diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index c0ef05b..73851b2 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -22,6 +22,7 @@
 	apt (Erich Schubert)
 	audioentropy
 	calamaris
+	cipe
 	clamav (Erich Schubert)
 	dpkg (Erich Schubert)
 	ethereal
diff --git a/refpolicy/policy/modules/kernel/corecommands.fc b/refpolicy/policy/modules/kernel/corecommands.fc
index fb37388..3fbafa0 100644
--- a/refpolicy/policy/modules/kernel/corecommands.fc
+++ b/refpolicy/policy/modules/kernel/corecommands.fc
@@ -33,6 +33,9 @@ ifdef(`distro_redhat',`
 # /etc
 #
 
+/etc/cipe/ip-up.*		--	gen_context(system_u:object_r:bin_t,s0)
+/etc/cipe/ip-down.*		--	gen_context(system_u:object_r:bin_t,s0)
+
 /etc/hotplug/.*agent		--	gen_context(system_u:object_r:sbin_t,s0)
 /etc/hotplug/.*rc		-- 	gen_context(system_u:object_r:sbin_t,s0)
 /etc/hotplug/hotplug\.functions --	gen_context(system_u:object_r:sbin_t,s0)
diff --git a/refpolicy/policy/modules/kernel/corecommands.te b/refpolicy/policy/modules/kernel/corecommands.te
index 75dc4f1..5b418df 100644
--- a/refpolicy/policy/modules/kernel/corecommands.te
+++ b/refpolicy/policy/modules/kernel/corecommands.te
@@ -1,5 +1,5 @@
 
-policy_module(corecommands,1.3.5)
+policy_module(corecommands,1.3.6)
 
 ########################################
 #
diff --git a/refpolicy/policy/modules/services/cipe.fc b/refpolicy/policy/modules/services/cipe.fc
new file mode 100644
index 0000000..afcdf02
--- /dev/null
+++ b/refpolicy/policy/modules/services/cipe.fc
@@ -0,0 +1,4 @@
+#
+# /usr
+#
+/usr/sbin/ciped.*	--	gen_context(system_u:object_r:ciped_exec_t,s0)
diff --git a/refpolicy/policy/modules/services/cipe.if b/refpolicy/policy/modules/services/cipe.if
new file mode 100644
index 0000000..b5fd668
--- /dev/null
+++ b/refpolicy/policy/modules/services/cipe.if
@@ -0,0 +1 @@
+## <summary>Encrypted tunnel daemon</summary>
diff --git a/refpolicy/policy/modules/services/cipe.te b/refpolicy/policy/modules/services/cipe.te
new file mode 100644
index 0000000..70fe0ae
--- /dev/null
+++ b/refpolicy/policy/modules/services/cipe.te
@@ -0,0 +1,88 @@
+
+policy_module(cipe,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ciped_t;
+type ciped_exec_t;
+init_daemon_domain(ciped_t,ciped_exec_t)
+
+########################################
+#
+# Local policy
+#
+
+allow ciped_t self:capability { net_admin ipc_lock sys_tty_config };
+dontaudit ciped_t self:capability sys_tty_config;
+allow ciped_t self:process signal_perms;
+allow ciped_t self:fifo_file rw_file_perms;
+allow ciped_t self:unix_dgram_socket create_socket_perms;
+allow ciped_t self:unix_stream_socket create_socket_perms;
+allow ciped_t self:udp_socket create_socket_perms;
+
+kernel_read_kernel_sysctls(ciped_t)
+kernel_read_system_state(ciped_t)
+
+corecmd_exec_shell(ciped_t)
+corecmd_exec_bin(ciped_t)
+corecmd_exec_sbin(ciped_t)
+
+corenet_udp_sendrecv_generic_if(ciped_t)
+corenet_raw_sendrecv_generic_if(ciped_t)
+corenet_udp_sendrecv_all_nodes(ciped_t)
+corenet_raw_sendrecv_all_nodes(ciped_t)
+corenet_udp_sendrecv_all_ports(ciped_t)
+corenet_non_ipsec_sendrecv(ciped_t)
+corenet_udp_bind_all_nodes(ciped_t)
+# cipe uses the afs3-bos port (udp 7007)
+corenet_udp_bind_afs_bos_port(ciped_t)
+
+dev_read_sysfs(ciped_t)
+dev_read_rand(ciped_t)
+# for SSP
+dev_read_urand(ciped_t)
+
+domain_use_interactive_fds(ciped_t)
+
+files_read_etc_files(ciped_t)
+files_read_etc_runtime_files(ciped_t)
+files_dontaudit_search_var(ciped_t)
+
+fs_search_auto_mountpoints(ciped_t)
+
+term_dontaudit_use_console(ciped_t)
+
+init_use_fds(ciped_t)
+init_use_script_ptys(ciped_t)
+
+libs_use_ld_so(ciped_t)
+libs_use_shared_libs(ciped_t)
+
+logging_send_syslog_msg(ciped_t)
+
+miscfiles_read_localization(ciped_t)
+
+sysnet_read_config(ciped_t)
+
+userdom_dontaudit_use_unpriv_user_fds(ciped_t)
+
+ifdef(`targeted_policy',`
+	term_dontaudit_use_unallocated_ttys(ciped_t)
+	term_dontaudit_use_generic_ptys(ciped_t)
+	files_dontaudit_read_root_files(ciped_t)
+')
+
+optional_policy(`
+	nis_use_ypbind(ciped_t)
+')
+
+optional_policy(`
+	seutil_sigchld_newrole(ciped_t)
+')
+
+optional_policy(`
+	udev_read_db(ciped_t)
+')