diff --git a/.gitignore b/.gitignore
index 16244c3..109031b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@
 /container-selinux-c89e9b5.tar.gz
 /container-selinux-58324f3.tar.gz
 /container-selinux-81ff96c.tar.gz
+/container-selinux-a9260d4.tar.gz
diff --git a/container-selinux.spec b/container-selinux.spec
index c096def..182d6d7 100644
--- a/container-selinux.spec
+++ b/container-selinux.spec
@@ -3,7 +3,7 @@
 # container-selinux
 %global git0 https://github.com/projectatomic/container-selinux
 %if 0%{?fedora} || 0%{?rhel} > 7
-%global commit0 81ff96c3e100ec23f7934000e96adab56762fd96
+%global commit0 a9260d44ecb10cc824ad0e18bcd22cb93a5dbdaf
 %else
 # use upstream's RHEL-1.12 branch for CentOS 7
 %global commit0 56c32da8a72f9e7af5daeaebac5b887830d123b1
@@ -35,7 +35,7 @@ Name: container-selinux
 %if 0%{?fedora} || 0%{?centos} || 0%{?rhel} > 7
 Epoch: 2
 %endif
-Version: 2.23
+Version: 2.24
 Release: 1%{?dist}
 License: GPLv2
 URL: %{git0}
@@ -118,6 +118,9 @@ fi
 %{_datadir}/selinux/*
 
 %changelog
+* Fri Sep 22 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.24-1
+-     Make sure container_runtime_t has all access of container_t
+
 * Thu Sep 7 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.23-1
 - Allow container runtimes to create sockets in tmp dirs
 
diff --git a/sources b/sources
index 9f28103..b692fbb 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (container-selinux-81ff96c.tar.gz) = 4d1fac6319e0f45ed6daf0413bdb4f9bbc6389d8aef3039a5d089084937df9baa67106f33dfd50911d81f47a8f7867cdd1c74a441e8a86fe5d57c87299a46c98
+SHA512 (container-selinux-a9260d4.tar.gz) = a28462bdbedd1ad8b94d8da8cb8577f1e2b7ddf441b689ae71d97e0152adb5b75f0f4601e5c2f2311642ec65605e1440b56bb07317246a18206964717af4d981