commit cfa63bfedb3b94a2b78bc3ee394cf7132167e45b

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 02:18:29 2012 +0200

    roleattribute patch

diff --git a/policy/modules/admin/bootloader.if b/policy/modules/admin/bootloader.if

index 4a50807..5e914db 100644

--- a/policy/modules/admin/bootloader.if

+++ b/policy/modules/admin/bootloader.if

@@ -56,11 +56,21 @@ interface(`bootloader_exec',`

 #

 interface(`bootloader_run',`

 	gen_require(`

-		attribute_role bootloader_roles;

+		type bootloader_t;

+		#attribute_role bootloader_roles;

 	')

+	#bootloader_domtrans($1)

+	#roleattribute $2 bootloader_roles;

+

 	bootloader_domtrans($1)

-	roleattribute $2 bootloader_roles;

+

+        role $2 types bootloader_t;

+

+        ifdef(`distro_redhat',`

+                # for mke2fs

+		mount_run(bootloader_t, $2)

+	')

 ')

 ########################################

diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te

index 81a08e4..e717a21 100644

--- a/policy/modules/admin/bootloader.te

+++ b/policy/modules/admin/bootloader.te

@@ -5,8 +5,8 @@ policy_module(bootloader, 1.13.0)

 # Declarations

 #

-attribute_role bootloader_roles;

-roleattribute system_r bootloader_roles;

+#attribute_role bootloader_roles;

+#roleattribute system_r bootloader_roles;

 #

 # boot_runtime_t is the type for /boot/kernel.h,

@@ -19,7 +19,8 @@ files_type(boot_runtime_t)

 type bootloader_t;

 type bootloader_exec_t;

 application_domain(bootloader_t, bootloader_exec_t)

-role bootloader_roles types bootloader_t;

+#role bootloader_roles types bootloader_t;

+role system_r types bootloader_t;

 #

 # bootloader_etc_t is the configuration file,

@@ -174,7 +175,8 @@ ifdef(`distro_redhat',`

 	files_manage_isid_type_chr_files(bootloader_t)

 	# for mke2fs

-	mount_run(bootloader_t, bootloader_roles)

+	#mount_run(bootloader_t, bootloader_roles)

+	mount_domtrans(bootloader_t)

 	optional_policy(`

 		unconfined_domain(bootloader_t)

diff --git a/policy/modules/admin/usermanage.if b/policy/modules/admin/usermanage.if

index 4d387af..764260e 100644

--- a/policy/modules/admin/usermanage.if

+++ b/policy/modules/admin/usermanage.if

@@ -37,11 +37,16 @@ interface(`usermanage_domtrans_chfn',`

 #

 interface(`usermanage_run_chfn',`

 	gen_require(`

-		attribute_role chfn_roles;

+		#attribute_role chfn_roles;

+		type chfn_t;

 	')

+	#usermanage_domtrans_chfn($1)

+	#roleattribute $2 chfn_roles;

+

 	usermanage_domtrans_chfn($1)

-	roleattribute $2 chfn_roles;

+        role $2 types chfn_t;

+

 ')

 ########################################

@@ -101,11 +106,19 @@ interface(`usermanage_access_check_groupadd',`

 #

 interface(`usermanage_run_groupadd',`

 	gen_require(`

-		attribute_role groupadd_roles;

+		type groupadd_t;

+		#attribute_role groupadd_roles;

 	')

+	#usermanage_domtrans_groupadd($1)

+	#roleattribute $2 groupadd_roles;

 	usermanage_domtrans_groupadd($1)

-	roleattribute $2 groupadd_roles;

+        role $2 types groupadd_t;

+

+        optional_policy(`

+                nscd_run(groupadd_t, $2)

+        ')

+

 ')

 ########################################

@@ -163,11 +176,17 @@ interface(`usermanage_kill_passwd',`

 #

 interface(`usermanage_run_passwd',`

 	gen_require(`

-		attribute_role passwd_roles;

+		type type passwd_t;

+		#attribute_role passwd_roles;

 	')

+	#usermanage_domtrans_passwd($1)

+	#roleattribute $2 passwd_roles;

+

 	usermanage_domtrans_passwd($1)

-	roleattribute $2 passwd_roles;

+        role $2 types passwd_t;

+        auth_run_chk_passwd(passwd_t, $2)

+

 ')

 ########################################

@@ -229,11 +248,20 @@ interface(`usermanage_domtrans_admin_passwd',`

 #

 interface(`usermanage_run_admin_passwd',`

 	gen_require(`

-		attribute_role sysadm_passwd_roles;

+		type sysadm_passwd_t;

+		#attribute_role sysadm_passwd_roles;

 	')

+	#usermanage_domtrans_admin_passwd($1)

+	#roleattribute $2 sysadm_passwd_roles;

+

 	usermanage_domtrans_admin_passwd($1)

-	roleattribute $2 sysadm_passwd_roles;

+        role $2 types sysadm_passwd_t;

+

+        optional_policy(`

+                nscd_run(sysadm_passwd_t, $2)

+        ')

+

 ')

 ########################################

@@ -292,11 +320,20 @@ interface(`usermanage_domtrans_useradd',`

 #

 interface(`usermanage_run_useradd',`

 	gen_require(`

-		attribute_role useradd_roles;

+		#attribute_role useradd_roles;

+		type sysadm_passwd_t;

 	')

-	usermanage_domtrans_useradd($1)

-	roleattribute $2 useradd_roles;

+	#usermanage_domtrans_useradd($1)

+	#roleattribute $2 useradd_roles;

+

+	usermanage_domtrans_admin_passwd($1)

+        role $2 types sysadm_passwd_t;

+

+        optional_policy(`

+                nscd_run(sysadm_passwd_t, $2)

+        ')

+

 ')

 ########################################

diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te

index 446b743..a077b28 100644

--- a/policy/modules/admin/usermanage.te

+++ b/policy/modules/admin/usermanage.te

@@ -5,18 +5,18 @@ policy_module(usermanage, 1.17.3)

 # Declarations

 #

-attribute_role chfn_roles;

-role system_r types chfn_t;

+#attribute_role chfn_roles;

+#role system_r types chfn_t;

-attribute_role groupadd_roles;

+#attribute_role groupadd_roles;

-attribute_role passwd_roles;

-roleattribute system_r passwd_roles;

+#attribute_role passwd_roles;

+#roleattribute system_r passwd_roles;

-attribute_role sysadm_passwd_roles;

-roleattribute system_r sysadm_passwd_roles;

+#attribute_role sysadm_passwd_roles;

+#roleattribute system_r sysadm_passwd_roles;

-attribute_role useradd_roles;

+#attribute_role useradd_roles;

 type admin_passwd_exec_t;

 files_type(admin_passwd_exec_t)

@@ -25,7 +25,8 @@ type chfn_t;

 type chfn_exec_t;

 domain_obj_id_change_exemption(chfn_t)

 application_domain(chfn_t, chfn_exec_t)

-role chfn_roles types chfn_t;

+#role chfn_roles types chfn_t;

+role system_r types chfn_t;

 type crack_t;

 type crack_exec_t;

@@ -42,18 +43,21 @@ type groupadd_t;

 type groupadd_exec_t;

 domain_obj_id_change_exemption(groupadd_t)

 init_system_domain(groupadd_t, groupadd_exec_t)

-role groupadd_roles types groupadd_t;

+#role groupadd_roles types groupadd_t;

+

 type passwd_t;

 type passwd_exec_t;

 domain_obj_id_change_exemption(passwd_t)

 application_domain(passwd_t, passwd_exec_t)

-role passwd_roles types passwd_t;

+#role passwd_roles types passwd_t;

+role system_r types passwd_t;

 type sysadm_passwd_t;

 domain_obj_id_change_exemption(sysadm_passwd_t)

 application_domain(sysadm_passwd_t, admin_passwd_exec_t)

-role sysadm_passwd_roles types sysadm_passwd_t;

+#role sysadm_passwd_roles types sysadm_passwd_t;

+role system_r types sysadm_passwd_t;

 type sysadm_passwd_tmp_t;

 files_tmp_file(sysadm_passwd_tmp_t)

@@ -62,7 +66,8 @@ type useradd_t;

 type useradd_exec_t;

 domain_obj_id_change_exemption(useradd_t)

 init_system_domain(useradd_t, useradd_exec_t)

-role useradd_roles types useradd_t;

+#role useradd_roles types useradd_t;

+role system_r types useradd_t;

 ########################################

 #

@@ -106,11 +111,11 @@ fs_search_auto_mountpoints(chfn_t)

 dev_read_urand(chfn_t)

 dev_dontaudit_getattr_all(chfn_t)

-#auth_manage_passwd(chfn_t)

-#auth_use_pam(chfn_t)

-auth_run_chk_passwd(chfn_t, chfn_roles)

-auth_dontaudit_read_shadow(chfn_t)

-auth_use_nsswitch(chfn_t)

+auth_manage_passwd(chfn_t)

+auth_use_pam(chfn_t)

+#auth_run_chk_passwd(chfn_t, chfn_roles)

+#auth_dontaudit_read_shadow(chfn_t)

+#auth_use_nsswitch(chfn_t)

 # allow checking if a shell is executable

 corecmd_check_exec_shell(chfn_t)

@@ -250,7 +255,8 @@ logging_send_syslog_msg(groupadd_t)

 miscfiles_read_localization(groupadd_t)

-auth_run_chk_passwd(groupadd_t, groupadd_roles)

+#auth_run_chk_passwd(groupadd_t, groupadd_roles)

+auth_domtrans_chk_passwd(groupadd_t)

 auth_rw_lastlog(groupadd_t)

 auth_use_nsswitch(groupadd_t)

 auth_manage_passwd(groupadd_t)

@@ -273,7 +279,8 @@ optional_policy(`

 ')

 optional_policy(`

-	nscd_run(groupadd_t, groupadd_roles)

+#	nscd_run(groupadd_t, groupadd_roles)

+	nscd_domtrans(groupadd_t)

 ')

 optional_policy(`

@@ -332,18 +339,18 @@ selinux_compute_user_contexts(passwd_t)

 term_use_all_inherited_terms(passwd_t)

 term_getattr_all_ptys(passwd_t)

-#auth_manage_passwd(passwd_t)

-#auth_manage_shadow(passwd_t)

-#auth_relabel_shadow(passwd_t)

-#auth_etc_filetrans_shadow(passwd_t)

-#auth_use_pam(passwd_t)

-

-auth_run_chk_passwd(passwd_t, passwd_roles)

 auth_manage_passwd(passwd_t)

 auth_manage_shadow(passwd_t)

 auth_relabel_shadow(passwd_t)

 auth_etc_filetrans_shadow(passwd_t)

-auth_use_nsswitch(passwd_t)

+auth_use_pam(passwd_t)

+

+#auth_run_chk_passwd(passwd_t, passwd_roles)

+#auth_manage_passwd(passwd_t)

+#auth_manage_shadow(passwd_t)

+#auth_relabel_shadow(passwd_t)

+#auth_etc_filetrans_shadow(passwd_t)

+#auth_use_nsswitch(passwd_t)

 # allow checking if a shell is executable

 corecmd_check_exec_shell(passwd_t)

@@ -385,7 +392,8 @@ userdom_dontaudit_search_user_home_content(passwd_t)

 userdom_stream_connect(passwd_t)

 optional_policy(`

-	nscd_run(passwd_t, passwd_roles)

+	#nscd_run(passwd_t, passwd_roles)

+	nscd_domtrans(passwd_t)

 ')

 ########################################

@@ -469,7 +477,8 @@ userdom_use_unpriv_users_fds(sysadm_passwd_t)

 userdom_dontaudit_search_user_home_content(sysadm_passwd_t)

 optional_policy(`

-	nscd_run(sysadm_passwd_t, sysadm_passwd_roles)

+	nscd_domtrans(sysadm_passwd_t)

+	#nscd_run(sysadm_passwd_t, sysadm_passwd_roles)

 ')

 ########################################

@@ -525,7 +534,8 @@ seutil_manage_default_contexts(useradd_t)

 term_use_all_inherited_terms(useradd_t)

 term_getattr_all_ptys(useradd_t)

-auth_run_chk_passwd(useradd_t, useradd_roles)

+#auth_run_chk_passwd(useradd_t, useradd_roles)

+auth_domtrans_chk_passwd(useradd_t)

 auth_rw_lastlog(useradd_t)

 auth_rw_faillog(useradd_t)

 auth_use_nsswitch(useradd_t)

@@ -547,15 +557,15 @@ miscfiles_read_localization(useradd_t)

 seutil_read_config(useradd_t)

 seutil_read_file_contexts(useradd_t)

 seutil_read_default_contexts(useradd_t)

-#seutil_domtrans_semanage(useradd_t)

-#seutil_domtrans_setfiles(useradd_t)

-#seutil_domtrans_loadpolicy(useradd_t)

-#seutil_manage_bin_policy(useradd_t)

-#seutil_manage_module_store(useradd_t)

-#seutil_get_semanage_trans_lock(useradd_t)

-#seutil_get_semanage_read_lock(useradd_t)

-seutil_run_semanage(useradd_t, useradd_roles)

-seutil_run_setfiles(useradd_t, useradd_roles)

+seutil_domtrans_semanage(useradd_t)

+seutil_domtrans_setfiles(useradd_t)

+seutil_domtrans_loadpolicy(useradd_t)

+seutil_manage_bin_policy(useradd_t)

+seutil_manage_module_store(useradd_t)

+seutil_get_semanage_trans_lock(useradd_t)

+seutil_get_semanage_read_lock(useradd_t)

+#seutil_run_semanage(useradd_t, useradd_roles)

+#seutil_run_setfiles(useradd_t, useradd_roles)

 userdom_use_unpriv_users_fds(useradd_t)

 # Add/remove user home directories

@@ -576,7 +586,8 @@ optional_policy(`

 ')

 optional_policy(`

-	nscd_run(useradd_t, useradd_roles)

+	nscd_domtrans(useradd_t)

+#	nscd_run(useradd_t, useradd_roles)

 ')

 optional_policy(`

diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if

index 174cfdb..7071460 100644

--- a/policy/modules/system/iptables.if

+++ b/policy/modules/system/iptables.if

@@ -38,11 +38,22 @@ interface(`iptables_domtrans',`

 #

 interface(`iptables_run',`

 	gen_require(`

-		attribute_role iptables_roles;

+		#attribute_role iptables_roles;

+		type iptables_t;

 	')

+	#iptables_domtrans($1)

+	#roleattribute $2 iptables_roles;

+

 	iptables_domtrans($1)

-	roleattribute $2 iptables_roles;

+        role $2 types iptables_t;

+

+        sysnet_run_ifconfig(iptables_t, $2)

+

+        optional_policy(`

+                modutils_run_insmod(iptables_t, $2)

+        ')

+

 ')

 ########################################

diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te

index cc8d773..36e02fa 100644

--- a/policy/modules/system/iptables.te

+++ b/policy/modules/system/iptables.te

@@ -5,13 +5,14 @@ policy_module(iptables, 1.13.0)

 # Declarations

 #

-attribute_role iptables_roles;

-roleattribute system_r iptables_roles;

+#attribute_role iptables_roles;

+#roleattribute system_r iptables_roles;

 type iptables_t;

 type iptables_exec_t;

 init_system_domain(iptables_t, iptables_exec_t)

-role iptables_roles types iptables_t;

+#role iptables_roles types iptables_t;

+role system_r types iptables_t;

 type iptables_initrc_exec_t;

 init_script_file(iptables_initrc_exec_t)

@@ -97,7 +98,8 @@ logging_send_syslog_msg(iptables_t)

 miscfiles_read_localization(iptables_t)

-sysnet_run_ifconfig(iptables_t, iptables_roles)

+#sysnet_run_ifconfig(iptables_t, iptables_roles)

+sysnet_domtrans_ifconfig(iptables_t)

 sysnet_dns_name_resolve(iptables_t)

 userdom_use_inherited_user_terminals(iptables_t)

@@ -119,7 +121,8 @@ optional_policy(`

 ')

 optional_policy(`

-	modutils_run_insmod(iptables_t, iptables_roles)

+	modutils_domtrans_insmod(iptables_t)

+	#modutils_run_insmod(iptables_t, iptables_roles)

 ')

 optional_policy(`

diff --git a/policy/modules/system/modutils.if b/policy/modules/system/modutils.if

index 786f87a..2debedc 100644

--- a/policy/modules/system/modutils.if

+++ b/policy/modules/system/modutils.if

@@ -345,11 +345,18 @@ interface(`modutils_domtrans_update_mods',`

 #

 interface(`modutils_run_update_mods',`

 	gen_require(`

-		attribute_role update_modules_roles;

+		#attribute_role update_modules_roles;

+		type update_modules_t;

 	')

+	#modutils_domtrans_update_mods($1)

+	#roleattribute $2 update_modules_roles;

+

 	modutils_domtrans_update_mods($1)

-	roleattribute $2 update_modules_roles;

+	role $2 types update_modules_t;

+

+	modutils_run_insmod(update_modules_t, $2)

+

 ')

 ########################################

diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te

index b83608d..86a7107 100644

--- a/policy/modules/system/modutils.te

+++ b/policy/modules/system/modutils.te

@@ -5,7 +5,7 @@ policy_module(modutils, 1.12.1)

 # Declarations

 #

-attribute_role update_modules_roles;

+#attribute_role update_modules_roles;

 type depmod_t;

 type depmod_exec_t;

@@ -30,8 +30,9 @@ files_type(modules_dep_t)

 type update_modules_t;

 type update_modules_exec_t;

 init_system_domain(update_modules_t, update_modules_exec_t)

-roleattribute system_r update_modules_roles;

-role update_modules_roles types update_modules_t;

+#roleattribute system_r update_modules_roles;

+#role update_modules_roles types update_modules_t;

+role system_r types update_modules_t;

 type update_modules_tmp_t;

 files_tmp_file(update_modules_tmp_t)

@@ -318,7 +319,7 @@ logging_send_syslog_msg(update_modules_t)

 miscfiles_read_localization(update_modules_t)

-modutils_run_insmod(update_modules_t, update_modules_roles)

+#modutils_run_insmod(update_modules_t, update_modules_roles)

 userdom_use_inherited_user_terminals(update_modules_t)

 userdom_dontaudit_search_user_home_dirs(update_modules_t)

diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if

index 52e78b8..4881d86 100644

--- a/policy/modules/system/mount.if

+++ b/policy/modules/system/mount.if

@@ -44,11 +44,36 @@ interface(`mount_domtrans',`

 #

 interface(`mount_run',`

 	gen_require(`

-		attribute_role mount_roles;

+		#attribute_role mount_roles;

+		type mount_t;

 	')

+	#mount_domtrans($1)

+	#roleattribute $2 mount_roles;

+

 	mount_domtrans($1)

-	roleattribute $2 mount_roles;

+        role $2 types mount_t;

+

+        optional_policy(`

+                fstools_run(mount_t, $2)

+        ')

+

+	optional_policy(`

+                lvm_run(mount_t, $2)

+        ')

+

+        optional_policy(`

+                modutils_run_insmod(mount_t, $2)

+        ')

+

+        optional_policy(`

+                rpc_run_rpcd(mount_t, $2)

+        ')

+

+        optional_policy(`

+                samba_run_smbmount(mount_t, $2)

+        ')

+

 ')

 ########################################

diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te

index cc76452..14320fe 100644

--- a/policy/modules/system/mount.te

+++ b/policy/modules/system/mount.te

@@ -12,13 +12,14 @@ policy_module(mount, 1.14.2)

 ## </desc>

 gen_tunable(allow_mount_anyfile, false)

-attribute_role mount_roles;

-roleattribute system_r mount_roles;

+#attribute_role mount_roles;

+#roleattribute system_r mount_roles;

 type mount_t;

 type mount_exec_t;

 init_system_domain(mount_t, mount_exec_t)

-role mount_roles types mount_t;

+#role mount_roles types mount_t;

+role system_r types mount_t;

 type fusermount_exec_t;

 domain_entry_file(mount_t, fusermount_exec_t)

@@ -286,25 +287,28 @@ optional_policy(`

 # Needed for mount crypt https://bugzilla.redhat.com/show_bug.cgi?id=418711

 optional_policy(`

-	lvm_run(mount_t, mount_roles)

+#	lvm_run(mount_t, mount_roles)

+	lvm_domtrans(mount_t)

 ')

 optional_policy(`

-	modutils_run_insmod(mount_t, mount_roles)

+	#modutils_run_insmod(mount_t, mount_roles)

+	modutils_domtrans_insmod(mount_t)

 	modutils_read_module_deps(mount_t)

 ')

 optional_policy(`

-	fstools_run(mount_t, mount_roles)

+	fstools_domtrans(mount_t)

+	#fstools_run(mount_t, mount_roles)

 ')

 optional_policy(`

 	rhcs_stream_connect_gfs_controld(mount_t)

 ')

-optional_policy(`

-	rpc_run_rpcd(mount_t, mount_roles)

-')

+#optional_policy(`

+#	rpc_run_rpcd(mount_t, mount_roles)

+#')

 # for kernel package installation

 optional_policy(`

@@ -314,7 +318,8 @@ optional_policy(`

 optional_policy(`

 	samba_read_config(mount_t)

-	samba_run_smbmount(mount_t, mount_roles)

+	samba_domtrans_smbmount(mount_t)

+	#samba_run_smbmount(mount_t, mount_roles)

 ')

 optional_policy(`

diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if

index a853819..cebf588 100644

--- a/policy/modules/system/selinuxutil.if

+++ b/policy/modules/system/selinuxutil.if

@@ -192,11 +192,22 @@ interface(`seutil_domtrans_newrole',`

 #

 interface(`seutil_run_newrole',`

 	gen_require(`

-		attribute_role newrole_roles;

+		type newrole_t;

+		#attribute_role newrole_roles;

 	')

+	#seutil_domtrans_newrole($1)

+	#roleattribute $2 newrole_roles;

+

 	seutil_domtrans_newrole($1)

-	roleattribute $2 newrole_roles;

+        role $2 types newrole_t;

+

+        auth_run_upd_passwd(newrole_t, $2)

+

+        optional_policy(`

+                namespace_init_run(newrole_t, $2)

+        ')

+

 ')

 ########################################

diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te

index 2aee0c0..4c24e3e 100644

--- a/policy/modules/system/selinuxutil.te

+++ b/policy/modules/system/selinuxutil.te

@@ -14,7 +14,7 @@ attribute can_relabelto_binary_policy;

 attribute setfiles_domain;

 attribute seutil_semanage_domain;

-attribute_role newrole_roles;

+#attribute_role newrole_roles;

 attribute_role run_init_roles;

 role system_r types run_init_t;

@@ -65,7 +65,8 @@ application_domain(newrole_t, newrole_exec_t)

 domain_role_change_exemption(newrole_t)

 domain_obj_id_change_exemption(newrole_t)

 domain_interactive_fd(newrole_t)

-role newrole_roles types newrole_t;

+#role newrole_roles types newrole_t;

+role system_r types newrole_t;

 #

 # policy_config_t is the type of /etc/security/selinux/*

@@ -299,10 +300,11 @@ term_relabel_all_ptys(newrole_t)

 term_getattr_unallocated_ttys(newrole_t)

 term_dontaudit_use_unallocated_ttys(newrole_t)

-auth_use_nsswitch(newrole_t)

-auth_run_chk_passwd(newrole_t, newrole_roles)

-auth_run_upd_passwd(newrole_t, newrole_roles)

-auth_rw_faillog(newrole_t)

+#auth_use_nsswitch(newrole_t)

+#auth_run_chk_passwd(newrole_t, newrole_roles)

+#auth_run_upd_passwd(newrole_t, newrole_roles)

+#auth_rw_faillog(newrole_t)

+auth_use_pam(newrole_t)

 # Write to utmp.

 init_rw_utmp(newrole_t)

@@ -322,9 +324,9 @@ optional_policy(`

     dbus_system_bus_client(newrole_t)

 ')

-optional_policy(`

-	namespace_init_run(newrole_t, newrole_roles)

-')

+#optional_policy(`

+#	namespace_init_run(newrole_t, newrole_roles)

+#')

 optional_policy(`

diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if

index 7b08f77..949fdcc 100644

--- a/policy/modules/system/sysnetwork.if

+++ b/policy/modules/system/sysnetwork.if

@@ -38,11 +38,47 @@ interface(`sysnet_domtrans_dhcpc',`

 #

 interface(`sysnet_run_dhcpc',`

 	gen_require(`

-		attribute_role dhcpc_roles;

+		type dhcpc_t;

+		#attribute_role dhcpc_roles;

 	')

+	#sysnet_domtrans_dhcpc($1)

+	#roleattribute $2 dhcpc_roles;

+

 	sysnet_domtrans_dhcpc($1)

-	roleattribute $2 dhcpc_roles;

+        role $2 types dhcpc_t;

+

+        modutils_run_insmod(dhcpc_t, $2)

+

+        sysnet_run_ifconfig(dhcpc_t, $2)

+

+        optional_policy(`

+                hostname_run(dhcpc_t, $2)

+        ')

+

+        optional_policy(`

+                netutils_run(dhcpc_t, $2)

+                netutils_run_ping(dhcpc_t, $2)

+        ')

+

+        optional_policy(`

+                networkmanager_run(dhcpc_t, $2)

+        ')

+

+        optional_policy(`

+                nis_run_ypbind(dhcpc_t, $2)

+        ')

+

+        optional_policy(`

+                nscd_run(dhcpc_t, $2)

+        ')

+

+        optional_policy(`

+                ntp_run(dhcpc_t, $2)

+        ')

+

+        seutil_run_setfiles(dhcpc_t, $2)

+

 ')

 ########################################

diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te

index 2d2b6ef..1bfcd4f 100644

--- a/policy/modules/system/sysnetwork.te

+++ b/policy/modules/system/sysnetwork.te

@@ -12,8 +12,8 @@ policy_module(sysnetwork, 1.13.2)

 ## </desc>

 gen_tunable(dhcpc_exec_iptables, false)

-attribute_role dhcpc_roles;

-roleattribute system_r dhcpc_roles;

+#attribute_role dhcpc_roles;

+#roleattribute system_r dhcpc_roles;

 # this is shared between dhcpc and dhcpd:

 type dhcp_etc_t;

@@ -27,7 +27,8 @@ files_type(dhcp_state_t)

 type dhcpc_t;

 type dhcpc_exec_t;

 init_daemon_domain(dhcpc_t, dhcpc_exec_t)

-role dhcpc_roles types dhcpc_t;

+#role dhcpc_roles types dhcpc_t;

+role system_r types dhcpc_t;

 type dhcpc_helper_exec_t;

 init_script_file(dhcpc_helper_exec_t)

@@ -159,9 +160,10 @@ logging_send_syslog_msg(dhcpc_t)

 miscfiles_read_generic_certs(dhcpc_t)

 miscfiles_read_localization(dhcpc_t)

-modutils_run_insmod(dhcpc_t, dhcpc_roles)

+#modutils_run_insmod(dhcpc_t, dhcpc_roles)

+modutils_domtrans_insmod(dhcpc_t)

+#sysnet_run_ifconfig(dhcpc_t, dhcpc_roles)

-sysnet_run_ifconfig(dhcpc_t, dhcpc_roles)

 userdom_use_user_terminals(dhcpc_t)

 userdom_dontaudit_search_user_home_dirs(dhcpc_t)

@@ -176,9 +178,9 @@ ifdef(`distro_ubuntu',`

 	')

 ')

-optional_policy(`

-	consoletype_run(dhcpc_t, dhcpc_roles)

-')

+#optional_policy(`

+#	consoletype_run(dhcpc_t, dhcpc_roles)

+#')

 optional_policy(`

 	chronyd_initrc_domtrans(dhcpc_t)

@@ -203,7 +205,8 @@ optional_policy(`

 ')

 optional_policy(`

-	hostname_run(dhcpc_t, dhcpc_roles)

+	hostname_domtrans(dhcpc_t)

+#	hostname_run(dhcpc_t, dhcpc_roles)

 ')

 optional_policy(`

commit 0a0c8b9d35398f3662db1b0bdb2f4c7761121ba1

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 02:26:53 2012 +0200

    roleattribute patch for passwd_t

diff --git a/policy/modules/admin/usermanage.if b/policy/modules/admin/usermanage.if

index 764260e..da75471 100644

--- a/policy/modules/admin/usermanage.if

+++ b/policy/modules/admin/usermanage.if

@@ -176,7 +176,7 @@ interface(`usermanage_kill_passwd',`

 #

 interface(`usermanage_run_passwd',`

 	gen_require(`

-		type type passwd_t;

+		type passwd_t;

 		#attribute_role passwd_roles;

 	')

commit 0b71245f63ddbb6ca00790fa5318db798286d8d8

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 02:38:28 2012 +0200

    Fix also for sysnetwork.te

diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te

index 1bfcd4f..3a94d52 100644

--- a/policy/modules/system/sysnetwork.te

+++ b/policy/modules/system/sysnetwork.te

@@ -226,8 +226,10 @@ optional_policy(`

 # for the dhcp client to run ping to check IP addresses

 optional_policy(`

-	netutils_run_ping(dhcpc_t, dhcpc_roles)

-	netutils_run(dhcpc_t, dhcpc_roles)

+	#netutils_run_ping(dhcpc_t, dhcpc_roles)

+	#netutils_run(dhcpc_t, dhcpc_roles)

+	netutils_domtrans_ping(dhcpc_t)

+        netutils_domtrans(dhcpc_t

 ',`

 	allow dhcpc_t self:capability setuid;

 	allow dhcpc_t self:rawip_socket create_socket_perms;

commit fdfc3cf8dbc69bda177afe16e78a52891cb6da4a

Author: Miroslav Grepl <mgrepl@redhat.com>

Date:   Thu Jun 7 02:41:48 2012 +0200

    Other

diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te

index 3a94d52..6a6f03f 100644

--- a/policy/modules/system/sysnetwork.te

+++ b/policy/modules/system/sysnetwork.te

@@ -229,7 +229,7 @@ optional_policy(`

 	#netutils_run_ping(dhcpc_t, dhcpc_roles)

 	#netutils_run(dhcpc_t, dhcpc_roles)

 	netutils_domtrans_ping(dhcpc_t)

-        netutils_domtrans(dhcpc_t