional_policy(`
 optional_policy(`
 	systemd_read_journal_files(wireplumber_t)
 	systemd_read_logind_sessions_files(wireplumber_t)
+	systemd_read_logind_runtime_files(wireplumber_t)
+	systemd_watch_logind_runtime_dirs(wireplumber_t)
 	systemd_watch_logind_sessions_dirs(wireplumber_t)
 ')
 
Index: refpolicy-2.20260728/policy/modules/apps/chromium.te
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/chromium.te
+++ refpolicy-2.20260728/policy/modules/apps/chromium.te
@@ -305,6 +305,10 @@ optional_policy(`
 		systemd_list_resolved_runtime(chromium_t)
 		systemd_dbus_chat_hostnamed(chromium_t)
 	')
+
+	optional_policy(`
+		wireplumber_dbus_chat(chromium_t)
+	')
 ')
 
 optional_policy(`
Index: refpolicy-2.20260728/policy/modules/apps/wireplumber.if
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/wireplumber.if
+++ refpolicy-2.20260728/policy/modules/apps/wireplumber.if
@@ -31,6 +31,7 @@
 template(`wireplumber_role',`
 	gen_require(`
 		attribute_role wireplumber_roles;
+		class dbus send_msg;
 		type wireplumber_t, wireplumber_exec_t;
 		type wireplumber_home_t, wireplumber_tmpfs_t, wireplumber_runtime_t;
 	')
@@ -58,6 +59,9 @@ template(`wireplumber_role',`
 	allow $2 wireplumber_runtime_t:dir { manage_dir_perms relabel_dir_perms };
 	allow $2 wireplumber_runtime_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
 
+	allow $2 wireplumber_t:dbus send_msg;
+	allow wireplumber_t $2:dbus send_msg;
+
 	# Allow the user domain to manage shared memory files created by the daemon.
 	wireplumber_mmap_rw_tmpfs_files($2)
 	allow $2 wireplumber_tmpfs_t:file relabel_file_perms;
@@ -147,3 +151,23 @@ interface(`wireplumber_read_home_files',
 	read_files_pattern($1, wireplumber_home_t, wireplumber_home_t)
 	read_lnk_files_pattern($1, wireplumber_home_t, wireplumber_home_t)
 ')
+
+########################################
+## <summary>
+##	Allow a domain to chat to WirePlumber via dbus
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`wireplumber_dbus_chat',`
+	gen_require(`
+		type wireplumber_t;
+		class dbus send_msg;
+	')
+
+	allow $1 wireplumber_t:dbus send_msg;
+	allow wireplumber_t $1:dbus send_msg;
+')
Index: refpolicy-2.20260728/policy/modules/apps/pipewire.fc
===================================================================
--- refpolicy-2.20260728.orig/policy/modules/apps/pipewire.fc
+++ refpolicy-2.20260728/policy/modules/apps/pipewire.fc
@@ -9,6 +9,7 @@
 
 # System-service runtime directory (/run/pipewire).
 /run/pipewire(/.*)?		gen_context(system_u:object_r:pipewire_runtime_t,s0)
+/run/user/%{USERID}/pipewire-.*	gen_context(system_u:object_r:pipewire_runtime_t,s0)
 
 # User-session runtime sockets live under $XDG_RUNTIME_DIR/pipewire and are
 # labelled at runtime via userdom_user_runtime_filetrans; no static entry needed.
