From 347ff1a0c32240b71213c4e9adc4a3daf80224d3 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@fedoraproject.org>
Date: Sep 21 2007 20:21:36 +0000
Subject: - Allow cupsd_config_t to read/write usb_device_t

- Support for finger print reader,
- Many fixes for clvmd
- dbus starting networkmanager

---

diff --git a/policy-20070703.patch b/policy-20070703.patch
index b13a801..a24e1c5 100644
--- a/policy-20070703.patch
+++ b/policy-20070703.patch
@@ -1462,7 +1462,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc 
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.8/policy/modules/apps/java.if
 --- nsaserefpolicy/policy/modules/apps/java.if	2007-08-02 08:17:26.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/java.if	2007-09-20 17:57:24.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/java.if	2007-09-20 18:26:14.000000000 -0400
 @@ -32,7 +32,7 @@
  ##	</summary>
  ## </param>
@@ -1482,7 +1482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if 
  	allow $1_javaplugin_t $2:fd use;
  	# Unrestricted inheritance from the caller.
  	allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh };
-@@ -166,6 +165,60 @@
+@@ -166,6 +165,62 @@
  	optional_policy(`
  		xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
  	')
@@ -1537,13 +1537,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if 
 +	dev_read_urand($1_java_t)
 +	dev_read_rand($1_java_t)
 +
++	fs_dontaudit_rw_tmpfs_files($1_java_t)
++
 +	optional_policy(`
 +		xserver_xdm_rw_shm($1_java_t)
 +	')
  ')
  
  ########################################
-@@ -219,3 +272,66 @@
+@@ -219,3 +274,66 @@
  	corecmd_search_bin($1)
  	domtrans_pattern($1, java_exec_t, java_t)
  ')
@@ -1612,7 +1614,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if 
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.8/policy/modules/apps/java.te
 --- nsaserefpolicy/policy/modules/apps/java.te	2007-07-25 10:37:37.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/java.te	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/apps/java.te	2007-09-20 18:14:17.000000000 -0400
+@@ -23,7 +23,7 @@
+ #
+ 
+ # execheap is needed for itanium/BEA jrocket
+-allow java_t self:process { execstack execmem execheap };
++allow java_t self:process { getsched sigkill execheap execmem execstack };
+ 
+ init_dbus_chat_script(java_t)
+ 
 @@ -31,3 +31,7 @@
  	unconfined_domain_noaudit(java_t)
  	unconfined_dbus_chat(java_t)
@@ -1623,8 +1634,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te 
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.8/policy/modules/apps/mono.if
 --- nsaserefpolicy/policy/modules/apps/mono.if	2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/mono.if	2007-09-20 11:42:05.000000000 -0400
-@@ -18,3 +18,102 @@
++++ serefpolicy-3.0.8/policy/modules/apps/mono.if	2007-09-20 18:25:48.000000000 -0400
+@@ -18,3 +18,103 @@
  	corecmd_search_bin($1)
  	domtrans_pattern($1, mono_exec_t, mono_t)
  ')
@@ -1720,6 +1731,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if 
 +	userdom_unpriv_usertype($1, $1_mono_t)
 +
 +	allow $1_mono_t self:process { signal getsched execheap execmem };
++	allow $2 $1_mono_t:process noatsecure;
 +
 +	domtrans_pattern($2, mono_exec_t, $1_mono_t)
 +
@@ -2250,7 +2262,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te 
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc
 --- nsaserefpolicy/policy/modules/kernel/corecommands.fc	2007-08-22 07:14:06.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc	2007-09-21 14:41:45.000000000 -0400
 @@ -36,6 +36,11 @@
  /etc/cipe/ip-up.*		--	gen_context(system_u:object_r:bin_t,s0)
  /etc/cipe/ip-down.*		--	gen_context(system_u:object_r:bin_t,s0)
@@ -2284,7 +2296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
  
  /usr/sbin/sesh			--	gen_context(system_u:object_r:shell_exec_t,s0)
  
-@@ -259,3 +265,7 @@
+@@ -259,3 +265,8 @@
  ifdef(`distro_suse',`
  /var/lib/samba/bin/.+			gen_context(system_u:object_r:bin_t,s0)
  ')
@@ -2292,6 +2304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
 +/etc/gdm/XKeepsCrashing[^/]*	--	gen_context(system_u:object_r:bin_t,s0)
 +/etc/gdm/[^/]+			-d	gen_context(system_u:object_r:bin_t,s0)
 +/etc/gdm/[^/]+/.*			gen_context(system_u:object_r:bin_t,s0)
++/lib(64)?/dbus-1/dbus-daemon-launch-helper --    gen_context(system_u:object_r:bin_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in
 --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in	2007-07-03 07:05:38.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in	2007-09-17 16:20:18.000000000 -0400
@@ -2415,7 +2428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.8/policy/modules/kernel/devices.fc
 --- nsaserefpolicy/policy/modules/kernel/devices.fc	2007-09-12 10:34:49.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc	2007-09-21 14:29:01.000000000 -0400
 @@ -20,6 +20,7 @@
  /dev/evtchn		-c	gen_context(system_u:object_r:xen_device_t,s0)
  /dev/fb[0-9]*		-c	gen_context(system_u:object_r:framebuf_device_t,s0)
@@ -2424,6 +2437,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
  /dev/fw.*		-c	gen_context(system_u:object_r:usb_device_t,s0)
  /dev/hiddev.*		-c	gen_context(system_u:object_r:usb_device_t,s0)
  /dev/hpet		-c	gen_context(system_u:object_r:clock_device_t,s0)
+@@ -98,6 +99,7 @@
+ /dev/input/event.*	-c	gen_context(system_u:object_r:event_device_t,s0)
+ /dev/input/mice		-c	gen_context(system_u:object_r:mouse_device_t,s0)
+ /dev/input/js.*		-c	gen_context(system_u:object_r:mouse_device_t,s0)
++/dev/input/uimput	-c	gen_context(system_u:object_r:scanner_device_t,s0)
+ 
+ /dev/mapper/control	-c	gen_context(system_u:object_r:lvm_control_t,s0)
+ 
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.8/policy/modules/kernel/domain.if
 --- nsaserefpolicy/policy/modules/kernel/domain.if	2007-06-19 16:23:34.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/kernel/domain.if	2007-09-17 16:20:18.000000000 -0400
@@ -4904,7 +4925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
  ifdef(`TODO',`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.8/policy/modules/services/cups.fc
 --- nsaserefpolicy/policy/modules/services/cups.fc	2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/cups.fc	2007-09-18 12:31:53.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cups.fc	2007-09-21 15:23:17.000000000 -0400
 @@ -8,17 +8,14 @@
  /etc/cups/ppd/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  /etc/cups/ppds\.dat	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -4924,24 +4945,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  /usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
  
  /usr/libexec/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
-@@ -26,6 +23,9 @@
+@@ -26,6 +23,11 @@
  /usr/sbin/cupsd		--	gen_context(system_u:object_r:cupsd_exec_t,s0)
  /usr/sbin/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
  /usr/sbin/hpiod		--	gen_context(system_u:object_r:hplip_exec_t,s0)
 +/usr/sbin/hp-[^/]+	--	gen_context(system_u:object_r:hplip_exec_t,s0)
-+/usr/lib(64)?/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
++# keep as separate lines to ensure proper sorting
++/usr/lib/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
++/usr/lib64/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
 +
  /usr/sbin/printconf-backend --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
  /usr/sbin/ptal-printd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
  /usr/sbin/ptal-mlcd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
-@@ -52,3 +52,4 @@
+@@ -52,3 +54,4 @@
  /var/run/ptal-mlcd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
  
  /var/spool/cups(/.*)?		gen_context(system_u:object_r:print_spool_t,mls_systemhigh)
 +/usr/local/Brother/inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te
 --- nsaserefpolicy/policy/modules/services/cups.te	2007-09-12 10:34:50.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/cups.te	2007-09-18 12:15:12.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cups.te	2007-09-21 09:12:45.000000000 -0400
 @@ -49,9 +49,6 @@
  type hplip_exec_t;
  init_daemon_domain(hplip_t,hplip_exec_t)
@@ -5103,7 +5126,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  	seutil_sigchld_newrole(cupsd_t)
  ')
  
-@@ -377,6 +400,14 @@
+@@ -331,6 +354,7 @@
+ dev_read_sysfs(cupsd_config_t)
+ dev_read_urand(cupsd_config_t)
+ dev_read_rand(cupsd_config_t)
++dev_rw_generic_usb_dev(cupsd_config_t)
+ 
+ fs_getattr_all_fs(cupsd_config_t)
+ fs_search_auto_mountpoints(cupsd_config_t)
+@@ -377,6 +401,14 @@
  ')
  
  optional_policy(`
@@ -5118,7 +5149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  	cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
  ')
  
-@@ -526,11 +557,6 @@
+@@ -526,11 +558,6 @@
  
  cups_stream_connect(hplip_t)
  
@@ -5130,7 +5161,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
  files_pid_filetrans(hplip_t,hplip_var_run_t,file)
  
-@@ -560,7 +586,7 @@
+@@ -560,7 +587,7 @@
  dev_read_urand(hplip_t)
  dev_read_rand(hplip_t)
  dev_rw_generic_usb_dev(hplip_t)
@@ -5139,7 +5170,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
  
  fs_getattr_all_fs(hplip_t)
  fs_search_auto_mountpoints(hplip_t)
-@@ -587,8 +613,6 @@
+@@ -587,8 +614,6 @@
  userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
  userdom_dontaudit_search_all_users_home_content(hplip_t)
  
@@ -5189,7 +5220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.8/policy/modules/services/dbus.if
 --- nsaserefpolicy/policy/modules/services/dbus.if	2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/dbus.if	2007-09-20 15:31:09.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dbus.if	2007-09-21 06:44:48.000000000 -0400
 @@ -50,6 +50,12 @@
  ## </param>
  #
@@ -5330,7 +5361,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.8/policy/modules/services/dbus.te
 --- nsaserefpolicy/policy/modules/services/dbus.te	2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/dbus.te	2007-09-20 12:01:29.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dbus.te	2007-09-21 14:44:08.000000000 -0400
 @@ -23,6 +23,9 @@
  type system_dbusd_var_run_t;
  files_pid_file(system_dbusd_var_run_t)
@@ -5350,7 +5381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
  manage_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t)
  manage_sock_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t)
  files_pid_filetrans(system_dbusd_t,system_dbusd_var_run_t,file)
-@@ -116,9 +121,18 @@
+@@ -116,9 +121,22 @@
  ')
  
  optional_policy(`
@@ -5358,6 +5389,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
 +')
 +
 +optional_policy(`
++	networkmanager_domtrans(system_dbusd_t)
++')
++
++optional_policy(`
  	sysnet_domtrans_dhcpc(system_dbusd_t)
  ')
  
@@ -6134,7 +6169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
  /var/run/vbestate 	--			gen_context(system_u:object_r:hald_var_run_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te
 --- nsaserefpolicy/policy/modules/services/hal.te	2007-09-12 10:34:50.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/hal.te	2007-09-19 13:28:57.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/hal.te	2007-09-21 14:55:44.000000000 -0400
 @@ -155,6 +155,8 @@
  selinux_compute_relabel_context(hald_t)
  selinux_compute_user_contexts(hald_t)
@@ -6152,6 +6187,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
  allow hald_acl_t self:fifo_file read_fifo_file_perms;
  
  domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
+@@ -344,6 +347,8 @@
+ 
+ files_read_usr_files(hald_mac_t)
+ 
++kernel_read_system_state(hald_mac_t)
++
+ libs_use_ld_so(hald_mac_t)
+ libs_use_shared_libs(hald_mac_t)
+ 
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.8/policy/modules/services/inetd.te
 --- nsaserefpolicy/policy/modules/services/inetd.te	2007-09-12 10:34:50.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/services/inetd.te	2007-09-17 16:20:18.000000000 -0400
@@ -7921,7 +7965,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb
  	consoletype_exec(rhgb_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.8/policy/modules/services/ricci.te
 --- nsaserefpolicy/policy/modules/services/ricci.te	2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/ricci.te	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ricci.te	2007-09-21 10:21:12.000000000 -0400
 @@ -138,6 +138,7 @@
  files_create_boot_flag(ricci_t)
  
@@ -7930,6 +7974,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
  auth_append_login_records(ricci_t)
  
  init_dontaudit_stream_connect_script(ricci_t)
+@@ -260,7 +261,7 @@
+ # ricci_modclusterd local policy
+ #
+ 
+-allow ricci_modclusterd_t self:capability sys_nice;
++allow ricci_modclusterd_t self:capability { sys_nice sys_tty_config };
+ allow ricci_modclusterd_t self:process { signal sigkill setsched };
+ allow ricci_modclusterd_t self:fifo_file rw_fifo_file_perms;
+ allow ricci_modclusterd_t self:unix_stream_socket create_stream_socket_perms;
 @@ -321,6 +322,10 @@
  ')
  
@@ -7941,6 +7994,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc
  	unconfined_use_fds(ricci_modclusterd_t)
  ')
  
+@@ -468,9 +473,6 @@
+ 
+ logging_send_syslog_msg(ricci_modstorage_t)
+ 
+-lvm_domtrans(ricci_modstorage_t)
+-lvm_manage_config(ricci_modstorage_t)
+-
+ miscfiles_read_localization(ricci_modstorage_t)
+ 
+ modutils_read_module_deps(ricci_modstorage_t)
+@@ -482,6 +484,7 @@
+ 
+ optional_policy(`
+ 	lvm_domtrans(ricci_modstorage_t)
++	lvm_manage_config(ricci_modstorage_t)
+ ')
+ 
+ optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.8/policy/modules/services/rlogin.te
 --- nsaserefpolicy/policy/modules/services/rlogin.te	2007-07-25 10:37:42.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/services/rlogin.te	2007-09-17 16:20:18.000000000 -0400
@@ -11141,6 +11212,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
  	seutil_sigchld_newrole(iptables_t)
  ')
  
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.0.8/policy/modules/system/iscsi.te
+--- nsaserefpolicy/policy/modules/system/iscsi.te	2007-07-25 10:37:42.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/iscsi.te	2007-09-21 14:55:01.000000000 -0400
+@@ -68,6 +68,8 @@
+ 
+ files_read_etc_files(iscsid_t)
+ 
++kernel_read_system_state(iscsid_t)
++
+ libs_use_ld_so(iscsid_t)
+ libs_use_shared_libs(iscsid_t)
+ 
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc
 --- nsaserefpolicy/policy/modules/system/libraries.fc	2007-08-02 08:17:28.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/system/libraries.fc	2007-09-18 10:51:20.000000000 -0400
@@ -11862,7 +11945,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
  files_dontaudit_search_isid_type_dirs(syslogd_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.8/policy/modules/system/lvm.fc
 --- nsaserefpolicy/policy/modules/system/lvm.fc	2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/lvm.fc	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/lvm.fc	2007-09-21 09:54:46.000000000 -0400
 @@ -15,6 +15,7 @@
  #
  /etc/lvm(/.*)?			gen_context(system_u:object_r:lvm_etc_t,s0)
@@ -11873,19 +11956,66 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
  /etc/lvm/lock(/.*)?		gen_context(system_u:object_r:lvm_lock_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te
 --- nsaserefpolicy/policy/modules/system/lvm.te	2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/lvm.te	2007-09-17 16:20:18.000000000 -0400
-@@ -150,7 +150,9 @@
++++ serefpolicy-3.0.8/policy/modules/system/lvm.te	2007-09-21 15:33:57.000000000 -0400
+@@ -44,9 +44,9 @@
+ # Cluster LVM daemon local policy
+ #
+ 
+-allow clvmd_t self:capability { sys_admin mknod };
++allow clvmd_t self:capability { sys_nice chown ipc_lock sys_admin mknod };
+ dontaudit clvmd_t self:capability sys_tty_config;
+-allow clvmd_t self:process signal_perms;
++allow clvmd_t self:process { signal_perms  setsched };
+ dontaudit clvmd_t self:process ptrace;
+ allow clvmd_t self:socket create_socket_perms;
+ allow clvmd_t self:fifo_file rw_fifo_file_perms;
+@@ -85,6 +85,9 @@
+ corenet_sendrecv_generic_server_packets(clvmd_t)
+ 
+ dev_read_sysfs(clvmd_t)
++dev_manage_generic_symlinks(clvmd_t)
++dev_relabel_generic_dev_dirs(clvmd_t)
++dev_manage_generic_blk_files(clvmd_t)
+ dev_manage_generic_chr_files(clvmd_t)
+ dev_rw_lvm_control(clvmd_t)
+ dev_dontaudit_getattr_all_blk_files(clvmd_t)
+@@ -102,6 +105,7 @@
+ 
+ domain_use_interactive_fds(clvmd_t)
+ 
++storage_relabel_fixed_disk(clvmd_t)
+ storage_raw_read_fixed_disk(clvmd_t)
+ 
+ libs_use_ld_so(clvmd_t)
+@@ -113,6 +117,9 @@
+ 
+ seutil_dontaudit_search_config(clvmd_t)
+ seutil_sigchld_newrole(clvmd_t)
++seutil_read_config(clvmd_t)
++seutil_read_file_contexts(clvmd_t)
++seutil_search_default_contexts(clvmd_t)
+ 
+ sysnet_read_config(clvmd_t)
+ 
+@@ -150,7 +157,8 @@
  
  # DAC overrides and mknod for modifying /dev entries (vgmknodes)
  # rawio needed for dmraid
 -allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio };
 +allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio net_admin };
 +# lvm needs net_admin for multipath
-+
  dontaudit lvm_t self:capability sys_tty_config;
  allow lvm_t self:process { sigchld sigkill sigstop signull signal };
  # LVM will complain a lot if it cannot set its priority.
-@@ -228,6 +230,8 @@
+@@ -208,7 +216,6 @@
+ selinux_compute_user_contexts(lvm_t)
+ 
+ dev_create_generic_chr_files(lvm_t)
+-dev_delete_generic_dirs(lvm_t)
+ dev_read_rand(lvm_t)
+ dev_read_urand(lvm_t)
+ dev_rw_lvm_control(lvm_t)
+@@ -228,6 +235,8 @@
  dev_dontaudit_getattr_generic_blk_files(lvm_t)
  dev_dontaudit_getattr_generic_pipes(lvm_t)
  dev_create_generic_dirs(lvm_t)
@@ -11894,7 +12024,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
  
  fs_getattr_xattr_fs(lvm_t)
  fs_search_auto_mountpoints(lvm_t)
-@@ -246,6 +250,7 @@
+@@ -246,6 +255,7 @@
  storage_dev_filetrans_fixed_disk(lvm_t)
  # Access raw devices and old /dev/lvm (c 109,0).  Is this needed?
  storage_manage_fixed_disk(lvm_t)
@@ -11902,7 +12032,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
  
  term_getattr_all_user_ttys(lvm_t)
  term_list_ptys(lvm_t)
-@@ -275,6 +280,8 @@
+@@ -275,6 +285,8 @@
  seutil_search_default_contexts(lvm_t)
  seutil_sigchld_newrole(lvm_t)
  
@@ -11911,7 +12041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
  ifdef(`distro_redhat',`
  	# this is from the initrd:
  	files_rw_isid_type_dirs(lvm_t)
-@@ -293,5 +300,15 @@
+@@ -293,5 +305,14 @@
  ')
  
  optional_policy(`
@@ -11926,7 +12056,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
 +	xen_append_log(lvm_t)
 +	xen_dontaudit_rw_unix_stream_sockets(lvm_t)
 +')
-+
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.8/policy/modules/system/modutils.te
 --- nsaserefpolicy/policy/modules/system/modutils.te	2007-08-22 07:14:12.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/system/modutils.te	2007-09-17 16:20:18.000000000 -0400
@@ -12838,6 +12967,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
  term_dontaudit_use_all_user_ttys(ifconfig_t)
  term_dontaudit_use_all_user_ptys(ifconfig_t)
  
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.0.8/policy/modules/system/unconfined.fc
+--- nsaserefpolicy/policy/modules/system/unconfined.fc	2007-05-29 14:10:58.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc	2007-09-21 06:46:14.000000000 -0400
+@@ -10,3 +10,4 @@
+ /usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+ 
+ /usr/local/RealPlayer/realplay\.bin --	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
++/usr/bin/rhythmbox		    --	gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if
 --- nsaserefpolicy/policy/modules/system/unconfined.if	2007-06-15 14:54:34.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/system/unconfined.if	2007-09-17 16:20:18.000000000 -0400
@@ -13047,7 +13184,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te
 --- nsaserefpolicy/policy/modules/system/unconfined.te	2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/unconfined.te	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.te	2007-09-21 06:44:58.000000000 -0400
 @@ -5,28 +5,36 @@
  #
  # Declarations
@@ -13231,14 +13368,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
  ')
  
  ########################################
-@@ -227,6 +223,17 @@
- 	unconfined_dbus_chat(unconfined_execmem_t)
+@@ -225,8 +221,20 @@
  
- 	optional_policy(`
-+		avahi_dbus_chat(unconfined_t)
-+	')
+ 	init_dbus_chat_script(unconfined_execmem_t)
+ 	unconfined_dbus_chat(unconfined_execmem_t)
++	dbus_connect_system_bus(unconfined_execmem_t)
 +
 +	optional_policy(`
++		avahi_dbus_chat(unconfined_execmem_t)
++	')
+ 
+ 	optional_policy(`
  		hal_dbus_chat(unconfined_execmem_t)
  	')
 +
diff --git a/selinux-policy.spec b/selinux-policy.spec
index a42480c..5fcd68e 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.0.8
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -362,6 +362,12 @@ exit 0
 %endif
 
 %changelog
+* Fri Sep 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-7
+- Allow cupsd_config_t to read/write usb_device_t
+- Support for finger print reader,
+- Many fixes for clvmd
+- dbus starting networkmanager
+
 * Thu Sep 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-5
 - Fix java and mono to run in xguest account