diff -up serefpolicy-3.10.0/policy/modules/admin/rpm.te.execmem serefpolicy-3.10.0/policy/modules/admin/rpm.te

--- serefpolicy-3.10.0/policy/modules/admin/rpm.te.execmem	2011-11-02 16:19:54.192885000 -0400

+++ serefpolicy-3.10.0/policy/modules/admin/rpm.te	2011-11-02 16:19:58.603545000 -0400

@@ -419,14 +419,6 @@ optional_policy(`

 	unconfined_domain_noaudit(rpm_script_t)

 	unconfined_domtrans(rpm_script_t)

 	unconfined_execmem_domtrans(rpm_script_t)

-

-	optional_policy(`

-		java_domtrans_unconfined(rpm_script_t)

-	')

-

-	optional_policy(`

-		mono_domtrans(rpm_script_t)

-	')

 ')

 optional_policy(`

diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.fc.execmem serefpolicy-3.10.0/policy/modules/apps/execmem.fc

--- serefpolicy-3.10.0/policy/modules/apps/execmem.fc.execmem	2011-11-02 16:19:54.370885000 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/execmem.fc	2011-11-02 16:19:58.609541000 -0400

@@ -47,3 +47,56 @@ ifdef(`distro_gentoo',`

 /opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)

 /opt/Adobe/Reader9/Reader/intellinux/bin/acroread -- gen_context(system_u:object_r:execmem_exec_t,s0)

 /usr/local/Wolfram/Mathematica(/.*)?MathKernel	  -- gen_context(system_u:object_r:execmem_exec_t,s0)

+

+#

+# /opt

+#

+/opt/(.*/)?bin/java[^/]* --	gen_context(system_u:object_r:execmem_exec_t,s0)

+/opt/ibm/java.*/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:execmem_exec_t,s0)

+/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)

+/opt/matlab.*/bin.*/MATLAB.* --	gen_context(system_u:object_r:execmem_exec_t,s0)

+/opt/local/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)

+/opt/MATLAB.*/bin.*/MATLAB.* --	gen_context(system_u:object_r:execmem_exec_t,s0)

+

+#

+# /usr

+#

+/usr/Aptana[^/]*/AptanaStudio	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/(.*/)?bin/java.* 	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/fastjar	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/frysk		--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gappletviewer	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gcj-dbtool	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gij		--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gjarsigner	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gkeytool	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/grmic		--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/grmiregistry	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/jv-convert	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/octave-[^/]*	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+

+/usr/lib(.*/)?bin/java[^/]* --	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/lib/eclipse/eclipse --	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/lib/opera(/.*)?/opera --	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/lib/opera(/.*)?/works --	gen_context(system_u:object_r:execmem_exec_t,s0)

+

+/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)

+

+/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)

+

+/opt/ibm/lotus/Symphony/framework/rcp/eclipse/plugins(/.*)?	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/opt/ibm(/.*)?/eclipse/plugins(/.*)?	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+

+ifdef(`distro_redhat',`

+/usr/java/eclipse[^/]*/eclipse	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+')

+/usr/bin/mono.*	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+

+#

+# Conflicts with ada domain

+#

+/usr/bin/gnatbind	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gnatls		--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/bin/gnatmake	--	gen_context(system_u:object_r:execmem_exec_t,s0)

+/usr/libexec/gcc(/.*)?/gnat1 -- gen_context(system_u:object_r:execmem_exec_t,s0)

diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.if.execmem serefpolicy-3.10.0/policy/modules/apps/execmem.if

--- serefpolicy-3.10.0/policy/modules/apps/execmem.if.execmem	2011-11-02 16:19:54.372890000 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/execmem.if	2011-11-02 16:19:58.615541000 -0400

@@ -129,4 +129,3 @@ interface(`execmem_execmod',`

 	allow $1 execmem_exec_t:file execmod;

 ')

-

diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.te.execmem serefpolicy-3.10.0/policy/modules/apps/execmem.te

--- serefpolicy-3.10.0/policy/modules/apps/execmem.te.execmem	2011-11-02 16:19:54.374890000 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/execmem.te	2011-11-02 16:19:58.620541000 -0400

@@ -4,7 +4,25 @@ policy_module(execmem, 1.0.0)

 #

 # Declarations

 #

+attribute execmem_type;

-type execmem_exec_t alias unconfined_execmem_exec_t;

+type execmem_exec_t;

+typealias execmem_exec_t alias { unconfined_execmem_exec_t mono_exec_t java_exec_t };

 application_executable_file(execmem_exec_t)

+allow execmem_type self:process { execmem execstack };

+files_execmod_tmp(execmem_type)

+execmem_execmod(execmem_type)

+

+optional_policy(`

+	gnome_read_usr_config(execmem_type)

+')

+	

+optional_policy(`

+	mozilla_execmod_user_home_files(execmem_type)

+')

+

+optional_policy(`

+	nsplugin_rw_shm(execmem_type)

+	nsplugin_rw_semaphores(execmem_type)

+')

diff -up serefpolicy-3.10.0/policy/modules/apps/mozilla.te.execmem serefpolicy-3.10.0/policy/modules/apps/mozilla.te

--- serefpolicy-3.10.0/policy/modules/apps/mozilla.te.execmem	2011-11-02 16:19:54.533885000 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/mozilla.te	2011-11-02 16:19:58.629541000 -0400

@@ -273,10 +273,6 @@ optional_policy(`

 ')

 optional_policy(`

-	java_domtrans(mozilla_t)

-')

-

-optional_policy(`

 	lpd_domtrans_lpr(mozilla_t)

 ')

@@ -456,7 +452,7 @@ optional_policy(`

 ')

 optional_policy(`

-	java_exec(mozilla_plugin_t)

+	execmem_exec(mozilla_plugin_t)

 ')

 optional_policy(`

diff -up serefpolicy-3.10.0/policy/modules/apps/podsleuth.te.execmem serefpolicy-3.10.0/policy/modules/apps/podsleuth.te

--- serefpolicy-3.10.0/policy/modules/apps/podsleuth.te.execmem	2011-06-27 14:18:04.000000000 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/podsleuth.te	2011-11-02 16:19:58.635560000 -0400

@@ -85,5 +85,5 @@ optional_policy(`

 ')

 optional_policy(`

-	mono_exec(podsleuth_t)

+	execmem_exec(podsleuth_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/roles/staff.te.execmem serefpolicy-3.10.0/policy/modules/roles/staff.te

--- serefpolicy-3.10.0/policy/modules/roles/staff.te.execmem	2011-11-02 16:19:55.151799000 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/staff.te	2011-11-02 16:19:58.642541000 -0400

@@ -262,10 +262,6 @@ ifndef(`distro_redhat',`

 	')

 	optional_policy(`

-		java_role(staff_r, staff_t)

-	')

-

-	optional_policy(`

 		lockdev_role(staff_r, staff_t)

 	')

diff -up serefpolicy-3.10.0/policy/modules/roles/sysadm.te.execmem serefpolicy-3.10.0/policy/modules/roles/sysadm.te

--- serefpolicy-3.10.0/policy/modules/roles/sysadm.te.execmem	2011-11-02 16:19:55.158799000 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/sysadm.te	2011-11-02 16:19:58.650541000 -0400

@@ -530,10 +530,6 @@ ifndef(`distro_redhat',`

 	')

 	optional_policy(`

-		java_role(sysadm_r, sysadm_t)

-	')

-

-	optional_policy(`

 		lockdev_role(sysadm_r, sysadm_t)

 	')

diff -up serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.execmem serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te

--- serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.execmem	2011-11-02 16:19:58.593541000 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te	2011-11-02 16:20:17.606179000 -0400

@@ -302,10 +302,6 @@ optional_policy(`

 ')

 optional_policy(`

-	java_run_unconfined(unconfined_t, unconfined_r)

-')

-

-optional_policy(`

 	livecd_run(unconfined_t, unconfined_r)

 ')

@@ -322,13 +318,6 @@ optional_policy(`

 ')

 optional_policy(`

-	mono_role_template(unconfined, unconfined_r, unconfined_t)

-	unconfined_domain_noaudit(unconfined_mono_t)

-	role system_r types unconfined_mono_t;

-')

-

-

-optional_policy(`

 	mozilla_role_plugin(unconfined_r)

 	tunable_policy(`unconfined_mozilla_plugin_transition', `

diff -up serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.execmem serefpolicy-3.10.0/policy/modules/roles/unprivuser.te

--- serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.execmem	2011-11-02 16:19:55.173799000 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/unprivuser.te	2011-11-02 16:19:58.666544000 -0400

@@ -148,10 +148,6 @@ ifndef(`distro_redhat',`

 	')

 	optional_policy(`

-		java_role(user_r, user_t)

-	')

-

-	optional_policy(`

 		lockdev_role(user_r, user_t)

 	')

diff -up serefpolicy-3.10.0/policy/modules/roles/xguest.te.execmem serefpolicy-3.10.0/policy/modules/roles/xguest.te

--- serefpolicy-3.10.0/policy/modules/roles/xguest.te.execmem	2011-11-02 16:19:55.184799000 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/xguest.te	2011-11-02 16:19:58.674541000 -0400

@@ -107,14 +107,6 @@ optional_policy(`

 ')

 optional_policy(`

-	java_role_template(xguest, xguest_r, xguest_t)

-')

-

-optional_policy(`

-	mono_role_template(xguest, xguest_r, xguest_t)

-')

-

-optional_policy(`

 	mozilla_run_plugin(xguest_usertype, xguest_r)

 ')

diff -up serefpolicy-3.10.0/policy/modules/services/boinc.te.execmem serefpolicy-3.10.0/policy/modules/services/boinc.te

--- serefpolicy-3.10.0/policy/modules/services/boinc.te.execmem	2011-11-02 16:19:55.443799000 -0400

+++ serefpolicy-3.10.0/policy/modules/services/boinc.te	2011-11-02 16:19:58.679549000 -0400

@@ -170,5 +170,5 @@ miscfiles_read_fonts(boinc_project_t)

 miscfiles_read_localization(boinc_project_t)

 optional_policy(`

-	java_exec(boinc_project_t)

+	execmem_exec(boinc_project_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/services/cron.te.execmem serefpolicy-3.10.0/policy/modules/services/cron.te

--- serefpolicy-3.10.0/policy/modules/services/cron.te.execmem	2011-11-02 16:19:55.743799000 -0400

+++ serefpolicy-3.10.0/policy/modules/services/cron.te	2011-11-02 16:19:58.690541000 -0400

@@ -299,10 +299,6 @@ optional_policy(`

 ')

 optional_policy(`

-	mono_domtrans(crond_t)

-')

-

-optional_policy(`

 	amanda_search_var_lib(crond_t)

 ')

@@ -553,10 +549,6 @@ optional_policy(`

 ')

 optional_policy(`

-	mono_domtrans(system_cronjob_t)

-')

-

-optional_policy(`

 	mrtg_append_create_logs(system_cronjob_t)

 ')

@@ -710,11 +702,6 @@ tunable_policy(`fcron_crond',`

 	allow crond_t user_cron_spool_t:file manage_file_perms;

 ')

-# need a per-role version of this:

-#optional_policy(`

-#	mono_domtrans(cronjob_t)

-#')

-

 optional_policy(`

 	nis_use_ypbind(cronjob_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/services/hadoop.if.execmem serefpolicy-3.10.0/policy/modules/services/hadoop.if

--- serefpolicy-3.10.0/policy/modules/services/hadoop.if.execmem	2011-11-02 16:19:56.185713000 -0400

+++ serefpolicy-3.10.0/policy/modules/services/hadoop.if	2011-11-02 16:19:58.698541000 -0400

@@ -127,7 +127,7 @@ template(`hadoop_domain_template',`

 	hadoop_exec_config(hadoop_$1_t)

-	java_exec(hadoop_$1_t)

+	execmem_exec(hadoop_$1_t)

 	kerberos_use(hadoop_$1_t)

diff -up serefpolicy-3.10.0/policy/modules/services/hadoop.te.execmem serefpolicy-3.10.0/policy/modules/services/hadoop.te

--- serefpolicy-3.10.0/policy/modules/services/hadoop.te.execmem	2011-11-02 16:19:56.193713000 -0400

+++ serefpolicy-3.10.0/policy/modules/services/hadoop.te	2011-11-02 16:19:58.707541000 -0400

@@ -167,7 +167,7 @@ miscfiles_read_localization(hadoop_t)

 userdom_use_inherited_user_terminals(hadoop_t)

-java_exec(hadoop_t)

+execmem_exec(hadoop_t)

 kerberos_use(hadoop_t)

@@ -342,7 +342,7 @@ sysnet_read_config(zookeeper_t)

 userdom_use_inherited_user_terminals(zookeeper_t)

 userdom_dontaudit_search_user_home_dirs(zookeeper_t)

-java_exec(zookeeper_t)

+execmem_exec(zookeeper_t)

 ########################################

 #

@@ -427,4 +427,4 @@ miscfiles_read_localization(zookeeper_se

 sysnet_read_config(zookeeper_server_t)

-java_exec(zookeeper_server_t)

+execmem_exec(zookeeper_server_t)

diff -up serefpolicy-3.10.0/policy/modules/services/xserver.te.execmem serefpolicy-3.10.0/policy/modules/services/xserver.te

--- serefpolicy-3.10.0/policy/modules/services/xserver.te.execmem	2011-11-02 16:19:57.848627000 -0400

+++ serefpolicy-3.10.0/policy/modules/services/xserver.te	2011-11-02 16:19:58.744541000 -0400

@@ -1250,10 +1250,6 @@ optional_policy(`

 ')

 optional_policy(`

-	mono_rw_shm(xserver_t)

-')

-

-optional_policy(`

 	rhgb_rw_shm(xserver_t)

 	rhgb_rw_tmpfs_files(xserver_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/system/init.te.execmem serefpolicy-3.10.0/policy/modules/system/init.te

--- serefpolicy-3.10.0/policy/modules/system/init.te.execmem	2011-11-02 16:19:58.044541000 -0400

+++ serefpolicy-3.10.0/policy/modules/system/init.te	2011-11-02 16:19:58.757543000 -0400

@@ -1191,10 +1191,6 @@ optional_policy(`

 		unconfined_dontaudit_rw_pipes(daemon)

 	')

-	optional_policy(`

-		mono_domtrans(initrc_t)

-	')

-

 	# Allow SELinux aware applications to request rpm_script_t execution

 	rpm_transition_script(initrc_t)

diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.if.execmem serefpolicy-3.10.0/policy/modules/system/userdomain.if

--- serefpolicy-3.10.0/policy/modules/system/userdomain.if.execmem	2011-11-02 16:19:58.435541000 -0400

+++ serefpolicy-3.10.0/policy/modules/system/userdomain.if	2011-11-02 16:19:58.796541000 -0400

@@ -1281,14 +1281,6 @@ template(`userdom_unpriv_user_template',

 	')

 	optional_policy(`

-		java_role_template($1, $1_r, $1_t)

-	')

-

-	optional_policy(`

-		mono_role_template($1, $1_r, $1_t)

-	')

-

-	optional_policy(`

 		mount_run_fusermount($1_t, $1_r)

 		mount_read_pid_files($1_t)

 	')

diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.if~ serefpolicy-3.10.0/policy/modules/system/userdomain.if

--- serefpolicy-3.10.0/policy/modules/system/userdomain.if~	2011-11-04 13:31:34.537348883 -0400

+++ serefpolicy-3.10.0/policy/modules/system/userdomain.if	2011-11-04 15:02:50.404128186 -0400

@@ -84,7 +84,7 @@ template(`userdom_base_user_template',`

 ##	The user domain

 ##	</summary>

 ## </param>

-## <rolebase/>

+>## <rolebase/>

 #

 interface(`userdom_ro_home_role',`

 	gen_require(`

@@ -4705,3 +4705,39 @@ interface(`userdom_rw_unpriv_user_semaph

    allow $1 unpriv_userdomain:sem rw_sem_perms;

 ')

+

+#######################################

+## <summary>

+##	The Interface gives a domain the privs of a unpriv_userdomain

+## </summary>

+## <param name="userdomain">

+##	<summary>

+##	The user domain

+##	</summary>

+## </param>

+#

+template(`userdom_unpriv_user',`

+	gen_require(`

+		attribute unpriv_userdomain;

+	')

+

+	typeattribute $1 unpriv_userdomain;

+')

+

+#######################################

+## <summary>

+##	The Interface gives a domain the privs of a common_userdomain

+## </summary>

+## <param name="userdomain">

+##	<summary>

+##	The user domain

+##	</summary>

+## </param>

+#

+template(`userdom_common_user',`

+	gen_require(`

+		attribute common_userdomain;

+	')

+

+	typeattribute $1 common_userdomain;

+')