Description: We cannot rely on XDG_RUNTIME_DIR on CentOS 7.x,
	as it may not have been created,
	so we need to allow the cups backend to connect to the socket
	found in the ~/.xpra directory.

Index: selinux/cups_xpra/cups_xpra.te
===================================================================
--- a/selinux/cups_xpra/cups_xpra.te
+++ b/selinux/cups_xpra/cups_xpra.te
@@ -1,7 +1,9 @@
 policy_module(cups_xpra, 1.0)
 
 require {
+	type user_home_t;
 	type user_tmp_t;
+	type var_run_t;
 	type init_var_run_t;
 	type passwd_file_t;
 	type print_spool_t;
@@ -46,3 +48,9 @@
 #to generate the default xpra config object,
 #we may need to getattr the Xorg binary:
 allow cups_xpra_t xserver_exec_t:file getattr;
+
+#allow connection to the socket in ~/.xpra
+allow cups_xpra_t user_home_t:dir search;
+allow cups_xpra_t user_home_t:sock_file write;
+allow cups_xpra_t user_tmp_t:dir getattr;
+allow cups_xpra_t var_run_t:dir write;
