diff --git a/backport-Allow-dovecot-bind-to-smtp-ports.patch b/backport-Allow-dovecot-bind-to-smtp-ports.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6ba675181376af123325a5968f15a5e4901da2fb
--- /dev/null
+++ b/backport-Allow-dovecot-bind-to-smtp-ports.patch
@@ -0,0 +1,29 @@
+From f5c688321e04364bdfd030dd1412a7e5a4ecc6b6 Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Tue, 10 Nov 2020 18:04:49 +0100
+Subject: [PATCH] Allow dovecot bind to smtp ports
+
+When dovecot is configured to listen on submission ports
+(tcp 465 or 587), it requires the name_bind permission to ports
+labeled smtp_port_t.
+
+Resolves: rhbz#1881884
+---
+ dovecot.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/contrib/dovecot.te b/policy/modules/contrib/dovecot.te
+index 6cf4b72e9..0b140e932 100644
+--- a/policy/modules/contrib/dovecot.te
++++ b/policy/modules/contrib/dovecot.te
+@@ -147,6 +147,7 @@ corenet_tcp_bind_mail_port(dovecot_t)
+ corenet_tcp_bind_pop_port(dovecot_t)
+ corenet_tcp_bind_lmtp_port(dovecot_t)
+ corenet_tcp_bind_sieve_port(dovecot_t)
++corenet_tcp_bind_smtp_port(dovecot_t)
+ corenet_tcp_connect_all_ports(dovecot_t)
+ corenet_tcp_connect_postgresql_port(dovecot_t)
+ corenet_sendrecv_pop_server_packets(dovecot_t)
+-- 
+2.23.0
+
diff --git a/backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch b/backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch
new file mode 100644
index 0000000000000000000000000000000000000000..8783ef1a7c899d81bd7b38dad6fc32239fb9654a
--- /dev/null
+++ b/backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch
@@ -0,0 +1,37 @@
+From f88337df43f6afce019ad8431815dde794a4f4d9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Wed, 28 Oct 2020 09:26:42 +0100
+Subject: [PATCH] selinux: tweak selinux_get_enforce_mode() to allow status
+ page to be used
+
+https://github.com/SELinuxProject/refpolicy/pull/308/commits/24827d807379302f5e6d31389911292d304136a1
+creates a separate interface for this, but I don't think it makes sense
+to complicate things so much. The intent of selinux_get_enforce_mode()
+is allow status to be checked. Over time various code that checks it
+will transistion to the new more efficient interface. In the meantime, allow
+both. At some point in the future, selinux_get_enforce_mode() can be
+reduced to
+        dev_search_sysfs($1)
+	allow $1 security_t:dir list_dir_perms;
+	allow $1 security_t:file mmap_read_file_perms;
+like selinux_use_status_page() in refpolicy.
+---
+ policy/modules/kernel/selinux.if | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if
+index ac70efb08..a2ab3fca5 100644
+--- a/policy/modules/kernel/selinux.if
++++ b/policy/modules/kernel/selinux.if
+@@ -324,7 +324,7 @@ interface(`selinux_get_enforce_mode',`
+ 	dev_search_sysfs($1)
+ 	selinux_get_fs_mount($1)
+ 	allow $1 security_t:dir list_dir_perms;
+-	allow $1 security_t:file read_file_perms;
++	allow $1 security_t:file mmap_read_file_perms;
+ 	allow $1 security_t:lnk_file read_lnk_file_perms;
+ ')
+ 
+-- 
+2.23.0
+
diff --git a/selinux-policy.spec b/selinux-policy.spec
index d3e7fdbc77cea7700b2b8377c7b9c7a14e83c7ea..346480a8bf123f99e7d58d604d94538fac60e310 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -12,7 +12,7 @@
 Summary: SELinux policy configuration
 Name:    selinux-policy
 Version: 3.14.2
-Release: 66
+Release: 67
 License: GPLv2+
 URL:     https://github.com/fedora-selinux/selinux-policy/
 
@@ -71,6 +71,8 @@ Patch18: add-firewalld-fc.patch
 Patch19: add-allow-systemd-timedated-to-unlink-etc-link.patch
 Patch20: add-avc-for-openEuler-1.patch
 Patch21: backport-systemd-allow-all-systemd-services-to-check-selinux-.patch
+Patch22: backport-Allow-dovecot-bind-to-smtp-ports.patch
+Patch23: backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch
 
 BuildArch: noarch
 BuildRequires:  python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
@@ -736,6 +738,10 @@ exit 0
 %endif
 
 %changelog
+Sat Feb 27 2021 luhuaxin <1539327763@qq.com> - 3.14.2-67
+- add avc for allowing dovecot bind to smtp ports
+- add mmap permission in selinux_get_enforce_mode interface
+
 Sat Feb 27 2021 luhuaxin <1539327763@qq.com> - 3.14.2-66
 - add allow systemd services to check selinux status