From 211fb9932a7c6f805a7a018901d4b52384f5fc9d Mon Sep 17 00:00:00 2001
From: Miroslav Grepl <mgrepl@redhat.com>
Date: Jun 20 2014 14:27:18 +0000
Subject: * Fri Jun 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-61

- Add back MLS policy

---

diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 83ee110..0c11554 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -27856,7 +27856,7 @@ index edece47..cb014fd 100644
  ')
  
 diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
-index 948ce2a..1b38e87 100644
+index 948ce2a..8cab8ae 100644
 --- a/policy/modules/system/fstools.fc
 +++ b/policy/modules/system/fstools.fc
 @@ -1,4 +1,3 @@
@@ -27872,7 +27872,7 @@ index 948ce2a..1b38e87 100644
  /sbin/parted		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partprobe		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partx		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -36,14 +34,53 @@
+@@ -36,14 +34,55 @@
  /sbin/swapoff		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/swapon.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/tune2fs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -27920,8 +27920,10 @@ index 948ce2a..1b38e87 100644
 +/usr/sbin/scsi_info	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 +/usr/sbin/sfdisk	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
  /usr/sbin/smartctl	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
++/usr/sbin/swapoff	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 +/usr/sbin/swapon.*	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 +/usr/sbin/tune2fs	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
++/usr/sbin/xfs_growfs    --  gen_context(system_u:object_r:fsadm_exec_t,s0)
  
  /var/log/fsck(/.*)?		gen_context(system_u:object_r:fsadm_log_t,s0)
 +
@@ -29903,7 +29905,7 @@ index 79a45f6..89b43aa 100644
 +	files_etc_filetrans($1, machineid_t, file, "machine-id" )
 +')
 diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 17eda24..fc94c2a 100644
+index 17eda24..7c66e96 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
 @@ -11,10 +11,31 @@ gen_require(`
@@ -30177,7 +30179,7 @@ index 17eda24..fc94c2a 100644
  
  ifdef(`distro_gentoo',`
  	allow init_t self:process { getcap setcap };
-@@ -186,29 +305,236 @@ ifdef(`distro_gentoo',`
+@@ -186,29 +305,237 @@ ifdef(`distro_gentoo',`
  ')
  
  ifdef(`distro_redhat',`
@@ -30413,7 +30415,8 @@ index 17eda24..fc94c2a 100644
  
  optional_policy(`
 -	nscd_use(init_t)
-+		networkmanager_stream_connect(init_t)
++	networkmanager_stream_connect(init_t)
++	networkmanager_stream_connect(initrc_t)
 +')
 +
 +optional_policy(`
@@ -30423,7 +30426,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -216,7 +542,31 @@ optional_policy(`
+@@ -216,7 +543,31 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30455,7 +30458,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  ########################################
-@@ -225,9 +575,9 @@ optional_policy(`
+@@ -225,9 +576,9 @@ optional_policy(`
  #
  
  allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -30467,7 +30470,7 @@ index 17eda24..fc94c2a 100644
  allow initrc_t self:passwd rootok;
  allow initrc_t self:key manage_key_perms;
  
-@@ -258,12 +608,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
+@@ -258,12 +609,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
  
  allow initrc_t initrc_var_run_t:file manage_file_perms;
  files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -30484,7 +30487,7 @@ index 17eda24..fc94c2a 100644
  
  manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
  manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
-@@ -279,23 +633,36 @@ kernel_change_ring_buffer_level(initrc_t)
+@@ -279,23 +634,36 @@ kernel_change_ring_buffer_level(initrc_t)
  kernel_clear_ring_buffer(initrc_t)
  kernel_get_sysvipc_info(initrc_t)
  kernel_read_all_sysctls(initrc_t)
@@ -30527,7 +30530,7 @@ index 17eda24..fc94c2a 100644
  corenet_tcp_sendrecv_all_ports(initrc_t)
  corenet_udp_sendrecv_all_ports(initrc_t)
  corenet_tcp_connect_all_ports(initrc_t)
-@@ -303,9 +670,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
+@@ -303,9 +671,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
  
  dev_read_rand(initrc_t)
  dev_read_urand(initrc_t)
@@ -30539,7 +30542,7 @@ index 17eda24..fc94c2a 100644
  dev_rw_sysfs(initrc_t)
  dev_list_usbfs(initrc_t)
  dev_read_framebuffer(initrc_t)
-@@ -313,8 +682,10 @@ dev_write_framebuffer(initrc_t)
+@@ -313,8 +683,10 @@ dev_write_framebuffer(initrc_t)
  dev_read_realtime_clock(initrc_t)
  dev_read_sound_mixer(initrc_t)
  dev_write_sound_mixer(initrc_t)
@@ -30550,7 +30553,7 @@ index 17eda24..fc94c2a 100644
  dev_delete_lvm_control_dev(initrc_t)
  dev_manage_generic_symlinks(initrc_t)
  dev_manage_generic_files(initrc_t)
-@@ -322,8 +693,7 @@ dev_manage_generic_files(initrc_t)
+@@ -322,8 +694,7 @@ dev_manage_generic_files(initrc_t)
  dev_delete_generic_symlinks(initrc_t)
  dev_getattr_all_blk_files(initrc_t)
  dev_getattr_all_chr_files(initrc_t)
@@ -30560,7 +30563,7 @@ index 17eda24..fc94c2a 100644
  
  domain_kill_all_domains(initrc_t)
  domain_signal_all_domains(initrc_t)
-@@ -332,7 +702,6 @@ domain_sigstop_all_domains(initrc_t)
+@@ -332,7 +703,6 @@ domain_sigstop_all_domains(initrc_t)
  domain_sigchld_all_domains(initrc_t)
  domain_read_all_domains_state(initrc_t)
  domain_getattr_all_domains(initrc_t)
@@ -30568,7 +30571,7 @@ index 17eda24..fc94c2a 100644
  domain_getsession_all_domains(initrc_t)
  domain_use_interactive_fds(initrc_t)
  # for lsof which is used by alsa shutdown:
-@@ -340,6 +709,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
+@@ -340,6 +710,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
  domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
  domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
  domain_dontaudit_getattr_all_pipes(initrc_t)
@@ -30576,7 +30579,7 @@ index 17eda24..fc94c2a 100644
  
  files_getattr_all_dirs(initrc_t)
  files_getattr_all_files(initrc_t)
-@@ -347,14 +717,15 @@ files_getattr_all_symlinks(initrc_t)
+@@ -347,14 +718,15 @@ files_getattr_all_symlinks(initrc_t)
  files_getattr_all_pipes(initrc_t)
  files_getattr_all_sockets(initrc_t)
  files_purge_tmp(initrc_t)
@@ -30594,7 +30597,7 @@ index 17eda24..fc94c2a 100644
  files_read_usr_files(initrc_t)
  files_manage_urandom_seed(initrc_t)
  files_manage_generic_spool(initrc_t)
-@@ -364,8 +735,12 @@ files_list_isid_type_dirs(initrc_t)
+@@ -364,8 +736,12 @@ files_list_isid_type_dirs(initrc_t)
  files_mounton_isid_type_dirs(initrc_t)
  files_list_default(initrc_t)
  files_mounton_default(initrc_t)
@@ -30608,7 +30611,7 @@ index 17eda24..fc94c2a 100644
  fs_list_inotifyfs(initrc_t)
  fs_register_binary_executable_type(initrc_t)
  # rhgb-console writes to ramfs
-@@ -375,10 +750,11 @@ fs_mount_all_fs(initrc_t)
+@@ -375,10 +751,11 @@ fs_mount_all_fs(initrc_t)
  fs_unmount_all_fs(initrc_t)
  fs_remount_all_fs(initrc_t)
  fs_getattr_all_fs(initrc_t)
@@ -30622,7 +30625,7 @@ index 17eda24..fc94c2a 100644
  mcs_process_set_categories(initrc_t)
  
  mls_file_read_all_levels(initrc_t)
-@@ -387,8 +763,10 @@ mls_process_read_up(initrc_t)
+@@ -387,8 +764,10 @@ mls_process_read_up(initrc_t)
  mls_process_write_down(initrc_t)
  mls_rangetrans_source(initrc_t)
  mls_fd_share_all_levels(initrc_t)
@@ -30633,7 +30636,7 @@ index 17eda24..fc94c2a 100644
  
  storage_getattr_fixed_disk_dev(initrc_t)
  storage_setattr_fixed_disk_dev(initrc_t)
-@@ -398,6 +776,7 @@ term_use_all_terms(initrc_t)
+@@ -398,6 +777,7 @@ term_use_all_terms(initrc_t)
  term_reset_tty_labels(initrc_t)
  
  auth_rw_login_records(initrc_t)
@@ -30641,7 +30644,7 @@ index 17eda24..fc94c2a 100644
  auth_setattr_login_records(initrc_t)
  auth_rw_lastlog(initrc_t)
  auth_read_pam_pid(initrc_t)
-@@ -416,20 +795,18 @@ logging_read_all_logs(initrc_t)
+@@ -416,20 +796,18 @@ logging_read_all_logs(initrc_t)
  logging_append_all_logs(initrc_t)
  logging_read_audit_config(initrc_t)
  
@@ -30665,7 +30668,7 @@ index 17eda24..fc94c2a 100644
  
  ifdef(`distro_debian',`
  	dev_setattr_generic_dirs(initrc_t)
-@@ -451,7 +828,6 @@ ifdef(`distro_gentoo',`
+@@ -451,7 +829,6 @@ ifdef(`distro_gentoo',`
  	allow initrc_t self:process setfscreate;
  	dev_create_null_dev(initrc_t)
  	dev_create_zero_dev(initrc_t)
@@ -30673,7 +30676,7 @@ index 17eda24..fc94c2a 100644
  	term_create_console_dev(initrc_t)
  
  	# unfortunately /sbin/rc does stupid tricks
-@@ -486,6 +862,10 @@ ifdef(`distro_gentoo',`
+@@ -486,6 +863,10 @@ ifdef(`distro_gentoo',`
  	sysnet_setattr_config(initrc_t)
  
  	optional_policy(`
@@ -30684,7 +30687,7 @@ index 17eda24..fc94c2a 100644
  		alsa_read_lib(initrc_t)
  	')
  
-@@ -506,7 +886,7 @@ ifdef(`distro_redhat',`
+@@ -506,7 +887,7 @@ ifdef(`distro_redhat',`
  
  	# Red Hat systems seem to have a stray
  	# fd open from the initrd
@@ -30693,7 +30696,7 @@ index 17eda24..fc94c2a 100644
  	files_dontaudit_read_root_files(initrc_t)
  
  	# These seem to be from the initrd
-@@ -521,6 +901,7 @@ ifdef(`distro_redhat',`
+@@ -521,6 +902,7 @@ ifdef(`distro_redhat',`
  	files_create_boot_dirs(initrc_t)
  	files_create_boot_flag(initrc_t)
  	files_rw_boot_symlinks(initrc_t)
@@ -30701,7 +30704,7 @@ index 17eda24..fc94c2a 100644
  	# wants to read /.fonts directory
  	files_read_default_files(initrc_t)
  	files_mountpoint(initrc_tmp_t)
-@@ -541,6 +922,7 @@ ifdef(`distro_redhat',`
+@@ -541,6 +923,7 @@ ifdef(`distro_redhat',`
  	miscfiles_rw_localization(initrc_t)
  	miscfiles_setattr_localization(initrc_t)
  	miscfiles_relabel_localization(initrc_t)
@@ -30709,7 +30712,7 @@ index 17eda24..fc94c2a 100644
  
  	miscfiles_read_fonts(initrc_t)
  	miscfiles_read_hwdata(initrc_t)
-@@ -550,8 +932,44 @@ ifdef(`distro_redhat',`
+@@ -550,8 +933,44 @@ ifdef(`distro_redhat',`
  	')
  
  	optional_policy(`
@@ -30754,7 +30757,7 @@ index 17eda24..fc94c2a 100644
  	')
  
  	optional_policy(`
-@@ -559,14 +977,31 @@ ifdef(`distro_redhat',`
+@@ -559,14 +978,31 @@ ifdef(`distro_redhat',`
  		rpc_write_exports(initrc_t)
  		rpc_manage_nfs_state_data(initrc_t)
  	')
@@ -30786,7 +30789,7 @@ index 17eda24..fc94c2a 100644
  	')
  ')
  
-@@ -577,6 +1012,39 @@ ifdef(`distro_suse',`
+@@ -577,6 +1013,39 @@ ifdef(`distro_suse',`
  	')
  ')
  
@@ -30826,7 +30829,7 @@ index 17eda24..fc94c2a 100644
  optional_policy(`
  	amavis_search_lib(initrc_t)
  	amavis_setattr_pid_files(initrc_t)
-@@ -589,6 +1057,8 @@ optional_policy(`
+@@ -589,6 +1058,8 @@ optional_policy(`
  optional_policy(`
  	apache_read_config(initrc_t)
  	apache_list_modules(initrc_t)
@@ -30835,7 +30838,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -610,6 +1080,7 @@ optional_policy(`
+@@ -610,6 +1081,7 @@ optional_policy(`
  
  optional_policy(`
  	cgroup_stream_connect_cgred(initrc_t)
@@ -30843,7 +30846,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -626,6 +1097,17 @@ optional_policy(`
+@@ -626,6 +1098,17 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30861,7 +30864,7 @@ index 17eda24..fc94c2a 100644
  	dev_getattr_printer_dev(initrc_t)
  
  	cups_read_log(initrc_t)
-@@ -642,9 +1124,13 @@ optional_policy(`
+@@ -642,9 +1125,13 @@ optional_policy(`
  	dbus_connect_system_bus(initrc_t)
  	dbus_system_bus_client(initrc_t)
  	dbus_read_config(initrc_t)
@@ -30875,7 +30878,7 @@ index 17eda24..fc94c2a 100644
  	')
  
  	optional_policy(`
-@@ -657,15 +1143,11 @@ optional_policy(`
+@@ -657,15 +1144,11 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30893,7 +30896,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -686,6 +1168,15 @@ optional_policy(`
+@@ -686,6 +1169,15 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30909,7 +30912,7 @@ index 17eda24..fc94c2a 100644
  	inn_exec_config(initrc_t)
  ')
  
-@@ -726,6 +1217,7 @@ optional_policy(`
+@@ -726,6 +1218,7 @@ optional_policy(`
  	lpd_list_spool(initrc_t)
  
  	lpd_read_config(initrc_t)
@@ -30917,7 +30920,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -743,7 +1235,13 @@ optional_policy(`
+@@ -743,7 +1236,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30932,7 +30935,7 @@ index 17eda24..fc94c2a 100644
  	mta_dontaudit_read_spool_symlinks(initrc_t)
  ')
  
-@@ -766,6 +1264,10 @@ optional_policy(`
+@@ -766,6 +1265,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30943,7 +30946,7 @@ index 17eda24..fc94c2a 100644
  	postgresql_manage_db(initrc_t)
  	postgresql_read_config(initrc_t)
  ')
-@@ -775,10 +1277,20 @@ optional_policy(`
+@@ -775,10 +1278,20 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30964,7 +30967,7 @@ index 17eda24..fc94c2a 100644
  	quota_manage_flags(initrc_t)
  ')
  
-@@ -787,6 +1299,10 @@ optional_policy(`
+@@ -787,6 +1300,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30975,7 +30978,7 @@ index 17eda24..fc94c2a 100644
  	fs_write_ramfs_sockets(initrc_t)
  	fs_search_ramfs(initrc_t)
  
-@@ -808,8 +1324,6 @@ optional_policy(`
+@@ -808,8 +1325,6 @@ optional_policy(`
  	# bash tries ioctl for some reason
  	files_dontaudit_ioctl_all_pids(initrc_t)
  
@@ -30984,7 +30987,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -818,6 +1332,10 @@ optional_policy(`
+@@ -818,6 +1333,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -30995,7 +30998,7 @@ index 17eda24..fc94c2a 100644
  	# shorewall-init script run /var/lib/shorewall/firewall
  	shorewall_lib_domtrans(initrc_t)
  ')
-@@ -827,10 +1345,12 @@ optional_policy(`
+@@ -827,10 +1346,12 @@ optional_policy(`
  	squid_manage_logs(initrc_t)
  ')
  
@@ -31008,7 +31011,7 @@ index 17eda24..fc94c2a 100644
  
  optional_policy(`
  	ssh_dontaudit_read_server_keys(initrc_t)
-@@ -857,21 +1377,60 @@ optional_policy(`
+@@ -857,21 +1378,60 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31070,7 +31073,7 @@ index 17eda24..fc94c2a 100644
  ')
  
  optional_policy(`
-@@ -887,6 +1446,10 @@ optional_policy(`
+@@ -887,6 +1447,10 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -31081,7 +31084,7 @@ index 17eda24..fc94c2a 100644
  	# Set device ownerships/modes.
  	xserver_setattr_console_pipes(initrc_t)
  
-@@ -897,3 +1460,218 @@ optional_policy(`
+@@ -897,3 +1461,218 @@ optional_policy(`
  optional_policy(`
  	zebra_read_config(initrc_t)
  ')
@@ -40196,10 +40199,10 @@ index 0000000..d2a8fc7
 +')
 diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
 new file mode 100644
-index 0000000..898464f
+index 0000000..8af0084
 --- /dev/null
 +++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,679 @@
+@@ -0,0 +1,681 @@
 +policy_module(systemd, 1.0.0)
 +
 +#######################################
@@ -40298,6 +40301,8 @@ index 0000000..898464f
 +
 +fs_mount_tmpfs(systemd_logind_t)
 +fs_unmount_tmpfs(systemd_logind_t)
++fs_manage_fusefs_dirs(systemd_logind_t)
++fs_manage_fusefs_files(systemd_logind_t)
 +
 +manage_dirs_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t)
 +manage_files_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t)
@@ -42270,7 +42275,7 @@ index db75976..8f5380f 100644
 +/var/tmp/hsperfdata_root    gen_context(system_u:object_r:user_tmp_t,s0)
 +
 diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 9dc60c6..9464dee 100644
+index 9dc60c6..d193211 100644
 --- a/policy/modules/system/userdomain.if
 +++ b/policy/modules/system/userdomain.if
 @@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@@ -43653,7 +43658,7 @@ index 9dc60c6..9464dee 100644
 +	')
 +
 +	optional_policy(`
-+		games_rw_data($1_usertype)
++        games_manage_data_files($1_usertype)
 +	')
 +
 +	optional_policy(`
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 6d64a86..d8f8723 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -7486,7 +7486,7 @@ index f3c0aba..2b3352b 100644
 +	files_etc_filetrans(apcupsd_t, apcupsd_power_t, file, "powerfail")
  ')
 diff --git a/apcupsd.te b/apcupsd.te
-index 080bc4d..0b6be35 100644
+index 080bc4d..d49f4ef 100644
 --- a/apcupsd.te
 +++ b/apcupsd.te
 @@ -24,6 +24,12 @@ files_tmp_file(apcupsd_tmp_t)
@@ -7533,7 +7533,7 @@ index 080bc4d..0b6be35 100644
  
  corenet_udp_bind_snmp_port(apcupsd_t)
  corenet_sendrecv_snmp_server_packets(apcupsd_t)
-@@ -74,19 +82,25 @@ corenet_udp_sendrecv_snmp_port(apcupsd_t)
+@@ -74,19 +82,24 @@ corenet_udp_sendrecv_snmp_port(apcupsd_t)
  
  dev_rw_generic_usb_dev(apcupsd_t)
  
@@ -7543,8 +7543,8 @@ index 080bc4d..0b6be35 100644
  files_manage_etc_runtime_files(apcupsd_t)
  files_etc_filetrans_etc_runtime(apcupsd_t, file, "nologin")
  
- term_use_unallocated_ttys(apcupsd_t)
-+term_use_usb_ttys(apcupsd_t)
+-term_use_unallocated_ttys(apcupsd_t)
++term_use_all_terms(apcupsd_t)
  
 -logging_send_syslog_msg(apcupsd_t)
 +#apcupsd runs shutdown, probably need a shutdown domain
@@ -7563,7 +7563,7 @@ index 080bc4d..0b6be35 100644
  
  optional_policy(`
  	hostname_exec(apcupsd_t)
-@@ -101,6 +115,11 @@ optional_policy(`
+@@ -101,6 +114,11 @@ optional_policy(`
  	shutdown_domtrans(apcupsd_t)
  ')
  
@@ -7575,7 +7575,7 @@ index 080bc4d..0b6be35 100644
  ########################################
  #
  # CGI local policy
-@@ -108,20 +127,20 @@ optional_policy(`
+@@ -108,20 +126,20 @@ optional_policy(`
  
  optional_policy(`
  	apache_content_template(apcupsd_cgi)
@@ -13159,7 +13159,7 @@ index c223f81..8b567c1 100644
 -	admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t })
  ')
 diff --git a/cobbler.te b/cobbler.te
-index 5f306dd..1543aec 100644
+index 5f306dd..e01156f 100644
 --- a/cobbler.te
 +++ b/cobbler.te
 @@ -81,6 +81,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
@@ -13220,7 +13220,7 @@ index 5f306dd..1543aec 100644
  ')
  
  optional_policy(`
-@@ -179,12 +183,26 @@ optional_policy(`
+@@ -179,12 +183,22 @@ optional_policy(`
  optional_policy(`
  	dhcpd_domtrans(cobblerd_t)
  	dhcpd_initrc_domtrans(cobblerd_t)
@@ -13235,10 +13235,6 @@ index 5f306dd..1543aec 100644
 +')
 +
 +optional_policy(`
-+    gnome_dontaudit_search_config(cobblerd_t)
-+')
-+
-+optional_policy(`
 +    libs_exec_ldconfig(cobblerd_t)
 +')
 +
@@ -13247,7 +13243,7 @@ index 5f306dd..1543aec 100644
  ')
  
  optional_policy(`
-@@ -192,13 +210,13 @@ optional_policy(`
+@@ -192,13 +206,13 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -27988,6 +27984,34 @@ index 36838c2..a09e8b2 100644
 -	fs_read_nfs_files(sftpd_t)
 -	fs_read_nfs_symlinks(ftpd_t)
 -')
+diff --git a/games.if b/games.if
+index e2a3e0d..50ebd40 100644
+--- a/games.if
++++ b/games.if
+@@ -58,3 +58,23 @@ interface(`games_rw_data',`
+ 	files_search_var_lib($1)
+ 	rw_files_pattern($1, games_data_t, games_data_t)
+ ')
++
++########################################
++## <summary>
++##	Manage games data files.
++##	games data.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`games_manage_data_files',`
++	gen_require(`
++		type games_data_t;
++	')
++
++	files_search_var_lib($1)
++	manage_files_pattern($1, games_data_t, games_data_t)
++')
 diff --git a/games.te b/games.te
 index e5b15fb..220622e 100644
 --- a/games.te
@@ -28372,10 +28396,10 @@ index 0000000..04e159f
 +')
 diff --git a/gear.te b/gear.te
 new file mode 100644
-index 0000000..91ed5f4
+index 0000000..7a27337
 --- /dev/null
 +++ b/gear.te
-@@ -0,0 +1,134 @@
+@@ -0,0 +1,140 @@
 +policy_module(gear, 1.0.0)
 +
 +########################################
@@ -28483,7 +28507,10 @@ index 0000000..91ed5f4
 +
 +mount_domtrans(gear_t)
 +
++selinux_validate_context(gear_t)
++
 +seutil_read_default_contexts(gear_t)
++seutil_read_config(gear_t)
 +
 +sysnet_dns_name_resolve(gear_t)
 +
@@ -28493,6 +28520,9 @@ index 0000000..91ed5f4
 +systemd_manage_all_unit_files(gear_t)
 +systemd_exec_systemctl(gear_t)
 +
++usermanage_domtrans_useradd(gear_t)
++usermanage_domtrans_passwd(gear_t)
++
 +optional_policy(`
 +	hostname_exec(gear_t)
 +')
@@ -73606,10 +73636,10 @@ index 83eb09e..b48c931 100644
 +')
 +
 diff --git a/quantum.fc b/quantum.fc
-index 70ab68b..32dec67 100644
+index 70ab68b..2a8e41b 100644
 --- a/quantum.fc
 +++ b/quantum.fc
-@@ -1,10 +1,28 @@
+@@ -1,10 +1,31 @@
 -/etc/rc\.d/init\.d/quantum.*	--	gen_context(system_u:object_r:quantum_initrc_exec_t,s0)
 +/etc/rc\.d/init\.d/neutron.*	--	gen_context(system_u:object_r:neutron_initrc_exec_t,s0)
 +/etc/rc\.d/init\.d/quantum.*	--	gen_context(system_u:object_r:neutron_initrc_exec_t,s0)
@@ -73621,6 +73651,9 @@ index 70ab68b..32dec67 100644
 +/usr/bin/neutron-dhcp-agent     --  gen_context(system_u:object_r:neutron_exec_t,s0)
 +/usr/bin/neutron-l3-agent       --  gen_context(system_u:object_r:neutron_exec_t,s0)
 +/usr/bin/neutron-lbaas-agent	--	gen_context(system_u:object_r:neutron_exec_t,s0)
++/usr/bin/neutron-metadata-agent    --  gen_context(system_u:object_r:neutron_exec_t,s0)
++/usr/bin/neutron-netns-cleanup --  gen_context(system_u:object_r:neutron_exec_t,s0)
++/usr/bin/neutron-ns-metadata-proxy --  gen_context(system_u:object_r:neutron_exec_t,s0)
 +/usr/bin/neutron-rootwrap	--	gen_context(system_u:object_r:neutron_exec_t,s0)
 +/usr/bin/neutron-linuxbridge-agent	--	gen_context(system_u:object_r:neutron_exec_t,s0)
 +/usr/bin/neutron-openvswitch-agent	--	gen_context(system_u:object_r:neutron_exec_t,s0)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 29ca069..ddb7d64 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -11,7 +11,7 @@
 %define BUILD_MINIMUM 1
 %endif
 %if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
-%define BUILD_MLS 0
+%define BUILD_MLS 1
 %endif
 %define POLICYVER 29
 %define POLICYCOREUTILSVER 2.1.14-74
@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 60%{?dist}
+Release: 61%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -600,6 +600,9 @@ SELinux Reference policy mls base module.
 %endif
 
 %changelog
+* Fri Jun 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-61
+- Add back MLS policy
+
 * Thu Jun 19 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-60
 - Implement new spec file handling for *.pp modules which allows us to move a policy module out of the policy