diff -up serefpolicy-3.10.0/policy/modules/kernel/devices.if.systemd serefpolicy-3.10.0/policy/modules/kernel/devices.if

--- serefpolicy-3.10.0/policy/modules/kernel/devices.if.systemd	2012-01-13 12:21:08.578666030 -0500

+++ serefpolicy-3.10.0/policy/modules/kernel/devices.if	2012-01-13 12:21:08.678669095 -0500

@@ -143,13 +143,13 @@ interface(`dev_relabel_all_dev_nodes',`

 		type device_t;

 	')

-	relabelfrom_dirs_pattern($1, device_t, device_node)

-	relabelfrom_files_pattern($1, device_t, device_node)

-	relabelfrom_lnk_files_pattern($1, device_t, { device_t device_node })

-	relabel_fifo_files_pattern($1, device_t,  { device_t device_node })

-	relabel_sock_files_pattern($1, device_t, { device_t device_node })

-	relabel_blk_files_pattern($1, device_t, { device_t device_node })

-	relabel_chr_files_pattern($1, device_t, { device_t device_node })

+	relabel_dirs_pattern($1, device_t, device_node)

+	relabel_files_pattern($1, device_t, device_node)

+	relabel_lnk_files_pattern($1, device_t, device_node)

+	relabel_fifo_files_pattern($1, device_t,  device_node)

+	relabel_sock_files_pattern($1, device_t, device_node)

+	relabel_blk_files_pattern($1, device_t, device_node)

+	relabel_chr_files_pattern($1, device_t, device_node)

 ')

 ########################################

@@ -4201,6 +4201,27 @@ interface(`dev_read_cpu_online',`

 ########################################

 ## <summary>

+##	Relabel cpu online hardware state information.

+## </summary>

+## <param name="domain">

+##	<summary>

+##	Domain allowed access.

+##	</summary>

+## </param>

+#

+interface(`dev_relabel_cpu_online',`

+	gen_require(`

+		type cpu_online_t;

+		type sysfs_t;

+	')

+

+	dev_search_sysfs($1)

+	allow $1 cpu_online_t:file relabel;

+')

+

+

+########################################

+## <summary>

 ##	Read hardware state information.

 ## </summary>

 ## <desc>

@@ -4269,6 +4290,26 @@ interface(`dev_relabel_sysfs_dirs',`

 ')

 ########################################

+## <summary>

+##	Relabel hardware state files

+## </summary>

+## <param name="domain">

+##	<summary>

+##	Domain allowed access.

+##	</summary>

+## </param>

+#

+interface(`dev_relabel_all_sysfs',`

+	gen_require(`

+		type sysfs_t;

+	')

+

+	relabel_dirs_pattern($1, sysfs_t, sysfs_t)

+	relabel_files_pattern($1, sysfs_t, sysfs_t)

+	relabel_lnk_files_pattern($1, sysfs_t, sysfs_t)

+')

+

+########################################

 ## <summary>

 ##	Allow caller to modify hardware state information.

 ## </summary>

diff -up serefpolicy-3.10.0/policy/modules/roles/staff.te.systemd serefpolicy-3.10.0/policy/modules/roles/staff.te

--- serefpolicy-3.10.0/policy/modules/roles/staff.te.systemd	2012-01-13 12:21:08.586666274 -0500

+++ serefpolicy-3.10.0/policy/modules/roles/staff.te	2012-01-13 12:21:08.678669095 -0500

@@ -70,6 +70,10 @@ optional_policy(`

 ')

 optional_policy(`

+	bluetooth_role(staff_r, staff_t)

+')

+

+optional_policy(`

 	dbadm_role_change(staff_r)

 ')

@@ -238,10 +242,6 @@ ifndef(`distro_redhat',`

 	')

 	optional_policy(`

-		bluetooth_role(staff_r, staff_t)

-	')

-

-	optional_policy(`

 		cdrecord_role(staff_r, staff_t)

 	')

diff -up serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.systemd serefpolicy-3.10.0/policy/modules/roles/unprivuser.te

--- serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.systemd	2012-01-13 12:21:08.586666274 -0500

+++ serefpolicy-3.10.0/policy/modules/roles/unprivuser.te	2012-01-13 12:21:08.678669095 -0500

@@ -35,6 +35,10 @@ optional_policy(`

 ')

 optional_policy(`

+	bluetooth_role(user_r, user_t)

+')

+

+optional_policy(`

 	colord_dbus_chat(user_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/services/apache.fc.systemd serefpolicy-3.10.0/policy/modules/services/apache.fc

--- serefpolicy-3.10.0/policy/modules/services/apache.fc.systemd	2012-01-13 12:21:08.589666367 -0500

+++ serefpolicy-3.10.0/policy/modules/services/apache.fc	2012-01-13 12:21:08.678669095 -0500

@@ -140,6 +140,8 @@ ifdef(`distro_debian', `

 /var/www/gallery/albums(/.*)?		gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)

+/var/www/moodledata(/.*)?		gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)

+

 /var/www/svn(/.*)?			gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)

 /var/www/svn/hooks(/.*)?		gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)

 /var/www/svn/conf(/.*)?			gen_context(system_u:object_r:httpd_sys_content_t,s0)

diff -up serefpolicy-3.10.0/policy/modules/services/blueman.te.systemd serefpolicy-3.10.0/policy/modules/services/blueman.te

--- serefpolicy-3.10.0/policy/modules/services/blueman.te.systemd	2012-01-13 12:21:08.594666519 -0500

+++ serefpolicy-3.10.0/policy/modules/services/blueman.te	2012-01-13 12:21:08.679669126 -0500

@@ -36,3 +36,7 @@ miscfiles_read_localization(blueman_t)

 optional_policy(`

 	avahi_domtrans(blueman_t)

 ')

+

+optional_policy(`

+	gnome_search_gconf(blueman_t)

+')

diff -up serefpolicy-3.10.0/policy/modules/services/entropyd.te.systemd serefpolicy-3.10.0/policy/modules/services/entropyd.te

--- serefpolicy-3.10.0/policy/modules/services/entropyd.te.systemd	2012-01-13 12:21:08.609666980 -0500

+++ serefpolicy-3.10.0/policy/modules/services/entropyd.te	2012-01-13 12:21:08.679669126 -0500

@@ -52,6 +52,8 @@ domain_use_interactive_fds(entropyd_t)

 logging_send_syslog_msg(entropyd_t)

+auth_use_nsswitch(entropyd_t)

+

 miscfiles_read_localization(entropyd_t)

 userdom_dontaudit_use_unpriv_user_fds(entropyd_t)

diff -up serefpolicy-3.10.0/policy/modules/services/virt.fc.systemd serefpolicy-3.10.0/policy/modules/services/virt.fc

--- serefpolicy-3.10.0/policy/modules/services/virt.fc.systemd	2012-01-13 12:21:08.653668329 -0500

+++ serefpolicy-3.10.0/policy/modules/services/virt.fc	2012-01-13 12:21:08.679669126 -0500

@@ -49,3 +49,7 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_

 # support for nova-stack

 /usr/bin/nova-compute       --  gen_context(system_u:object_r:virtd_exec_t,s0)

+/usr/bin/qemu		--	gen_context(system_u:object_r:qemu_exec_t,s0)

+/usr/bin/qemu-system-.*	--	gen_context(system_u:object_r:qemu_exec_t,s0)

+/usr/bin/qemu-kvm	--	gen_context(system_u:object_r:qemu_exec_t,s0)

+/usr/libexec/qemu.*	--	gen_context(system_u:object_r:qemu_exec_t,s0)

diff -up serefpolicy-3.10.0/policy/modules/system/init.te.systemd serefpolicy-3.10.0/policy/modules/system/init.te

diff -up serefpolicy-3.10.0/policy/modules/system/logging.fc.systemd serefpolicy-3.10.0/policy/modules/system/logging.fc

--- serefpolicy-3.10.0/policy/modules/system/logging.fc.systemd	2012-01-13 12:21:08.664668666 -0500

+++ serefpolicy-3.10.0/policy/modules/system/logging.fc	2012-01-13 12:21:11.123743804 -0500

@@ -61,6 +61,7 @@ ifdef(`distro_suse', `

 /var/log/spooler[^/]*		gen_context(system_u:object_r:var_log_t,mls_systemhigh)

 /var/log/audit(/.*)?		gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)

 /var/log/syslog-ng(/.*)? 	gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)

+/var/run/log(/.*)?		gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)

 ifndef(`distro_gentoo',`

 /var/log/audit\.log	--	gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)

diff -up serefpolicy-3.10.0/policy/modules/system/logging.te.systemd serefpolicy-3.10.0/policy/modules/system/logging.te

--- serefpolicy-3.10.0/policy/modules/system/logging.te.systemd	2012-01-13 12:21:08.665668696 -0500

+++ serefpolicy-3.10.0/policy/modules/system/logging.te	2012-01-13 12:21:11.123743804 -0500

@@ -386,7 +386,7 @@ optional_policy(`

 # chown fsetid for syslog-ng

 # sys_admin for the integrated klog of syslog-ng and metalog

 # cjp: why net_admin!

-allow syslogd_t self:capability { dac_override sys_resource sys_tty_config ipc_lock net_admin sys_admin sys_nice chown fsetid };

+allow syslogd_t self:capability { dac_override sys_resource sys_tty_config ipc_lock net_admin sys_admin sys_nice chown fsetid setuid setgid };

 dontaudit syslogd_t self:capability sys_tty_config;

 allow syslogd_t self:capability2 syslog;

 # setpgid for metalog

@@ -474,6 +474,7 @@ tunable_policy(`logging_syslogd_can_send

 dev_filetrans(syslogd_t, devlog_t, sock_file)

 dev_read_sysfs(syslogd_t)

 dev_read_rand(syslogd_t)

+dev_read_urand(syslogd_t)

 # relating to systemd-kmsg-syslogd

 dev_write_kmsg(syslogd_t)

@@ -497,6 +498,7 @@ mls_file_write_all_levels(syslogd_t) # N

 term_write_console(syslogd_t)

 # Allow syslog to a terminal

 term_write_unallocated_ttys(syslogd_t)

+term_use_generic_ptys(syslogd_t)

 init_stream_connect(syslogd_t)

 # for sending messages to logged in users

diff -up serefpolicy-3.10.0/policy/modules/system/sysnetwork.te.systemd serefpolicy-3.10.0/policy/modules/system/sysnetwork.te

--- serefpolicy-3.10.0/policy/modules/system/sysnetwork.te.systemd	2012-01-13 12:21:08.669668819 -0500

+++ serefpolicy-3.10.0/policy/modules/system/sysnetwork.te	2012-01-13 12:21:11.124743834 -0500

@@ -150,6 +150,8 @@ term_dontaudit_use_all_ptys(dhcpc_t)

 term_dontaudit_use_unallocated_ttys(dhcpc_t)

 term_dontaudit_use_generic_ptys(dhcpc_t)

+auth_use_nsswitch(dhcpc_t)

+

 init_rw_utmp(dhcpc_t)

 init_stream_connect(dhcpc_t)

 init_stream_send(dhcpc_t)

@@ -333,6 +335,7 @@ domain_use_interactive_fds(ifconfig_t)

 read_files_pattern(ifconfig_t, dhcpc_state_t, dhcpc_state_t)

+files_dontaudit_read_root_files(ifconfig_t)

 files_read_etc_files(ifconfig_t)

 files_read_etc_runtime_files(ifconfig_t)

 files_read_usr_files(ifconfig_t)

@@ -348,7 +351,7 @@ term_dontaudit_use_all_ptys(ifconfig_t)

 term_dontaudit_use_ptmx(ifconfig_t)

 term_dontaudit_use_generic_ptys(ifconfig_t)

-files_dontaudit_read_root_files(ifconfig_t)

+auth_use_nsswitch(ifconfig_t)

 init_use_fds(ifconfig_t)

 init_use_script_ptys(ifconfig_t)

@@ -359,7 +362,6 @@ logging_send_syslog_msg(ifconfig_t)

 miscfiles_read_localization(ifconfig_t)

-

 seutil_use_runinit_fds(ifconfig_t)

 sysnet_dns_name_resolve(ifconfig_t)

@@ -423,10 +425,6 @@ optional_policy(`

 ')

 optional_policy(`

-	nis_use_ypbind(ifconfig_t)

-')

-

-optional_policy(`

 	ppp_use_fds(ifconfig_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/system/systemd.if.systemd serefpolicy-3.10.0/policy/modules/system/systemd.if

--- serefpolicy-3.10.0/policy/modules/system/systemd.if.systemd	2012-01-13 12:21:08.669668819 -0500

+++ serefpolicy-3.10.0/policy/modules/system/systemd.if	2012-01-13 12:21:11.124743834 -0500

@@ -51,6 +51,9 @@ interface(`systemd_exec_systemctl',`

 	init_list_pid_dirs($1)

 	init_read_state($1)

 	init_stream_send($1)

+

+	systemd_login_list_pid_dirs($1)

+	systemd_login_read_pid_files($1)

 ')

 #######################################

diff -up serefpolicy-3.10.0/policy/modules/system/systemd.te.systemd serefpolicy-3.10.0/policy/modules/system/systemd.te

--- serefpolicy-3.10.0/policy/modules/system/systemd.te.systemd	2012-01-13 12:21:08.670668850 -0500

+++ serefpolicy-3.10.0/policy/modules/system/systemd.te	2012-01-13 12:21:11.124743834 -0500

@@ -111,6 +111,7 @@ init_dbus_chat(systemd_logind_t)

 init_dbus_chat_script(systemd_logind_t)

 init_read_script_state(systemd_logind_t)

 init_read_state(systemd_logind_t)

+init_rw_stream_sockets(systemd_logind_t)

 logging_send_syslog_msg(systemd_logind_t)

@@ -198,6 +199,8 @@ kernel_read_network_state(systemd_tmpfil

 files_delete_kernel_modules(systemd_tmpfiles_t)

 dev_write_kmsg(systemd_tmpfiles_t)

+dev_relabel_all_sysfs(systemd_tmpfiles_t)

+dev_read_cpu_online(systemd_tmpfiles_t)

 domain_obj_id_change_exemption(systemd_tmpfiles_t)

@@ -322,6 +325,8 @@ fs_getattr_cgroup_files(systemd_notify_t

 auth_use_nsswitch(systemd_notify_t)

+init_rw_stream_sockets(systemd_notify_t)

+

 miscfiles_read_localization(systemd_notify_t)

 optional_policy(`

diff -up serefpolicy-3.10.0/policy/modules/system/udev.te.systemd serefpolicy-3.10.0/policy/modules/system/udev.te

--- serefpolicy-3.10.0/policy/modules/system/udev.te.systemd	2012-01-13 12:21:08.670668850 -0500

+++ serefpolicy-3.10.0/policy/modules/system/udev.te	2012-01-13 12:21:11.124743834 -0500

@@ -333,6 +333,7 @@ optional_policy(`

 	kernel_read_xen_state(udev_t)

 	xen_manage_log(udev_t)

 	xen_read_image_files(udev_t)

+	xen_stream_connect_xenstore(udev_t)

 ')

 optional_policy(`

diff -up serefpolicy-3.10.0/policy/modules/system/xen.fc.systemd serefpolicy-3.10.0/policy/modules/system/xen.fc

--- serefpolicy-3.10.0/policy/modules/system/xen.fc.systemd	2012-01-13 12:21:08.673668943 -0500

+++ serefpolicy-3.10.0/policy/modules/system/xen.fc	2012-01-13 12:21:11.125743864 -0500

@@ -4,7 +4,7 @@

 /usr/sbin/evtchnd	--	gen_context(system_u:object_r:evtchnd_exec_t,s0)

 /usr/sbin/tapdisk	--	gen_context(system_u:object_r:blktap_exec_t,s0)

-/usr/lib/xen/bin/qemu-dm	-- gen_context(system_u:object_r:qemu_dm_exec_t,s0)

+#/usr/lib/xen/bin/qemu-dm	-- gen_context(system_u:object_r:qemu_dm_exec_t,s0)

 ifdef(`distro_debian',`

 /usr/lib/xen-[^/]*/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0)

diff -up serefpolicy-3.10.0/policy/modules/system/xen.te.systemd serefpolicy-3.10.0/policy/modules/system/xen.te

--- serefpolicy-3.10.0/policy/modules/system/xen.te.systemd	2012-01-13 12:21:08.673668943 -0500

+++ serefpolicy-3.10.0/policy/modules/system/xen.te	2012-01-13 12:21:11.125743864 -0500

@@ -167,6 +167,10 @@ files_pid_filetrans(evtchnd_t, evtchnd_v

 #

 # qemu-dm local policy

 #

+

+# TODO: This part of policy should be removed

+#       qemu-dm should run in xend_t domain

+

 # Do we need to allow execution of qemu-dm?

 tunable_policy(`xend_run_qemu',`

 	allow qemu_dm_t self:capability sys_resource;

@@ -207,6 +211,11 @@ tunable_policy(`xend_run_qemu',`

 allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_admin sys_nice sys_tty_config net_raw };

 allow xend_t self:process { signal sigkill };

+

+# needed by qemu_dm

+allow xend_t self:capability sys_resource;

+allow xend_t self:process setrlimit;

+

 dontaudit xend_t self:process ptrace;

 # internal communication is often done using fifo and unix sockets.

 allow xend_t self:fifo_file rw_fifo_file_perms;

@@ -319,7 +328,6 @@ logging_send_syslog_msg(xend_t)

 miscfiles_read_localization(xend_t)

 miscfiles_read_hwdata(xend_t)

-

 sysnet_domtrans_dhcpc(xend_t)

 sysnet_signal_dhcpc(xend_t)

 sysnet_domtrans_ifconfig(xend_t)