From b5d89d03256b3451126639f3b69d39b9d8d7b998 Mon Sep 17 00:00:00 2001
From: Jeremy Solt <jsolt@tresys.com>
Date: Jun 29 2010 15:02:45 +0000
Subject: vpn patch from Dan Walsh


fixed gen_require in vpn_relabelfrom_tun_socket interface (wrong type)
removed userdom_read_home_certs (not in refpolicy)

---

diff --git a/policy/modules/admin/vpn.if b/policy/modules/admin/vpn.if
index b5272fb..ccda6e4 100644
--- a/policy/modules/admin/vpn.if
+++ b/policy/modules/admin/vpn.if
@@ -110,7 +110,7 @@ interface(`vpn_signull',`
 ##	</summary>
 ## </param>
 #
-interface(`vpnc_dbus_chat',`
+interface(`vpn_dbus_chat',`
 	gen_require(`
 		type vpnc_t;
 		class dbus send_msg;
@@ -119,3 +119,21 @@ interface(`vpnc_dbus_chat',`
 	allow $1 vpnc_t:dbus send_msg;
 	allow vpnc_t $1:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Relabelfrom from vpnc socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`vpn_relabelfrom_tun_socket',`
+	gen_require(`
+		type vpnc_t;
+	')
+
+	allow $1 vpnc_t:tun_socket relabelfrom;
+')
diff --git a/policy/modules/admin/vpn.te b/policy/modules/admin/vpn.te
index 796ad45..0468e74 100644
--- a/policy/modules/admin/vpn.te
+++ b/policy/modules/admin/vpn.te
@@ -30,7 +30,7 @@ allow vpnc_t self:udp_socket create_socket_perms;
 allow vpnc_t self:rawip_socket create_socket_perms;
 allow vpnc_t self:unix_dgram_socket create_socket_perms;
 allow vpnc_t self:unix_stream_socket create_socket_perms;
-allow vpnc_t self:tun_socket create_socket_perms;
+allow vpnc_t self:tun_socket { create_socket_perms relabelfrom };
 # cjp: this needs to be fixed
 allow vpnc_t self:socket create_socket_perms;