From 5493c2036b65967d23d9ef48f2a20ed9b4826ebf Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Sep 15 2005 21:03:45 +0000
Subject: more updates



---

diff --git a/docs/macro_conversion_guide b/docs/macro_conversion_guide
index f01429c..0d6aeb2 100644
--- a/docs/macro_conversion_guide
+++ b/docs/macro_conversion_guide
@@ -301,16 +301,7 @@ optional_policy(`kerberos.te',`
 #
 # can_ldap(): complete
 #
-optional_policy(`ldap.te',`
-	allow $1 self:tcp_socket create_socket_perms;
-	corenet_tcp_sendrecv_all_if($1)
-	corenet_raw_sendrecv_all_if($1)
-	corenet_tcp_sendrecv_all_nodes($1)
-	corenet_raw_sendrecv_all_nodes($1)
-	corenet_tcp_sendrecv_ldap_port($1)
-	corenet_tcp_bind_all_nodes($1)
-	sysnet_read_config($1)
-')
+sysnet_use_ldap($1)
 
 #
 # can_loadpol(): complete
@@ -421,18 +412,14 @@ allow $1 $2:process ptrace;
 allow $2 $1:process sigchld;
 
 #
+# can_portmap():
+#
+sysnet_use_portmap($1)
+
+#
 # can_resolve(): complete
 #
-tunable_policy(`use_dns',`
-	allow $1 self:udp_socket create_socket_perms;
-	corenet_udp_sendrecv_all_if($1)
-	corenet_raw_sendrecv_all_if($1)
-	corenet_udp_sendrecv_all_nodes($1)
-	corenet_raw_sendrecv_all_nodes($1)
-	corenet_udp_sendrecv_dns_port($1)
-	corenet_udp_bind_all_nodes($1)
-	sysnet_read_config($1)
-')
+sysnet_dns_name_resolve($1)
 
 #
 # can_setbool(): complete
@@ -790,7 +777,7 @@ optional_policy(`nscd.te',`
 #
 # legacy_domain(): complete
 #
-allow $1_t self:process execmem;
+allow $1_t self:process { execmem execstack };
 libs_legacy_use_shared_libs($1_t)
 libs_legacy_use_ld_so($1_t)
 
@@ -827,6 +814,30 @@ can_exec($1, $2)
 allow $1 $2:{ sock_file fifo_file } { create ioctl read getattr lock write setattr append link unlink rename };
 
 #
+# polyinstantiater():
+#
+ifdef(`support_polyinstantiation', `
+# Need to give access to /selinux/member
+selinux_compute_member($1)
+# Need sys_admin capability for mounting
+allow $1 self:capability sys_admin;
+# Need to give access to the directories to be polyinstantiated
+allow $1 polydir:dir { getattr mounton add_name create setattr write search };
+# Need to give access to the polyinstantiated subdirectories
+allow $1 polymember:dir {getattr search };
+# Need to give access to parent directories where original
+# is remounted for polyinstantiation aware programs (like gdm)
+allow $1 polyparent:dir { getattr mounton };
+# Need to give permission to create directories where applicable
+allow $1 polymember: dir { create setattr };
+allow $1 polydir: dir { write add_name };
+allow $1 self:process setfscreate;
+allow $1 polyparent:dir { write add_name };
+# Default type for mountpoints
+allow $1 poly_t:dir { create mounton };
+')
+
+#
 # pty_slave_label():
 #
 type $1_devpts_t, file_type, sysadmfile, ptyfile $2;
diff --git a/strict/ChangeLog b/strict/ChangeLog
index 0e38453..20fcfc3 100644
--- a/strict/ChangeLog
+++ b/strict/ChangeLog
@@ -1,3 +1,206 @@
+1.26 2005-09-06
+	* Updated version for release.
+
+1.25.4 2005-08-10
+	* Merged small patches from Russell Coker for the restorecon,
+	kudzu, lvm, radvd, and spamassasin policies.
+	* Added fs_use_trans rule for mqueue from Mark Gebhart to support
+	the work he has done on providing SELinux support for mqueue.
+	* Merged a patch from Dan Walsh. Removes the user_can_mount
+	tunable.  Adds disable_evolution_trans and disable_thunderbird_trans
+	booleans.  Adds the nscd_client_domain attribute to insmod_t.
+	Removes the user_ping boolean from targeted policy.  Adds
+	hugetlbfs, inotifyfs, and mqueue filesystems to genfs_contexts.
+	Adds the isakmp_port for vpnc.  Creates the pptp daemon domain.
+	Allows getty to run sbin_t for pppd.  Allows initrc to write to
+	default_t for booting.  Allows Hotplug_t sys_rawio for prism54
+	card at boot.  Other minor fixes.
+
+1.25.3 2005-07-18
+	* Merged patch from Dan Walsh.  Adds auth_bool attribute to allow
+	domains to have read access to shadow_t.  Creates pppd_can_insmod
+	boolean to control the loading of modem kernel modules.  Allows
+	nfs to export noexattrfile types.  Allows unix_chpwd to access
+	cert files and random devices for encryption purposes.  Other
+	minor cleanups and fixes.
+
+1.25.2 2005-07-11
+	* Merged patch from Dan Walsh.  Added allow_ptrace boolean to
+	allow sysadm_t to ptrace and debug apps.  Gives auth_chkpwd the
+	audit_control and audit_write capabilities.  Stops targeted policy
+	from transitioning from unconfined_t to netutils.  Allows cupsd to
+	audit messages.  Gives prelink the execheap, execmem, and execstack
+	permissions by default.  Adds can_winbind boolean and functions to
+	better handle samba and winbind communications.  Eliminates
+	allow_execmod checks around texrel_shlib_t libraries.  Other minor
+	cleanups and fixes.
+	
+1.25.1 2005-07-05
+	* Moved role_tty_type_change, reach_sysadm, and priv_user macros
+	from user.te to user_macros.te as suggested by Steve.
+	* Modified admin_domain macro so autrace would work and removed
+	privuser attribute for dhcpc as suggested by Russell Coker.
+	* Merged rather large patch from Dan Walsh.  Moves
+	targeted/strict/mls policies closer together.  Adds local.te for
+	users to customize.  Includes minor fixes to auditd, cups,
+	cyrus_imapd, dhcpc, and dovecot.  Includes Russell Coker's patch
+	that defines all ports in network.te.  Ports are always defined
+	now, no ifdefs are used in network.te.  Also includes Ivan
+	Gyurdiev's user home directory policy patches.  These patches add
+	alsa, bonobo, ethereal, evolution, gconf, gnome, gnome_vfs,
+	iceauth, orbit, and thunderbird policy.  They create read_content,
+	write_trusted, and write_untrusted macros in content.te.  They
+	create network_home, write_network_home, read_network_home,
+	base_domain_ro_access, home_domain_access, home_domain, and
+	home_domain_ro macros in home_macros.te.  They also create
+	$3_read_content, $3_write_content, and write_untrusted booleans.
+	
+1.24 2005-06-20
+	* Updated version for release.
+
+1.23.18 2005-05-31
+	* Merged minor fixes to pppd.fc and courier.te by Russell Coker.
+	* Removed devfsd policy as suggested by Russell Coker.
+	* Merged patch from Dan Walsh.  Includes beginnings of Ivan
+	Gyurdiev's Font Config policy.  Don't transition to fsadm_t from
+	unconfined_t (sysadm_t) in targeted policy.  Add support for
+	debugfs in modutil.  Allow automount to create and delete
+	directories in /root and /home dirs.  Move can_ypbind to
+	chkpwd_macro.te.  Allow useradd to create additional files and
+	types via the skell mechanism.  Other minor cleanups and fixes.
+
+1.23.17 2005-05-23
+	* Merged minor fixes by Petre Rodan to the daemontools, dante,
+	gpg, kerberos, and ucspi-tcp policies.
+	* Merged minor fixes by Russell Coker to the bluetooth, crond,
+	initrc, postfix, and udev  policies.  Modifies constraints so that
+	newaliases can be run.  Modifies types.fc so that objects in
+	lost+found directories will not be relabled.
+	* Modified fc rules for nvidia.
+	* Added Chad Sellers policy for polyinstantiation support, which
+	creates the polydir, polyparent, and polymember attributes.  Also
+	added the support_polyinstantiation tunable.
+	* Merged patch from Dan Walsh.  Includes mount_point attribute,
+	read_font macros and some other policy fixes from Ivan Gyurdiev.
+	Adds privkmsg and secadmfile attributes and ddcprobe policy.
+	Removes the use_syslogng boolean.  Many other minor fixes.
+
+1.23.16 2005-05-13
+	* Added rdisc policy from Russell Coker.
+	* Merged minor fix to named policy by Petre Rodan.
+	* Merged minor fixes to policy from Russell Coker for kudzu,
+	named, screen, setfiles, telnet, and xdm.
+	* Merged minor fix to Makefile from Russell Coker.
+
+1.23.15 2005-05-06
+	* Added tripwire and yam policy from David Hampton.
+	* Merged minor fixes to amavid and a clarification to the
+	httpdcontent attribute comments from David Hampton.
+	* Merged patch from Dan Walsh.  Includes fixes for restorecon,
+	games, and postfix from Russell Coker.  Adds support for debugfs.
+	Restores support for reiserfs.  Allows udev to work with tmpfs_t
+	before /dev is labled.  Removes transition from sysadm_t
+	(unconfined_t) to ifconfig_t for the targeted policy.  Other minor
+	cleanups and fixes.
+
+1.23.14 2005-04-29
+	* Added afs policy from Andrew Reisse.
+	* Merged patch from Lorenzo Hernández García-Hierro which defines
+	execstack and execheap permissions.  The patch excludes these
+	permissions from general_domain_access and updates the macros for
+	X, legacy binaries, users, and unconfined domains.
+	* Added nlmsg_relay permisison where netlink_audit_socket class is
+	used.  Added nlmsg_readpriv permission to auditd_t and auditctl_t.
+	* Merged some minor cleanups from Russell Coker and David Hampton.
+	* Merged patch from Dan Walsh.  Many changes made to allow
+	targeted policy to run closer to strict and now almost all of
+	non-userspace is protected via SELinux.  Kernel is now in
+	unconfined_domain for targeted and runs as root:system_r:kernel_t.
+	Added transitionbool to daemon_sub_domain, mainly to turn off
+	httpd_suexec transitioning.  Implemented web_client_domain
+	name_connect rules.  Added yp support for cups.  Now the real
+	hotplug, udev, initial_sid_contexts are used for the targeted
+	policy.  Other minor cleanups and fixes.  Auditd fixes by Paul
+	Moore.
+
+1.23.13 2005-04-22
+	* Merged more changes from Dan Walsh to initrc_t for removal of
+	unconfined_domain.
+	* Merged Dan Walsh's split of auditd policy into auditd_t for the
+	audit daemon and auditctl_t for the autoctl program.
+	* Added use of name_connect to uncond_can_ypbind macro by Dan
+	Walsh.
+	* Merged other cleanup and fixes by Dan Walsh.
+
+1.23.12 2005-04-20
+	* Merged Dan Walsh's Netlink changes to handle new auditing pam
+	modules.
+	* Merged Dan Walsh's patch removing the sysadmfile attribute from
+	policy files to separate sysadm_t from secadm_t.
+	* Added CVS and uucpd policy from Dan Walsh.
+	* Cleanup by Dan Walsh to handle turning off unlimitedRC.
+	* Merged Russell Coker's fixes to ntpd, postgrey, and named
+	policy.
+	* Cleanup of chkpwd_domain and added permissions to su_domain
+	macro due to pam changes to support audit.
+	* Added nlmsg_relay and nlmsg_readpriv permissions to the
+	netlink_audit_socket class.
+
+1.23.11 2005-04-14
+	* Merged Dan Walsh's separation of the security manager and system
+	administrator.
+	* Removed screensaver.te as suggested by Thomas Bleher
+	* Cleanup of typealiases that are no longer used by Thomas Bleher.
+	* Cleanup of fc files and additional rules for SuSE by Thomas
+	Bleher.
+	* Merged changes to auditd and named policy by Russell Coker.
+	* Merged MLS change from Darrel Goeddel to support the policy
+	hierarchy patch.
+
+1.23.10 2005-04-08
+	* Removed pump.te, pump.fc, and targeted/domains/program/modutil.te
+
+1.23.9 2005-04-07
+	* Merged diffs from Dan Walsh.  Includes Ivan Gyurdiev's cleanup
+	of x_client apps.
+	* Added dmidecode policy from Ivan Gyurdiev.
+
+1.23.8 2005-04-05
+	* Added netlink_kobject_uevent_socket class.
+	* Removed empty files pump.te and pump.fc.
+	* Added NetworkManager policy from Dan Walsh.
+	* Merged Dan Walsh's major restructuring of Apache's policy.
+
+1.23.7 2005-04-04
+	* Merged David Hampton's amavis and clamav cleanups.
+	* Added David Hampton's dcc, pyzor, and razor policy.
+	
+1.23.6 2005-04-01
+	* Merged cleanup of the Makefile and other stuff from Dan Walsh.
+	Dan's patch includes some desktop changes from Ivan Gyurdiev.
+	* Merged Thomas Bleher's patches which increase the usage of
+	lock_domain() and etc_domain(), changes var_lib_DOMAIN_t usage to
+	DOMAIN_var_lib_t, and removes use of notdevfile_class_set where
+	possible. 
+	* Merged Greg Norris's cleanup of fetchmail.
+	
+1.23.5 2005-03-23
+	* Added name_connect support from Dan Walsh.
+	* Added httpd_unconfined_t from Dan Walsh.
+	* Merged cleanup of assert.te to allow unresticted full access
+	from Dan Walsh.
+	
+1.23.4 2005-03-21
+	* Merged diffs from Dan Walsh:  
+	* Cleanup of x_client_macro, tvtime, mozilla, and mplayer by Ivan 
+	Gyurdiev.  
+	* Added syslogng support to syslog.te.
+	
+1.23.3 2005-03-15
+	* Added policy for nx_server from Thomas Bleher.
+	* Added policies for clockspeed, daemontools, djbdns, ucspi-tcp, and
+	publicfile from Petre Rodan.
+	
 1.23.2 2005-03-14
 	* Merged diffs from Dan Walsh.  Dan's patch includes Ivan Gyurdiev's 
 	gift policy.
diff --git a/strict/Makefile b/strict/Makefile
index 5a70bc7..fec8c3e 100644
--- a/strict/Makefile
+++ b/strict/Makefile
@@ -60,7 +60,7 @@ POLICYFILES += $(USER_FILES)
 POLICYFILES += constraints
 POLICYFILES += $(DEFCONTEXTFILES)
 CONTEXTFILES = $(DEFCONTEXTFILES)
-POLICY_DIRS = domains/program domains/misc
+POLICY_DIRS = domains domains/program domains/misc macros macros/program
 
 UNUSED_TE_FILES := $(wildcard domains/program/unused/*.te)
 
@@ -70,19 +70,19 @@ FCFILES=file_contexts/types.fc $(patsubst domains/program/%.te,file_contexts/pro
 CONTEXTFILES += $(FCFILES)
 
 APPDIR=$(CONTEXTPATH)
-APPFILES = $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types) $(CONTEXTPATH)/files/media
+APPFILES = $(addprefix $(APPDIR)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types port_types) $(CONTEXTPATH)/files/media
 CONTEXTFILES += $(wildcard appconfig/*_context*) appconfig/media
 
 ROOTFILES = $(addprefix $(APPDIR)/users/,root)
 
 all:  policy
 
-tmp/valid_fc: $(APPFILES) $(ROOTFILES) $(LOADPATH) $(FCPATH) 
-	@echo "Validating file_contexts ..."	
-	$(SETFILES) -q -c $(LOADPATH) $(FCPATH)
+tmp/valid_fc: $(LOADPATH) $(FC) 
+	@echo "Validating file contexts files ..."	
+	$(SETFILES) -q -c $(LOADPATH) $(FC)
 	@touch tmp/valid_fc
 
-install: tmp/valid_fc $(USERPATH)/local.users
+install: $(FCPATH) $(APPFILES) $(ROOTFILES) $(USERPATH)/local.users
 
 $(USERPATH)/system.users: $(ALL_TUNABLES) $(USER_FILES) policy.conf
 	@mkdir -p $(USERPATH)
@@ -91,61 +91,64 @@ $(USERPATH)/system.users: $(ALL_TUNABLES) $(USER_FILES) policy.conf
 	@echo "# This file is replaced on reinstalls of this policy." >> tmp/system.users
 	@echo "# Please edit local.users to make local changes." >> tmp/system.users
 	@echo "#" >> tmp/system.users
-	m4 $(ALL_TUNABLES) tmp/program_used_flags.te $(USER_FILES) | grep -v "^#" >> tmp/system.users
+	@m4 $(ALL_TUNABLES) tmp/program_used_flags.te $(USER_FILES) | grep -v "^#" >> tmp/system.users
 	install -m 644 tmp/system.users $@
 
 $(USERPATH)/local.users: local.users
 	@mkdir -p $(USERPATH)
-	install -C -b -m 644 $< $@
+	install -b -m 644 $< $@
 
 $(CONTEXTPATH)/files/media: appconfig/media
-	mkdir -p $(CONTEXTPATH)/files/
+	@mkdir -p $(CONTEXTPATH)/files/
 	install -m 644 $< $@
 
 $(APPDIR)/default_contexts: appconfig/default_contexts
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/removable_context: appconfig/removable_context
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/customizable_types: policy.conf
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	@grep "^type .*customizable" $< | cut -d',' -f1 | cut -d' ' -f2 > tmp/customizable_types
 	install -m 644 tmp/customizable_types $@ 
 
+$(APPDIR)/port_types: policy.conf
+	@mkdir -p $(APPDIR)
+	@grep "^type .*port_type" $< | cut -d',' -f1 | cut -d' ' -f2 > tmp/port_types
+	install -m 644 tmp/port_types $@ 
+
 $(APPDIR)/default_type: appconfig/default_type
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/userhelper_context: appconfig/userhelper_context
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/initrc_context: appconfig/initrc_context
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/failsafe_context: appconfig/failsafe_context
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/dbus_contexts: appconfig/dbus_contexts
-	mkdir -p $(APPDIR)
+	@mkdir -p $(APPDIR)
 	install -m 644 $< $@
 
 $(APPDIR)/users/root: appconfig/root_default_contexts
-	mkdir -p $(APPDIR)/users
+	@mkdir -p $(APPDIR)/users
 	install -m 644 $< $@
 
-$(LOADPATH):  policy.conf $(CHECKPOLICY)
-	mkdir -p $(POLICYPATH)
+$(LOADPATH): policy.conf $(CHECKPOLICY) 
+	@echo "Compiling policy ..."
+	@mkdir -p $(POLICYPATH)
 	$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
 ifneq ($(MLS),y)
-ifneq ($(VERS),18)
-	$(CHECKPOLICY) -c 18 -o $(POLICYPATH)/policy.18 policy.conf
-endif
 endif
 # Note: Can't use install, so not sure how to deal with mode, user, and group
 #	other than by default.
@@ -154,46 +157,39 @@ policy: $(POLICYVER)
 
 $(POLICYVER):  policy.conf $(FC) $(CHECKPOLICY)
 	$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
-ifneq ($(MLS),y)
-ifneq ($(VERS),18)
-	$(CHECKPOLICY) -c 18 -o policy.18 policy.conf
-endif
-endif
-	@echo "Validating file_contexts ..."
+	@echo "Validating file contexts files ..."
 	$(SETFILES) -q -c $(POLICYVER) $(FC)
 
-reload tmp/load: $(FCPATH) $(LOADPATH)
-ifeq ($(VERS), $(KERNVERS))
+reload tmp/load: $(LOADPATH) 
+	@echo "Loading Policy ..."
 	$(LOADPOLICY) $(LOADPATH)
-else
-	$(LOADPOLICY) $(POLICYPATH)/policy.18
-endif
 	touch tmp/load
 
-load: tmp/load
+load: tmp/load $(FCPATH) 
 
 enableaudit: policy.conf 
 	grep -v dontaudit policy.conf > policy.audit
 	mv policy.audit policy.conf
 
 policy.conf: $(POLICYFILES) $(POLICY_DIRS)
-	mkdir -p tmp
+	@echo "Building policy.conf ..."
+	@mkdir -p tmp
 	m4 $(M4PARAM) -Imacros -s $(POLICYFILES) > $@.tmp
-	mv $@.tmp $@
+	@mv $@.tmp $@
 
 install-src: 
 	rm -rf $(SRCPATH)/policy.old
 	-mv $(SRCPATH)/policy $(SRCPATH)/policy.old
-	mkdir -p $(SRCPATH)/policy
+	@mkdir -p $(SRCPATH)/policy
 	cp -R . $(SRCPATH)/policy
 
 tmp/program_used_flags.te: $(wildcard domains/program/*.te) domains/program
-	mkdir -p tmp
+	@mkdir -p tmp
 	( cd domains/program/ ; for n in *.te ; do echo "define(\`$$n')"; done ) > $@.tmp
 	( cd domains/misc/ ; for n in *.te ; do echo "define(\`$$n')"; done ) >> $@.tmp
 	mv $@.tmp $@
 
-FILESYSTEMS=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs).*rw/{print $$3}';`
+FILESYSTEMS=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[23]| xfs| jfs | reiserfs ).*rw/{print $$3}';`
 
 checklabels: $(SETFILES)
 	$(SETFILES) -v -n $(FC) $(FILESYSTEMS)
@@ -205,20 +201,20 @@ relabel:  $(FC) $(SETFILES)
 	$(SETFILES) $(FC) $(FILESYSTEMS)
 
 file_contexts/misc:
-	mkdir -p file_contexts/misc
-
+	@mkdir -p file_contexts/misc
 
-$(FCPATH): $(FC) $(USERPATH)/system.users 
+$(FCPATH): tmp/valid_fc $(USERPATH)/system.users  $(APPDIR)/customizable_types $(APPDIR)/port_types
+	@echo "Installing file contexts files..."
 	@mkdir -p $(CONTEXTPATH)/files
-	install -m 644 $(FC) $(FCPATH)
 	install -m 644 $(HOMEDIR_TEMPLATE) $(HOMEDIRPATH)
+	install -m 644 $(FC) $(FCPATH)
 	@$(GENHOMEDIRCON) -d $(TOPDIR) -t $(TYPE) $(USEPWD)
 
 $(FC): $(ALL_TUNABLES) tmp/program_used_flags.te $(FCFILES) domains/program domains/misc file_contexts/program file_contexts/misc users /etc/passwd
-	@echo "Building file_contexts ..."
+	@echo "Building file contexts files..."
 	@m4 $(M4PARAM) $(ALL_TUNABLES) tmp/program_used_flags.te $(FCFILES) > $@.tmp
-	@grep -v -e HOME -e ROLE $@.tmp > $@
-	@grep -e HOME -e ROLE $@.tmp  > $(HOMEDIR_TEMPLATE)
+	@grep -v -e HOME -e ROLE -e USER $@.tmp > $@
+	@grep -e HOME -e ROLE -e USER $@.tmp  > $(HOMEDIR_TEMPLATE)
 	@-rm $@.tmp
 
 # Create a tags-file for the policy:
@@ -239,7 +235,7 @@ tags: $(wildcard *.te types/*.te domains/*.te domains/misc/*.te domains/program/
 	  --regex-te='/^[ \t]*bool[ \t]+(\w+)/\1/b,bool/' $^
  
 clean:
-	rm -f policy.conf $(POLICYVER) policy.18
+	rm -f policy.conf $(POLICYVER)
 	rm -f tags
 	rm -f tmp/*
 	rm -f $(FC)
@@ -324,8 +320,11 @@ mlsconvert:
 	done
 	@for file in $(USER_FILES); do \
 		echo "Converting $$file"; \
-		sed -e 's/;/ level s0 range s0 - s9 : c0 . c127;/' $$file > $$file.new && \
+		sed -e 's/;/ level s0 range s0 - s9:c0.c127;/' $$file > $$file.new && \
 		mv $$file.new $$file; \
 	done
-	@sed -e '/sid kernel/s/s0/s0 - s9 : c0 . c127/' initial_sid_contexts > initial_sid_contexts.new && mv initial_sid_contexts.new initial_sid_contexts
+	@sed -e '/sid kernel/s/s0/s0 - s9:c0.c127/' initial_sid_contexts > initial_sid_contexts.new && mv initial_sid_contexts.new initial_sid_contexts
+	@echo "Enabling MLS in the Makefile"
+	@sed "s/MLS=n/MLS=y/" Makefile > Makefile.new
+	@mv Makefile.new Makefile
 	@echo "Done"
diff --git a/strict/VERSION b/strict/VERSION
index aa3e574..24cffb8 100644
--- a/strict/VERSION
+++ b/strict/VERSION
@@ -1 +1 @@
-1.23.2-1
+1.26
diff --git a/strict/attrib.te b/strict/attrib.te
index cc79235..ca9d8e8 100644
--- a/strict/attrib.te
+++ b/strict/attrib.te
@@ -110,6 +110,10 @@ attribute privlog;
 # and an allow rule to permit it
 attribute privmodule;
 
+# The privsysmod attribute identifies every domain that can have the
+# sys_module capability
+attribute privsysmod;
+
 # The privmem attribute identifies every domain that can 
 # access kernel memory devices.
 # This attribute is used in the TE assertions to verify
@@ -117,6 +121,13 @@ attribute privmodule;
 # tagged with this attribute.
 attribute privmem;
 
+# The privkmsg attribute identifies every domain that can 
+# read kernel messages (/proc/kmsg)
+# This attribute is used in the TE assertions to verify
+# that such access is limited to domains that are explicitly
+# tagged with this attribute.
+attribute privkmsg;
+
 # The privfd attribute identifies every domain that should have
 # file handles inherited widely (IE sshd_t and getty_t).
 attribute privfd;
@@ -251,6 +262,12 @@ attribute sysadmfile;
 # overall filesystem statistics.
 attribute fs_type;
 
+# The mount_point attribute identifies all types that can serve
+# as a mount point (for the mount binary). It is used in the mount 
+# policy to grant mounton permission, and in other domains to grant 
+# getattr permission over all the mount points.
+attribute mount_point;
+
 # The exec_type attribute identifies all types assigned
 # to entrypoint executables for domains.  This attribute is 
 # used in TE rules and assertions that should be applied to all 
@@ -413,7 +430,11 @@ attribute nscd_client_domain;
 # For clients of nscd that can use shmem interface.
 attribute nscd_shmem_domain;
 
-# For labeling of content for httpd
+# For labeling of content for httpd.  This attribute is only used by
+# the httpd_unified domain, which says treat all httpdcontent the
+# same.  If you want content to be served in a "non-unified" system
+# you must specifically add "r_dir_file(httpd_t, your_content_t)" to
+# your policy.
 attribute httpdcontent;
 
 # For labeling of domains whos transition can be disabled
diff --git a/strict/constraints b/strict/constraints
index 17fccc0..46a9875 100644
--- a/strict/constraints
+++ b/strict/constraints
@@ -61,6 +61,10 @@ ifdef(`crond.te', `
 ')
 ifdef(`userhelper.te', 
 	`or (t1 == userhelperdomain)')
+ifdef(`postfix.te', `
+ifdef(`direct_sysadm_daemon',
+	`or (t1 == sysadm_mail_t and t2 == system_mail_t and r2 == system_r )')
+')
 	 or (t1 == priv_system_role and r2 == system_r )
         );
 
diff --git a/strict/domains/program/crond.te b/strict/domains/program/crond.te
index d92a422..43d6bbe 100644
--- a/strict/domains/program/crond.te
+++ b/strict/domains/program/crond.te
@@ -86,6 +86,8 @@ allow crond_t rpm_log_t: file create_file_perms;
 
 system_crond_entry(rpm_exec_t, rpm_t)
 allow system_crond_t rpm_log_t:file create_file_perms;
+#read ahead wants to read this
+allow initrc_t system_cron_spool_t:file { getattr read };
 ')
 ')
 
diff --git a/strict/domains/program/dhcpc.te b/strict/domains/program/dhcpc.te
index 3703ce4..442d46f 100644
--- a/strict/domains/program/dhcpc.te
+++ b/strict/domains/program/dhcpc.te
@@ -64,6 +64,9 @@ allow ping_t hotplug_t:fd use;
 ifdef(`cardmgr.te', `
 allow ping_t cardmgr_t:fd use;
 ') dnl end if cardmgr
+', `
+allow dhcpc_t self:capability setuid;
+allow dhcpc_t self:rawip_socket create_socket_perms;
 ') dnl end if ping
 
 ifdef(`dhcpd.te', `', `
@@ -116,7 +119,7 @@ allow dhcpc_t self:packet_socket create_socket_perms;
 allow dhcpc_t var_lib_t:dir search;
 file_type_auto_trans(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
 
-allow dhcpc_t bin_t:dir search;
+allow dhcpc_t bin_t:dir { getattr search };
 allow dhcpc_t bin_t:lnk_file read;
 can_exec(dhcpc_t, { bin_t shell_exec_t })
 
diff --git a/strict/domains/program/hotplug.te b/strict/domains/program/hotplug.te
index 65f5396..38e1d52 100644
--- a/strict/domains/program/hotplug.te
+++ b/strict/domains/program/hotplug.te
@@ -65,7 +65,7 @@ allow hotplug_t usbfs_t:file { getattr read };
 allow hotplug_t etc_t:dir r_dir_perms;
 allow hotplug_t etc_t:{ file lnk_file } r_file_perms;
 
-allow hotplug_t kernel_t:process sigchld;
+allow hotplug_t kernel_t:process { sigchld setpgid };
 
 ifdef(`distro_redhat', `
 allow hotplug_t var_lock_t:dir search;
@@ -128,9 +128,9 @@ dontaudit hotplug_t initctl_t:fifo_file { read write };
 # Read /usr/lib/gconv/.*
 allow hotplug_t lib_t:file { getattr read };
 
-allow hotplug_t self:capability { net_admin sys_tty_config mknod };
-allow hotplug_t sysfs_t:dir { getattr read search };
-allow hotplug_t sysfs_t:file { getattr read };
+allow hotplug_t self:capability { net_admin sys_tty_config mknod sys_rawio };
+allow hotplug_t sysfs_t:dir { getattr read search write };
+allow hotplug_t sysfs_t:file rw_file_perms;
 allow hotplug_t sysfs_t:lnk_file { getattr read };
 allow hotplug_t udev_runtime_t:file rw_file_perms;
 ifdef(`lpd.te', `
@@ -156,10 +156,7 @@ ifdef(`mta.te', `
 domain_auto_trans(hotplug_t, sendmail_exec_t, system_mail_t) 
 ')
 
-allow restorecon_t hotplug_t:fd use;
+allow { insmod_t kernel_t } hotplug_etc_t:dir { search getattr };
+allow hotplug_t self:netlink_route_socket r_netlink_socket_perms;
 
-ifdef(`unlimitedUtils', `
-unconfined_domain(hotplug_t) 
-')
-
-allow kernel_t hotplug_etc_t:dir search;
+dontaudit hotplug_t selinux_config_t:dir search;
diff --git a/strict/domains/program/ipsec.te b/strict/domains/program/ipsec.te
index dd32f69..3bb4bad 100644
--- a/strict/domains/program/ipsec.te
+++ b/strict/domains/program/ipsec.te
@@ -185,9 +185,8 @@ allow ipsec_t etc_t:file { read getattr };
 allow ipsec_mgmt_t null_device_t:chr_file rw_file_perms;
 allow ipsec_t null_device_t:chr_file rw_file_perms;
 
-# Allow scripts to use /var/locl/subsys/ipsec
-allow ipsec_mgmt_t var_lock_t:dir rw_dir_perms;
-allow ipsec_mgmt_t var_lock_t:file create_file_perms;
+# Allow scripts to use /var/lock/subsys/ipsec
+lock_domain(ipsec_mgmt)
 
 # allow tncfg to create sockets
 allow ipsec_mgmt_t self:udp_socket { create ioctl };
diff --git a/strict/domains/program/klogd.te b/strict/domains/program/klogd.te
index 42a136e..dd0b79c 100644
--- a/strict/domains/program/klogd.te
+++ b/strict/domains/program/klogd.te
@@ -43,3 +43,6 @@ allow klogd_t kernel_t:system { syslog_mod syslog_console };
 # Read /boot/System.map*
 allow klogd_t system_map_t:file r_file_perms;
 allow klogd_t boot_t:dir r_dir_perms;
+ifdef(`targeted_policy', `
+allow klogd_t unconfined_t:system syslog_mod;
+')
diff --git a/strict/domains/program/load_policy.te b/strict/domains/program/load_policy.te
index 8276f58..e10a6e2 100644
--- a/strict/domains/program/load_policy.te
+++ b/strict/domains/program/load_policy.te
@@ -11,6 +11,7 @@
 
 type load_policy_t, domain;
 role sysadm_r types load_policy_t;
+role secadm_r types load_policy_t;
 role system_r types load_policy_t;
 
 type load_policy_exec_t, file_type, exec_type, sysadmfile;
@@ -19,7 +20,7 @@ type load_policy_exec_t, file_type, exec_type, sysadmfile;
 # 
 # Rules
 
-domain_auto_trans(sysadm_t, load_policy_exec_t, load_policy_t)
+domain_auto_trans(secadmin, load_policy_exec_t, load_policy_t)
 
 allow load_policy_t console_device_t:chr_file { read write };
 
diff --git a/strict/domains/program/login.te b/strict/domains/program/login.te
index 540b68f..887aa58 100644
--- a/strict/domains/program/login.te
+++ b/strict/domains/program/login.te
@@ -13,7 +13,7 @@
 
 # $1 is the name of the domain (local or remote)
 define(`login_domain', `
-type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain;
+type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
 role system_r types $1_login_t;
 
 dontaudit $1_login_t shadow_t:file { getattr read };
@@ -83,6 +83,9 @@ if (use_samba_home_dirs) {
 r_dir_file($1_login_t, cifs_t)
 }
 
+# Login can polyinstantiate
+polyinstantiater($1_login_t)
+
 # FIXME: what is this for?
 ifdef(`xdm.te', `
 allow xdm_t $1_login_t:process signull;
@@ -166,9 +169,7 @@ dontaudit local_login_t mnt_t:dir r_dir_perms;
 
 
 # Create lock file.
-allow local_login_t var_lock_t:dir rw_dir_perms;
-allow local_login_t var_lock_t:file create_file_perms;
-
+lock_domain(local_login)
 
 # Read and write ttys.
 allow local_login_t tty_device_t:chr_file { setattr rw_file_perms };
diff --git a/strict/domains/program/logrotate.te b/strict/domains/program/logrotate.te
index 9cdcf6f..33c1d51 100644
--- a/strict/domains/program/logrotate.te
+++ b/strict/domains/program/logrotate.te
@@ -46,7 +46,7 @@ allow logrotate_t etc_runtime_t:file r_file_perms;
 allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search };
 
 # create lock files
-rw_dir_create_file(logrotate_t, var_lock_t)
+lock_domain(logrotate)
 
 # Create temporary files.
 tmp_domain(logrotate)
diff --git a/strict/domains/program/modutil.te b/strict/domains/program/modutil.te
index ca8d7c1..64028d6 100644
--- a/strict/domains/program/modutil.te
+++ b/strict/domains/program/modutil.te
@@ -71,7 +71,7 @@ r_dir_file(depmod_t, { staff_home_t sysadm_home_t })
 # Rules for the insmod_t domain.
 #
 
-type insmod_t, domain, privlog, sysctl_kernel_writer, privmem ifdef(`unlimitedUtils', `, admin, etc_writer, fs_domain, auth_write, privowner, privmodule' )
+type insmod_t, domain, privlog, sysctl_kernel_writer, privmem, privsysmod ifdef(`unlimitedUtils', `, admin, etc_writer, fs_domain, auth_write, privowner, privmodule' ), mlsfilewrite, nscd_client_domain
 ;
 role system_r types insmod_t;
 role sysadm_r types insmod_t;
diff --git a/strict/domains/program/mount.te b/strict/domains/program/mount.te
index 8f1b7c1..9efd6a4 100644
--- a/strict/domains/program/mount.te
+++ b/strict/domains/program/mount.te
@@ -11,7 +11,7 @@
 
 type mount_exec_t, file_type, sysadmfile, exec_type;
 
-mount_domain(sysadm, mount, `, fs_domain, nscd_client_domain')
+mount_domain(sysadm, mount, `, fs_domain, nscd_client_domain, mlsfileread, mlsfilewrite')
 mount_loopback_privs(sysadm, mount)
 role sysadm_r types mount_t;
 role system_r types mount_t;
@@ -39,20 +39,16 @@ allow mount_t file_t:file { getattr read unlink };
 allow mount_t fs_type:filesystem mount_fs_perms;
 allow mount_t mount_point:dir mounton;
 allow mount_t nfs_t:dir search;
-# nfsv4 has a filesystem to mount for its userspace daemons
-allow mount_t var_lib_nfs_t:dir mounton;
-
-# On some RedHat systems, /boot is a mount point
-allow mount_t boot_t:dir mounton;
-allow mount_t device_t:dir mounton;
-# mount binfmt_misc on /proc/sys/fs/binfmt_misc
-allow mount_t sysctl_t:dir { mounton search };
+allow mount_t sysctl_t:dir search;
 
 allow mount_t root_t:filesystem unmount;
 
+can_portmap(mount_t)
+
 ifdef(`portmap.te', `
 # for nfs
 can_network(mount_t)
+allow mount_t port_type:tcp_socket name_connect;
 can_ypbind(mount_t)
 allow mount_t port_t:{ tcp_socket udp_socket } name_bind;
 allow mount_t reserved_port_t:{ tcp_socket udp_socket } name_bind;
@@ -83,11 +79,7 @@ dontaudit mount_t kernel_t:fd use;
 allow mount_t userdomain:fd use;
 can_exec(mount_t, { sbin_t bin_t })
 allow mount_t device_t:dir r_dir_perms;
-ifdef(`distro_redhat', `
 allow mount_t tmpfs_t:chr_file { read write };
-allow mount_t tmpfs_t:dir mounton;
-')
-
 
 # tries to read /init
 dontaudit mount_t root_t:file { getattr read };
diff --git a/strict/domains/program/mta.te b/strict/domains/program/mta.te
index 096c734..6c141c4 100644
--- a/strict/domains/program/mta.te
+++ b/strict/domains/program/mta.te
@@ -13,8 +13,6 @@
 ifdef(`sendmail.te', `', `
 type sendmail_exec_t, file_type, exec_type, sysadmfile;
 ')
-type smtp_port_t, port_type, reserved_port_type;
-
 
 # create a system_mail_t domain for daemons, init scripts, etc when they run
 # "mail user@domain"
@@ -25,6 +23,7 @@ ifdef(`targeted_policy', `
 # targeted policy.  We could move these rules permanantly here.
 ifdef(`postfix.te', `', `can_exec_any(system_mail_t)')
 allow system_mail_t self:dir { search };
+allow system_mail_t self:lnk_file read;
 r_dir_file(system_mail_t, { proc_t proc_net_t })
 allow system_mail_t fs_t:filesystem getattr;
 allow system_mail_t { var_t var_spool_t }:dir getattr;
@@ -59,15 +58,6 @@ allow { system_mail_t mta_user_agent } privmail:process sigchld;
 allow { system_mail_t mta_user_agent } privmail:fifo_file { read write };
 allow { system_mail_t mta_user_agent } admin_tty_type:chr_file { read write };
 
-ifdef(`arpwatch.te', `
-# why is mail delivered to a directory of type arpwatch_data_t?
-allow mta_delivery_agent arpwatch_data_t:dir search;
-allow { system_mail_t mta_user_agent } arpwatch_tmp_t:file rw_file_perms;
-ifdef(`hide_broken_symptoms', `
-dontaudit { system_mail_t mta_user_agent } arpwatch_t:packet_socket { read write };
-')
-')dnl end if arpwatch.te
-
 allow mta_delivery_agent home_root_t:dir { getattr search };
 
 # for /var/spool/mail
@@ -81,4 +71,4 @@ allow mta_delivery_agent devtty_t:chr_file rw_file_perms;
 allow mta_delivery_agent { etc_runtime_t proc_t }:file { getattr read };
 
 allow system_mail_t etc_runtime_t:file { getattr read };
-allow system_mail_t urandom_device_t:chr_file read;
+allow system_mail_t { random_device_t urandom_device_t }:chr_file { getattr read };
diff --git a/strict/domains/program/mysqld.te b/strict/domains/program/mysqld.te
index 84934de..1bd9073 100644
--- a/strict/domains/program/mysqld.te
+++ b/strict/domains/program/mysqld.te
@@ -10,15 +10,13 @@
 #
 # mysqld_exec_t is the type of the mysqld executable.
 #
-daemon_domain(mysqld)
+daemon_domain(mysqld, `, nscd_client_domain')
 
-type mysqld_port_t, port_type;
 allow mysqld_t mysqld_port_t:tcp_socket name_bind;
 
 allow mysqld_t mysqld_var_run_t:sock_file create_file_perms;
 
 etcdir_domain(mysqld)
-typealias mysqld_etc_t alias etc_mysqld_t;
 type mysqld_db_t, file_type, sysadmfile;
 
 log_domain(mysqld)
@@ -36,7 +34,7 @@ allow initrc_t mysqld_var_run_t:sock_file write;
 allow initrc_t mysqld_log_t:file { write append setattr ioctl };
 
 allow mysqld_t self:capability { dac_override setgid setuid net_bind_service };
-allow mysqld_t self:process getsched;
+allow mysqld_t self:process { setsched getsched };
 
 allow mysqld_t proc_t:file { getattr read };
 
@@ -90,3 +88,4 @@ allow userdomain mysqld_var_run_t:sock_file write;
 }
 ')
 
+allow mysqld_t self:netlink_route_socket r_netlink_socket_perms;
diff --git a/strict/domains/program/named.te b/strict/domains/program/named.te
index 028667e..39924d7 100644
--- a/strict/domains/program/named.te
+++ b/strict/domains/program/named.te
@@ -10,11 +10,13 @@
 #
 # Rules for the named_t domain.
 #
-type rndc_port_t, port_type, reserved_port_type;
 
 daemon_domain(named, `, nscd_client_domain')
 tmp_domain(named)
 
+type named_checkconf_exec_t, file_type, exec_type, sysadmfile;
+domain_auto_trans(initrc_t, named_checkconf_exec_t, named_t)
+
 # For /var/run/ndc used in BIND 8
 file_type_auto_trans(named_t, var_run_t, named_var_run_t, sock_file)
 
@@ -54,11 +56,13 @@ allow named_t etc_runtime_t:{ file lnk_file } { getattr read };
 
 #Named can use network
 can_network(named_t)
+allow named_t port_type:tcp_socket name_connect;
 can_ypbind(named_t)
 # allow UDP transfer to/from any program
 can_udp_send(domain, named_t)
 can_udp_send(named_t, domain)
 can_tcp_connect(domain, named_t)
+log_domain(named)
 
 # Bind to the named port.
 allow named_t dns_port_t:udp_socket name_bind;
@@ -103,6 +107,7 @@ type ndc_exec_t, file_type,sysadmfile, exec_type;
 domain_auto_trans({ sysadm_t initrc_t }, ndc_exec_t, ndc_t)
 uses_shlib(ndc_t)
 can_network_client_tcp(ndc_t)
+allow ndc_t rndc_port_t:tcp_socket name_connect;
 can_ypbind(ndc_t)
 can_resolve(ndc_t)
 read_locale(ndc_t)
@@ -113,6 +118,7 @@ ifdef(`distro_redhat', `
 allow { ndc_t initrc_t } named_conf_t:dir search;
 # Allow init script to cp localtime to named_conf_t
 allow initrc_t named_conf_t:file { setattr write };
+allow initrc_t named_conf_t:dir create_dir_perms;
 ')
 allow { ndc_t initrc_t } named_conf_t:file { getattr read };
 
diff --git a/strict/domains/program/newrole.te b/strict/domains/program/newrole.te
index 6f6489e..8d66e4b 100644
--- a/strict/domains/program/newrole.te
+++ b/strict/domains/program/newrole.te
@@ -17,3 +17,4 @@ newrole_domain(newrole)
 allow newrole_t var_run_t:dir r_dir_perms;
 allow newrole_t initrc_var_run_t:file rw_file_perms;
 
+role secadm_r types newrole_t;
diff --git a/strict/domains/program/nscd.te b/strict/domains/program/nscd.te
index 40ffbbc..77e2eb7 100644
--- a/strict/domains/program/nscd.te
+++ b/strict/domains/program/nscd.te
@@ -73,3 +73,6 @@ allow nscd_t self:netlink_route_socket r_netlink_socket_perms;
 allow nscd_t tmp_t:dir { search getattr };
 allow nscd_t tmp_t:lnk_file read;
 allow nscd_t { urandom_device_t random_device_t }:chr_file { getattr read };
+log_domain(nscd)
+r_dir_file(nscd_t, cert_t)
+allow nscd_t tun_tap_device_t:chr_file { read write };
diff --git a/strict/domains/program/ntpd.te b/strict/domains/program/ntpd.te
index 2b7480c..80ea965 100644
--- a/strict/domains/program/ntpd.te
+++ b/strict/domains/program/ntpd.te
@@ -43,6 +43,7 @@ can_network(ntpd_t)
 allow ntpd_t ntp_port_t:tcp_socket name_connect;
 can_ypbind(ntpd_t)
 allow ntpd_t ntp_port_t:udp_socket name_bind;
+allow sysadm_t ntp_port_t:udp_socket name_bind;
 allow ntpd_t self:unix_dgram_socket create_socket_perms;
 allow ntpd_t self:unix_stream_socket create_socket_perms;
 allow ntpd_t self:netlink_route_socket r_netlink_socket_perms;
diff --git a/strict/domains/program/pam.te b/strict/domains/program/pam.te
index 7c5710f..2d71222 100644
--- a/strict/domains/program/pam.te
+++ b/strict/domains/program/pam.te
@@ -37,4 +37,9 @@ dontaudit pam_t self:capability sys_tty_config;
 
 allow initrc_t pam_var_run_t:dir rw_dir_perms;
 allow initrc_t pam_var_run_t:file { getattr read unlink };
-dontaudit pam_t initrc_var_run_t:file { read write };
+dontaudit pam_t initrc_var_run_t:file rw_file_perms;
+
+# Supress xdm denial
+ifdef(`xdm.te', `
+dontaudit pam_t xdm_t:fd use;
+') dnl ifdef
diff --git a/strict/domains/program/ping.te b/strict/domains/program/ping.te
index c23d92b..cc1407e 100644
--- a/strict/domains/program/ping.te
+++ b/strict/domains/program/ping.te
@@ -17,6 +17,7 @@ role system_r types ping_t;
 in_user_role(ping_t)
 type ping_exec_t, file_type, sysadmfile, exec_type;
 
+ifdef(`targeted_policy', `', `
 bool user_ping false;
 
 if (user_ping) {
@@ -25,6 +26,7 @@ if (user_ping) {
 	allow ping_t { ttyfile ptyfile }:chr_file rw_file_perms;
 	ifdef(`gnome-pty-helper.te', `allow ping_t gphdomain:fd use;')
 }
+')
 
 # Transition into this domain when you run this program.
 domain_auto_trans(sysadm_t, ping_exec_t, ping_t)
@@ -32,6 +34,7 @@ domain_auto_trans(initrc_t, ping_exec_t, ping_t)
 
 uses_shlib(ping_t)
 can_network_client(ping_t)
+can_resolve(ping_t)
 can_ypbind(ping_t)
 allow ping_t etc_t:file { getattr read };
 allow ping_t self:unix_stream_socket create_socket_perms;
diff --git a/strict/domains/program/udev.te b/strict/domains/program/udev.te
index fb70a35..ae4760c 100644
--- a/strict/domains/program/udev.te
+++ b/strict/domains/program/udev.te
@@ -28,18 +28,19 @@ can_exec_any(udev_t)
 type udev_tdb_t, file_type, sysadmfile, dev_fs;
 typealias udev_tdb_t alias udev_tbl_t;
 file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
-allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin };
+allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin sys_nice mknod net_raw net_admin sys_rawio };
 allow udev_t self:file { getattr read };
 allow udev_t self:unix_stream_socket {connectto create_stream_socket_perms};
 allow udev_t self:unix_dgram_socket create_socket_perms;
 allow udev_t self:fifo_file rw_file_perms;
 allow udev_t self:netlink_kobject_uevent_socket { create bind read }; 
+allow udev_t device_t:file { unlink rw_file_perms };
 allow udev_t device_t:sock_file create_file_perms;
 allow udev_t device_t:lnk_file create_lnk_perms;
 allow udev_t { device_t device_type }:{ chr_file blk_file } { relabelfrom relabelto create_file_perms };
 ifdef(`distro_redhat', `
-allow udev_t tmpfs_t:dir rw_dir_perms;
-allow udev_t tmpfs_t:sock_file create_file_perms;
+allow udev_t tmpfs_t:dir create_dir_perms;
+allow udev_t tmpfs_t:{ sock_file file } create_file_perms;
 allow udev_t tmpfs_t:lnk_file create_lnk_perms;
 allow udev_t tmpfs_t:{ chr_file blk_file } { relabelfrom relabelto create_file_perms };
 allow udev_t tmpfs_t:dir search;
@@ -53,7 +54,7 @@ allow udev_t { sbin_t bin_t }:lnk_file read;
 allow udev_t bin_t:lnk_file read;
 can_exec(udev_t, { shell_exec_t bin_t sbin_t etc_t } )
 can_exec(udev_t, udev_exec_t)
-r_dir_file(udev_t, sysfs_t)
+rw_dir_file(udev_t, sysfs_t)
 allow udev_t sysadm_tty_device_t:chr_file { read write };
 
 # to read the file_contexts file
@@ -138,3 +139,8 @@ file_type_auto_trans(udev_t, etc_t, dhcp_etc_t, file)
 ')
 r_dir_file(udev_t, domain)
 allow udev_t modules_dep_t:file r_file_perms;
+
+ifdef(`unlimitedUtils', `
+unconfined_domain(udev_t) 
+')
+dontaudit hostname_t udev_t:fd use;
diff --git a/strict/domains/user.te b/strict/domains/user.te
index 02f6be9..39a76d6 100644
--- a/strict/domains/user.te
+++ b/strict/domains/user.te
@@ -10,10 +10,15 @@ bool user_dmesg false;
 # Support NFS home directories
 bool use_nfs_home_dirs false;
 
-# Allow execution of anonymous mappings, e.g. executable stack.
+# Allow making anonymous memory executable, e.g. 
+# for runtime-code generation or executable stack.
 bool allow_execmem false;
 
-# Support Share libraries with Text Relocation
+# Allow making the stack executable via mprotect.
+# Also requires allow_execmem.
+bool allow_execstack false;
+
+# Allow making a modified private file mapping executable (text relocation).
 bool allow_execmod false;
 
 # Support SAMBA home directories
@@ -126,7 +131,16 @@ dontaudit unpriv_userdomain { sysadm_home_dir_t staff_home_dir_t }:dir { getattr
 role_tty_type_change(sysadm, user)
 role_tty_type_change(staff, sysadm)
 role_tty_type_change(sysadm, staff)
+role_tty_type_change(sysadm, secadm)
+role_tty_type_change(staff, secadm)
 
 # "ps aux" and "ls -l /dev/pts" make too much noise without this
 dontaudit unpriv_userdomain ptyfile:chr_file getattr;
 
+# to allow w to display everyone...
+bool user_ttyfile_stat false;
+
+if (user_ttyfile_stat) {
+allow userdomain ttyfile:chr_file getattr;
+}
+
diff --git a/strict/fs_use b/strict/fs_use
index 8f167a7..1dec535 100644
--- a/strict/fs_use
+++ b/strict/fs_use
@@ -8,6 +8,7 @@ fs_use_xattr ext2 system_u:object_r:fs_t;
 fs_use_xattr ext3 system_u:object_r:fs_t;
 fs_use_xattr xfs system_u:object_r:fs_t;
 fs_use_xattr jfs system_u:object_r:fs_t;
+fs_use_xattr reiserfs system_u:object_r:fs_t;
 
 # Use the allocating task SID to label inodes in the following filesystem
 # types, and label the filesystem itself with the specified context.
@@ -25,6 +26,7 @@ fs_use_task sockfs system_u:object_r:fs_t;
 fs_use_trans devpts system_u:object_r:devpts_t;
 fs_use_trans tmpfs system_u:object_r:tmpfs_t;
 fs_use_trans shm system_u:object_r:tmpfs_t;
+fs_use_trans mqueue system_u:object_r:tmpfs_t;
 
 # The separate genfs_contexts configuration can be used for filesystem 
 # types that cannot support persistent label mappings or use
diff --git a/strict/genfs_contexts b/strict/genfs_contexts
index 3c2438b..6686d2e 100644
--- a/strict/genfs_contexts
+++ b/strict/genfs_contexts
@@ -91,8 +91,10 @@ genfscon nfs /				system_u:object_r:nfs_t
 genfscon nfs4 /				system_u:object_r:nfs_t
 genfscon afs /				system_u:object_r:nfs_t
 
-# reiserfs - until xattr security support works properly
-genfscon reiserfs /			system_u:object_r:nfs_t
+genfscon debugfs /			system_u:object_r:debugfs_t
+genfscon inotifyfs /			system_u:object_r:inotifyfs_t
+genfscon hugetlbfs /			system_u:object_r:hugetlbfs_t
+genfscon mqueue /			system_u:object_r:mqueue_t
 
 # needs more work
 genfscon eventpollfs / system_u:object_r:eventpollfs_t
diff --git a/strict/macros/base_user_macros.te b/strict/macros/base_user_macros.te
index 06bd8b3..6281fca 100644
--- a/strict/macros/base_user_macros.te
+++ b/strict/macros/base_user_macros.te
@@ -35,7 +35,8 @@ r_dir_file($1_t, usercanread)
 general_domain_access($1_t)
 
 if (allow_execmem) {
-# Allow loading DSOs that require executable stack.
+# Allow making anonymous memory executable, e.g. 
+# for runtime-code generation or executable stack.
 allow $1_t self:process execmem;
 }
 
@@ -131,10 +132,6 @@ ifdef(`cardmgr.te', `
 allow $1_t cardmgr_var_run_t:file { getattr read };
 ')
 
-# Read and write /var/catman.
-allow $1_t catman_t:dir rw_dir_perms;
-allow $1_t catman_t:file create_file_perms;
-
 # Modify mail spool file.
 allow $1_t mail_spool_t:dir r_dir_perms;
 allow $1_t mail_spool_t:file rw_file_perms;
@@ -176,19 +173,38 @@ ifdef(`crontab.te', `crontab_domain($1)')
 ifdef(`screen.te', `screen_domain($1)')
 ifdef(`tvtime.te', `tvtime_domain($1)')
 ifdef(`mozilla.te', `mozilla_domain($1)')
+ifdef(`thunderbird.te', `thunderbird_domain($1)')
 ifdef(`samba.te', `samba_domain($1)')
-ifdef(`games.te', `games_domain($1)')
 ifdef(`gpg.te', `gpg_domain($1)')
 ifdef(`xauth.te', `xauth_domain($1)')
+ifdef(`iceauth.te', `iceauth_domain($1)')
 ifdef(`startx.te', `xserver_domain($1)')
 ifdef(`lpr.te', `lpr_domain($1)')
 ifdef(`ssh.te', `ssh_domain($1)')
 ifdef(`irc.te', `irc_domain($1)')
 ifdef(`using_spamassassin', `spamassassin_domain($1)')
+ifdef(`pyzor.te', `pyzor_domain($1)')
+ifdef(`razor.te', `razor_domain($1)')
 ifdef(`uml.te', `uml_domain($1)')
 ifdef(`cdrecord.te', `cdrecord_domain($1)')
 ifdef(`mplayer.te', `mplayer_domains($1)')
+
+fontconfig_domain($1)
+
+# GNOME
+ifdef(`gnome.te', `
+gnome_domain($1)
+ifdef(`games.te', `games_domain($1)')
 ifdef(`gift.te', `gift_domains($1)')
+ifdef(`evolution.te', `evolution_domains($1)')
+ifdef(`ethereal.te', `ethereal_domain($1)')
+')
+
+# ICE communication channel
+ice_domain($1, $1)
+
+# ORBit communication channel (independent of GNOME)
+orbit_domain($1, $1)
 
 # Instantiate a derived domain for user cron jobs.
 ifdef(`crond.te', `crond_domain($1)')
@@ -213,7 +229,9 @@ dontaudit $1_t self:netlink_route_socket create_netlink_socket_perms;
 
 # Use the network.
 can_network($1_t)
+allow $1_t port_type:tcp_socket name_connect;
 can_ypbind($1_t)
+can_winbind($1_t)
 
 ifdef(`pamconsole.te', `
 allow $1_t pam_var_console_t:dir search;
@@ -321,13 +339,12 @@ allow $1_t mnt_t:dir { getattr search };
 
 # Get attributes of file systems.
 allow $1_t fs_type:filesystem getattr;
-allow $1_t removable_t:filesystem getattr;
 
 # Read and write /dev/tty and /dev/null.
 allow $1_t devtty_t:chr_file rw_file_perms;
 allow $1_t null_device_t:chr_file rw_file_perms;
 allow $1_t zero_device_t:chr_file { rw_file_perms execute };
-allow $1_t { random_device_t urandom_device_t }:chr_file { getattr read ioctl };
+allow $1_t { random_device_t urandom_device_t }:chr_file ra_file_perms;
 #
 # Added to allow reading of cdrom
 #
@@ -347,8 +364,11 @@ dontaudit $1_t wtmp_t:file write;
 # Read the devpts root directory.
 allow $1_t devpts_t:dir r_dir_perms;
 
-allow $1_t src_t:dir r_dir_perms;
-allow $1_t src_t:notdevfile_class_set r_file_perms;
+r_dir_file($1_t, src_t)
+
+# Allow user to read default_t files
+# This is different from reading default_t content, 
+# because it also includes sockets, fifos, and links
 
 if (read_default_t) {
 allow $1_t default_t:dir r_dir_perms;
@@ -368,8 +388,6 @@ dontaudit $1_t initrc_devpts_t:chr_file { ioctl read write };
 dontaudit $1_t self:socket create;
 dontaudit $1_t sysctl_net_t:dir search;
 
-dontaudit $1_t default_context_t:dir search;
-
 ifdef(`rpcd.te', `
 create_dir_file($1_t, nfsd_rw_t)
 ')
diff --git a/strict/macros/core_macros.te b/strict/macros/core_macros.te
index 37f2975..b744fe5 100644
--- a/strict/macros/core_macros.te
+++ b/strict/macros/core_macros.te
@@ -662,9 +662,9 @@ allow $1_t $2_devpts_t:chr_file { setattr rw_file_perms };
 #
 define(`general_domain_access',`
 # Access other processes in the same domain.
-# Omits ptrace, setcurrent, setexec, setfscreate, setrlimit, and execmem.  
+# Omits ptrace, setcurrent, setexec, setfscreate, setrlimit, execmem, execstack and execheap.
 # These must be granted separately if desired.
-allow $1 self:process ~{ptrace setcurrent setexec setfscreate setrlimit execmem};
+allow $1 self:process ~{ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap};
 
 # Access /proc/PID files for processes in the same domain.
 allow $1 self:dir r_dir_perms;
diff --git a/strict/macros/global_macros.te b/strict/macros/global_macros.te
index cfb47cd..b4cccc4 100644
--- a/strict/macros/global_macros.te
+++ b/strict/macros/global_macros.te
@@ -60,7 +60,7 @@ allow $1 self:file { getattr read write };
 # read_sysctl(domain)
 #
 # Permissions for reading sysctl variables.
-# If the second parameter is 'full', allow
+# If the second parameter is full, allow
 # reading of any sysctl variables, else only
 # sysctl_kernel_t.
 #
@@ -106,6 +106,7 @@ allow $1 ld_so_t:file rx_file_perms;
 allow $1 ld_so_t:lnk_file r_file_perms;
 allow $1 { texrel_shlib_t shlib_t }:file rx_file_perms;
 allow $1 { texrel_shlib_t shlib_t }:lnk_file r_file_perms;
+allow $1 texrel_shlib_t:file execmod;
 allow $1 ld_so_cache_t:file r_file_perms;
 allow $1 device_t:dir search;
 allow $1 null_device_t:chr_file rw_file_perms;
@@ -156,7 +157,6 @@ allow $1 lib_t:file r_file_perms;
 r_dir_file($1, locale_t)
 ')
 
-
 ###################################
 #
 # access_terminal(domain, typeprefix)
@@ -253,7 +253,7 @@ allow $1_t self:process { signal_perms fork };
 uses_shlib($1_t)
 
 allow $1_t { self proc_t }:dir r_dir_perms;
-allow $1_t { self proc_t }:lnk_file read;
+allow $1_t { self proc_t }:lnk_file { getattr read };
 
 allow $1_t device_t:dir r_dir_perms;
 ifdef(`udev.te', `
@@ -293,6 +293,8 @@ domain_auto_trans(init_t, $1_exec_t, $1_t)
 # Define a daemon domain with a base set of type declarations
 # and permissions that are common to most daemons.
 # attribs is the list of attributes which must start with "," if it is not empty
+# nosysadm may be given as an optional third parameter, to specify that the
+# sysadmin should not transition to the domain when directly calling the executable
 #
 # Author:  Russell Coker <russell@coker.com.au>
 #
@@ -353,6 +355,14 @@ file_type_auto_trans($1_t, var_run_t, $1_var_run_t, $2)
 allow $1_t var_t:dir search;
 allow $1_t $1_var_run_t:dir rw_dir_perms;
 ')
+
+#######################
+# daemon_domain(domain_prefix, attribs)
+#
+# see daemon_base_domain for calling details
+# daemon_domain defines some additional privileges needed by many domains,
+# like pid files and locale support
+
 define(`daemon_domain', `
 ifdef(`targeted_policy', `
 daemon_base_domain($1, `$2, transitionbool', $3)
@@ -396,8 +406,19 @@ type $2_exec_t, file_type, sysadmfile, exec_type;
 
 role system_r types $2_t;
 
+ifelse(index(`$3',`transitionbool'), -1, `
+
 domain_auto_trans($1, $2_exec_t, $2_t)
 
+', `
+
+bool $2_disable_trans false;
+
+if (! $2_disable_trans) {
+domain_auto_trans($1, $2_exec_t, $2_t)
+}
+
+');
 # Inherit and use descriptors from parent.
 allow $2_t $1:fd use;
 allow $2_t $1:process sigchld;
@@ -422,16 +443,23 @@ ifelse($3, `',
 `file_type_auto_trans($1_t, tmp_t, $1_tmp_t, `$3')')
 ')
 
+# grant access to /tmp. Do not perform an automatic transition.
+define(`tmp_domain_notrans', `
+type $1_tmp_t, file_type, sysadmfile, polymember, tmpfile $2;
+')
+
 define(`tmpfs_domain', `
+ifdef(`$1_tmpfs_t_defined',`', `
+define(`$1_tmpfs_t_defined')
 type $1_tmpfs_t, file_type, sysadmfile, tmpfsfile;
 # Use this type when creating tmpfs/shm objects.
 file_type_auto_trans($1_t, tmpfs_t, $1_tmpfs_t)
 allow $1_tmpfs_t tmpfs_t:filesystem associate;
 ')
+')
 
 define(`var_lib_domain', `
 type $1_var_lib_t, file_type, sysadmfile;
-typealias $1_var_lib_t alias var_lib_$1_t;
 file_type_auto_trans($1_t, var_lib_t, $1_var_lib_t, file)
 allow $1_t $1_var_lib_t:dir rw_dir_perms;
 ')
@@ -474,105 +502,6 @@ type $1_lock_t, file_type, sysadmfile, lockfile;
 file_type_auto_trans($1_t, var_lock_t, $1_lock_t, file)
 ')
 
-####################################################################
-# home_domain_ro_access(source, user, app) 
-# 
-# Gives source access to the read-only home
-# domain of app for the given user type
-#
-
-define(`home_domain_ro_access', `
-
-allow $1 home_root_t:dir search;
-
-if (use_nfs_home_dirs) {
-r_dir_file($1, nfs_t)
-}
-if (use_samba_home_dirs) {
-r_dir_file($1, cifs_t)
-}
-allow $1 autofs_t:dir { search getattr };
-
-r_dir_file($1, $2_$3_ro_home_t)
-
-') dnl home_domain_ro_access
-
-####################################################################
-# home_domain_access(source, user, app)
-#
-# Gives source full access to the home
-# domain of app for the given user type
-#
-
-define(`home_domain_access', `
-
-allow $1 home_root_t:dir search;
-
-if (use_nfs_home_dirs) {
-create_dir_file($1, nfs_t)
-}
-if (use_samba_home_dirs) {
-create_dir_file($1, cifs_t)
-}
-allow $1 autofs_t:dir { search getattr };
-
-file_type_auto_trans($1, $2_home_dir_t, $2_$3_home_t)
-
-') dnl home_domain_access
-
-####################################################################
-# home_domain (prefix, app)
-#
-# Creates a domain in the prefix home where an application can
-# store its settings. It's accessible by the prefix domain.
-#
-
-define(`home_domain', `
-
-# Declare home domain
-# FIXME: the second alias is problematic because
-# home_domain and home_domain_ro cannot be used in parallel
-# Remove the second alias when compatibility is no longer an issue
-
-type $1_$2_home_t, file_type, $1_file_type, sysadmfile;
-typealias $1_$2_home_t alias $1_$2_rw_t;
-typealias $1_$2_home_t alias $1_home_$2_t;
-
-# User side access
-create_dir_file($1_t, $1_$2_home_t)
-allow $1_t $1_$2_home_t:{ dir file lnk_file } { relabelfrom relabelto };
-
-# App side access
-home_domain_access($1_$2_t, $1, $2)
-')
-
-####################################################################
-# home_domain_ro (user, app)
-#
-# Creates a read-only domain in the user home where an application can
-# store its settings. It's fully accessible by the user, but
-# it's read-only for the application.
-#
-
-define(`home_domain_ro', `
-
-# Declare home domain
-# FIXME: the second alias is problematic because
-# home_domain and home_domain_ro cannot be used in parallel
-# Remove the second alias when compatibility is no longer an issue
-
-type $1_$2_ro_home_t, file_type, $1_file_type, sysadmfile;
-typealias $1_$2_ro_home_t alias $1_$2_ro_t;
-typealias $1_$2_ro_home_t alias $1_home_$2_t;
-
-# User side access
-create_dir_file($1_t, $1_$2_ro_home_t)
-allow $1_t $1_$2_ro_home_t:{ dir file lnk_file } { relabelfrom relabelto };
-
-# App side access
-home_domain_ro_access($1_$2_t, $1, $2)
-')
-
 #######################
 # application_domain(domain_prefix)
 #
@@ -589,12 +518,6 @@ domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
 uses_shlib($1_t)
 ')
 
-define(`user_application_domain', `
-application_domain($1, `$2')
-in_user_role($1_t)
-domain_auto_trans(userdomain, $1_exec_t, $1_t)
-')
-
 define(`system_domain', `
 type $1_t, domain, privlog $2;
 type $1_exec_t, file_type, sysadmfile, exec_type;
@@ -603,23 +526,25 @@ uses_shlib($1_t)
 allow $1_t etc_t:dir r_dir_perms;
 ')
 
-# Do not flood message log, if the user does a browse
-define(`file_browse_domain', `
+# Dontaudit macros to prevent flooding the log
 
-# Regular files/directories that are not security sensitive
+define(`dontaudit_getattr', `
 dontaudit $1 file_type - secure_file_type:dir_file_class_set getattr; 
-dontaudit $1 file_type - secure_file_type:dir { read search };
-
-# /dev
-dontaudit $1 dev_fs:dir_file_class_set getattr;
-dontaudit $1 dev_fs:dir { read search };
-
-# /proc
-dontaudit $1 sysctl_t:dir_file_class_set getattr;
-dontaudit $1 proc_fs:dir { read search };
-
-')dnl end file_browse_domain
-
+dontaudit $1 unlabeled_t:dir_file_class_set getattr;
+dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir_file_class_set getattr;
+')dnl end dontaudit_getattr 
+
+define(`dontaudit_search_dir', `
+dontaudit $1 file_type - secure_file_type:dir search;
+dontaudit $1 unlabeled_t:dir search;
+dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir search;
+')dnl end dontaudit_search_dir
+
+define(`dontaudit_read_dir', `
+dontaudit $1 file_type - secure_file_type:dir read;
+dontaudit $1 unlabeled_t:dir read;
+dontaudit $1 { fs_type proc_fs dev_fs sysctl_type }:dir read;
+')dnl end dontaudit_read_dir
 
 # Define legacy_domain  for legacy binaries (java)
 # "legacy" binary == lacks PT_GNU_STACK header, i.e. built with an old
@@ -629,12 +554,46 @@ dontaudit $1 proc_fs:dir { read search };
 # shlib_t and ld_so_t unlike non-legacy binaries.
 
 define(`legacy_domain', `
-allow $1_t self:process { execmem };
+allow $1_t self:process { execmem execstack };
 allow $1_t { texrel_shlib_t shlib_t }:file execmod;
 allow $1_t ld_so_t:file execmod;
 allow $1_t ld_so_cache_t:file execute;
 ')
 
+
+# Allow domain to perform polyinstantiation functions
+# polyinstantiater(domain)
+
+define(`polyinstantiater', `
+
+ifdef(`support_polyinstantiation', `
+# Need to give access to /selinux/member
+allow $1 security_t:security compute_member;
+
+# Need to give access to the directories to be polyinstantiated
+allow $1 polydir:dir { getattr mounton add_name create setattr write search };
+
+# Need to give access to the polyinstantiated subdirectories
+allow $1 polymember:dir {getattr search };
+
+# Need to give access to parent directories where original
+# is remounted for polyinstantiation aware programs (like gdm)
+allow $1 polyparent:dir { getattr mounton };
+
+# Need to give permission to create directories where applicable
+allow $1 polymember: dir { create setattr };
+allow $1 polydir: dir { write add_name };
+allow $1 self:process setfscreate;
+allow $1 polyparent:dir { write add_name };
+# Default type for mountpoints
+allow $1 poly_t:dir { create mounton };
+
+# Need sys_admin capability for mounting
+allow $1 self:capability sys_admin;
+')dnl end else support_polyinstantiation
+
+')dnl end polyinstantiater
+
 # 
 # Define a domain that can do anything, so that it is
 # effectively unconfined by the SELinux policy.  This
@@ -679,6 +638,7 @@ can_sysctl($1)
 allow $1 node_type:node *;
 allow $1 netif_type:netif *;
 allow $1 port_type:{ tcp_socket udp_socket } { send_msg recv_msg };
+allow $1 port_type:tcp_socket name_connect;
 
 # Bind to any network address.
 allow $1 port_type:{ tcp_socket udp_socket } name_bind;
@@ -698,13 +658,24 @@ allow $1 domain:process ~{ transition dyntransition execmem };
 allow $1 self:process transition;
 
 if (allow_execmem) {
-# Allow loading DSOs that require executable stack.
+# Allow making anonymous memory executable, e.g. 
+# for runtime-code generation or executable stack.
 allow $1 self:process execmem;
 }
 
+if (allow_execmem && allow_execstack) {
+# Allow making the stack executable via mprotect.
+allow $1 self:process execstack;
+}
+
 if (allow_execmod) {
 # Allow text relocations on system shared libraries, e.g. libGL.
+ifdef(`targeted_policy', `
+allow $1 file_type:file execmod;
+', `
 allow $1 texrel_shlib_t:file execmod;
+allow $1 home_type:file execmod;
+')
 }
 
 # Create/access any System V IPC objects.
@@ -737,3 +708,22 @@ allow $1 nscd_t:nscd *;
 ')
 
 ')dnl end unconfined_domain
+
+
+define(`access_removable_media', `
+
+can_exec($1, { removable_t noexattrfile } )
+if (user_rw_noexattrfile) {
+create_dir_file($1, noexattrfile)
+create_dir_file($1, removable_t)
+# Write floppies 
+allow $1 removable_device_t:blk_file rw_file_perms;
+allow $1 usbtty_device_t:chr_file write;
+} else {
+r_dir_file($1, noexattrfile)
+r_dir_file($1, removable_t)
+allow $1 removable_device_t:blk_file r_file_perms;
+}
+allow $1 removable_t:filesystem getattr;
+
+')
diff --git a/strict/macros/network_macros.te b/strict/macros/network_macros.te
index bf6761f..d5eaca1 100644
--- a/strict/macros/network_macros.te
+++ b/strict/macros/network_macros.te
@@ -155,14 +155,23 @@ allow $1 mount_t:udp_socket rw_socket_perms;
 ')dnl end can_network definition
 
 define(`can_resolve',`
-ifdef(`use_dns',`
 can_network_udp($1, `dns_port_t')
 ')
+
+define(`can_portmap',`
+can_network_client($1, `portmap_port_t')
+allow $1 portmap_port_t:tcp_socket name_connect;
 ')
 
 define(`can_ldap',`
-ifdef(`slapd.te',`
 can_network_client_tcp($1, `ldap_port_t')
-')
+allow $1 ldap_port_t:tcp_socket name_connect;
 ')
 
+define(`can_winbind',`
+ifdef(`winbind.te', `
+allow $1 winbind_var_run_t:dir { getattr search };
+allow $1 winbind_t:unix_stream_socket connectto;
+allow $1 winbind_var_run_t:sock_file { getattr read write };
+')
+')
diff --git a/strict/macros/program/games_domain.te b/strict/macros/program/games_domain.te
index 9816896..d4c1d05 100644
--- a/strict/macros/program/games_domain.te
+++ b/strict/macros/program/games_domain.te
@@ -10,49 +10,80 @@
 #
 #
 define(`games_domain', `
-x_client_domain($1, `games', `, transitionbool')
 
+type $1_games_t, domain, nscd_client_domain;
+
+# Type transition
+if (! disable_games_trans) {
+domain_auto_trans($1_t, games_exec_t, $1_games_t)
+}
+can_exec($1_games_t, games_exec_t)
+role $1_r types $1_games_t;
+
+can_create_pty($1_games)
+
+# X access, GNOME, /tmp files
+x_client_domain($1_games, $1)
+tmp_domain($1_games, `', { dir notdevfile_class_set })
+gnome_application($1_games, $1)
+gnome_file_dialog($1_games, $1)
+
+# Games seem to need this
+if (allow_execmem) {
+allow $1_games_t self:process execmem;
+}
+
+allow $1_games_t texrel_shlib_t:file execmod;
 allow $1_games_t var_t:dir { search getattr };
 rw_dir_create_file($1_games_t, games_data_t)
 allow $1_games_t sound_device_t:chr_file rw_file_perms;
-r_dir_file($1_games_t, usr_t)
 can_udp_send($1_games_t, $1_games_t)
 can_tcp_connect($1_games_t, $1_games_t)
 
 # Access /home/user/.gnome2
-create_dir_file($1_games_t, $1_home_t)
-allow $1_games_t $1_home_dir_t:dir search;
-allow $1_games_t $1_home_t:dir { read getattr };
+# FIXME: Change to use per app types
+create_dir_file($1_games_t, $1_gnome_settings_t)
 
+# FIXME: why is this necessary - ORBit?
+# ORBit works differently now
 create_dir_file($1_games_t, $1_tmp_t)
 allow $1_games_t $1_tmp_t:sock_file create_file_perms;
+can_unix_connect($1_t, $1_games_t)
+can_unix_connect($1_games_t, $1_t)
 
-dontaudit $1_games_t sysctl_t:dir search;
-
-tmp_domain($1_games)
-allow $1_games_t urandom_device_t:chr_file { getattr ioctl read };
 ifdef(`xdm.te', `
 allow $1_games_t xdm_tmp_t:dir rw_dir_perms;
 allow $1_games_t xdm_tmp_t:sock_file create_file_perms;
 allow $1_games_t xdm_var_lib_t:file { getattr read };
 ')dnl end if xdm.te
 
-can_unix_connect($1_t, $1_games_t)
-can_unix_connect($1_games_t, $1_t)
-
 allow $1_games_t var_lib_t:dir search;
 r_dir_file($1_games_t, man_t)
-allow $1_games_t proc_t:file { read getattr };
+allow $1_games_t { proc_t self }:dir search;
+allow $1_games_t { proc_t self }:{ file lnk_file } { read getattr };
 ifdef(`mozilla.te', ` 
 dontaudit $1_games_t $1_mozilla_t:unix_stream_socket connectto;
 ')
 allow $1_games_t event_device_t:chr_file getattr;
 allow $1_games_t mouse_device_t:chr_file getattr;
+
 allow $1_games_t self:file { getattr read };
+allow $1_games_t self:sem create_sem_perms;
+
+allow $1_games_t { bin_t sbin_t }:dir { getattr search };
+can_exec($1_games_t, { shell_exec_t bin_t utempter_exec_t })
+allow $1_games_t bin_t:lnk_file read;
 
-# kpat spews errors
-dontaudit $1_games_t bin_t:dir getattr;
 dontaudit $1_games_t var_run_t:dir search;
+dontaudit $1_games_t initrc_var_run_t:file { read write };
+dontaudit $1_games_t var_log_t:dir search;
+
+can_network($1_games_t)
+allow $1_games_t port_t:tcp_socket name_bind;
+allow $1_games_t port_t:tcp_socket name_connect;
+
+# Suppress .icons denial until properly implemented
+dontaudit $1_games_t $1_home_t:dir read;
 
 ')dnl end macro definition
 
diff --git a/strict/macros/program/gift_macros.te b/strict/macros/program/gift_macros.te
index 3589c05..c75a061 100644
--- a/strict/macros/program/gift_macros.te
+++ b/strict/macros/program/gift_macros.te
@@ -12,49 +12,34 @@
 
 define(`gift_domain', `
 
-# Connect to X
-x_client_domain($1, gift, `')	
-
-# Transition
+# Type transition
+type $1_gift_t, domain, nscd_client_domain;
 domain_auto_trans($1_t, gift_exec_t, $1_gift_t)
-can_exec($1_gift_t, gift_exec_t)
 role $1_r types $1_gift_t;
 
-# Self permissions
-allow $1_gift_t self:process getsched;
-
-# Home files
+# X access, Home files, GNOME, /tmp
+x_client_domain($1_gift, $1)
+gnome_application($1_gift, $1)
 home_domain($1, gift)
+file_type_auto_trans($1_gift_t, $1_home_dir_t, $1_gift_home_t, dir)
 
-# Fonts, icons
-r_dir_file($1_gift_t, usr_t)
-r_dir_file($1_gift_t, fonts_t)
+# Allow the user domain to signal/ps.
+can_ps($1_t, $1_gift_t)
+allow $1_t $1_gift_t:process signal_perms;
 
 # Launch gift daemon
-allow $1_gift_t self:process fork;
+allow $1_gift_t bin_t:dir search;
 domain_auto_trans($1_gift_t, giftd_exec_t, $1_giftd_t)
 
 # Connect to gift daemon
-can_network($1_gift_t)
+can_network_client_tcp($1_gift_t, giftd_port_t)
+allow $1_gift_t giftd_port_t:tcp_socket name_connect;
 
 # Read /proc/meminfo
 allow $1_gift_t proc_t:dir search;
 allow $1_gift_t proc_t:file { getattr read };
 
-# Tmp/ORBit
-tmp_domain($1_gift)
-file_type_auto_trans($1_gift_t, $1_tmp_t, $1_gift_tmp_t)
-can_unix_connect($1_t, $1_gift_t)
-can_unix_connect($1_gift_t, $1_t)
-allow $1_t $1_gift_tmp_t:sock_file write;
-allow $1_gift_t $1_tmp_t:file { getattr read write lock };
-allow $1_gift_t $1_tmp_t:sock_file { read write };
-dontaudit $1_gift_t $1_tmp_t:dir setattr;
-
-# Access random device
-allow $1_gift_t urandom_device_t:chr_file { read getattr ioctl };
-
-# giftui looks in .icons, .themes, .fonts-cache.
+# giftui looks in .icons, .themes.
 dontaudit $1_gift_t $1_home_t:dir { getattr read search };
 dontaudit $1_gift_t $1_home_t:file { getattr read };
 
@@ -79,26 +64,34 @@ allow $1_giftd_t self:unix_stream_socket create_socket_perms;
 read_sysctl($1_giftd_t)
 read_locale($1_giftd_t)
 uses_shlib($1_giftd_t)
+access_terminal($1_giftd_t, $1)
+
+# Read /proc/meminfo
+allow $1_giftd_t proc_t:dir search;
+allow $1_giftd_t proc_t:file { getattr read };
+
+# Read /etc/mtab
+allow $1_giftd_t etc_runtime_t:file { getattr read };
 
 # Access home domain
 home_domain_access($1_giftd_t, $1, gift)
-	
-# Allow networking
-allow $1_giftd_t port_t:tcp_socket name_bind;
-allow $1_giftd_t port_t:udp_socket name_bind;
+file_type_auto_trans($1_gift_t, $1_home_dir_t, $1_gift_home_t, dir)
+
+# Serve content on various p2p networks. Ports can be random.
 can_network_server($1_giftd_t)
-can_network_client($1_giftd_t)
+allow $1_giftd_t self:udp_socket listen;
+allow $1_giftd_t port_type:{ tcp_socket udp_socket } name_bind;
 
-# FIXME: ???
-dontaudit $1_giftd_t self:udp_socket listen;
+# Connect to various p2p networks. Ports can be random.
+can_network_client($1_giftd_t)
+allow $1_giftd_t port_type:tcp_socket name_connect;
 
 # Plugins
 r_dir_file($1_giftd_t, usr_t)
 
 # Connect to xdm
 ifdef(`xdm.te', `
-allow $1_giftd_t xdm_t:fd use;
-allow $1_giftd_t xdm_t:fifo_file write;
+can_pipe_xdm($1_giftd_t)
 ') 
 
 ') dnl giftd_domain
diff --git a/strict/macros/program/userhelper_macros.te b/strict/macros/program/userhelper_macros.te
index 109b973..2c715d3 100644
--- a/strict/macros/program/userhelper_macros.te
+++ b/strict/macros/program/userhelper_macros.te
@@ -76,8 +76,7 @@ allow $1_userhelper_t devpts_t:dir r_dir_perms;
 allow $1_userhelper_t etc_t:file r_file_perms;
 
 # Read /var.
-allow $1_userhelper_t var_t:dir r_dir_perms;
-allow $1_userhelper_t var_t:notdevfile_class_set r_file_perms;
+r_dir_file($1_userhelper_t, var_t)
 
 # Read /dev directories and any symbolic links.
 allow $1_userhelper_t device_t:dir r_dir_perms;
@@ -97,7 +96,7 @@ can_getsecurity($1_userhelper_t)
 allow $1_userhelper_t fs_t:filesystem getattr;
 
 # for some PAM modules and for cwd
-dontaudit $1_userhelper_t { home_root_t home_type }:dir search;
+allow $1_userhelper_t { home_root_t $1_home_dir_t }:dir search;
 
 allow $1_userhelper_t proc_t:dir search;
 allow $1_userhelper_t proc_t:file { getattr read };
@@ -120,8 +119,7 @@ role system_r types $1_userhelper_t;
 r_dir_file($1_userhelper_t, nfs_t)
 
 ifdef(`xdm.te', `
-allow $1_userhelper_t xdm_t:fd use;
-allow $1_userhelper_t xdm_t:fifo_file rw_file_perms;
+can_pipe_xdm($1_userhelper_t)
 allow $1_userhelper_t xdm_var_run_t:dir search;
 ')
 
diff --git a/strict/macros/program/ypbind_macros.te b/strict/macros/program/ypbind_macros.te
index 2157995..61db7cc 100644
--- a/strict/macros/program/ypbind_macros.te
+++ b/strict/macros/program/ypbind_macros.te
@@ -1,10 +1,12 @@
 
 define(`uncond_can_ypbind', `
-dontaudit $1 reserved_port_type:{ tcp_socket udp_socket } name_bind;
 can_network($1)
 r_dir_file($1,var_yp_t)
 allow $1 { reserved_port_t port_t }:{ tcp_socket udp_socket } name_bind;
+allow $1 { portmap_port_t reserved_port_t port_t }:tcp_socket name_connect;
 dontaudit $1 self:capability net_bind_service;
+dontaudit $1 reserved_port_type:tcp_socket name_connect;
+dontaudit $1 reserved_port_type:{ tcp_socket udp_socket } name_bind;
 ')
 
 define(`can_ypbind', `
diff --git a/strict/tunables/distro.tun b/strict/tunables/distro.tun
index 00b6eca..2d49189 100644
--- a/strict/tunables/distro.tun
+++ b/strict/tunables/distro.tun
@@ -5,7 +5,7 @@
 # appropriate ifdefs.
 
 
-define(`distro_redhat')
+dnl define(`distro_redhat')
 
 dnl define(`distro_suse')
 
diff --git a/strict/tunables/tunable.tun b/strict/tunables/tunable.tun
index bd8b797..a6cc2f4 100644
--- a/strict/tunables/tunable.tun
+++ b/strict/tunables/tunable.tun
@@ -1,27 +1,27 @@
-# Allow users to execute the mount command
-define(`user_can_mount')
-
 # Allow rpm to run unconfined.
-#define(`unlimitedRPM')
+dnl define(`unlimitedRPM')
 
 # Allow privileged utilities like hotplug and insmod to run unconfined.
-#define(`unlimitedUtils')
+dnl define(`unlimitedUtils')
 
 # Allow rc scripts to run unconfined, including any daemon
 # started by an rc script that does not have a domain transition
 # explicitly defined.
-#define(`unlimitedRC')
+dnl define(`unlimitedRC')
 
 # Allow sysadm_t to directly start daemons
 define(`direct_sysadm_daemon')
 
+# Do not allow sysadm_t to be in the security manager domain
+dnl define(`separate_secadm')
+
 # Do not audit things that we know to be broken but which
 # are not security risks
-define(`hide_broken_symptoms')
+dnl define(`hide_broken_symptoms')
 
 # Allow user_r to reach sysadm_r via su, sudo, or userhelper.
 # Otherwise, only staff_r can do so.
-define(`user_canbe_sysadm')
+dnl define(`user_canbe_sysadm')
 
 # Allow xinetd to run unconfined, including any services it starts
 # that do not have a domain transition explicitly defined.
@@ -29,3 +29,6 @@ dnl define(`unlimitedInetd')
 
 # for ndc_t to be used for restart shell scripts
 dnl define(`ndc_shell_script')
+
+# Enable Polyinstantiation support
+dnl define(`support_polyinstatiation')
diff --git a/strict/types/nfs.te b/strict/types/nfs.te
index 154a65b..9076bb8 100644
--- a/strict/types/nfs.te
+++ b/strict/types/nfs.te
@@ -13,7 +13,7 @@
 # The nfs_*_t types are used for specific NFS
 # servers in net_contexts or net_contexts.mls.
 #
-type nfs_t, fs_type;
+type nfs_t, mount_point, fs_type;
 
 #
 # Allow NFS files to be associated with an NFS file system.
diff --git a/strict/types/procfs.te b/strict/types/procfs.te
index 0cab0fa..20703ac 100644
--- a/strict/types/procfs.te
+++ b/strict/types/procfs.te
@@ -14,7 +14,7 @@
 # proc_mdstat_t is the type of /proc/mdstat.
 # proc_net_t is the type of /proc/net.
 #
-type proc_t, fs_type, proc_fs;
+type proc_t, fs_type, mount_point, proc_fs;
 type proc_kmsg_t, proc_fs;
 type proc_kcore_t, proc_fs;
 type proc_mdstat_t, proc_fs;
@@ -35,7 +35,7 @@ type proc_net_t, proc_fs;
 # These types are applied to both the entries in
 # /proc/sys and the corresponding sysctl parameters.
 #
-type sysctl_t, sysctl_type;
+type sysctl_t, mount_point, sysctl_type;
 type sysctl_fs_t, sysctl_type;
 type sysctl_kernel_t, sysctl_type;
 type sysctl_modprobe_t, sysctl_type;